dev  

Messages by Date

• 2026/09/30 (tomcat) 07/09: Validate the port header value in RemoteIpFilter and RemoteIpValve so that values outside the 1-65535 range fall back to the default server port rather than being applied as an invalid port remm
• 2026/09/30 (tomcat) 04/09: Use an instanceof check when instantiating the configured rateLimitClassName in RateLimitFilter.init() so a class that does not implement RateLimiter produces the intended ServletException rather than a raw ClassCastException remm
• 2026/09/30 (tomcat) branch 10.1.x updated (5301caf434 -> 1765a0eb20) remm
• 2026/09/30 (tomcat) 09/11: Merge branch 'main' of [email protected]:apache/tomcat.git into main remm
• 2026/09/30 (tomcat) 03/08: Use an instanceof check when instantiating the configured randomClass in CsrfPreventionFilterBase.init() so a class that is not a Random subclass produces the intended ServletException rather than a raw ClassCastException remm
• 2026/09/30 (tomcat) 07/08: Validate the port header value in RemoteIpFilter and RemoteIpValve so that values outside the 1-65535 range fall back to the default server port rather than being applied as an invalid port remm
• 2026/09/30 (tomcat) branch 11.0.x updated (78036375a6 -> 677e69a178) remm
• 2026/09/30 (tomcat) 08/08: Remove the placeholder from the http.403 message of the filters package which was rendered literally in the non-HTTP deny response of RequestFilter since no argument was ever provided remm
• 2026/09/30 (tomcat) 02/08: Make the content-type checks in the AddDefaultCharsetFilter response wrapper case-insensitive as required by RFC 9110 for media types and parameter names remm
• 2026/09/30 (tomcat) 05/08: Synchronise the check for an existing nonce cache with its creation in CsrfPreventionFilter to prevent concurrent requests on the same session discarding a cache containing already-issued nonces, which could trigger spurious rejections remm
• 2026/09/30 (tomcat) 04/08: Use an instanceof check when instantiating the configured rateLimitClassName in RateLimitFilter.init() so a class that does not implement RateLimiter produces the intended ServletException rather than a raw ClassCastException remm
• 2026/09/30 (tomcat) 01/08: Ignore a null charset in the AddDefaultCharsetFilter response wrapper rather than storing it and later appending a literal charset=null parameter to the Content-Type header remm
• 2026/09/30 (tomcat) 06/08: Clamp the max-age value generated by the ExpiresFilter to a minimum of zero to avoid emitting the invalid negative delta-seconds value when the computed expiration time is already in the past remm
• 2026/09/30 (tomcat) 01/11: Ignore a null charset in the AddDefaultCharsetFilter response wrapper rather than storing it and later appending a literal charset=null parameter to the Content-Type header remm
• 2026/09/30 (tomcat) 08/11: Remove the placeholder from the http.403 message of the filters package which was rendered literally in the non-HTTP deny response of RequestFilter since no argument was ever provided remm
• 2026/09/30 (tomcat) 02/11: Make the content-type checks in the AddDefaultCharsetFilter response wrapper case-insensitive as required by RFC 9110 for media types and parameter names remm
• 2026/09/30 (tomcat) 10/11: Merge branch 'main' of [email protected]:apache/tomcat.git into main remm
• 2026/09/30 (tomcat) 06/11: Clamp the max-age value generated by the ExpiresFilter to a minimum of zero to avoid emitting the invalid negative delta-seconds value when the computed expiration time is already in the past remm
• 2026/09/30 (tomcat) 03/11: Use an instanceof check when instantiating the configured randomClass in CsrfPreventionFilterBase.init() so a class that is not a Random subclass produces the intended ServletException rather than a raw ClassCastException remm
• 2026/09/30 (tomcat) 05/11: Synchronise the check for an existing nonce cache with its creation in CsrfPreventionFilter to prevent concurrent requests on the same session discarding a cache containing already-issued nonces, which could trigger spurious rejections remm
• 2026/09/30 (tomcat) 11/11: Merge branch 'main' of [email protected]:apache/tomcat.git into main remm
• 2026/09/30 (tomcat) 07/11: Validate the port header value in RemoteIpFilter and RemoteIpValve so that values outside the 1-65535 range fall back to the default server port rather than being applied as an invalid port remm
• 2026/09/30 (tomcat) branch main updated (9c6823e159 -> 8443c1d858) remm
• 2026/09/30 (tomcat) 04/11: Use an instanceof check when instantiating the configured rateLimitClassName in RateLimitFilter.init() so a class that does not implement RateLimiter produces the intended ServletException rather than a raw ClassCastException remm
• 2026/09/30 (tomcat) branch 11.0.x updated: Tomcat 11 baseline is Java 17 not Java 21 markt
• 2026/09/30 (tomcat) branch 9.0.x updated: Update to Bouncy Castle 1.86 markt
• 2026/09/30 (tomcat) branch 10.1.x updated: Update to Bouncy Castle 1.86 markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Correct location markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Update to Bouncy Castle 1.86 markt
• 2026/09/30 Re: October release timeline Mark Thomas
• 2026/09/30 (tomcat) branch main updated: Update to Bouncy Castle 1.8.6 markt
• 2026/09/30 (tomcat) branch 9.0.x updated: Update to Byte Buddy 1.18.14 markt
• 2026/09/30 (tomcat) branch main updated: Update to Checkstyle 14.3.0 markt
• 2026/09/30 (tomcat) branch 10.1.x updated: Update to Byte Buddy 1.18.14 markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Update to Byte Buddy 1.18.14 markt
• 2026/09/30 (tomcat) branch main updated: Update to Byte Buddy 1.18.14 markt
• 2026/09/30 (tomcat) branch 9.0.x updated: Update NSIS to 3.13 markt
• 2026/09/30 (tomcat) branch 10.1.x updated: Update NSIS to 3.13 markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Correct location markt
• 2026/09/30 (tomcat) 02/02: Update NSIS to 3.13 markt
• 2026/09/30 (tomcat) 01/02: Update to the Eclipse JDT compiler 4.41 markt
• 2026/09/30 (tomcat) branch 11.0.x updated (f386b930f1 -> 04acaa8e32) markt
• 2026/09/30 (tomcat) branch main updated: Update NSIS to 3.13 markt
• 2026/09/30 (tomcat) branch main updated: Update to the Eclipse JDT compiler 4.41 markt
• 2026/09/30 [Bug 70251] New: CloseableURLConnection closes shared Jar file bugzilla
• 2026/09/30 (tomcat) branch 11.0.x updated: Treat close() the same was as shutdown() markt
• 2026/09/30 (tomcat) branch main updated: Treat close() the same was as shutdown() markt
• 2026/09/30 (tomcat) branch 9.0.x updated: Rename tests to match standard naming convention. markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Rename tests to match standard naming convention. markt
• 2026/09/30 (tomcat) branch main updated: Rename tests to match standard naming convention. markt
• 2026/09/30 (tomcat) branch 10.1.x updated: Rename tests to match standard naming convention. markt
• 2026/09/30 (tomcat) branch 9.0.x updated: Explicitly state virtual host and SNI matching are separate markt
• 2026/09/30 (tomcat) 01/10: Add the missing standardService.connector.startFailed and standardService.connector.stopFailed localization keys so connector start and stop failures produce readable messages rather than the raw key remm
• 2026/09/30 (tomcat) branch 11.0.x updated: Explicitly state virtual host and SNI matching are separate markt
• 2026/09/30 (tomcat) branch main updated: Follow-up to 87ed9d47 markt
• 2026/09/30 (tomcat) branch 9.0.x updated (2fb3864f0e -> 006099e16a) markt
• 2026/09/30 (tomcat) 07/08: Make FrameworkListener registration idempotent so repeated Server start events do not add duplicate container listeners or orphan previous per-context lifecycle listeners that can no longer be removed remm
• 2026/09/30 (tomcat) 07/10: Walk the class hierarchy in NamingResourcesImpl getSetterType() and getFieldType() so that injection targets resolving to inherited fields or setters are no longer rejected at deployment, matching the behaviour of the runtime injection engine remm
• 2026/09/30 (tomcat) 10/10: Merge branch 'main' of [email protected]:apache/tomcat.git into main remm
• 2026/09/30 (tomcat) 06/10: Retain an existing resource link in NamingResourcesImpl.addEnvironment() when the link's global target is not an overridable global environment rather than adding an environment entry with the same name which would create a duplicate JNDI binding remm
• 2026/09/30 Re: (tomcat) branch main updated: Follow-up to 09c0caced9 Rémy Maucherat
• 2026/09/30 (tomcat) 05/07: Initialize the ServerAuthModule before caching the SingleModuleServerAuthContext so a failed initialization is not cached permanently and can be re-attempted on next use remm
• 2026/09/30 (tomcat) 04/04: Merge branch '10.1.x' of [email protected]:apache/tomcat.git into 10.1.x remm
• 2026/09/30 (tomcat) branch 9.0.x updated: Follow-up to 87ed9d47 markt
• 2026/09/30 (tomcat) branch main updated: Follow-up to 34315ac0 markt
• 2026/09/30 (tomcat) 07/08: Use the atomic add() of the shared entries set as the name claim in all NamingResourcesImpl add*() methods to close the check-then-act race which could allow two descriptors with the same JNDI name to both be registered remm
• 2026/09/30 (tomcat) 05/07: Initialize the ServerAuthModule before caching the SingleModuleServerAuthContext so a failed initialization is not cached permanently and can be re-attempted on next use remm
• 2026/09/30 (tomcat) branch 9.0.x updated: Partial revert of 6fd26942 markt
• 2026/09/30 (tomcat) branch 10.1.x updated: Fix CharChunk.indexOf(char) for chunks with a non-zero start markt
• 2026/09/30 (tomcat) 07/08: Use the atomic add() of the shared entries set as the name claim in all NamingResourcesImpl add*() methods to close the check-then-act race which could allow two descriptors with the same JNDI name to both be registered remm
• 2026/09/30 (tomcat) branch 10.1.x updated (792859bdb8 -> bd356f1714) remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Partial revert of 99d1d567 markt
• 2026/09/30 (tomcat) 05/06: Update the JASPIC client Subject only when password validation succeeded (or was not requested), failing closed rather than adding a principal derived from untrusted caller-supplied data when validation failed remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Fix IDE resource leak warnings markt
• 2026/09/30 (tomcat) 03/04: Merge branch '10.1.x' of [email protected]:apache/tomcat.git into 10.1.x remm
• 2026/09/30 (tomcat) branch 9.0.x updated: Fix IDE resource leak warnings markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Fix IDE resource leak warnings markt
• 2026/09/30 (tomcat) branch main updated: Fix IDE resource leak warnings markt
• 2026/09/30 (tomcat) 10/10: Merge branch '11.0.x' of [email protected]:apache/tomcat.git into 11.0.x remm
• 2026/09/30 Re: [PR] Fix CharChunk.indexOf(char) for chunks with a non-zero start [tomcat] via GitHub
• 2026/09/30 (tomcat) 03/07: Return 0 rather than -1 for zero-length reads from InputBuffer at end of stream, as required by the InputStream/Reader contract, and avoid the unnecessary blocking fill these requests previously triggered remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Route JspC context logging through Ant markt
• 2026/09/30 (tomcat) branch 9.0.x updated: Route JspC context logging through Ant markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Route JspC context logging through Ant markt
• 2026/09/30 (tomcat) branch 10.1.x updated (ce5f2588a8 -> ae6ad90929) remm
• 2026/09/30 Re: [PR] Route JspC context logging through Ant [tomcat] via GitHub
• 2026/09/30 (tomcat) branch main updated: Route JspC context logging through Ant markt
• 2026/09/30 Re: [PR] Fix Map.Entry contract for CaseInsensitiveKeyMap entries [tomcat] via GitHub
• 2026/09/30 (tomcat) branch 9.0.x updated: Fix CharChunk.indexOf(char) for chunks with a non-zero start markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Fix CharChunk.indexOf(char) for chunks with a non-zero start markt
• 2026/09/30 (tomcat) branch main updated: Fix CharChunk.indexOf(char) for chunks with a non-zero start markt
• 2026/09/30 (tomcat) branch 9.0.x updated: Partial revert of 99d1d567 markt
• 2026/09/30 (tomcat) branch main updated: Skip test on MacOS remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Remove unnecessary cast markt
• 2026/09/30 (tomcat) branch 10.1.x updated: Follow-up to ba91d79a markt
• 2026/09/30 (tomcat) branch 9.0.x updated: Follow-up to ba91d79a markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Follow-up to ba91d79a markt
• 2026/09/30 (tomcat) branch main updated: Follow-up to ba91d79a markt
• 2026/09/30 (tomcat) 03/10: Delegate awaitTermination() in StandardThreadExecutor and StandardVirtualThreadExecutor to the wrapped executor rather than unconditionally returning false which violates the ExecutorService contract remm
• 2026/09/30 (tomcat) branch 11.0.x updated: Follow-up to 34315ac0 markt
• 2026/09/30 (tomcat) 01/08: Delegate awaitTermination() in StandardThreadExecutor and StandardVirtualThreadExecutor to the wrapped executor rather than unconditionally returning false which violates the ExecutorService contract remm
• 2026/09/30 (tomcat) 03/08: Validate the incoming entry at the start of NamingResourcesImpl.addEnvironment() so that an entry which is ignored or rejected cannot first destroy the existing environment entry or resource link with the same name remm
• 2026/09/30 (tomcat) 08/08: Fix return statement remm
• 2026/09/30 (tomcat) 06/08: Only release the shared naming entry name in NamingResourcesImpl remove*() methods when the type-specific map actually held the entry, preventing the removal of the JNDI name reservation of a differently typed descriptor with the same name remm
• 2026/09/30 (tomcat) 04/08: Retain an existing resource link in NamingResourcesImpl.addEnvironment() when the link's global target is not an overridable global environment rather than adding an environment entry with the same name which would create a duplicate JNDI binding remm
• 2026/09/30 (tomcat) branch 9.0.x updated (1e8b11fd73 -> 6080ad30f1) remm
• 2026/09/30 (tomcat) 05/08: Merge branch '10.1.x' of [email protected]:apache/tomcat.git into 10.1.x remm
• 2026/09/30 (tomcat) 02/08: Synchronise the check and assignment of the servlet instance in getServletMethods() to prevent a race which could result in a second, never initialised instance being retained by the wrapper remm
• 2026/09/30 (tomcat) branch 11.0.x updated: Partial revert of 99d1d567 markt
• 2026/09/30 (tomcat) branch main updated: Partial revert of 99d1d567 markt
• 2026/09/30 (tomcat) 04/08: Retain an existing resource link in NamingResourcesImpl.addEnvironment() when the link's global target is not an overridable global environment rather than adding an environment entry with the same name which would create a duplicate JNDI binding remm
• 2026/09/30 (tomcat) 02/08: Synchronise the check and assignment of the servlet instance in getServletMethods() to prevent a race which could result in a second, never initialised instance being retained by the wrapper remm
• 2026/09/30 (tomcat) 03/08: Validate the incoming entry at the start of NamingResourcesImpl.addEnvironment() so that an entry which is ignored or rejected cannot first destroy the existing environment entry or resource link with the same name remm
• 2026/09/30 (tomcat) 05/08: Merge branch '10.1.x' of [email protected]:apache/tomcat.git into 10.1.x remm
• 2026/09/30 (tomcat) 01/08: Delegate awaitTermination() in StandardThreadExecutor and StandardVirtualThreadExecutor to the wrapped executor rather than unconditionally returning false which violates the ExecutorService contract remm
• 2026/09/30 (tomcat) 08/08: Fix return statement remm
• 2026/09/30 (tomcat) 06/08: Only release the shared naming entry name in NamingResourcesImpl remove*() methods when the type-specific map actually held the entry, preventing the removal of the JNDI name reservation of a differently typed descriptor with the same name remm
• 2026/09/30 (tomcat) 01/04: Add the missing standardService.connector.startFailed and standardService.connector.stopFailed localization keys so connector start and stop failures produce readable messages rather than the raw key remm
• 2026/09/30 (tomcat) branch 10.1.x updated (f1dca9e463 -> 792859bdb8) remm
• 2026/09/30 (tomcat) 02/04: Synchronize access to the StandardHost childClassLoaders map which is written by context start threads and read by findReloadedContextMemoryLeaks() from Manager/JMX threads, preventing concurrent modification of the underlying WeakHashMap during iteration remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Partial revert of 6fd26942 markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Partial revert of 6fd26942 markt
• 2026/09/30 (tomcat) branch main updated: Partial revert of 6fd26942 markt
• 2026/09/30 (tomcat) 04/10: Synchronise the check and assignment of the servlet instance in getServletMethods() to prevent a race which could result in a second, never initialised instance being retained by the wrapper remm
• 2026/09/30 (tomcat) 08/10: Only release the shared naming entry name in NamingResourcesImpl remove*() methods when the type-specific map actually held the entry, preventing the removal of the JNDI name reservation of a differently typed descriptor with the same name remm
• 2026/09/30 (tomcat) branch 11.0.x updated (a0733659dc -> 8119db0676) remm
• 2026/09/30 (tomcat) 03/10: Delegate awaitTermination() in StandardThreadExecutor and StandardVirtualThreadExecutor to the wrapped executor rather than unconditionally returning false which violates the ExecutorService contract remm
• 2026/09/30 (tomcat) branch 9.0.x updated: Remove unnecessary cast markt
• 2026/09/30 (tomcat) branch main updated: Remove unnecessary cast markt
• 2026/09/30 (tomcat) 01/10: Add the missing standardService.connector.startFailed and standardService.connector.stopFailed localization keys so connector start and stop failures produce readable messages rather than the raw key remm
• 2026/09/30 (tomcat) 06/10: Retain an existing resource link in NamingResourcesImpl.addEnvironment() when the link's global target is not an overridable global environment rather than adding an environment entry with the same name which would create a duplicate JNDI binding remm
• 2026/09/30 (tomcat) 09/10: Use the atomic add() of the shared entries set as the name claim in all NamingResourcesImpl add*() methods to close the check-then-act race which could allow two descriptors with the same JNDI name to both be registered remm
• 2026/09/30 (tomcat) 02/10: Synchronise access to the StandardHost childClassLoaders map which is written by context start threads and read by findReloadedContextMemoryLeaks() from Manager/JMX threads, preventing concurrent modification of the underlying WeakHashMap during iteration remm
• 2026/09/30 (tomcat) 07/10: Walk the class hierarchy in NamingResourcesImpl getSetterType() and getFieldType() so that injection targets resolving to inherited fields or setters are no longer rejected at deployment, matching the behaviour of the runtime injection engine remm
• 2026/09/30 (tomcat) 05/10: Validate the incoming entry at the start of NamingResourcesImpl.addEnvironment() so that an entry which is ignored or rejected cannot first destroy the existing environment entry or resource link with the same name remm
• 2026/09/30 (tomcat) branch 11.0.x updated: Remove unnecessary cast markt
• 2026/09/30 Re: (tomcat) branch 9.0.x updated: Partial revert of c817143f and a further correction Rémy Maucherat
• 2026/09/30 October release timeline Mark Thomas
• 2026/09/30 (tomcat) branch 10.1.x updated: Partial revert of c817143f and a further correction markt
• 2026/09/30 (tomcat) branch main updated: Partial revert of c817143f and a further correction markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Partial revert of c817143f and a further correction markt
• 2026/09/30 (tomcat) 02/10: Synchronise access to the StandardHost childClassLoaders map which is written by context start threads and read by findReloadedContextMemoryLeaks() from Manager/JMX threads, preventing concurrent modification of the underlying WeakHashMap during iteration remm
• 2026/09/30 (tomcat) branch 9.0.x updated: Partial revert of c817143f and a further correction markt
• 2026/09/30 (tomcat) 08/10: Only release the shared naming entry name in NamingResourcesImpl remove*() methods when the type-specific map actually held the entry, preventing the removal of the JNDI name reservation of a differently typed descriptor with the same name remm
• 2026/09/30 (tomcat) branch main updated (1c6560001f -> 4f1ec70d54) remm
• 2026/09/30 (tomcat) 09/10: Use the atomic add() of the shared entries set as the name claim in all NamingResourcesImpl add*() methods to close the check-then-act race which could allow two descriptors with the same JNDI name to both be registered remm
• 2026/09/30 (tomcat) 05/10: Validate the incoming entry at the start of NamingResourcesImpl.addEnvironment() so that an entry which is ignored or rejected cannot first destroy the existing environment entry or resource link with the same name remm
• 2026/09/30 (tomcat) 04/10: Synchronise the check and assignment of the servlet instance in getServletMethods() to prevent a race which could result in a second, never initialised instance being retained by the wrapper remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Follow-up to 87ed9d47 markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Follow-up to 87ed9d47 markt
• 2026/09/30 (tomcat) 07/07: Store the JASPIC isMandatory MessageInfo property as a Boolean as the specification requires rather than a String, and throw IllegalArgumentException rather than NullPointerException when null is passed to the MessageInfoImpl request/response message setters remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Follow-up to 34315ac0 markt
• 2026/09/30 (tomcat) branch 9.0.x updated: Follow-up to 34315ac0 markt
• 2026/09/30 (tomcat) branch main updated: Follow-up to 4127ca5f markt
• 2026/09/30 (tomcat) branch main updated (85daf45655 -> 4d142cc729) remm
• 2026/09/30 (tomcat) branch 11.0.x updated: Follow-up to 4127ca5f markt
• 2026/09/30 (tomcat) 01/02: Follow-on to 1141d547 markt
• 2026/09/30 (tomcat) 02/02: Follow-up to 4127ca5f markt
• 2026/09/30 (tomcat) branch 10.1.x updated: Follow-up to 4127ca5f markt
• 2026/09/30 (tomcat) 01/07: Fix InputBuffer.skip() consuming and returning more characters than requested by comparing and advancing by the remaining count (n - nRead) rather than the original count, and add a regression test remm
• 2026/09/30 (tomcat) 08/08: jakarta -> javax and fix test remm
• 2026/09/30 (tomcat) 03/08: Return 0 rather than -1 for zero-length reads from InputBuffer at end of stream, as required by the InputStream/Reader contract, and avoid the unnecessary blocking fill these requests previously triggered remm
• 2026/09/30 (tomcat) 04/08: Return a snapshot enumeration from Request.getLocales() to prevent ConcurrentModificationExceptions when the locales list is modified while a previously returned enumeration is being iterated remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Fix registration test remm
• 2026/09/30 (tomcat) 07/08: Make FrameworkListener registration idempotent so repeated Server start events do not add duplicate container listeners or orphan previous per-context lifecycle listeners that can no longer be removed remm
• 2026/09/30 (tomcat) 06/08: Fall back to the raw trimmed filename value in ApplicationPart.getSubmittedFileName() when HttpParser.unquote() rejects an invalid quoted-string, keeping the result consistent with the file-vs-field classification performed by FileUploadBase.getFileName() for malformed Content-Disposition headers remm
• 2026/09/30 (tomcat) branch 9.0.x updated (6da20f64db -> 2fb3864f0e) remm
• 2026/09/30 (tomcat) 05/08: Add spec-mandated validation to ApplicationServletRegistration: throw IllegalStateException when the registration is modified after the context has been initialised (using a deliberately lenient availability test to avoid breaking existing applications that configure registrations before start) and IllegalArgumentException from addMapping for null or empty URL patterns remm
• 2026/09/30 (tomcat) 02/08: Record an error in CoyoteWriter.close() when the underlying OutputBuffer close fails, rather than swallowing the IOException silently, so checkError() reflects the failure remm
• 2026/09/30 (tomcat) 01/08: Fix InputBuffer.skip() consuming and returning more characters than requested by comparing and advancing by the remaining count (n - nRead) rather than the original count, and add a regression test remm
• 2026/09/30 (tomcat) branch 11.0.x updated: Fix registration test remm
• 2026/09/30 (tomcat) 05/07: Add spec-mandated validation to ApplicationServletRegistration: throw IllegalStateException when the registration is modified after the context has been initialised (using a deliberately lenient availability test to avoid breaking existing applications that configure registrations before start) and IllegalArgumentException from addMapping for null or empty URL patterns remm
• 2026/09/30 (tomcat) branch 11.0.x updated (9b0f7e4cfe -> 731e38b9c8) remm
• 2026/09/30 (tomcat) 04/07: Document that a failure to create a persistent JASPIC provider registration is deliberately fatal rather than silently skipped, since skipping an authentication provider would fail open remm
• 2026/09/30 (tomcat) branch main updated: Follow-on to 1141d547 markt
• 2026/09/30 (tomcat) branch 10.1.x updated: Follow-on to 1141d547 markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Follow-on to 1141d547 markt
• 2026/09/30 (tomcat) 06/07: Fall back to the raw trimmed filename value in ApplicationPart.getSubmittedFileName() when HttpParser.unquote() rejects an invalid quoted-string, keeping the result consistent with the file-vs-field classification performed by FileUploadBase.getFileName() for malformed Content-Disposition headers remm
• 2026/09/30 (tomcat) 04/07: Return a snapshot enumeration from Request.getLocales() to prevent ConcurrentModificationExceptions when the locales list is modified while a previously returned enumeration is being iterated remm
• 2026/09/30 (tomcat) 07/07: Make FrameworkListener registration idempotent so repeated Server start events do not add duplicate container listeners or orphan previous per-context lifecycle listeners that can no longer be removed remm
• 2026/09/30 (tomcat) 02/07: Record an error in CoyoteWriter.close() when the underlying OutputBuffer close fails, rather than swallowing the IOException silently, so checkError() reflects the failure remm
• 2026/09/30 (tomcat) 06/08: Fall back to the raw trimmed filename value in ApplicationPart.getSubmittedFileName() when HttpParser.unquote() rejects an invalid quoted-string, keeping the result consistent with the file-vs-field classification performed by FileUploadBase.getFileName() for malformed Content-Disposition headers remm
• 2026/09/30 (tomcat) branch 9.0.x updated: Follow-up to 0dd86e53 markt
• 2026/09/30 (tomcat) 08/08: Merge branch '11.0.x' of [email protected]:apache/tomcat.git into 11.0.x remm
• 2026/09/30 (tomcat) 05/08: Add spec-mandated validation to ApplicationServletRegistration: throw IllegalStateException when the registration is modified after the context has been initialised (using a deliberately lenient availability test to avoid breaking existing applications that configure registrations before start) and IllegalArgumentException from addMapping for null or empty URL patterns remm
• 2026/09/30 (tomcat) branch 11.0.x updated: Follow-up to 0dd86e53 markt
• 2026/09/30 (tomcat) 01/08: Fix InputBuffer.skip() consuming and returning more characters than requested by comparing and advancing by the remaining count (n - nRead) rather than the original count, and add a regression test remm
• 2026/09/30 (tomcat) 04/08: Return a snapshot enumeration from Request.getLocales() to prevent ConcurrentModificationExceptions when the locales list is modified while a previously returned enumeration is being iterated remm
• 2026/09/30 (tomcat) 02/08: Record an error in CoyoteWriter.close() when the underlying OutputBuffer close fails, rather than swallowing the IOException silently, so checkError() reflects the failure remm
• 2026/09/30 (tomcat) 03/08: Return 0 rather than -1 for zero-length reads from InputBuffer at end of stream, as required by the InputStream/Reader contract, and avoid the unnecessary blocking fill these requests previously triggered remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Follow-up to 0dd86e53 markt
• 2026/09/30 (tomcat) branch main updated: Follow-up to 0dd86e53 markt
• 2026/09/30 (tomcat) 07/08: Make FrameworkListener registration idempotent so repeated Server start events do not add duplicate container listeners or orphan previous per-context lifecycle listeners that can no longer be removed remm
• 2026/09/30 (tomcat) 03/08: Return 0 rather than -1 for zero-length reads from InputBuffer at end of stream, as required by the InputStream/Reader contract, and avoid the unnecessary blocking fill these requests previously triggered remm
• 2026/09/30 (tomcat) 08/08: Merge branch 'main' of [email protected]:apache/tomcat.git into main remm
• 2026/09/30 (tomcat) 05/08: Add spec-mandated validation to ApplicationServletRegistration: throw IllegalStateException when the registration is modified after the context has been initialised (using a deliberately lenient availability test to avoid breaking existing applications that configure registrations before start) and IllegalArgumentException from addMapping for null or empty URL patterns remm
• 2026/09/30 (tomcat) 06/08: Fall back to the raw trimmed filename value in ApplicationPart.getSubmittedFileName() when HttpParser.unquote() rejects an invalid quoted-string, keeping the result consistent with the file-vs-field classification performed by FileUploadBase.getFileName() for malformed Content-Disposition headers remm
• 2026/09/30 (tomcat) 04/08: Return a snapshot enumeration from Request.getLocales() to prevent ConcurrentModificationExceptions when the locales list is modified while a previously returned enumeration is being iterated remm
• 2026/09/30 (tomcat) 01/08: Fix InputBuffer.skip() consuming and returning more characters than requested by comparing and advancing by the remaining count (n - nRead) rather than the original count, and add a regression test remm
• 2026/09/30 (tomcat) 02/08: Record an error in CoyoteWriter.close() when the underlying OutputBuffer close fails, rather than swallowing the IOException silently, so checkError() reflects the failure remm

• Earlier messages
• Later messages