Am 31.01.25 um 14:49 schrieb Rémy Maucherat:
On Thu, Jan 30, 2025 at 5:52 PM Mark Thomas <ma...@apache.org> wrote:
All,
We have discussed plans for extended Tomcat 9 support several times. It
is still probably a couple of years away but I thought it would be worth
starting the discussion again.
There are a wide range of options. This is a brain dump of the questions
I have been mulling over when considering options.
1. Extended support requires back-porting of security fixes. What else
do we want to back-port. Bug fixes? New features?
I would keep the current backport policy, so backport most.
I agree with Rémy. There might come bigger changes, which we do not even
backport to 10.1, but it might be better to discuss, once we know what
type of feature this would be. Then we can see, whether the old plan of
having a 9.x.y with x != 0 makes sense.
2. Do we want to continue to support the APR connector? If we decide no,
we can also stop supporting Tomcat Native 1.x. Equally, if we keep APR
we'll need to keep making Native 1.x releases to pick up OpenSSL updates.
Keeping it is certainly a high cost ...
Not sure either. Normally we don't throw out a feature during an version
lifecycle and we announce deprecation far in advance. So kicking APR
might mean deprecation, announcing EOL for APR and probably 9.0 with a
date in the future and switching from 9.0 to 9.1 (or whatever) without
APR then.
3. What minimum version of Java do we want to support? Stick with Java
8? Increase the minimum version in line with availability of free
supported JREs (e.g. from Temurin)? Something else?
I would stick with Java 8 rather than ever try bumping. Bumping Java
could be very hard for apps and their libraries. Realistically we
would have to move to 21 minimum all of a sudden, so this would hurt a
lot.
Java 8 remains supported until the end of 2026 (and 2030 for extended
support versions). It would therefore seem ok to me to keep in mind
those dates for the Tomcat 9.0 support.
I volunteer to keep on RMing Tomcat 9.0 :D (and make the releases as
long as I have enough votes obviously)
I agree with 8. Although most vendors stop free releases of OpenJDK 8
october/november 2026, Amazon announced Corretto until 2030:
https://aws.amazon.com/de/corretto/faqs/
and the commercial offerings provide paid support until 2030. Even
Adoptium has not yet release a final date, just an "at least".
It might make sense to review this decision around mid 2026. And it
might have a dependency on APR deprecation and branching 9.1 or similar.
All in all I think Java 8 support still has a big value out in the
field, exactly for the legacy apps that no-one ports from javax to
jakarta. So if the burden is not to high on the project it would be
quite nice to support it.
4. Do we cancel plans for extended Tomcat 9 support? (I'm not a fan of
this.)
I would say no.
Agreed.
5. Do we effectively just continue with 9.0.x or create 9.?.x?
I would continue with 9.0 for now (see below).
Agreed.
6. Do we continue from 9.0.x or do we start from 10.1.x and revert the
Jakarta EE API changes?
I would not do that, there's still not much benefit to it.
Agreed.
I suspect the folks that want extended 9.0.x support also want minimal
changes. If we do plan on changing things (minimum Java version,
dropping APR) we should provide plenty of notice.
Right now I would say upgrading Java is a bad move, we might as well
EOL Tomcat 9.0.
As a compromise to maintainability, there's a rationale for dropping
THE problematic feature (the APR connector and tomcat-native 1.x).
That would justify doing a 9.1 without any other changes, which would
be that "extended support version".
... and would need some advance publication of the plan.
When do we think extended support will start? My best guess is no
earlier than 31 March 2027.
It could start when Java 8 is EOL in Temurin (Red Hat has the same
date too), so end of 2026 ?
See above, there might be free Java 8 support even longer (Coretto,
maybe even Temurin).
I'm not sure, what we mean be "extended" support. Just keeping it
supported - then there would be no start date - or some kind of reduced
support (eg. only security) or what?
Best regards,
Rainer
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
