Tomcat 11.0.0-M1 (markt)


  • Code: This release contains all of the changes up to and including those in Apache Tomcat 10.1.1 plus the additional changes listed below. (markt)


  • Fix: 66175: Change the default character set used by the BasicAuthenticator from ISO-8859-1 to UTF-8. (markt)
  • Add: 66209: Add a configuration option to allow bloom filters used to index JAR files to be retained for the lifetime of the web application. Prior to this addition, the indexes were always flushed by the periodic calls to WebResourceRoot.gc(). As part of this addition, configuration of archive indexing moves from Context to WebResourceRoot. Based on a patch provided by Rahul Jaisimha. (markt)
  • Fix: 66330: Correct a regression introduced when fixing 62897 that meant any value configured for skipMemoryLeakChecksOnJvmShutdown on the Context was ignored and the default was always used. (markt)
  • Fix: 66331: Fix a regression in refactoring for Stack on the SystemLogHandler which caught incorrect exception. (lihan)
  • Fix: 66338: Fix a regression that caused a nuance in refactoring for ErrorReportValve. (lihan)
  • Fix: Escape values used to construct output for the JsonErrorReportValve to ensure that it always outputs valid JSON. (markt)
  • Fix: Correct the default implementation of HttpServletRequest.isTrailerFieldsReady() to return true so it is consistent with the default implementation of HttpServletRequest.getTrailerFields() and with the Servlet API provided by the Jakarta EE project. (markt)
  • Fix: Refactor WebappLoader so it only has a runtime dependency on the migration tool for Jakarta EE if configured to use the converter as classes are loaded. (markt)
  • Fix: Improve the behavior of the credential handler attribute that is set in the Servlet context so that it actually reflects what is used during authentication. (remm)
  • Fix: 66359: Update javadoc for RemoteIpValve and RemoteIpFilter with correct protocolHeader default value of "X-Forwarded-Proto". (lihan)
  • Add: Add support for the new attribute for error dispatches jakarta.servlet.error.query_string. (markt)
  • Update: Update ignoreAnnotation attribute on Context to dissociate it from metadata-complete. (remm)


  • Fix: Correct the date format used with the expires attribute of HTTP cookies. A single space rather than a single dash should be used to separate the day, month and year components to be compliant with RFC 6265. (markt)
  • Add: Include the name of the current stream state in the error message when a stream is cancelled due to an attempt to write to the stream when it is in a state that does not permit writes. (markt)
  • Code: NIO writes never return -1 so refactor CLOSED_NIO_CHANNEL not to do so and remove checks for this return value. Based on #562 by tianshuang. (markt)
  • Code: Remove unnecessary code that exposed the asyncTimeout to components that never used it. (markt)
  • Fix: Ensure that all MessageBytes conversions to byte arrays are valid for the configured character set and throw an exception if not. (markt)
  • Fix: When an HTTP/2 stream was reset, the current active stream count was not reduced. If enough resets occurred on a connection, the current active stream count limit was reached and no new streams could be created on that connection. (markt)


  • Fix: 66294: Make the use of a privileged block to obtain the thread context class loader added to address 62080 optional and disabled by default. This is now controlled by the org.apache.el.GET_CLASSLOADER_USE_PRIVILEGED system property. (markt)
  • Fix: 66317: Fix for Lambda coercion security manager missing privileges. Based on pull request #557 by Isaac Rivera Rivas (lihan)
  • Fix: 66325: Fix concurrency issue in evaluation of expression language containing lambda expressions. (markt)
  • Add: Update the ErrorData class in the JSP API to align with the recent changes in the Jakarta Pages specification to support the new error dispatch attribute jakarta.servlet.error.query_string.

Web applications

  • Fix: 66348: Update the JARs listed in the class loader documentation and note which ones are optional. (markt)
  • Fix: Documentation. Replace references in the application developer's guide to CVS with more general references to a source code control system. (markt)


  • Fix: 66346: Ensure all JDBC pool JARs are reproducible. Pull request #566 provided by John Neffenger. (markt)


  • Update: Update to Commons Daemon 1.3.3. (markt)
  • Fix: 66323: Move module start up parameters from JDK_JAVA_OPTIONS to JAVA_OPTS now that the minimum Java version is 11 and these options are always required. (markt)
  • Add: Improvements to Chinese translations. Contributed by DigitalCat and lihan. (markt)
  • Add: Improvements to French translations. Contributed by Mathieu Bouchard. (markt)
  • Add: Improvements to Japanese translations. Contributed by Shirayuking and tak7iji. (markt)
  • Add: Improvements to Korean translations. (markt)
  • Add: Improvements to Spanish translations. (markt)
  • Fix: Correct a regression in the removal of the APR connector that broke Graal native image support. Pull request #564 provided by Sébastien Deleuze. (markt)
  • Update: Update the packaged version of the Apache Tomcat Native Library to 2.0.2 to pick up the Windows binaries built with with OpenSSL 3.0.7. (markt)
  • Update: Update the packaged version of the Apache Tomcat Migration Tool for Jakarta EE to 1.0.5. (markt)
  • Code: Refactor code base to replace use of URL constructors. While they are deprecated in Java 20 onwards, the reasons for deprecation are valid for all versions so move away from them now. (markt)
  • Code: Refine the Tomcat native image metadata to avoid including unintended non-Tomcat resources. Pull request #569 provided by Sébastien Deleuze. (markt)
  • Update: Update the internal fork of Apache Commons BCEL to b015e90 (2022-11-28, 6.7.0-RC1). (markt)
  • Update: Update the internal fork of Apache Commons Codec to ae32a3f (2022-11-29, 1.16-SNAPSHOT). (markt)
  • Update: Update the internal fork of Apache Commons FileUpload to aa8eff6 (2022-11-29, 2.0-SNAPSHOT). (markt)