Changelog$$$Tomcat 11.0.22 (markt)$$$Catalina$$$Add: Enhance version.sh and version.bat to display APR; Tomcat Native; and OpenSSL version information (both APR and FFM implementations); along with version compatibility warnings and third-party library version information. (csutherl)$$$Code: Refactor generation of the remote user element in the access log to remove unnecessary code. (markt)$$$Fix: Fix a regression in the previous release that meant ?- could appear in the access log rather than ? when the query string was present but empty. (markt)$$$Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by Mahmoud Alarby. (remm)$$$Fix: Align the escaping in ExtendedAccessLogValve with the other AccessLogValve implementations. (markt)$$$Fix: 70000: fix duplication of special headers in the response after commit; following fix for 69967. (remm)$$$Fix: Correct the handling of URIs mapped to a security constraint that only specifies the special ** role for all authenticated users. Requests without authentication were receiving 403 responses rather than 401 responses. (markt)$$$Fix: Fix a race condition in StandardContext.getServletContext() that could cause the jakarta.servlet.context.tempdir attribute to be lost during a context reload. Make the context field volatile and use locking to ensure only one ApplicationContext instance is created. (dsoumis)$$$Fix: Update the Windows authentication (kerberos) documentation to reflect that both Java and Windows are removing / have removed support for RC4-HMAC. The guide now uses AES256-SHA1. (markt)$$$Fix: Add a new initialisation parameter for WebDAV; maxRequestBodySize which limits the size of a WebDAV request body for LOCK and PROPFIND. The default value is 4096 bytes. (markt)$$$Add: Add a new caseSensitive attribute to the LockOutRealm that controls the manner in which user names are treated when making locking decisions. The default is false; meaning user names are treated in a case insensitive manner. (markt)$$$Fix: Correct the handling of invalid users with DIGEST authentication. (markt)$$$Fix: Ensure RealmBase finds all matching extension based security constraints. (markt)$$$Coyote$$$Fix: Avoid various edge cases if Content-Length is set via setHeader(String;String) or addHeader(String;String) with an invalid value by always clearing the previous value whether the new value is valid or not and ignoring any invalid new value. (markt)$$$Code: Refactor the calculation of the real index in the HPACK dynamic header table implementation to reduce code duplication. (markt)$$$Fix: Fix various minor issues with some HTTP/2 stream error messages for HTTP/2. (markt)$$$Fix: Consistently reject URIs containing NULL bytes when normalizing. (markt)$$$Fix: Fix a few minor memory leaks on error paths reading TLS keys and certificates when using FFM. (markt)$$$Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC after a stream reset. (markt)$$$Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields not permitted in trailers. (markt)$$$Fix: Free private keys after use in FFM based connector configuration. (markt)$$$Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header decoding that could result in a valid header triggering an unexpected connection close. (markt)$$$Fix: Refactor HTTP/2 HPACK encoding so header field names are only converted to lower case once during the encoding process. (markt)$$$Fix: Refactor HTTP/2 header field validation so it occurs earlier. Extend validation to check for disallowed characters as well as upper case characters. (markt)$$$Fix: Add TLS 1.3 groups added in OpenSSL 4.0. (remm)$$$Fix: Add validation that the HTTP/2 :scheme pseudo-header is consistent with the use (or not) of TLS. (markt)$$$Fix: Correct the validation of pseudo headers and CONNECT requests to align Tomcats behaviour with RFC 9113; section 8.5. (markt)$$$Fix: Fix a potential integer overflow when allocating capacity from a conne

Apache Tomcat 11$$$Version 11.0.21; Mar 30 2026$$$$$$Changelog$$$Tomcat 11.0.21 (markt)$$$Catalina$$$Fix: Add escaping for URI and query string in the access log. (markt)$$$Coyote$$$Fix: Fix an HTTP/2 header frame parsing bug that could result in a connection being closed without a GOAWAY frame if an invalid HEADERS frame was received. (markt)$$$Fix: 69982: Fix a bug in the non-blocking flushing code for NIO+TLS that meant that a response may not be fully written until the connection is closed. Pull request #966 provided by Phil Clay. (markt)$$$Fix: Ensure the HTTP/2 request header read buffer is reset (including restoration to default size) after a stream reset. (markt)$$$Add: Provide trailer field filtering equivalent to that provided for non-trailer fields. Control characters (excluding TAB); and characters with code points above 255 will be replaced with a space. (markt)$$$Fix: Align OpenSSl FFM behaviour with Tomcat Native for various OCSP edge cases. (markt)$$$Cluster$$$Fix: Reduce log verbosity of the Kubernetes connection attempts and failure. (remm)$$$Fix: Better error handling for the EncryptInterceptor. (markt)$$$Other$$$Update: Update bnd to 7.2.3. (markt)$$$Update: Improvements to French translations. (remm)$$$Update: Improvements to Japanese translations provided by tak7iji. (markt)

Apache Tomcat 11$$$Version 11.0.21; Mar 30 2026$$$$$$Changelog$$$Tomcat 11.0.21 (markt)$$$Catalina$$$Fix: Add escaping for URI and query string in the access log. (markt)$$$Coyote$$$Fix: Fix an HTTP/2 header frame parsing bug that could result in a connection being closed without a GOAWAY frame if an invalid HEADERS frame was received. (markt)$$$Fix: 69982: Fix a bug in the non-blocking flushing code for NIO+TLS that meant that a response may not be fully written until the connection is closed. Pull request #966 provided by Phil Clay. (markt)$$$Fix: Ensure the HTTP/2 request header read buffer is reset (including restoration to default size) after a stream reset. (markt)$$$Add: Provide trailer field filtering equivalent to that provided for non-trailer fields. Control characters (excluding TAB); and characters with code points above 255 will be replaced with a space. (markt)$$$Fix: Align OpenSSl FFM behaviour with Tomcat Native for various OCSP edge cases. (markt)$$$Cluster$$$Fix: Reduce log verbosity of the Kubernetes connection attempts and failure. (remm)$$$Fix: Better error handling for the EncryptInterceptor. (markt)$$$Other$$$Update: Update bnd to 7.2.3. (markt)$$$Update: Improvements to French translations. (remm)$$$Update: Improvements to Japanese translations provided by tak7iji. (markt)

Apache Tomcat 11$$$Version 11.0.20; Mar 16 2026$$$$$$Changelog$$$Tomcat 11.0.20 (markt)$$$Coyote$$$Fix: Fix case sensitive handling of the protocol host name. (remm)

Apache Tomcat 11$$$Version 11.0.20; Mar 16 2026$$$$$$Changelog$$$Tomcat 11.0.20 (markt)$$$Coyote$$$Fix: Fix case sensitive handling of the protocol host name. (remm)

Apache Tomcat 11$$$Version 11.0.18; Jan 23 2026$$$$$$Changelog$$$Tomcat 11.0.18 (markt)$$$Coyote$$$Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown that triggered a significant memory leak. Patch provided by Wes. (markt)

Apache Tomcat 11$$$Version 11.0.18; Jan 23 2026$$$$$$Changelog$$$Tomcat 11.0.18 (markt)$$$Coyote$$$Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown that triggered a significant memory leak. Patch provided by Wes. (markt)

Tomcat 11.0.15 (markt)$$$Catalina$$$Fix: 69871: Increase log level to INFO for missing configuration for the rewrite valve. (remm)$$$Fix: Add log warnings for additional Host appBase suspicious values. (remm)$$$Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar. org.apache.catalina.Connector no longer requires org.apache.tomcat.jni.AprStatus to be present. (markt)$$$Add: Add the ability to use a custom function to generate the client identifier in the CrawlerSessionManagerValve. This is only available programmatically. Pull request #902 by Brian Matzon. (markt)$$$Fix: Change the SSO reauthentication behaviour for SPNEGO authentication so that a normal SPNEGO authentication is performed if the SSL Valve is configured with reauthentication enabled. This is so that the delegated credentials will be available to the web application. (markt)$$$Coyote$$$Fix: Dont log an incorrect certificate KeyStore location when creating a TLS connector if the KeyStore instance has been set directly on the connector. (markt)$$$Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)$$$Add: Add strictSNI attribute on the Connector to allow matching the SSLHostConfig configuration associated with the SNI host name to the SSLHostConfig configuration matched from the HTTP protocol host name. Non matching configurations will cause the request to be rejected. The attribute default value is true; enabling the matching. (remm)$$$Jasper$$$Fix: 69877: Catch IllegalArgumentException when processing URIs when creating the classpath to handle invalid URIs. (remm)$$$Fix: Fix populating the classpath with the webapp classloader repositories. (remm)$$$Clustering$$$Fix: Correct a regression introduced in 11.0.11 that broke some clustering configurations. (markt)$$$Web Applications$$$Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server status output if one or more of the web applications failed to start. (schultz)$$$Add: Manager: Include web application state in the HTML and JSON complete server status output. (markt)$$$Add: Documentation: Expand the documentation to better explain when OCSP is supported and when it is not. (markt)$$$jdbc-pool$$$Fix: 64083: If the underlying connection has been closed; dont add it to the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)$$$Other$$$Update: Update file extension to media type mappings to align with the current list used by the Apache Web Server (httpd). (markt)$$$Update: Update the packaged version of the Tomcat Migration Tool for Jakarta EE to 1.0.10. (markt)$$$Update: Update Commons Daemon to 1.5.0. (markt)$$$Update: Update Byte Buddy to 1.18.2. (markt)$$$Update: Update Checkstyle to 12.2.0. (markt)$$$Add: Improvements to Spanish translations provided by White Vogel. (markt)$$$Add: Improvements to French translations. (remm)$$$Add: Improvements to Japanese translations provided by tak7iji. (markt)

Tomcat 11.0.15 (markt)$$$Catalina$$$Fix: 69871: Increase log level to INFO for missing configuration for the rewrite valve. (remm)$$$Fix: Add log warnings for additional Host appBase suspicious values. (remm)$$$Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar. org.apache.catalina.Connector no longer requires org.apache.tomcat.jni.AprStatus to be present. (markt)$$$Add: Add the ability to use a custom function to generate the client identifier in the CrawlerSessionManagerValve. This is only available programmatically. Pull request #902 by Brian Matzon. (markt)$$$Fix: Change the SSO reauthentication behaviour for SPNEGO authentication so that a normal SPNEGO authentication is performed if the SSL Valve is configured with reauthentication enabled. This is so that the delegated credentials will be available to the web application. (markt)$$$Coyote$$$Fix: Dont log an incorrect certificate KeyStore location when creating a TLS connector if the KeyStore instance has been set directly on the connector. (markt)$$$Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)$$$Add: Add strictSNI attribute on the Connector to allow matching the SSLHostConfig configuration associated with the SNI host name to the SSLHostConfig configuration matched from the HTTP protocol host name. Non matching configurations will cause the request to be rejected. The attribute default value is true; enabling the matching. (remm)$$$Jasper$$$Fix: 69877: Catch IllegalArgumentException when processing URIs when creating the classpath to handle invalid URIs. (remm)$$$Fix: Fix populating the classpath with the webapp classloader repositories. (remm)$$$Clustering$$$Fix: Correct a regression introduced in 11.0.11 that broke some clustering configurations. (markt)$$$Web Applications$$$Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server status output if one or more of the web applications failed to start. (schultz)$$$Add: Manager: Include web application state in the HTML and JSON complete server status output. (markt)$$$Add: Documentation: Expand the documentation to better explain when OCSP is supported and when it is not. (markt)$$$jdbc-pool$$$Fix: 64083: If the underlying connection has been closed; dont add it to the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)$$$Other$$$Update: Update file extension to media type mappings to align with the current list used by the Apache Web Server (httpd). (markt)$$$Update: Update the packaged version of the Tomcat Migration Tool for Jakarta EE to 1.0.10. (markt)$$$Update: Update Commons Daemon to 1.5.0. (markt)$$$Update: Update Byte Buddy to 1.18.2. (markt)$$$Update: Update Checkstyle to 12.2.0. (markt)$$$Add: Improvements to Spanish translations provided by White Vogel. (markt)$$$Add: Improvements to French translations. (remm)$$$Add: Improvements to Japanese translations provided by tak7iji. (markt)

Tomcat 11.0.14 (markt)$$$Catalina$$$Fix: When generating the class path in the Loader; re-order the check on individual class path components to avoid a potential NullPointerException. Identified by Coverity Scan. (markt)$$$Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull request #915 by Joshua Rogers. (remm)$$$Update: Add an attribute; digestInRfc3112Order; to MessageDigestCredentialHandler to control the order in which the credential and salt are digested. By default; the current; non-RFC 3112 compliant; order of salt then credential will be used. This default will change in Tomcat 12 to the RFC 3112 compliant order of credential then salt. (markt)$$$Coyote$$$Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)$$$Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL provider. Pull request #912 by aogburn. (markt)$$$Fix: Fix potential crash on shutdown when a Connector depends on the Tomcat Native library. (markt)$$$Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers. (remm)$$$Jasper$$$Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some exception details. Patch submitted by Eric Blanquer. (remm)$$$Other$$$Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)$$$Update: Update to the Eclipse JDT compiler 4.37. (markt)$$$Update: Update to Byte Buddy 1.17.8. (markt)$$$Update: Update to Checkstyle 12.1.1. (markt)$$$Update: Update to Jacoco 0.8.14. (markt)$$$Update: Update to SpotBugs 4.9.8. (markt)$$$Update: Update to JSign 7.4. (markt)$$$Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)$$$Add: Improvements to French translations. (remm)$$$Add: Improvements to Japanese translations provided by tak7iji. (markt)

Tomcat 11.0.14 (markt)$$$Catalina$$$Fix: When generating the class path in the Loader; re-order the check on individual class path components to avoid a potential NullPointerException. Identified by Coverity Scan. (markt)$$$Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull request #915 by Joshua Rogers. (remm)$$$Update: Add an attribute; digestInRfc3112Order; to MessageDigestCredentialHandler to control the order in which the credential and salt are digested. By default; the current; non-RFC 3112 compliant; order of salt then credential will be used. This default will change in Tomcat 12 to the RFC 3112 compliant order of credential then salt. (markt)$$$Coyote$$$Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)$$$Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL provider. Pull request #912 by aogburn. (markt)$$$Fix: Fix potential crash on shutdown when a Connector depends on the Tomcat Native library. (markt)$$$Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers. (remm)$$$Jasper$$$Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some exception details. Patch submitted by Eric Blanquer. (remm)$$$Other$$$Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)$$$Update: Update to the Eclipse JDT compiler 4.37. (markt)$$$Update: Update to Byte Buddy 1.17.8. (markt)$$$Update: Update to Checkstyle 12.1.1. (markt)$$$Update: Update to Jacoco 0.8.14. (markt)$$$Update: Update to SpotBugs 4.9.8. (markt)$$$Update: Update to JSign 7.4. (markt)$$$Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)$$$Add: Improvements to French translations. (remm)$$$Add: Improvements to Japanese translations provided by tak7iji. (markt)

Tomcat 11.0.13 (markt)$$$Catalina$$$Add: Add CIDR support for the configuration of internal and trusted proxies for the RemoteIpFilter and RemoteIpValve. Configuration via regular expression has been deprecated and will be removed in Tomcat 12. (markt)$$$Fix: Log warnings when the SSO configuration does not comply with the documentation. (remm)$$$Update: Deprecate the RemoteAddrFilter and RemoteAddValve in favour of the RemoteCIDRFilter and RemoteCIDRValve. (markt)$$$Fix: 69837: Fix corruption of the class path generated by the Loader when running on Windows. (markt)$$$Fix: Reject requests that map to invalid Windows file names earlier. (markt)$$$Fix: 69839: Ensure that changes to session IDs (typically after authentication) are promulgated to the SSO Valve to ensure that SSO entries are fully clean-up on session expiration. Patch provided by Kim Johan Andersson. (markt)$$$Fix: Fix a race condition in the creation of the storage location for the FileStore. (markt)$$$Coyote$$$Fix: 69836: Incorrect processing of partitioned setting when generating session cookie. Patch submitted by Marc Pynaert. (remm)$$$Fix: 69848: Fix copy/paste errors in 11.0.12 that meant DELETE requests received via the AJP connector were processed as OPTIONS requests and PROPFIND requests were processed as TRACE. (markt)$$$WebSocket$$$Fix: 69845: When using permessage-deflate with Java 25 onwards; handle the underlying Inflater and/or Deflater throwing IllegalStateException when closed rather than NullPointerException as they do in Java 24 and earlier. (markt)$$$Other$$$Fix: 69847: Remove remaining references to the org.apache.tomcat.util.codec.binary package which has been deleted. (markt)

Tomcat 11.0.13 (markt)$$$Catalina$$$Add: Add CIDR support for the configuration of internal and trusted proxies for the RemoteIpFilter and RemoteIpValve. Configuration via regular expression has been deprecated and will be removed in Tomcat 12. (markt)$$$Fix: Log warnings when the SSO configuration does not comply with the documentation. (remm)$$$Update: Deprecate the RemoteAddrFilter and RemoteAddValve in favour of the RemoteCIDRFilter and RemoteCIDRValve. (markt)$$$Fix: 69837: Fix corruption of the class path generated by the Loader when running on Windows. (markt)$$$Fix: Reject requests that map to invalid Windows file names earlier. (markt)$$$Fix: 69839: Ensure that changes to session IDs (typically after authentication) are promulgated to the SSO Valve to ensure that SSO entries are fully clean-up on session expiration. Patch provided by Kim Johan Andersson. (markt)$$$Fix: Fix a race condition in the creation of the storage location for the FileStore. (markt)$$$Coyote$$$Fix: 69836: Incorrect processing of partitioned setting when generating session cookie. Patch submitted by Marc Pynaert. (remm)$$$Fix: 69848: Fix copy/paste errors in 11.0.12 that meant DELETE requests received via the AJP connector were processed as OPTIONS requests and PROPFIND requests were processed as TRACE. (markt)$$$WebSocket$$$Fix: 69845: When using permessage-deflate with Java 25 onwards; handle the underlying Inflater and/or Deflater throwing IllegalStateException when closed rather than NullPointerException as they do in Java 24 and earlier. (markt)$$$Other$$$Fix: 69847: Remove remaining references to the org.apache.tomcat.util.codec.binary package which has been deleted. (markt)

Tomcat 11.0.12 (markt)$$$Catalina$$$Update: Change the digest used to calculate strong ETags (if enabled) for the default Servlet from SHA-1 to SHA-256 to align with the recommendation in RFC 9110 that hash functions used to generate strong ETags should be collision resistant. (markt)$$$Fix: HTTP methods are case-sensitive so always use case sensitive comparisons when comparing HTTP methods. (markt)$$$Fix: 69814: Ensure that HttpSession.isNew() returns false once the client has joined the session. (markt)$$$Fix: Further performance improvements for ParameterMap. (jengebr/markt)$$$Code: Refactor access log time stamps to be based on the Instant request processing starts. (markt)$$$Fix: Fix a case-sensitivity issue in the trailer header allow list. (markt)$$$Fix: Be proactive in cleaning up temporary files after a failed multi-part upload rather than waiting for GC to do it. (markt)$$$Coyote$$$Update: Add specific certificate selection code for TLS 1.3 supporting post quantum cryptography. Certificates defined with type MLDSA will be selected depending on the TLS client hello. (remm)$$$Update: Add groups attribute on SSLHostConfig allowing to restrict which groups can be enabled on the SSL engine. (remm)$$$Add: Optimize the conversion of HTTP method from byte form to String form. (markt)$$$Fix: Store HTTP request headers using the original case for the header name rather than forcing it to lower case. (markt)$$$Cluster$$$Fix: Prevent the channel configuration (sender; receiver; membership service) from being changed unless the channel is fully stopped. (markt)$$$Web applications$$$Fix: Documentation. Clarify the purpose of the maxPostSize attribute of the Connector element. (markt)$$$Fix: Avoid NPE in manager webapp displaying certificate information. (remm)$$$Other$$$Update: Update Byte Buddy to 1.17.7. (markt)$$$Update: Update Checkstyle to 11.1.0. (markt)$$$Update: Update SpotBugs to 4.9.6. (markt)$$$Update: Update Jsign to 7.2. (markt)$$$Add: Improvements to Russian translations provided by usmazat. (markt)$$$Add: Improvements to French translations. (remm)$$$Add: Improvements to Japanese translations provided by tak7iji. (markt)$$$Update: Minor refactoring in JULI loggers. Patch provided by minjund. (schultz)

Tomcat 11.0.12 (markt)$$$Catalina$$$Update: Change the digest used to calculate strong ETags (if enabled) for the default Servlet from SHA-1 to SHA-256 to align with the recommendation in RFC 9110 that hash functions used to generate strong ETags should be collision resistant. (markt)$$$Fix: HTTP methods are case-sensitive so always use case sensitive comparisons when comparing HTTP methods. (markt)$$$Fix: 69814: Ensure that HttpSession.isNew() returns false once the client has joined the session. (markt)$$$Fix: Further performance improvements for ParameterMap. (jengebr/markt)$$$Code: Refactor access log time stamps to be based on the Instant request processing starts. (markt)$$$Fix: Fix a case-sensitivity issue in the trailer header allow list. (markt)$$$Fix: Be proactive in cleaning up temporary files after a failed multi-part upload rather than waiting for GC to do it. (markt)$$$Coyote$$$Update: Add specific certificate selection code for TLS 1.3 supporting post quantum cryptography. Certificates defined with type MLDSA will be selected depending on the TLS client hello. (remm)$$$Update: Add groups attribute on SSLHostConfig allowing to restrict which groups can be enabled on the SSL engine. (remm)$$$Add: Optimize the conversion of HTTP method from byte form to String form. (markt)$$$Fix: Store HTTP request headers using the original case for the header name rather than forcing it to lower case. (markt)$$$Cluster$$$Fix: Prevent the channel configuration (sender; receiver; membership service) from being changed unless the channel is fully stopped. (markt)$$$Web applications$$$Fix: Documentation. Clarify the purpose of the maxPostSize attribute of the Connector element. (markt)$$$Fix: Avoid NPE in manager webapp displaying certificate information. (remm)$$$Other$$$Update: Update Byte Buddy to 1.17.7. (markt)$$$Update: Update Checkstyle to 11.1.0. (markt)$$$Update: Update SpotBugs to 4.9.6. (markt)$$$Update: Update Jsign to 7.2. (markt)$$$Add: Improvements to Russian translations provided by usmazat. (markt)$$$Add: Improvements to French translations. (remm)$$$Add: Improvements to Japanese translations provided by tak7iji. (markt)$$$Update: Minor refactoring in JULI loggers. Patch provided by minjund. (schultz)

Tomcat 11.0.12 (markt)$$$Catalina$$$Update: Change the digest used to calculate strong ETags (if enabled) for the default Servlet from SHA-1 to SHA-256 to align with the recommendation in RFC 9110 that hash functions used to generate strong ETags should be collision resistant. (markt)$$$Fix: HTTP methods are case-sensitive so always use case sensitive comparisons when comparing HTTP methods. (markt)$$$Fix: 69814: Ensure that HttpSession.isNew() returns false once the client has joined the session. (markt)$$$Fix: Further performance improvements for ParameterMap. (jengebr/markt)$$$Code: Refactor access log time stamps to be based on the Instant request processing starts. (markt)$$$Fix: Fix a case-sensitivity issue in the trailer header allow list. (markt)$$$Fix: Be proactive in cleaning up temporary files after a failed multi-part upload rather than waiting for GC to do it. (markt)$$$Coyote$$$Update: Add specific certificate selection code for TLS 1.3 supporting post quantum cryptography. Certificates defined with type MLDSA will be selected depending on the TLS client hello. (remm)$$$Update: Add groups attribute on SSLHostConfig allowing to restrict which groups can be enabled on the SSL engine. (remm)$$$Add: Optimize the conversion of HTTP method from byte form to String form. (markt)$$$Fix: Store HTTP request headers using the original case for the header name rather than forcing it to lower case. (markt)$$$Cluster$$$Fix: Prevent the channel configuration (sender; receiver; membership service) from being changed unless the channel is fully stopped. (markt)$$$Web applications$$$Fix: Documentation. Clarify the purpose of the maxPostSize attribute of the Connector element. (markt)$$$Fix: Avoid NPE in manager webapp displaying certificate information. (remm)$$$Other$$$Update: Update Byte Buddy to 1.17.7. (markt)$$$Update: Update Checkstyle to 11.1.0. (markt)$$$Update: Update SpotBugs to 4.9.6. (markt)$$$Update: Update Jsign to 7.2. (markt)$$$Add: Improvements to Russian translations provided by usmazat. (markt)$$$Add: Improvements to French translations. (remm)$$$Add: Improvements to Japanese translations provided by tak7iji. (markt)$$$Update: Minor refactoring in JULI loggers. Patch provided by minjund. (schultz)

Apache Tomcat 11$$$Version 11.0.11; Sep 1 2025$$$$$$Changelog$$$Tomcat 11.0.11 (markt)$$$Catalina$$$Code: Remove a number of unnecessary packages from the catalina-deployer.jar. (markt)$$$Fix: 69781: Fix concurrent access issues in the session FileStore implementation that were causing lost sessions when the store was used with the PersistentValve. Based on pull request #882 by Aaron Ogburn. (markt)$$$Code: Refactor WebResource locking to use the new KeyedReentrantReadWriteLock. (markt)$$$Fix: Fix handling of QSA and QSD flags in RewriteValve. (markt)$$$Coyote$$$Fix: 69762: Additional overflow fix for HPACK decoding of integers. Pull request #880 by Chenjp. (markt)$$$Fix: Ensure keys are handed out to OpenSSL even if PEMFile fails to process it; with appropriate logging. (remm)$$$Fix: Add new ML-DSA key algorithm to PEMFile and improve reporting when reading a key fails. (remm)$$$Fix: Fix possible early timeouts for network operations caused by a spurious wake-up of a waiting thread. Found by Coverity Scan. (markt)$$$Cluster$$$Fix: Handle spurious wake-ups during leader election for NonBlockingCoordinator. (markt)$$$Fix: Handle spurious wake-ups during sending of messages by RpcChannel. (markt)$$$Other$$$Code: Review logging and include the full stack trace and exception message by default rather then just the exception message when logging an error or warning in response to an exception. (markt)$$$Add: Add escaping to log formatters to align with JSON formatter. (markt)$$$Update: Update Checkstyle to 11.0.0. (markt)

Apache Tomcat 11$$$Version 11.0.11; Sep 1 2025$$$$$$Changelog$$$Tomcat 11.0.11 (markt)$$$Catalina$$$Code: Remove a number of unnecessary packages from the catalina-deployer.jar. (markt)$$$Fix: 69781: Fix concurrent access issues in the session FileStore implementation that were causing lost sessions when the store was used with the PersistentValve. Based on pull request #882 by Aaron Ogburn. (markt)$$$Code: Refactor WebResource locking to use the new KeyedReentrantReadWriteLock. (markt)$$$Fix: Fix handling of QSA and QSD flags in RewriteValve. (markt)$$$Coyote$$$Fix: 69762: Additional overflow fix for HPACK decoding of integers. Pull request #880 by Chenjp. (markt)$$$Fix: Ensure keys are handed out to OpenSSL even if PEMFile fails to process it; with appropriate logging. (remm)$$$Fix: Add new ML-DSA key algorithm to PEMFile and improve reporting when reading a key fails. (remm)$$$Fix: Fix possible early timeouts for network operations caused by a spurious wake-up of a waiting thread. Found by Coverity Scan. (markt)$$$Cluster$$$Fix: Handle spurious wake-ups during leader election for NonBlockingCoordinator. (markt)$$$Fix: Handle spurious wake-ups during sending of messages by RpcChannel. (markt)$$$Other$$$Code: Review logging and include the full stack trace and exception message by default rather then just the exception message when logging an error or warning in response to an exception. (markt)$$$Add: Add escaping to log formatters to align with JSON formatter. (markt)$$$Update: Update Checkstyle to 11.0.0. (markt)

Apache Tomcat 11$$$Version 11.0.11; Sep 1 2025$$$$$$Changelog$$$Tomcat 11.0.11 (markt)$$$Catalina$$$Code: Remove a number of unnecessary packages from the catalina-deployer.jar. (markt)$$$Fix: 69781: Fix concurrent access issues in the session FileStore implementation that were causing lost sessions when the store was used with the PersistentValve. Based on pull request #882 by Aaron Ogburn. (markt)$$$Code: Refactor WebResource locking to use the new KeyedReentrantReadWriteLock. (markt)$$$Fix: Fix handling of QSA and QSD flags in RewriteValve. (markt)$$$Coyote$$$Fix: 69762: Additional overflow fix for HPACK decoding of integers. Pull request #880 by Chenjp. (markt)$$$Fix: Ensure keys are handed out to OpenSSL even if PEMFile fails to process it; with appropriate logging. (remm)$$$Fix: Add new ML-DSA key algorithm to PEMFile and improve reporting when reading a key fails. (remm)$$$Fix: Fix possible early timeouts for network operations caused by a spurious wake-up of a waiting thread. Found by Coverity Scan. (markt)$$$Cluster$$$Fix: Handle spurious wake-ups during leader election for NonBlockingCoordinator. (markt)$$$Fix: Handle spurious wake-ups during sending of messages by RpcChannel. (markt)$$$Other$$$Code: Review logging and include the full stack trace and exception message by default rather then just the exception message when logging an error or warning in response to an exception. (markt)$$$Add: Add escaping to log formatters to align with JSON formatter. (markt)$$$Update: Update Checkstyle to 11.0.0. (markt)

Changelog$$$Tomcat 11.0.10 (markt)$$$Catalina$$$Fix: Fix bloom filter population for archive indexing when using a packed WAR containing one or more JAR files. (markt)$$$Coyote$$$Fix: 69748: Add missing call to set keep-alive timeout when using HTTP/1.1 following an async request; which was present for AJP. (remm/markt)$$$Fix: 69762: Fix possible overflow during HPACK decoding of integers. Note that the maximum permitted value of an HPACK decoded integer is Integer.MAX_VALUE. (markt)$$$Fix: Update the HTTP/2 overhead documentation - particularly the code comments - to reflect the deprecation of the PRIORITY frame and clarify that a stream reset always triggers an overhead increase. (markt)$$$Cluster$$$Update: Add enableStatistics configuration attribute for the DeltaManager; defaulting to true. (remm)$$$WebSocket$$$Fix: Align the WebSocket extension handling for WebSocket client connections with WebSocket server connections. The WebSocket client now only includes an extension requested by an endpoint in the opening handshake if the WebSocket client supports that extension. (markt)$$$Web applications$$$Fix: Manager and Host Manager. Provide the Manager and Host Manager web applications with a dedicated favicon file rather than using the one from the ROOT web application which might not be present or may represent something entirely different. Pull requests #876 and #878 by Simon Arame.$$$Other$$$Update: Update Checkstyle to 10.26.1. (markt)$$$Add: Improvements to French translations. (remm)$$$Add: Improvements to Japanese translations by tak7iji. (markt)

Changelog$$$Tomcat 11.0.10 (markt)$$$Catalina$$$Fix: Fix bloom filter population for archive indexing when using a packed WAR containing one or more JAR files. (markt)$$$Coyote$$$Fix: 69748: Add missing call to set keep-alive timeout when using HTTP/1.1 following an async request; which was present for AJP. (remm/markt)$$$Fix: 69762: Fix possible overflow during HPACK decoding of integers. Note that the maximum permitted value of an HPACK decoded integer is Integer.MAX_VALUE. (markt)$$$Fix: Update the HTTP/2 overhead documentation - particularly the code comments - to reflect the deprecation of the PRIORITY frame and clarify that a stream reset always triggers an overhead increase. (markt)$$$Cluster$$$Update: Add enableStatistics configuration attribute for the DeltaManager; defaulting to true. (remm)$$$WebSocket$$$Fix: Align the WebSocket extension handling for WebSocket client connections with WebSocket server connections. The WebSocket client now only includes an extension requested by an endpoint in the opening handshake if the WebSocket client supports that extension. (markt)$$$Web applications$$$Fix: Manager and Host Manager. Provide the Manager and Host Manager web applications with a dedicated favicon file rather than using the one from the ROOT web application which might not be present or may represent something entirely different. Pull requests #876 and #878 by Simon Arame.$$$Other$$$Update: Update Checkstyle to 10.26.1. (markt)$$$Add: Improvements to French translations. (remm)$$$Add: Improvements to Japanese translations by tak7iji. (markt)

Changelog$$$Tomcat 11.0.9 (markt)$$$Catalina$$$Fix: Ensure application configured welcome files override the defaults when configuring an embedded web application programmatically. (markt)$$$Update: Optimize Request#getCharsetHolder to avoid repeated parsing when charset is null. Patch provided by morning-gu. (schultz)$$$Fix: Allow the default servlet to set the content length when the content length is known; no content has been written and a Writer is being used. (markt)$$$Fix: 69717: Correct a regression in the fix for CVE-2025-49125 that prevented access to PreResources and PostResources when mounted below the web application root with a path that was terminated with a file separator. (remm/markt)$$$Fix: 69731: Fix an issue that meant that the value of maxParameterCount applied was smaller than intended for multipart uploads with non-file parts when the parts were processed before query string parameters. (markt)$$$Fix: Align size tracking for multipart requests with FileUploads use of long. (schultz)$$$Coyote$$$Fix: 69710: Increase the default for maxPartCount from 10 to 50. Update the documentation to provide more details on the memory requirements to support multi-part uploads while avoiding a denial of service risk. (markt)$$$Fix: 69713: Correctly handle an HTTP/2 data frame that includes padding when the headers include a content-length. (remm/markt)$$$Fix: Correctly collect statistics for HTTP/2 requests and avoid counting one request multiple times. Based on pull request #868 by qingdaoheze. (markt)$$$Fix: Fix JMX value for keepAliveCount on the endpoint. Also add the value of useVirtualThreads in JMX. (remm)$$$Fix: 69728: Remove incorrect warning when HTTP/2 is used with optional certificate verification and improve the warnings when a web application tries to use CLIENT-CERT with either HTTP/2 or a JSSE implementation of TLS 1.3. (markt)$$$Fix: When setting the initial HTTP/2 connection limit; apply those limits earlier. (markt)$$$Jasper$$$Code: Remove IMPL_OBJ_START from EL grammar for IDENTIFIER. (markt)$$$Code: Remove the INSTANCEOF and FUNCTIONSUFFIX definitions from the EL grammar as both are unused. (markt)$$$Web applications$$$Add: Documentation. Provide more explicit guidance regarding the security considerations for enabling write access to the web application via WebDAV; HTTP PUT requests or similar. (markt)$$$Add: Documentation. Add a section on reverse proxies to the security considerations page. (markt)$$$Other$$$Update: Update to the Eclipse JDT compiler 4.36. (markt)$$$Update: Update UnboundID to 7.0.3. (markt)$$$Update: Update Checkstyle to 10.25.1. (markt)$$$Update: Improvements to French translations. (remm)$$$Update: Improvements to Japanese translations provided by tak7iji. (markt)

Changelog$$$Tomcat 11.0.9 (markt)$$$Catalina$$$Fix: Ensure application configured welcome files override the defaults when configuring an embedded web application programmatically. (markt)$$$Update: Optimize Request#getCharsetHolder to avoid repeated parsing when charset is null. Patch provided by morning-gu. (schultz)$$$Fix: Allow the default servlet to set the content length when the content length is known; no content has been written and a Writer is being used. (markt)$$$Fix: 69717: Correct a regression in the fix for CVE-2025-49125 that prevented access to PreResources and PostResources when mounted below the web application root with a path that was terminated with a file separator. (remm/markt)$$$Fix: 69731: Fix an issue that meant that the value of maxParameterCount applied was smaller than intended for multipart uploads with non-file parts when the parts were processed before query string parameters. (markt)$$$Fix: Align size tracking for multipart requests with FileUploads use of long. (schultz)$$$Coyote$$$Fix: 69710: Increase the default for maxPartCount from 10 to 50. Update the documentation to provide more details on the memory requirements to support multi-part uploads while avoiding a denial of service risk. (markt)$$$Fix: 69713: Correctly handle an HTTP/2 data frame that includes padding when the headers include a content-length. (remm/markt)$$$Fix: Correctly collect statistics for HTTP/2 requests and avoid counting one request multiple times. Based on pull request #868 by qingdaoheze. (markt)$$$Fix: Fix JMX value for keepAliveCount on the endpoint. Also add the value of useVirtualThreads in JMX. (remm)$$$Fix: 69728: Remove incorrect warning when HTTP/2 is used with optional certificate verification and improve the warnings when a web application tries to use CLIENT-CERT with either HTTP/2 or a JSSE implementation of TLS 1.3. (markt)$$$Fix: When setting the initial HTTP/2 connection limit; apply those limits earlier. (markt)$$$Jasper$$$Code: Remove IMPL_OBJ_START from EL grammar for IDENTIFIER. (markt)$$$Code: Remove the INSTANCEOF and FUNCTIONSUFFIX definitions from the EL grammar as both are unused. (markt)$$$Web applications$$$Add: Documentation. Provide more explicit guidance regarding the security considerations for enabling write access to the web application via WebDAV; HTTP PUT requests or similar. (markt)$$$Add: Documentation. Add a section on reverse proxies to the security considerations page. (markt)$$$Other$$$Update: Update to the Eclipse JDT compiler 4.36. (markt)$$$Update: Update UnboundID to 7.0.3. (markt)$$$Update: Update Checkstyle to 10.25.1. (markt)$$$Update: Improvements to French translations. (remm)$$$Update: Improvements to Japanese translations provided by tak7iji. (markt)

Tomcat 11.0.8 (markt)$$$Catalina$$$Fix: Add support for the java:module namespace which mirrors the java:comp namespace. (markt)$$$Fix: 69690: Calling HttpServletRequest.getParameter() and related methods for a request with content type multipart/form-data when the mapped servlet does not have a @MultipartConfig or equivalent should not trigger an exception. Note that calling getPart() or getParts() is these circumstances will trigger an exception. (markt)$$$Fix: Support parsing of multiple path parameters separated by ; in a single URL segment. Based on pull request #860 by Chenjp. (markt)$$$Fix: 69699: Encode redirect URL used by the rewrite valve with the session id if appropriate; and handle cross context with different session configuration when using rewrite. (remm)$$$Add: #863: Add support for comments at the end of lines in text rewrite map files to align behaviour with Apache httpd. Pull request provided by Chenjp. (markt)$$$Fix: 69706: Fix saved request serialization issue in FORM introduced when allowing infinite session timeouts. (remm)$$$Fix: Expand the path checks for Pre-Resources and Post-Resources mounted at a path within the web application. (markt)

Tomcat 11.0.8 (markt)$$$Catalina$$$Fix: Add support for the java:module namespace which mirrors the java:comp namespace. (markt)$$$Fix: 69690: Calling HttpServletRequest.getParameter() and related methods for a request with content type multipart/form-data when the mapped servlet does not have a @MultipartConfig or equivalent should not trigger an exception. Note that calling getPart() or getParts() is these circumstances will trigger an exception. (markt)$$$Fix: Support parsing of multiple path parameters separated by ; in a single URL segment. Based on pull request #860 by Chenjp. (markt)$$$Fix: 69699: Encode redirect URL used by the rewrite valve with the session id if appropriate; and handle cross context with different session configuration when using rewrite. (remm)$$$Add: #863: Add support for comments at the end of lines in text rewrite map files to align behaviour with Apache httpd. Pull request provided by Chenjp. (markt)$$$Fix: 69706: Fix saved request serialization issue in FORM introduced when allowing infinite session timeouts. (remm)$$$Fix: Expand the path checks for Pre-Resources and Post-Resources mounted at a path within the web application. (markt)

Tomcat 11.0.7 (markt)$$$Catalina$$$Fix: Process possible path parameters rewrite production in the rewrite valve. (remm)$$$Add: 69588: Enable allowLinking to be set on PreResources; JarResources and PostResources. If not set explicitly; the setting will be inherited from the Resources. (markt)$$$Fix: 69633: Add support for Filters using context root mappings. (markt)$$$Fix: 69643: Optimize directory listing for large amount of files. Patch submitted by Loic de lEprevier. (remm)$$$Fix: #843: Fix off by one validation logic for partial PUT ranges and associated test case. Submitted by Chenjp. (remm)$$$Code: Refactor GCI servlet to access resources via the WebResource API. (markt)$$$Fix: 69662: Report name in exception message when a naming lookup failure occurs. Based on code submitted by Donald Smith. (remm)$$$Fix: Ensure that the FORM authentication attribute authenticationSessionTimeout works correctly when sessions have an infinite timeout when authentication starts. (markt)$$$Add: Provide a content type based on file extension when web application resources are accessed via a URL. (markt)$$$Jasper$$$Fix: 69635: Add support to jakarta.el.ImportHandler for resolving inner classes. (markt)$$$Add: #842Add support for optimized execution of c:set and c:remove tags; when activated via JSP servlet param useNonstandardTagOptimizations. (jengebr)$$$Fix: Fix an edge case compilation bug for JSP and tag files on case insensitive file systems that was exposed by the test case for 69635. (markt)$$$Web applications$$$Fix: 68876: Documentation. Update the UML diagrams for server start-up; request processing and authentication using PlantUML and include the source files for each diagram. (markt)$$$Other$$$Update: Update Jacoco to 0.8.13. (remm)$$$Add: Explicitly set the locale to be used for Javadoc. For official releases; this locale will be English (US) to support reproducible builds. (schultz)$$$Update: Update Byte Buddy to 1.17.5. (markt)$$$Update: Update Checkstyle to 10.23.1. (markt)$$$Update: Update file extension to media type mappings to align with the current list used by the Apache Web Server (httpd). (markt)$$$Update: Improvements to French translations. (remm)$$$Update: Improvements to Japanese translations provided by tak7iji. (markt)

The notable changes in this release are:$$$$$$Remove the requirement that an MD5 implementation must be provided by JRE.$$$Improve the handling of %nn URL encoding in the RewriteValve$$$Various improvements to the JsonErrorReportValve$$$$$$Full details of these changes; and all the other changes; are available in the Tomcat 11 changelog - https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.6_(markt)

Tomcat 11.0.5 (markt)$$$Catalina$$$Fix: When looking up class loader resources by resource name; the resource name should not start with /. If the resource name does start with /; Tomcat is lenient and looks it up as if the / was not present. When the web application class loader was configured with external repositories and names starting with / were used for lookups; it was possible that cached not found results could effectively hide lookup results using the correct resource name. (markt)$$$Fix: Enable the JNDIRealm to validate credentials provided to HttpServletRequest.login(String username; String password) when the realm is configured to use GSSAPI authentication. (markt)$$$Fix: Improve the checks for exposure to and protection against CVE-2024-56337 so that reflection is not used unless required. The checks for whether the file system is case sensitive or not have been removed. (markt)$$$Fix: Fix a bug in the JRE compatibility detection that incorrectly identified Java 19 and Java 20 as supporting Java 21 features. (markt)$$$Add: Add support for logging the connection ID (as returned by ServletRequest.getServletConnection().getConnectionId()) with the AccessLogValve and ExtendedAccessLogValve. Based on pull request #814 by Dmole. (markt)$$$Fix: Avoid scenarios where temporary files used for partial PUT would not be deleted. (remm)

Tomcat 11.0.4 (markt)$$$Catalina$$$Fix: 69576: Avoid possible failure intializing JreCompat due to uncaught exception introduced for the check for CVE-2024-56337. (remm)$$$Other$$$Add: Add org.apache.juli.JsonFormatter to format log as one line JSON documents. (remm)

Tomcat 11.0.2 Released$$$The Apache Tomcat Project is proud to announce the release of version 11.0.2 of Apache Tomcat. This release implements specifications that are part of the Jakarta EE 11 platform.$$$$$$Users of Tomcat 10 onwards should be aware that; as a result of the move from Java EE to Jakarta EE as part of the transfer of Java EE to the Eclipse Foundation; the primary package for all implemented APIs has changed from javax.* to jakarta.*. This will almost certainly require code changes to enable applications to migrate from Tomcat 9 and earlier to Tomcat 10 and later. A migration tool is available to aid this process.$$$$$$The notable changes in this release are:$$$$$$Add strong ETag support for the WebDAV and default servlet; which can be enabled by using the useStrongETags init parameter with a value set to true. The ETag generated will be a SHA-1 checksum of the resource content.$$$Add support for RateLimit header fields for HTTP (RFC draft) in the RateLimitFilter. Based on pull request #775 provided by Chenjp.$$$Update Tomcats fork of Commons DBCP to 2.13.0.

Tomcat 11.0.1 Released$$$The Apache Tomcat Project is proud to announce the release of version 11.0.1 of Apache Tomcat. This release implements specifications that are part of the Jakarta EE 11 platform.$$$$$$Users of Tomcat 10 onwards should be aware that; as a result of the move from Java EE to Jakarta EE as part of the transfer of Java EE to the Eclipse Foundation; the primary package for all implemented APIs has changed from javax.* to jakarta.*. This will almost certainly require code changes to enable applications to migrate from Tomcat 9 and earlier to Tomcat 10 and later. A migration tool is available to aid this process.$$$$$$The notable changes in this release are:$$$$$$Fix a regression caused by the improvement 69333 which caused the tag release to be called when using tag pooling; and to be skipped when not using it. Patch submitted by Michal Sobkiewicz.$$$Further WebDAV fixes and improvements.$$$Restore providing a value (rather than null) for Class.getProtectionDomain().getCodeSource().getLocation() as a number of libraries and JRE features depend on this being non-null even when a SecurityManager is not in use.$$$Full details of these changes; and all the other changes; are available in the Tomcat 11 changelog.

Tomcat 11.0.1 Released$$$The Apache Tomcat Project is proud to announce the release of version 11.0.1 of Apache Tomcat. This release implements specifications that are part of the Jakarta EE 11 platform.$$$$$$Users of Tomcat 10 onwards should be aware that; as a result of the move from Java EE to Jakarta EE as part of the transfer of Java EE to the Eclipse Foundation; the primary package for all implemented APIs has changed from javax.* to jakarta.*. This will almost certainly require code changes to enable applications to migrate from Tomcat 9 and earlier to Tomcat 10 and later. A migration tool is available to aid this process.$$$$$$The notable changes in this release are:$$$$$$Fix a regression caused by the improvement 69333 which caused the tag release to be called when using tag pooling; and to be skipped when not using it. Patch submitted by Michal Sobkiewicz.$$$Further WebDAV fixes and improvements.$$$Restore providing a value (rather than null) for Class.getProtectionDomain().getCodeSource().getLocation() as a number of libraries and JRE features depend on this being non-null even when a SecurityManager is not in use.$$$Full details of these changes; and all the other changes; are available in the Tomcat 11 changelog.

Tomcat 11.0.1 Released$$$The Apache Tomcat Project is proud to announce the release of version 11.0.1 of Apache Tomcat. This release implements specifications that are part of the Jakarta EE 11 platform.$$$$$$Users of Tomcat 10 onwards should be aware that; as a result of the move from Java EE to Jakarta EE as part of the transfer of Java EE to the Eclipse Foundation; the primary package for all implemented APIs has changed from javax.* to jakarta.*. This will almost certainly require code changes to enable applications to migrate from Tomcat 9 and earlier to Tomcat 10 and later. A migration tool is available to aid this process.$$$$$$The notable changes in this release are:$$$$$$Fix a regression caused by the improvement 69333 which caused the tag release to be called when using tag pooling; and to be skipped when not using it. Patch submitted by Michal Sobkiewicz.$$$Further WebDAV fixes and improvements.$$$Restore providing a value (rather than null) for Class.getProtectionDomain().getCodeSource().getLocation() as a number of libraries and JRE features depend on this being non-null even when a SecurityManager is not in use.$$$Full details of these changes; and all the other changes; are available in the Tomcat 11 changelog.

Tomcat 11.0.1 Released$$$The Apache Tomcat Project is proud to announce the release of version 11.0.1 of Apache Tomcat. This release implements specifications that are part of the Jakarta EE 11 platform.$$$$$$Users of Tomcat 10 onwards should be aware that; as a result of the move from Java EE to Jakarta EE as part of the transfer of Java EE to the Eclipse Foundation; the primary package for all implemented APIs has changed from javax.* to jakarta.*. This will almost certainly require code changes to enable applications to migrate from Tomcat 9 and earlier to Tomcat 10 and later. A migration tool is available to aid this process.$$$$$$The notable changes in this release are:$$$$$$Fix a regression caused by the improvement 69333 which caused the tag release to be called when using tag pooling; and to be skipped when not using it. Patch submitted by Michal Sobkiewicz.$$$Further WebDAV fixes and improvements.$$$Restore providing a value (rather than null) for Class.getProtectionDomain().getCodeSource().getLocation() as a number of libraries and JRE features depend on this being non-null even when a SecurityManager is not in use.$$$Full details of these changes; and all the other changes; are available in the Tomcat 11 changelog.

2024-10-09Tomcat 11.0.0 Released$$$The Apache Tomcat Project is proud to announce the release of version 11.0.0 of Apache Tomcat. This release is targeted at Jakarta EE 11.$$$$$$Users of Tomcat 10 onwards should be aware that; as a result of the move from Java EE to Jakarta EE as part of the transfer of Java EE to the Eclipse Foundation; the primary package for all implemented APIs has changed from javax.* to jakarta.*. This will almost certainly require code changes to enable applications to migrate from Tomcat 9 and earlier to Tomcat 10 and later. A migration tool is available to aid this process.$$$$$$The notable changes in this release are:$$$$$$Multiple fixes and improvements for WebDAV$$$Improvements to the recently adding request/response recycling for HTTP/2$$$Improve the stability of Tomcat Native during GC$$$Full details of these changes; and all the other changes; are available in the Tomcat 11 changelog.