EOL of servelet-api

["Madhu Mitha (EXT-Nokia)" <ma...@nokia.com.INVALID>]

Hi,

I'm currently using Apache Tomcat 9.0.86, in my component(JOMA) that runs in RHEL 8.6.
Customer has triggered security scan and found servlet-api.jar has reached EOL in 2018 and the recommendation is to migrate to Jakarta-servelet-api.jar.

So, when can we expect the changes from Tomcat. Unless or until you change this, I cannot deploy in my component.

Please reply with the timeline on the availability of this, or any alternate way to mitigate this.

Thanks and Regards,
Madhu

RE: EOL of servelet-api

["Madhu Mitha (EXT-Nokia)" <ma...@nokia.com.INVALID>]

Hi Mark,

We have done research as well before reaching you. Tomcat 10.x series is designed to run on JAVA 11 or later, but we are in JAVA 8 environment. Hence for clarification raised mail.

Thanks,
Madhu

-----Original Message-----
From: Mark Thomas <ma...@apache.org> 
Sent: Wednesday, June 12, 2024 3:36 PM
To: users@tomcat.apache.org
Subject: Re: EOL of servelet-api

[You don't often get email from markt@apache.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

CAUTION: This is an external email. Please be very careful when clicking links or opening attachments. See the URL nok.it/ext for additional information.



On 12/06/2024 10:54, Madhu Mitha (EXT-Nokia) wrote:
> Hi,
>
> I'm currently using Apache Tomcat 9.0.86, in my component(JOMA) that runs in RHEL 8.6.
> Customer has triggered security scan and found servlet-api.jar has reached EOL in 2018 and the recommendation is to migrate to Jakarta-servelet-api.jar.

You need to get a better security scanner. That statement is nonsense for Tomcat 9. The servlet-api.jar provided with Tomcat 9.0.x is currently supported and will continue to be supported for as long as Tomcat 9.0.x is supported.

> So, when can we expect the changes from Tomcat. Unless or until you change this, I cannot deploy in my component.

If you had bothered to do even a minimal amount of research you would know that Tomcat 10.x is already available (and has been for over 3.5
years) with Jakarta EE support.

> Please reply with the timeline on the availability of this, or any alternate way to mitigate this.

See above.

Mark

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: EOL of servelet-api

[Mark Thomas <ma...@apache.org>]

On 12/06/2024 10:54, Madhu Mitha (EXT-Nokia) wrote:
> Hi,
> 
> I'm currently using Apache Tomcat 9.0.86, in my component(JOMA) that runs in RHEL 8.6.
> Customer has triggered security scan and found servlet-api.jar has reached EOL in 2018 and the recommendation is to migrate to Jakarta-servelet-api.jar.

You need to get a better security scanner. That statement is nonsense 
for Tomcat 9. The servlet-api.jar provided with Tomcat 9.0.x is 
currently supported and will continue to be supported for as long as 
Tomcat 9.0.x is supported.

> So, when can we expect the changes from Tomcat. Unless or until you change this, I cannot deploy in my component.

If you had bothered to do even a minimal amount of research you would 
know that Tomcat 10.x is already available (and has been for over 3.5 
years) with Jakarta EE support.

> Please reply with the timeline on the availability of this, or any alternate way to mitigate this.

See above.

Mark

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org