[jira] [Commented] (AXIS2-6090) Tomcat Version too high?

["Christian Ortlepp (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/AXIS2-6090?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17941460#comment-17941460 ] 

Christian Ortlepp commented on AXIS2-6090:
------------------------------------------

Hm. This is definitely something we should look into, until very recently tomcat 11 was actually still in alpha and I agree that we probably shouldn't ship alpha versions. Not sure when exactly we should do tomcat/jakarta updates, but it should probably be a manual & conscious decision each time. Just to decide on how to proceed here, does our dependency on tomcat 11 cause problems for you (right now) or did you just notice it as odd? If it doesn't cause immediate problems I think we maybe shouldn't downgrade to tomcat 10 again, because that could cause problems for people too.

 

For the future I'd suggest that we
 * instruct dependabot to only do minor tomcat updates
 * put the jakarta ee bom into the root DependencyManagement and also fix its version in dependabot

 

Would that resolve this issue for you?

> Tomcat Version too high?
> ------------------------
>
>                 Key: AXIS2-6090
>                 URL: https://issues.apache.org/jira/browse/AXIS2-6090
>             Project: Axis2
>          Issue Type: Bug
>    Affects Versions: 2.0.0
>            Reporter: Jeff Thomas
>            Priority: Major
>
> I *think* Axis2 is getting ahead of itself with regards to the Tomcat dependency.
> In this PR ([https://github.com/apache/axis-axis2-java-core/pull/866)] the level of the tomcat library was bumped to 11.0.5.
> Tomcat 11 uses the baseline described here:
> [https://tomcat.apache.org/whichversion.html]
> This includes the Jakarta Servlet 6.1 API, JSP 4.0, ... and requires Java 17 or higher.
> From the tomcat landing page:
> "The Apache Tomcat Project is proud to announce the release of version 11.0.5 of Apache Tomcat. This release implements specifications that are part of the Jakarta EE 11 platform."
> The most current spring boot version is still only supporting Jakarta EE 10 and uses Tomcat 10.*
> *EDIT* More info about the migration from 10 to 11 - significantly the removal of SecurityManager code *and* the ability to configure a security manager in tomcat:
> https://tomcat.apache.org/migration-11.0.html
>  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: java-dev-unsubscribe@axis.apache.org
For additional commands, e-mail: java-dev-help@axis.apache.org