You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Rémy Maucherat <re...@apache.org> on 2026/03/16 15:26:53 UTC
[VOTE] Release Apache Tomcat 9.0.116
The proposed Apache Tomcat 9.0.116 release is now available for voting.
The notable changes compared to 9.0.115 are:
- Relax HTTP/2 header validation and respond to invalid requests with
a stream reset or a 400 response as appropriate rather then with a
connection reset.
- Fix bug 69964: Respect the configured cipher order, which was no
longer respected following the addition of TLS 1.3 specific cipher
configuration. TLS 1.3 ciphers will always be first in the list.
- Update Tomcat Native to 1.3.7 / 2.0.14 and increase the recommended
version to 1.3.7 / 2.0.14
For full details, see the changelog:
https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
It can be obtained from:
https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.116/
The Maven staging repo is:
https://repository.apache.org/content/repositories/orgapachetomcat-1583
The tag is:
https://github.com/apache/tomcat/tree/9.0.116
d2c7dce5e94d6d1d81ad7d66402140b1c1962a53
The proposed 9.0.116 release is:
[ ] -1, Broken - do not release
[ ] +1, Stable - go ahead and release as 9.0.116
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[VOTE][RESULT] Release Apache Tomcat 9.0.116
Posted by Rémy Maucherat <re...@apache.org>.
The following votes were cast:
Binding:
+1: markt, dsoumis, csutherl, schultz, rjung
The vote therefore passes.
Thanks to everyone who contributed to this release.
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.116
Posted by Dimitris Soumis <ds...@apache.org>.
On Mon, Mar 16, 2026 at 5:35 PM Rémy Maucherat <re...@apache.org> wrote:
> The proposed Apache Tomcat 9.0.116 release is now available for voting.
>
> The notable changes compared to 9.0.115 are:
>
> - Relax HTTP/2 header validation and respond to invalid requests with
> a stream reset or a 400 response as appropriate rather then with a
> connection reset.
>
> - Fix bug 69964: Respect the configured cipher order, which was no
> longer respected following the addition of TLS 1.3 specific cipher
> configuration. TLS 1.3 ciphers will always be first in the list.
>
> - Update Tomcat Native to 1.3.7 / 2.0.14 and increase the recommended
> version to 1.3.7 / 2.0.14
>
> For full details, see the changelog:
> https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.116/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1583
>
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.116
> d2c7dce5e94d6d1d81ad7d66402140b1c1962a53
>
> The proposed 9.0.116 release is:
> [ ] -1, Broken - do not release
> [X] +1, Stable - go ahead and release as 9.0.116
>
> Rémy
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
Re: [VOTE] Release Apache Tomcat 9.0.116
Posted by Rainer Jung <ra...@kippdata.de>.
Am 16.03.26 um 16:26 schrieb Rémy Maucherat:
> The proposed Apache Tomcat 9.0.116 release is now available for voting.
>
> The notable changes compared to 9.0.115 are:
>
> - Relax HTTP/2 header validation and respond to invalid requests with
> a stream reset or a 400 response as appropriate rather then with a
> connection reset.
>
> - Fix bug 69964: Respect the configured cipher order, which was no
> longer respected following the addition of TLS 1.3 specific cipher
> configuration. TLS 1.3 ciphers will always be first in the list.
>
> - Update Tomcat Native to 1.3.7 / 2.0.14 and increase the recommended
> version to 1.3.7 / 2.0.14
>
> For full details, see the changelog:
> https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.116/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1583
>
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.116
> d2c7dce5e94d6d1d81ad7d66402140b1c1962a53
>
> The proposed 9.0.116 release is:
> [ ] -1, Broken - do not release
> [X] +1, Stable - go ahead and release as 9.0.116
+1 to release.
Reproducibility of the build checked (including the Windows installer)
using "ant verify-release" on Linux Mint 22.3. OK after setting LANG.
Original Windows installer signature verified with osslsigncode 2.10.
Unit tests ran on platforms
- RHEL 7, 8, 9 and 10 and SLES 12 and 15
using
- recent patch versions of JDK 1.8.0, 11, 17, 21, 25, 26 (only OpenJDK
GA) and 27 (EA)
from
- Eclipse Adoptium, Azul Zulu, Amazon Coretto, Oracle, RedHat and
OpenJDK (for 26 and 27)
where available.
Also tested with
- tcnative 1.3.7, 2.0.14 and panama
- tcnative including post-release memory leak patches
based on
- OpenSSL 3.0.19, 3.5.5, 3.6.1 and 4.0.0-alpha1 (for tcnative 2 and panama)
- OpenSSL containing one post-release patch for 3.5 and 3.6.
Not all test runs are done yet, but by far most of them. Only some
JDK25, 26 and 27 on RHEL still need to run.
Test observations:
- IMHO none critical
- TestOcspSoftFailTryLater often fails with jsse
(any JDK version)
- For TC 11 it was only for NIO2 and either
java.net.SocketException: Broken pipe or
java.net.SocketException: Connection reset by peer
- TestOcspEnabled sometimes fails when using panama
- TestOcspEnabled sometimes fails when using tcnative and JDK21+
(no crash case)
- in addition very few sporadic failures and or crashes
(8 without crash, 19 with crash; total 1150 test runs until now)
Thanks for RM!
Best regards,
Rainer
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.116
Posted by Mark Thomas <ma...@apache.org>.
On 16/03/2026 15:26, Rémy Maucherat wrote:
> The proposed 9.0.116 release is:
> [ ] -1, Broken - do not release
> [X] +1, Stable - go ahead and release as 9.0.116
Tests passed in the following configurations:
- MacOS, Tomcat Native 1.3.7, OpenSSL 3.6.1
- Linux, Tomcat Native 1.3.7, OpenSSL 3.0.13 (Ubuntu LTS latest)
- Windows, Tomcat Native 1.3.7, OpenSSL 3.0.19
Build is cross platform (Windows/Linux) reproducible.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.116
Posted by Rémy Maucherat <re...@apache.org>.
On Tue, Mar 17, 2026 at 10:15 AM Konstantin Kolinko
<kn...@gmail.com> wrote:
>
> Remy,
>
> The files at dist.apache.org are missing.
> URL 'https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.116'
> doesn't exist
>
> (The Maven staging repository is OK.)
I forgot to run svn commit after svn add ! Fixed.
Rémy
> Best regards,
> Konstantin Kolinko
>
> пн, 16 мар. 2026 г. в 18:27, Rémy Maucherat <re...@apache.org>:
>
> >
> > The proposed Apache Tomcat 9.0.116 release is now available for voting.
> >
> > The notable changes compared to 9.0.115 are:
> >
> > - Relax HTTP/2 header validation and respond to invalid requests with
> > a stream reset or a 400 response as appropriate rather then with a
> > connection reset.
> >
> > - Fix bug 69964: Respect the configured cipher order, which was no
> > longer respected following the addition of TLS 1.3 specific cipher
> > configuration. TLS 1.3 ciphers will always be first in the list.
> >
> > - Update Tomcat Native to 1.3.7 / 2.0.14 and increase the recommended
> > version to 1.3.7 / 2.0.14
> >
> > For full details, see the changelog:
> > https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
> >
> > It can be obtained from:
> > https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.116/
> >
> > The Maven staging repo is:
> > https://repository.apache.org/content/repositories/orgapachetomcat-1583
> >
> > The tag is:
> > https://github.com/apache/tomcat/tree/9.0.116
> > d2c7dce5e94d6d1d81ad7d66402140b1c1962a53
> >
> > The proposed 9.0.116 release is:
> > [ ] -1, Broken - do not release
> > [ ] +1, Stable - go ahead and release as 9.0.116
> >
> > Rémy
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> > For additional commands, e-mail: dev-help@tomcat.apache.org
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.116
Posted by Konstantin Kolinko <kn...@gmail.com>.
Remy,
The files at dist.apache.org are missing.
URL 'https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.116'
doesn't exist
(The Maven staging repository is OK.)
Best regards,
Konstantin Kolinko
пн, 16 мар. 2026 г. в 18:27, Rémy Maucherat <re...@apache.org>:
>
> The proposed Apache Tomcat 9.0.116 release is now available for voting.
>
> The notable changes compared to 9.0.115 are:
>
> - Relax HTTP/2 header validation and respond to invalid requests with
> a stream reset or a 400 response as appropriate rather then with a
> connection reset.
>
> - Fix bug 69964: Respect the configured cipher order, which was no
> longer respected following the addition of TLS 1.3 specific cipher
> configuration. TLS 1.3 ciphers will always be first in the list.
>
> - Update Tomcat Native to 1.3.7 / 2.0.14 and increase the recommended
> version to 1.3.7 / 2.0.14
>
> For full details, see the changelog:
> https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.116/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1583
>
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.116
> d2c7dce5e94d6d1d81ad7d66402140b1c1962a53
>
> The proposed 9.0.116 release is:
> [ ] -1, Broken - do not release
> [ ] +1, Stable - go ahead and release as 9.0.116
>
> Rémy
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.116
Posted by Coty Sutherland <cs...@apache.org>.
On Mon, Mar 16, 2026 at 11:27 AM Rémy Maucherat <re...@apache.org> wrote:
> The proposed Apache Tomcat 9.0.116 release is now available for voting.
>
> The notable changes compared to 9.0.115 are:
>
> - Relax HTTP/2 header validation and respond to invalid requests with
> a stream reset or a 400 response as appropriate rather then with a
> connection reset.
>
> - Fix bug 69964: Respect the configured cipher order, which was no
> longer respected following the addition of TLS 1.3 specific cipher
> configuration. TLS 1.3 ciphers will always be first in the list.
>
> - Update Tomcat Native to 1.3.7 / 2.0.14 and increase the recommended
> version to 1.3.7 / 2.0.14
>
> For full details, see the changelog:
> https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.116/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1583
>
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.116
> d2c7dce5e94d6d1d81ad7d66402140b1c1962a53
>
> The proposed 9.0.116 release is:
> [ ] -1, Broken - do not release
> [x] +1, Stable - go ahead and release as 9.0.116
>
LGTM
>
> Rémy
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
Re: [VOTE] Release Apache Tomcat 9.0.116
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Rémy,
Thanks for RMing.
On 3/16/26 11:26 AM, Rémy Maucherat wrote:
> The proposed Apache Tomcat 9.0.116 release is now available for voting.
>
> The notable changes compared to 9.0.115 are:
>
> - Relax HTTP/2 header validation and respond to invalid requests with
> a stream reset or a 400 response as appropriate rather then with a
> connection reset.
>
> - Fix bug 69964: Respect the configured cipher order, which was no
> longer respected following the addition of TLS 1.3 specific cipher
> configuration. TLS 1.3 ciphers will always be first in the list.
>
> - Update Tomcat Native to 1.3.7 / 2.0.14 and increase the recommended
> version to 1.3.7 / 2.0.14
>
> For full details, see the changelog:
> https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.116/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1583
>
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.116
> d2c7dce5e94d6d1d81ad7d66402140b1c1962a53
>
> The proposed 9.0.116 release is:
> [ ] -1, Broken - do not release
> [ ] +1, Stable - go ahead and release as 9.0.116
+1 for stable release
The release is 100% reproducible and the unit tests all pass on MacOS
aarch64.
Details:
* Environment
* Java (build): openjdk version "25.0.2" 2026-01-20 LTS OpenJDK
Runtime Environment Temurin-25.0.2+10 (build 25.0.2+10-LTS) OpenJDK
64-Bit Server VM Temurin-25.0.2+10 (build 25.0.2+10-LTS, mixed mode,
sharing)
* Java (test): openjdk version "25.0.2" 2026-01-20 LTS OpenJDK
Runtime Environment Temurin-25.0.2+10 (build 25.0.2+10-LTS) OpenJDK
64-Bit Server VM Temurin-25.0.2+10 (build 25.0.2+10-LTS, mixed mode,
sharing)
* Ant: Apache Ant(TM) version 1.10.15 compiled on August 25
2024
* OS: Darwin 25.3.0 arm64
* cc: Apple clang version 17.0.0 (clang-1700.6.4.2)
* make: GNU Make 3.81
* OpenSSL: OpenSSL 3.6.0 1 Oct 2025 (Library: OpenSSL 3.6.0 1
Oct 2025)
* APR: 1.7.6
*
* Valid SHA-512 signature for apache-tomcat-9.0.116.zip
* Valid GPG signature for apache-tomcat-9.0.116.zip
* Valid SHA-512 signature for apache-tomcat-9.0.116.tar.gz
* Valid GPG signature for apache-tomcat-9.0.116.tar.gz
* Valid SHA-512 signature for apache-tomcat-9.0.116.exe
* Valid GPG signature for apache-tomcat-9.0.116.exe
* Valid Windows Digital Signature for apache-tomcat-9.0.116.exe
* Valid SHA512 signature for apache-tomcat-9.0.116-src.zip
* Valid GPG signature for apache-tomcat-9.0.116-src.zip
* Valid SHA512 signature for apache-tomcat-9.0.116-src.tar.gz
* Valid GPG signature for apache-tomcat-9.0.116-src.tar.gz
*
* Binary Zip and tarball: Same
* Source Zip and tarball: Same
*
* Building dependencies returned: 0
* Tomcat builds cleanly
* tcnative builds cleanly
* Junit Tests: PASSED
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org