You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Rémy Maucherat <re...@apache.org> on 2026/01/21 09:35:09 UTC
[VOTE] Release Apache Tomcat 9.0.115
The proposed Apache Tomcat 9.0.115 release is now available for voting.
The notable changes compared to 9.0.113 are:
- For configuration consistency between OpenSSL and JSSE TLS
implementations, TLSv1.3 cipher suites included in the ciphers
attribute of an SSLHostConfig are now always ignored (previously
they would be ignored with OpenSSL implementations and used with
JSSE implementations) and a warning is logged that the cipher
suite has been ignored.
- Expand OCSP support to JSSE based connections and expand OCSP
configuration options
- Update Commons Daemon to 1.5.1.
- Update Tomcat Native to 2.0.12 and increase the minimum version to
2.0.12 / 1.3.4
For full details, see the changelog:
https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
It can be obtained from:
https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.115/
The Maven staging repo is:
https://repository.apache.org/content/repositories/orgapachetomcat-1578
The tag is:
https://github.com/apache/tomcat/tree/9.0.115
fd3e7b16a7ead52f696b827178333f9a00696d25
The proposed 9.0.115 release is:
[ ] -1, Broken - do not release
[ ] +1, Stable - go ahead and release as 9.0.115
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.115
Posted by Rémy Maucherat <re...@apache.org>.
On Fri, Jan 23, 2026 at 10:53 AM Mark Thomas <ma...@apache.org> wrote:
>
> On 21/01/2026 09:35, Rémy Maucherat wrote:
>
> > The proposed 9.0.115 release is:
> > [ ] -1, Broken - do not release
> > [X] +1, Stable - go ahead and release as 9.0.115
>
> Test pass on:
> - Windows - Tomcat Native 1.3.5 + OpenSSL 3.0.18
> - MacOS - Tomcat Native 1.3.5 + OpenSSL 3.6.0
> - Linux - Tomcat Native 2.0.12 + OpenSSL 3.0.13 (Ubuntu)
>
> Build is cross-platform reproducible.
Thanks !
So since I have nothing holding the 9.0 release somehow, I'll proceed
with the release later today.
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.115
Posted by Mark Thomas <ma...@apache.org>.
On 21/01/2026 09:35, Rémy Maucherat wrote:
> The proposed 9.0.115 release is:
> [ ] -1, Broken - do not release
> [X] +1, Stable - go ahead and release as 9.0.115
Test pass on:
- Windows - Tomcat Native 1.3.5 + OpenSSL 3.0.18
- MacOS - Tomcat Native 1.3.5 + OpenSSL 3.6.0
- Linux - Tomcat Native 2.0.12 + OpenSSL 3.0.13 (Ubuntu)
Build is cross-platform reproducible.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.115
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Rémy,
Thanks for RMing.
On 1/21/26 4:35 AM, Rémy Maucherat wrote:
> The proposed Apache Tomcat 9.0.115 release is now available for voting.
>
> The notable changes compared to 9.0.113 are:
>
> - For configuration consistency between OpenSSL and JSSE TLS
> implementations, TLSv1.3 cipher suites included in the ciphers
> attribute of an SSLHostConfig are now always ignored (previously
> they would be ignored with OpenSSL implementations and used with
> JSSE implementations) and a warning is logged that the cipher
> suite has been ignored.
>
> - Expand OCSP support to JSSE based connections and expand OCSP
> configuration options
>
> - Update Commons Daemon to 1.5.1.
>
> - Update Tomcat Native to 2.0.12 and increase the minimum version to
> 2.0.12 / 1.3.4
>
> For full details, see the changelog:
> https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.115/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1578
>
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.115
> fd3e7b16a7ead52f696b827178333f9a00696d25
>
> The proposed 9.0.115 release is:
> [ ] -1, Broken - do not release
> [ ] +1, Stable - go ahead and release as 9.0.115
+1 for stable release.
The build is reproducible on MacOS aarch64 and all the unit tests pass.
Details:
* Environment
* Java (build): openjdk version "25.0.1" 2025-10-21 LTS OpenJDK
Runtime Environment Temurin-25.0.1+8 (build 25.0.1+8-LTS) OpenJDK 64-Bit
Server VM Temurin-25.0.1+8 (build 25.0.1+8-LTS, mixed mode, sharing)
* Java (test): openjdk version "25.0.1" 2025-10-21 LTS OpenJDK
Runtime Environment Temurin-25.0.1+8 (build 25.0.1+8-LTS) OpenJDK 64-Bit
Server VM Temurin-25.0.1+8 (build 25.0.1+8-LTS, mixed mode, sharing)
* Ant: Apache Ant(TM) version 1.10.15 compiled on August 25
2024
* OS: Darwin 24.6.0 arm64
* cc: Apple clang version 17.0.0 (clang-1700.6.3.2)
* make: GNU Make 3.81
* OpenSSL: OpenSSL 3.6.0 1 Oct 2025 (Library: OpenSSL 3.6.0 1
Oct 2025)
* APR: 1.7.6
*
* Valid SHA-512 signature for apache-tomcat-9.0.115.zip
* Valid GPG signature for apache-tomcat-9.0.115.zip
* Valid SHA-512 signature for apache-tomcat-9.0.115.tar.gz
* Valid GPG signature for apache-tomcat-9.0.115.tar.gz
* Valid SHA-512 signature for apache-tomcat-9.0.115.exe
* Valid GPG signature for apache-tomcat-9.0.115.exe
* Valid Windows Digital Signature for apache-tomcat-9.0.115.exe
* Valid SHA512 signature for apache-tomcat-9.0.115-src.zip
* Valid GPG signature for apache-tomcat-9.0.115-src.zip
* Valid SHA512 signature for apache-tomcat-9.0.115-src.tar.gz
* Valid GPG signature for apache-tomcat-9.0.115-src.tar.gz
*
* Binary Zip and tarball: Same
* Source Zip and tarball: Same
*
* Building dependencies returned: 0
* Tomcat builds cleanly
* tcnative builds cleanly
* Junit Tests: PASSED
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.115
Posted by Rémy Maucherat <re...@apache.org>.
On Wed, Jan 21, 2026 at 1:17 PM Dimitris Soumis <ds...@apache.org> wrote:
>
> On Wed, Jan 21, 2026 at 11:42 AM Rémy Maucherat <re...@apache.org> wrote:
>
> > The proposed Apache Tomcat 9.0.115 release is now available for voting.
> >
> > The notable changes compared to 9.0.113 are:
> >
> > - For configuration consistency between OpenSSL and JSSE TLS
> > implementations, TLSv1.3 cipher suites included in the ciphers
> > attribute of an SSLHostConfig are now always ignored (previously
> > they would be ignored with OpenSSL implementations and used with
> > JSSE implementations) and a warning is logged that the cipher
> > suite has been ignored.
> >
> > - Expand OCSP support to JSSE based connections and expand OCSP
> > configuration options
> >
> > - Update Commons Daemon to 1.5.1.
> >
> > - Update Tomcat Native to 2.0.12 and increase the minimum version to
> > 2.0.12 / 1.3.4
> >
> > For full details, see the changelog:
> > https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
> >
> > It can be obtained from:
> > https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.115/
> >
> > The Maven staging repo is:
> > https://repository.apache.org/content/repositories/orgapachetomcat-1578
> >
> > The tag is:
> > https://github.com/apache/tomcat/tree/9.0.115
> > fd3e7b16a7ead52f696b827178333f9a00696d25
> >
> > The proposed 9.0.115 release is:
> > [ ] -1, Broken - do not release
> > [ ] +1, Stable - go ahead and release as 9.0.115
> >
> > Rémy
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> > For additional commands, e-mail: dev-help@tomcat.apache.org
> >
> >
> I am getting the same signature mismatch as in 11.0.16 when trying to
> reproduce the build.
> Tests pass on Fedora 43 with Java 25, tcnative-1.3.5, apr-1.7.6,
> openssl-3.5.4.
I'm also building on Fedora 43 (from the .release file) and so even if
there's a cross platform build issue it is not the expected result.
# OS: amd64 Linux 6.18.5-200.fc43.x86_64
# File encoding: UTF-8
#
# Release Manager: remm
release-java-version=25.0.1+8-LTS
release-ant-version=1.10.15
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.115
Posted by Mark Thomas <ma...@apache.org>.
On 21/01/2026 12:16, Dimitris Soumis wrote:
<snip/>
> I am getting the same signature mismatch as in 11.0.16 when trying to
> reproduce the build.
> Tests pass on Fedora 43 with Java 25, tcnative-1.3.5, apr-1.7.6,
> openssl-3.5.4.
I've tested with latest Ubuntu 24.04 and Windows 2025 server and get
100% reproducibility with each.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.115
Posted by Dimitris Soumis <ds...@apache.org>.
On Wed, Jan 21, 2026 at 2:16 PM Dimitris Soumis <ds...@apache.org> wrote:
> On Wed, Jan 21, 2026 at 11:42 AM Rémy Maucherat <re...@apache.org> wrote:
>
>> The proposed Apache Tomcat 9.0.115 release is now available for voting.
>>
>> The notable changes compared to 9.0.113 are:
>>
>> - For configuration consistency between OpenSSL and JSSE TLS
>> implementations, TLSv1.3 cipher suites included in the ciphers
>> attribute of an SSLHostConfig are now always ignored (previously
>> they would be ignored with OpenSSL implementations and used with
>> JSSE implementations) and a warning is logged that the cipher
>> suite has been ignored.
>>
>> - Expand OCSP support to JSSE based connections and expand OCSP
>> configuration options
>>
>> - Update Commons Daemon to 1.5.1.
>>
>> - Update Tomcat Native to 2.0.12 and increase the minimum version to
>> 2.0.12 / 1.3.4
>>
>> For full details, see the changelog:
>> https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
>>
>> It can be obtained from:
>> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.115/
>>
>> The Maven staging repo is:
>> https://repository.apache.org/content/repositories/orgapachetomcat-1578
>>
>> The tag is:
>> https://github.com/apache/tomcat/tree/9.0.115
>> fd3e7b16a7ead52f696b827178333f9a00696d25
>>
>> The proposed 9.0.115 release is:
>> [ ] -1, Broken - do not release
>> [ ] +1, Stable - go ahead and release as 9.0.115
>>
>> Rémy
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>
>>
> I am getting the same signature mismatch as in 11.0.16 when trying to
> reproduce the build.
> Tests pass on Fedora 43 with Java 25, tcnative-1.3.5, apr-1.7.6,
> openssl-3.5.4.
>
I had definitely missed something, since rebuilding and verifying was
successful. Sorry for the noise.
+1
Re: [VOTE] Release Apache Tomcat 9.0.115
Posted by Dimitris Soumis <ds...@apache.org>.
On Wed, Jan 21, 2026 at 11:42 AM Rémy Maucherat <re...@apache.org> wrote:
> The proposed Apache Tomcat 9.0.115 release is now available for voting.
>
> The notable changes compared to 9.0.113 are:
>
> - For configuration consistency between OpenSSL and JSSE TLS
> implementations, TLSv1.3 cipher suites included in the ciphers
> attribute of an SSLHostConfig are now always ignored (previously
> they would be ignored with OpenSSL implementations and used with
> JSSE implementations) and a warning is logged that the cipher
> suite has been ignored.
>
> - Expand OCSP support to JSSE based connections and expand OCSP
> configuration options
>
> - Update Commons Daemon to 1.5.1.
>
> - Update Tomcat Native to 2.0.12 and increase the minimum version to
> 2.0.12 / 1.3.4
>
> For full details, see the changelog:
> https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.115/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1578
>
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.115
> fd3e7b16a7ead52f696b827178333f9a00696d25
>
> The proposed 9.0.115 release is:
> [ ] -1, Broken - do not release
> [ ] +1, Stable - go ahead and release as 9.0.115
>
> Rémy
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
I am getting the same signature mismatch as in 11.0.16 when trying to
reproduce the build.
Tests pass on Fedora 43 with Java 25, tcnative-1.3.5, apr-1.7.6,
openssl-3.5.4.
Re: [VOTE] Release Apache Tomcat 9.0.115
Posted by Coty Sutherland <cs...@apache.org>.
On Wed, Jan 21, 2026 at 4:35 AM Rémy Maucherat <re...@apache.org> wrote:
> The proposed Apache Tomcat 9.0.115 release is now available for voting.
>
> The notable changes compared to 9.0.113 are:
>
> - For configuration consistency between OpenSSL and JSSE TLS
> implementations, TLSv1.3 cipher suites included in the ciphers
> attribute of an SSLHostConfig are now always ignored (previously
> they would be ignored with OpenSSL implementations and used with
> JSSE implementations) and a warning is logged that the cipher
> suite has been ignored.
>
> - Expand OCSP support to JSSE based connections and expand OCSP
> configuration options
>
> - Update Commons Daemon to 1.5.1.
>
> - Update Tomcat Native to 2.0.12 and increase the minimum version to
> 2.0.12 / 1.3.4
>
> For full details, see the changelog:
> https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.115/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1578
>
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.115
> fd3e7b16a7ead52f696b827178333f9a00696d25
>
> The proposed 9.0.115 release is:
> [ ] -1, Broken - do not release
> [x] +1, Stable - go ahead and release as 9.0.115
>
LGTM
>
> Rémy
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
Re: [VOTE] Release Apache Tomcat 9.0.115
Posted by Rémy Maucherat <re...@apache.org>.
On Wed, Jan 21, 2026 at 10:35 AM Rémy Maucherat <re...@apache.org> wrote:
>
> The proposed Apache Tomcat 9.0.115 release is now available for voting.
>
> The notable changes compared to 9.0.113 are:
>
> - For configuration consistency between OpenSSL and JSSE TLS
> implementations, TLSv1.3 cipher suites included in the ciphers
> attribute of an SSLHostConfig are now always ignored (previously
> they would be ignored with OpenSSL implementations and used with
> JSSE implementations) and a warning is logged that the cipher
> suite has been ignored.
>
> - Expand OCSP support to JSSE based connections and expand OCSP
> configuration options
>
> - Update Commons Daemon to 1.5.1.
>
> - Update Tomcat Native to 2.0.12 and increase the minimum version to
> 2.0.12 / 1.3.4
>
> For full details, see the changelog:
> https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.115/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1578
>
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.115
> fd3e7b16a7ead52f696b827178333f9a00696d25
>
> The proposed 9.0.115 release is:
> [ ] -1, Broken - do not release
> [X] +1, Stable - go ahead and release as 9.0.115
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[VOTE][RESULT] Release Apache Tomcat 9.0.115
Posted by Rémy Maucherat <re...@apache.org>.
The following votes were cast:
Binding:
+1: schultz, dsoumis, csutherl, remm, markt
The vote therefore passes.
Thanks to everyone who contributed to this release.
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org