• Backport everything possible from master
• Requires java 11 now

• library and build updates

• library and build updates

notice: Spring and Spring Security have now ended support for OSS projects for 5 series. A CVE has already been raised against Spring 5 that only is patched with commercial support. There is no way this OSS project can directly patch for this situation now. Therefore, do not consider the tomcat 9 line of psi probe as being secure. If you have commercial support, please build from the javax branch line to patch the necessary libraries. Releases may continue along with some back ported code changes based on demand otherwise.

suggestion: Upgrade to jakarta mainline releases as soon as possible (ie tomcat 10 or 11)

Jakarta Namespace (tomcat 10 | 11)

• Library / Plugin Updates
• Moved web.xml from servlet 3.1 to servlet 6

Jakarta Namespace (tomcat 9)

• Drop tomcat 8.5 support
• Library Updates / Plugin Updates
• Bump web.xml from servlet 3.1 to 4.0

Jakarta Namespace (tomcat 10 | 11)

• Requires java 17 due to spring requirement
• Finalize Jakarta support
• Drop tomcat 8.5 / 9.0 from this line as not possible to co-support
• Support tomcat 10.1 / 11.0 (note there will be no tomcat 10.0 support as end of life some time ago and api changes are breaking)
• Use updated cert names for SubjectDN and IssuerDn that were deprecated in java 16.
• Rework jmx isServiced support due to changes in tomcat 10 | 11

Upload changes

• Tomcat forced back changes that tomcat 10/11 use for file upload. This resulted in finding a solution that was a blocker for tomcat 10/11 migration. This was resolved by copying a part of Tomcat code and combining two different methods there to account for our usage. This this is the first release to support tomcat 9.0.88 and is required for 9.0.88 but was tested to work as far back as tomcat 9.0.52. See #3239

Others

• Library Updates
• Plugin Updates
• non impacting: port forwards test adjustments for tomcat 10/11 modules
• Fixed GHA for codeql as build requires java 17

• Library updates
• Plugin updates
• Fixed #3154 Size param position in requests
• Move jetty jspc to jetty 12 for ee8
• Drop java 11 from github actions build cycle as jetty jspc requires java 17. The runtime is still java 8.
• Move coverity action to java 21 build now
• Update renovate config
• Fix taglib xmlns to be javaee not j2ee (old bug)
• Make whitespace and open rewrite run during normal build cycles
• Trim left over whitespace
• Drop legacy maven compiler version as not needed
• Change modernizer plugin to use compiler release instead of target
• Adjust GHA CI build so java 23 will run with bytebuddy

• library updates
• plugin updates
• Removed distribution management added to all modules as it did not help solve site issues and made it worse. We continue to use GHA to do this.
• Added notes to readme regarding fact that tomcat newer versions add a number of add-opens, some of which are required to run this product. See catalina.sh or catalina.bat are up to date with tomcat requirements.
• Add a wait delay in the WAR controller of 10 seconds due to issues seen with #1961

• fix deletion logic on temp file processing of war upload
• library updates
• few fixes per codeql