-
Notifications
You must be signed in to change notification settings - Fork 1.9k
/
VERSION.txt
13595 lines (12916 loc) · 646 KB
/
VERSION.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
jetty-12.0.5 - 18 December 2023
+ 10277 Review read failures impacting writes
+ 10852 `ResourceHandler` could use a `.setUseFileMapping(boolean)` option
+ 10933 Review ServletChannelState.asyncError()
+ 10956 100 Continue handling
+ 11009 Add deployment exception for non Jakarta WebSocket endpoints used
in ServerEndpointConfig
+ 11014 RedirectRegexRule and RewritePatternRule should consider
relativeRedirectAllowed
+ 11016 IllegalStateException when stopping Server with pending
requests
+ 11021 Do not call afterResponse() in case of failures
+ 11024 Properly scope jetty-security optional / test dependencies
+ 11031 HttpClient should expose Connection/EndPoint used by HTTP requests
+ 11037 Serialize HttpClient request failures
+ 11039 Memory leak and multiple (Http|Servlet)*Listener invokations after
restart
+ 11040 "not an allowed scheme" for GraalVM Native-Image resource:-URIs
+ 11064 NPE if MultiPartFormData.setFilesDirectory() is not called
jetty-12.0.4 - 30 November 2023
+ 9502 Produce SBOM and deploy to Maven Central
+ 9900 Improve `Request.getBeginNanoTime()` accuracy
+ 10234 Make idle timeouts transient
+ 10384 ServletChannel now using proper state changes for calls to
ErrorHandler to avoid IllegalStateExceptions
+ 10687 Jetty WebSocket remembers mappings on restart
+ 10749 WebSocketClient should expose upgrade request/response
+ 10775 Review ConnectionMetaData.isSecure()
+ 10781 Investigate if the `secondary_super_cache` is stable
+ 10797 Multiple identical `Set-Cookie` response lines produced
+ 10812 jetty-deploy has unnecessary dependency on awaitility/hamcrest pulled
in at runtime
+ 10829 Expired Session timing issue leads to Warning: "Invalidating session
{} found to be expired when requested"
+ 10879 Improve redirect handling with reproducible content
+ 10891 Support the "Partitioned" cookie attribute
+ 10919 EE10 multipart parsing may include '\r' at the front under certain
conditions
+ 10922 Fix NPE on null host when checking virtual host
+ 10926 AttributeNormalizer does not support combined resources
jetty-12.0.3 - 26 October 2023
+ 1256 DoSFilter leaks USER_AUTH entries
+ 10390 Jetty HTTP/3 Client fails when connecting to `nghttpx` server
+ 10477 Jetty 12: Review MBeans for Handlers
+ 10519 java.lang.IllegalStateException: Flusher when using HTTP/3 with Spring
Boot 3.2
+ 10537 HTTP/3: Incomplete Data Transfer When Used with Spring Boot WebFlux
+ 10555 Re-introduce a more complete set of stats in `StatisticsHandler`
+ 10582 NPE when including a directory that should be resolved with
servlet-mapped welcome file
+ 10656 EE10 `ServletRequest.getProtocolRequestId()` impl not spec compliant
when protocol is H1
+ 10661 Ensure jetty api servlets/filters take precedence over
`webdefault.xml` declarations.
+ 10688 Introduce Jetty 12 ee8 osgi layer
+ 10696 jetty.sh doesn't work with JETTY_USER in Jetty 10.0.17 thru Jetty
12.0.2
+ 10699 Jetty HTTP SPI redirects SOAP POST requests to GET requests if URL
does not end with /
+ 10705 Creating a `HTTP3ServerConnector` with a `SslContextFactory` that has
a non-null `SSLContext` makes the server fail to start with an unclear error
message
+ 10716 Incorrect setting of content type with charset encoding before and
after PrintWriter obtained
+ 10726 NPE in ResponseListeners content notification
+ 10731 org.eclipse.jetty.server.Request uses wrong context attribute name
javax.servlet instead of jakarta.servlet
+ 10734 jakarta.websocket.Session.getRequestParameterMap() contains the value
as key
+ 10771 EE10 `ServletRequest.isSecure()` not set by
`ForwardedRequestCustomizer`
+ 10786 TLS handshake failures leak HttpConnection.RequestTimeouts tasks
+ 10794 301 Moved Permanently produces query with `;` instead of `?`
jetty-12.0.2 - 09 October 2023
+ 7408 Change scope of maven plugin dependencies
+ 9665 `HttpCookieStore` incorrectly rejects cookies for domains that are an
IPv6 address
+ 9777 CrossOriginFilter does not return Vary header on no-cors mode
+ 9928 Backport `Request.getBeginNanoTime()`
+ 10219 Review HTTP Cookie parsing
+ 10271 jetty.sh does not stop jetty anymore
+ 10328 Review `ResourceFactory.newSystemResource(String)` behavior & javadoc
+ 10361 Introduce QoSHandler
+ 10388 Jetty10 inetaccess mod started error
+ 10440 ClassCastException with `<jettyEnvXml>` use in
`jetty-ee10-maven-plugin`
+ 10441 Jetty 12 ee8 jaspi is missing
+ 10442 Reduce verbosity when JMX finds overloaded setter
+ 10463 Jetty 12 throws Exception handling static files when using response
wrapper
+ 10466 Review HTTP session documentation
+ 10473 Startup Script reports `ok` too fast, and doesn't wait for actual
start of Jetty
+ 10474 Jetty 12 default error handler throws IllegalStateException for
application/json
+ 10475 Update Jetty 12 MANIFEST's Bundle-Copyright
+ 10482 RewriteHandler with multiple HeaderPatternRules
+ 10490 Jetty 12 Jakarta Websockets user principal is always null
+ 10498 NullPointerException from call to UpgradeRequest#getUserPrincipal with
Jetty 12
+ 10500 Jetty 12 HTTP SPI does not preserve double-quotes on valid request
headers
+ 10508 Jetty 12 IllegalArgumentExeption when setting a HTTP header to null
+ 10513 Lockup processing POST request body with Jetty 12.0.1 using http/2
+ 10543 Review HttpStream.consumeAvailable() implementations
+ 10547 Cannot customize Executor on WebSocketClient
+ 10557 Update quiche to 0.18.0
+ 10558 NPE when forwarding a request to default servlet which should redirect
to a subdirectory with trailing slash
+ 10665 Wrong BREE in Jetty jars
+ 10679 Review HTTP/2 rate control (CVE-2023-44487)
jetty-12.0.1 - 29 August 2023
+ 8926 HttpClient GZIPContentDecoder should remove Content-Length and
Content-Encoding: gzip
+ 9169 Idle timeout is ignored if callback is not completed
+ 9900 Improve `Request.getBeginNanoTime()` accuracy
+ 10158 Deploying on Jetty 12 using context XML files will only work when a
.properties file with the EE details is also present
+ 10207 Update failed JSP deployment message
+ 10213 UnknownFormatConversionException in `start.jar --debug` if path has
`%` sign
+ 10217 Review ProxyConnectionFactory buffer management
+ 10218 NPE in HttpChannelOverFCGI.receive()
+ 10274 java.nio.file.FileSystemNotFoundException when creating a resource
from a JAR URL
+ 10294 Request.getContext().getContextPath()
+ 10295 FormAuthenticator does not dispatch to an error page but redirect
+ 10306 Jetty 12 generates wrong Host header
+ 10309 Jetty 12: X-Powered-By header is added 2 times (if enabled)
+ 10312 Remove jetty-home-with-docs to eliminate build time cyclic
dependencies
+ 10315 ServletInputStream::isReady results in IllegalArgumentException
+ 10323 Jetty 12.0.0 return wrong value for
HttpServletRequest.isRequestedSessionIdValid
+ 10327 Jetty (embedded) rejected warning logs
+ 10330 Jetty 12: ResourceService throws NPE when resource has no filesystem
path
+ 10337 SizeLimitHandler does not enforce 0 responseLimit
+ 10338 ErorrHandler#writeErrorJson is private
+ 10349 Character encoding is reset when setting Content-Type
+ 10350 Support Java 21 virtual threads
+ 10352 Jetty accepts "+" prefixed value in Content-Length (CVE-2023-40167)
+ 10353 Questions about porting WebSocket APIs to jetty-core 12
+ 10356 Deploying WAR with `ee10-cdi-spi` fails with Weld 5/CDI 4
+ 10383 Unsuppressed exceptions from EE10 ServletTest
+ 10397 Iso88591StringBuilder.append seems to have a logic error
+ 10402 Investigate NPE from EE10 AsyncServletIOTest
+ 10411 Review deployment of Jetty Context XML files
+ 10416 EE9 Copies HttpFields in response
jetty-11.0.18 - 26 October 2023
+ 1256 DoSFilter leaks USER_AUTH entries
+ 10390 Jetty HTTP/3 Client fails when connecting to `nghttpx` server
+ 10519 java.lang.IllegalStateException: Flusher when using HTTP/3 with Spring
Boot 3.2
+ 10537 HTTP/3: Incomplete Data Transfer When Used with Spring Boot WebFlux
+ 10696 jetty.sh doesn't work with JETTY_USER in Jetty 10.0.17 thru Jetty
12.0.2
+ 10705 Creating a `HTTP3ServerConnector` with a `SslContextFactory` that has
a non-null `SSLContext` makes the server fail to start with an unclear error
message
+ 10731 org.eclipse.jetty.server.Request uses wrong context attribute name
javax.servlet instead of jakarta.servlet
+ 10786 TLS handshake failures leak HttpConnection.RequestTimeouts tasks
jetty-11.0.17 - 09 October 2023
+ 9777 CrossOriginFilter does not return Vary header on no-cors mode
+ 9928 Backport `Request.getBeginNanoTime()`
+ 10271 jetty.sh does not stop jetty anymore
+ 10473 Startup Script reports `ok` too fast, and doesn't wait for actual
start of Jetty
+ 10547 Cannot customize Executor on WebSocketClient
+ 10679 Review HTTP/2 rate control (CVE-2023-44487)
jetty-10.0.18 - 26 October 2023
+ 1256 DoSFilter leaks USER_AUTH entries
+ 10390 Jetty HTTP/3 Client fails when connecting to `nghttpx` server
+ 10519 java.lang.IllegalStateException: Flusher when using HTTP/3 with Spring
Boot 3.2
+ 10537 HTTP/3: Incomplete Data Transfer When Used with Spring Boot WebFlux
+ 10696 jetty.sh doesn't work with JETTY_USER in Jetty 10.0.17 thru Jetty
12.0.2
+ 10705 Creating a `HTTP3ServerConnector` with a `SslContextFactory` that has
a non-null `SSLContext` makes the server fail to start with an unclear error
message
+ 10786 TLS handshake failures leak HttpConnection.RequestTimeouts tasks
jetty-10.0.17 - 09 October 2023
+ 9777 CrossOriginFilter does not return Vary header on no-cors mode
+ 9928 Backport `Request.getBeginNanoTime()`
+ 10473 Startup Script reports `ok` too fast, and doesn't wait for actual
start of Jetty
+ 10547 Cannot customize Executor on WebSocketClient
+ 10679 Review HTTP/2 rate control (CVE-2023-44487)
jetty-11.0.16 - 25 August 2023
+ 6140 Report total number of keys in SelectorManager
+ 7091 Add SOCKS5 support
+ 8405 Servlet 3.1 ReadListener.onAllDataRead() is called twice under h2 or
h2c if the server doesn't respond within 30s
+ 8556 ServletContext.getSessionTimeout() incorrectly throws
IllegalStateException
+ 8694 Make QuicServerConnector respect configured key store instances
+ 8926 HttpClient GZIPContentDecoder should remove Content-Length and
Content-Encoding: gzip
+ 9150 jetty-http-spi: Jetty's implementation of HttpExchange.setStreams
method faulty
+ 9386 SSL reports deprecated setting, but ssl.ini still uses it
+ 9397 HTTP/3 encryption configuration
+ 9476 onCompleteFailure called multiple times
+ 9524 InputStreamResponseListener's InputStream creates an exception on
close()
+ 9554 Move (qpack/hpack) HuffmanDecoder / HuffmanEncoder / NBitInteger* to
common location
+ 9682 RetainableByteBuffer buffer release bug in WebSocket
+ 9685 Jetty doesn't set the date header on error responses
+ 9720 Http2Session.streamIdleTimeout should permit being disabled from
AbstractHTTP2ServerConnectionFactory
+ 9749 Correct HPACK Integer Overflow (CVE-2023-36478)
+ 9772 Improve Quiche certificates deployment
+ 9777 CrossOriginFilter does not return Vary header on no-cors mode
+ 9795 http3-server is leaking the Jetty logging service to web applications
+ 9887 Deprecate CGI Servlet (CVE-2023-36479)
+ 9895 A MessageTooLargeException doesn't close a WebSocket connection
+ 9947 Cannot invoke "org.eclipse.jetty.io.ManagedSelector.getTotalKeys()"
because "selector" is null
+ 9990 Server rejects certain sizes of streamed request bodies
+ 10066 Allow `SAXParserFactory` or `SAXParser` to be configured in Jetty's
`XmlParser` class
+ 10086 Revisiting ProxyConfiguration.getProxies()
+ 10105 Document that Request objects are not reusable
+ 10120 OutOfMemoryError caused by CyclicTimeouts
+ 10135 Websocket: Using PerMessageDeflateExtension and flush in batchMode
send FLUSH_FRAME to client.
+ 10143 Startup fails due to IllegalArgumentException: Comparison method
violates its general contract
+ 10145 WritePendingException over HTTP/2 tunnel
+ 10160 Verify PROXY_AUTHENTICATION is sent to forward proxies
+ 10211 NPE in ArrayByteBufferPool.findOldestEntry()
+ 10312 Remove jetty-home-with-docs to eliminate build time cyclic
dependencies
+ 10350 Support Java 21 virtual threads
+ 10352 Jetty accepts "+" prefixed value in Content-Length (CVE-2023-40167)
+ 10388 Jetty10 inetaccess mod started error
+ 10397 Iso88591StringBuilder.append seems to have a logic error
jetty-12.0.0 - 07 August 2023
+ 8405 Servlet 3.1 ReadListener.onAllDataRead() is called twice under h2 or
h2c if the server doesn't respond within 30s
+ 9386 SSL reports deprecated setting, but ssl.ini still uses it
+ 9720 Http2Session.streamIdleTimeout should permit being disabled from
AbstractHTTP2ServerConnectionFactory
+ 10121 ee9 to ee8 conversion not working for JSP files with jakarta imports
+ 10135 Websocket: Using PerMessageDeflateExtension and flush in batchMode
send FLUSH_FRAME to client.
+ 10155 EE10 Servlet include after `HttpServletResponse.getWriter().println()`
omits `Content-Length` from the response
+ 10160 Verify PROXY_AUTHENTICATION is sent to forward proxies
+ 10164 Needless META-INF/resources and web-fragment.xml mounts
+ 10211 NPE in ArrayByteBufferPool.findOldestEntry()
+ 10227 EE10 Unable to use Cookie attributes with
`HttpServletResponse.addCookie(jakarta.servlet.http.Cookie)`
+ 10229 HttpConfiguration.setIdleTimeout() breaks long running requests
+ 10231 DefaultServlet no longer supports POST and OPTIONS and returns a 405
instead
jetty-12.0.0.beta4 - 26 July 2023
+ 8556 ServletContext.getSessionTimeout() incorrectly throws
IllegalStateException
+ 9444 Unexpected encoding in request.getPathInfo() with Jetty 12 beta 0
+ 9910 Inconsistent handling of welcome files between Jetty 10 and 12
+ 10055 Deployment of static files does not work with --dry-run Jetty-12
+ 10066 Allow `SAXParserFactory` or `SAXParser` to be configured in Jetty's
`XmlParser` class
+ 10068 Jetty 12: instantiation of `HashLoginService`
+ 10084 ServletApiContext.getResourcePaths() doesn't respect the spec
+ 10086 Revisiting ProxyConfiguration.getProxies()
+ 10105 Document that Request objects are not reusable
+ 10120 OutOfMemoryError Upgrading from 9.4.49.v20220914 to 12.0.0.beta3
+ 10122 in jetty12 beta build error-page redirects wrongly?
+ 10123 in jetty12 beta partial http data request can get stuck now
+ 10131 Review ERROR query-string handling
+ 10134 `Server.stop()` and `WebInfConfiguration.deconfigure()` can throw a
`ClosedFileSystemException` when restoring the original base resource
+ 10139 DefaultServlet not working with named dispatch in Jetty-12 EE10
+ 10141 welcome-file ignored on jetty12ee10 on exploded deploy, works on ee9
and older jettys
+ 10142 req.getRequestDispatcher("/test.htm").include(req, resp); does not go
anywhere on jetty12ee10 on exploded deploy, works on ee9 and older jetty
+ 10143 Jetty12 startup fails randomly on JRebel
+ 10145 WritePendingException over HTTP/2 tunnel
jetty-12.0.0.beta3 - 03 July 2023
+ 9919 Jetty-12 creates two instances of ArrayByteBufferPool
+ 9925 Bring back Jetty <12 flexibility of "current context / context handler"
+ 9944 Remove integer for demand in websocket in Jetty-12
+ 9946 Handler passed to Handler in constructor a parent or child?
+ 9947 Cannot invoke "org.eclipse.jetty.io.ManagedSelector.getTotalKeys()"
because "selector" is null
+ 9953 Jetty 12.0 Handle HEAD requests in Handler
+ 9955 Jetty 12.0 beta 2 HttpServletResponse::getStatus returns 0 by default
+ 9960 Custom logging in Jetty 12 beta2 can fail due to NullPointerException
in org.eclipse.jetty.server.Request
+ 9965 prevent multiple websocket frames from being demanded in Jetty-12
+ 9966 NullPointerException with default servlet, include and welcome pages
+ 9972 getResourcePaths fails when a META-INF resource has reserved characters
in its filename
+ 9973 Creating a Resource for an entry in a nested jar file in Jetty 12
+ 9984 URLResource.isDirectory() throws a NullPointerException when created
from a jar:file: URL
+ 9990 Server rejects certain sizes of streamed request bodies
jetty-12.0.0.beta2 - 16 June 2023
+ 6140 Report total number of keys in SelectorManager
+ 7091 Add SOCKS5 support
+ 8694 Make QuicServerConnector respect configured key store instances
+ 8819 Jetty-12 Improve CustomRequestLog efficiency
+ 8885 Jetty-12, replacement for HttpChannel.Listener
+ 9072 The great Jetty-12 renaming omnibus
+ 9150 jetty-http-spi: Jetty's implementation of HttpExchange.setStreams
method faulty
+ 9173 Configuring SameSite on a per-cookie basis in Jetty 12
+ 9397 HTTP/3 encryption configuration
+ 9524 InputStreamResponseListener's InputStream creates an exception on
close()
+ 9554 Move (qpack/hpack) HuffmanDecoder / HuffmanEncoder / NBitInteger* to
common location
+ 9630 Jetty 12 - Make Context dumpable
+ 9631 Update jaspi jar for jetty-10 and verify permission names
+ 9637 jetty-12 ee10 ServletRequestListeners called too many times on
sendError
+ 9639 Deprecated properties used in jetty-12 demos
+ 9648 jetty-12 ee10 ServletApiResponse.sendError does not check for the
response already being committed
+ 9649 jetty-12 ee10 ServletApiResponse.addIntHeader does not ignore headers
after response committed
+ 9650 jetty-12 ee10 `ServletApiResponse.resetBuffer` does not check for
response being committed
+ 9657 jetty-12 ee9 & ee10 Request.upgrade returns null
+ 9680 Jetty-12 QuickStartTest leaking resources
+ 9682 A possible native memory leak through RetainableByteBuffers
+ 9685 Jetty doesn't set the date header on error responses
+ 9731 Infinite loop with mapped roles
+ 9734 Cookie config can be set after SessionHandler is started
+ 9743 jetty-12 ee9 changeSessionId should throw ISE if no exception
+ 9745 jetty-12 SecurityHandler role checking with * not correct
+ 9750 jetty-12 ee10 wrong authType for CLIENT-CERT
+ 9760 jetty-12 ee9 Omnibus tck failure analysis
+ 9762 jetty-12 ee9 Double parsing of cookies
+ 9766 jetty-12 ee9 ServerPush failures
+ 9767 jetty-12 ee10 ServerPush failures
+ 9770 Pictures are missed in documentation
+ 9772 Improve Quiche certificates deployment
+ 9774 jetty-12 ee10 Cross context dispatch is not supported
+ 9777 CrossOriginFilter does not return Vary header on no-cors mode
+ 9785 jetty-12 ee9 contextPath not set correctly on nested ContextHandler
+ 9795 http3-server is leaking the Jetty logging service to web applications
+ 9879 Jetty-12 rewrite demo not working
+ 9880 Jetty 12 - jetty.sh does not work on Ubuntu
+ 9881 H2 perf can be pathologically bad
+ 9887 Deprecate CGI Servlet (CVE-2023-36479)
+ 9895 A MessageTooLargeException doesn't close a WebSocket connection
+ 9906 Inconsistent handling of empty "path info" between Jetty 10 and 12
+ Jan (@janbartel) is now using IntelliJ!
jetty-12.0.0.beta1 - 02 May 2023
+ 6184 Remove usages of classes associated with JEP-411 that deprecate/remove
the SecurityManager from the JVM
+ 6483 Jetty http client SSL connectivity over CNTLM proxy fails
+ 7608 Jetty-12 MetaData cleanup needed
+ 8740 Jetty 12 - Move org.eclipse.jetty.server.context.ManagedAttributes to
core
+ 9237 Decouple QTP `idleTimeout` from pool shrink rate
+ 9309 `jetty.sh` cannot handle complex Jetty properties from `start.d/*.ini`
+ 9311 Performance of `ArrayRetainableByteBufferPool.acquire()` can degenerate
pathologically as the buckets grow in size
+ 9391 Jetty 12: port/move Jetty WebSocket APIs, client and server to
jetty-core
+ 9400 Jetty logs warning with stacktrace when annotation parser encounters
module-info.class file inside elasticsearch-x-content jar
+ 9408 HugeResourceTest failing
+ 9410 Jetty 12: review locking in `MultiPartFormData` and
`MultiPartByteRanges`
+ 9412 Jetty 12: WebSocket hangs when
ServerEndpointConfig.Configurator.getEndpointInstance() throws
+ 9438 Jetty 12: Review JakartaWebSocketClientContainer use of reflection
+ 9440 Jetty 12: HttpCookieStore should return cookies for "ws" schemes
+ 9442 Jetty 12 Documentation Html artifact not populated
+ 9444 Unexpected encoding in request.getPathInfo() with Jetty 12 beta 0
+ 9459 Path is missing from JSESSIONID cookie in 12 beta 0
+ 9463 NPE when starting jetty-ee10-maven-plugin
+ 9464 Add optional configuration to log user out after OpenID idToken expires
(CVE-2023-41900)
+ 9466 WebSocket `DeploymentException` is not thrown by client nor server
+ 9467 Jetty 12 - Review BOMs
+ 9468 Jetty 11.0.14 is less tolerant of non-compliant cookies than 11.0.13
+ 9497 Maven plugin add support for jar projects in `:effective-web-xml`
+ 9501 jetty client with proxy - ssl traffic between both proxy and servers
+ 9516 Remove CGI Servlet (CVE-2023-36479)
+ 9537 "error-on-el-not-found" behavior is not as specified
+ 9552 Jetty 12 - Rewrite of the Jetty WebSocket APIs
+ 9554 Move (qpack/hpack) HuffmanDecoder / HuffmanEncoder / NBitInteger* to
common location
+ 9556 Password Util does not ask for password
+ 9617 Update to apache jasper 10.1.7 for jetty-12 ee10
+ 9656 jetty-12 ee10 PushBuilderImpl.push must throw IllegalStateException
+ 9685 Jetty doesn't set the date header on error responses
jetty-12.0.0.beta0 - 23 February 2023
+ 7650 QueuedThreadPool: Stopped without executing or closing null
+ 8069 Jetty 12 is missing a way to record server latencies
+ 8984 Jetty 12 - Attributes dump is not working
+ 8991 Review naming of FrameHandler.isDemanding() in Jetty 12
+ 8993 `Content.Chunk.isTerminal()` cannot discriminate `EOF` from chunks
containing a pooled empty buffer
+ 9038 Jetty 12 - Review EE10 Http[Input|Output].Interceptor APIs
+ 9046 Fix jetty-12 tck tests
com.sun.ts.tests.servlet.api.jakarta_servlet_http.httpsessionx.URLClient.invalidateHttpSessionTest
and
com.sun.ts.tests.servlet.api.jakarta_servlet_http.httpsessionx.URLClient.invalidateHttpSessionxTest
+ 9051 Review Jetty-12 DelayedHandler
+ 9059 IteratingCallback not serializing close() and failed()
+ 9066 TCK multipart not set as request parameter
+ 9067 TCK DefaultServlet handling of dispatch include incorrect
+ 9078 Header image for Jetty demo page fails on hard refresh
+ 9119 Wrong value of javax.servlet.forward.context_path attribute
+ 9141 Thread-safe Content.Chunk#slice
+ 9145 Failure when running `add-module` for openid, websocket, and stats
modules
+ 9166 Jetty 12: review/remove ByteBufferPool
+ 9173 Configuring SameSite on a per-cookie basis in Jetty 12
+ 9181 NPE in SessionHandler.checkRequestedSessionId()
+ 9182 Jetty 12 - Public version of JakartaWebSocketServerContainer
+ 9183 ConnectHandler may close the connection instead of sending 200 OK
+ 9210 Jetty 12 - Review Pool and Pool.Entry
+ 9240 Jetty 12 - `AbstractConnectionPool.toString()` can trigger NPE
+ 9275 Jetty-12 H3 tests passing after 30s timeout
+ 9285 ContextHandler sends redirect on BaseResponse instead of Wrapped
Response object from Handler chain
+ 9288 Jetty 12 - Use oej.http.HttpCookie in jetty-client
+ 9293 Jetty 12 - Relax JPMS dependencies
+ 9301 JSTL fails in JPMS
+ 9322 404 handler not working in jetty-12
+ 9326 Jetty 12 - Rename DecryptedEndPoint to SslEndPoint
+ 9334 Better support for Cookie RFC 2965 compliance (CVE-2023-26049)
+ 9336 Review LifeCycle of Parts in Jetty 12
+ 9337 LowResourceMonitor.getReasons should include detailed reason instead of
hard-coded message
+ 9387 Remove Request.__defaultLocale
+ 9398 DefaultHandler does not list contexts
+ 9403 TCK failure: DefaultServlet only sets status 404 instead of sending 404
response
jetty-9.4.51.v20230217 - 17 February 2023
+ 9059 IteratingCallback not serializing close() and failed()
+ 9181 NPE in SessionHandler.checkRequestedSessionId()
+ 9345 Backport Fix for CVE-2023-26048
+ 9352 Backport Fix for CVE-2023-26049
jetty-12.0.0.alpha3 - 07 December 2022
+ 5681 Unrecognized jetty-home/start.jar command line option not reported
clearly
+ 5965 Option --write-module-graph produces wrong .dot file
+ 7117 Timeout with Expect 100 continue when using ProxyServlet
+ 7182 jetty.sh start process should remove jetty_state whenever deleting the
pid
+ 7286 WebSocket write can time out even if the frame / callback has not been
failed.
+ 7657 Remove unused test imports in jetty-nosql
+ 7748 Allow overriding of url-pattern mapping in ServletContextHandler to
allow for regex or uri-template matching
+ 7863 Default servlet drops first accept-encoding header if there is more
than one.
+ 7891 Better Servlet PathMappings for Regex
+ 7993 HttpClient idleTimeout configuration being ignored/overridden
+ 8330 Persistent OpenId sessions can throw IllegalStateException
+ 8448 incomplete Blocking.Callback and write errors
+ 8460 Log or throw exception if DefaultSessionIdManager is used but has not
been started.
+ 8536 HotSwapHandler race condition
+ 8558 Idle timeout occured sometimes on HTTP/2 client with
`InputStreamResponseListener`
+ 8584 org.eclipse.jetty.client.HttpRequest.send() never returns
+ 8591 Indicate units of HttpClient properties
+ 8606 Jetty 12: restore scope listeners functionality
+ 8613 Update build for Java 19
+ 8623 Use AutoLock in InputStreamResponseListener
+ 8628 Pseudo restore `PathMappings.getMatch(String)` for backwards compat
reasons
+ 8678 Jetty client is not responding to GO_AWAY packet received from (Jetty)
Server and continue to send traffic on same connection
+ 8712 ELContextCleaner no longer needed
+ 8716 Multiple Host header values handled poorly
+ 8721 jetty:effective-web-xml doesn't generate quickstart information for web
fragment jars that contain META-INF/resources
+ 8723 Provide a thread-safe way to modify HttpClient proxies at runtime
+ 8726 Jetty 12 - Improve ErrorProcessor to handle error pages
+ 8744 jetty-12: Update to jasper 10.1.1
+ 8749 Jetty 12 - `request.getContext().getContextPath()` should return full
context, not just last one
+ 8750 AbstractProxyServlet.onServerResponseHeaders does not support headers
with empty values
+ 8753 Starting HttpClient with destinationIdleTimeout set throws NPE
+ 8770 Review whether to send request body in redirects
+ 8779 CompactPathRule drops query section on use
+ 8786 KeyStoreScanner is not able to monitor a symlink file and always
resolves to the target.
+ 8810 `ArrayRetainableByteBufferPool` inefficiently calculates bucket indices
+ 8811 HTTP/2 session shutdown race may cause `Server.stop()` to block until
stop timeout
+ 8858 Jetty 12 - Review MovedContextHandler
+ 8863 Provide a possibility to name virtual threads
+ 8886 Changes to Resource no longer support custom url schemes
+ 8895 Generate downloadable version of javadocs documentation in website
deploy script
+ 8897 Update Conditional request handling for RFC7232
+ 8905 GzipHandler fails to set Vary header on 304 responses
+ 8913 Review Jetty XML syntax to allow calling JDK methods
+ 8921 Normalization of resources incorrect for quickstart in jetty-12
+ 8923 Update FileID.getExtension() behaviors to match new JDK 20
Path.getExtension() behaviors
+ 8973 Does ssl-reload monitor keystore when it is a symlink?
+ 8975 Jetty 12 - rename getBaseResponse() to getServletContextResponse()
+ 8980 jetty-12.0.x WebappClassloader addJars(Resource) incorrectly transforms
into a CombinedResource
+ 8993 `Content.Chunk.isTerminal()` cannot discriminate `EOF` from chunks
containing a pooled empty buffer
+ 8999 Overuse of FileID.isArchive() and inability to deal with packed jars
without .jar extension
+ 9006 WebSocket Message InputStream read() returns signed byte
+ 8695 Update quiche to 0.16.0
jetty-10.0.16 - 25 August 2023
+ 6140 Report total number of keys in SelectorManager
+ 7091 Add SOCKS5 support
+ 8405 Servlet 3.1 ReadListener.onAllDataRead() is called twice under h2 or
h2c if the server doesn't respond within 30s
+ 8556 ServletContext.getSessionTimeout() incorrectly throws
IllegalStateException
+ 8694 Make QuicServerConnector respect configured key store instances
+ 8926 HttpClient GZIPContentDecoder should remove Content-Length and
Content-Encoding: gzip
+ 9150 jetty-http-spi: Jetty's implementation of HttpExchange.setStreams
method faulty
+ 9386 SSL reports deprecated setting, but ssl.ini still uses it
+ 9397 HTTP/3 encryption configuration
+ 9476 onCompleteFailure called multiple times
+ 9524 InputStreamResponseListener's InputStream creates an exception on
close()
+ 9554 Move (qpack/hpack) HuffmanDecoder / HuffmanEncoder / NBitInteger* to
common location
+ 9682 RetainableByteBuffer buffer release bug in WebSocket
+ 9685 Jetty doesn't set the date header on error responses
+ 9749 Correct HPACK Integer Overflow (CVE-2023-36478)
+ 9720 Http2Session.streamIdleTimeout should permit being disabled from
AbstractHTTP2ServerConnectionFactory
+ 9772 Improve Quiche certificates deployment
+ 9777 CrossOriginFilter does not return Vary header on no-cors mode
+ 9795 http3-server is leaking the Jetty logging service to web applications
+ 9887 Deprecate CGI Servlet (CVE-2023-36479)
+ 9895 A MessageTooLargeException doesn't close a WebSocket connection
+ 9947 Cannot invoke "org.eclipse.jetty.io.ManagedSelector.getTotalKeys()"
because "selector" is null
+ 9990 Server rejects certain sizes of streamed request bodies
+ 10055 Deployment of static files does not work with --dry-run Jetty-12
+ 10066 Allow `SAXParserFactory` or `SAXParser` to be configured in Jetty's
`XmlParser` class
+ 10086 Revisiting ProxyConfiguration.getProxies()
+ 10105 Document that Request objects are not reusable
+ 10120 OutOfMemoryError caused by CyclicTimeouts
+ 10135 Websocket: Using PerMessageDeflateExtension and flush in batchMode
send FLUSH_FRAME to client.
+ 10143 Startup fails due to IllegalArgumentException: Comparison method
violates its general contract
+ 10145 WritePendingException over HTTP/2 tunnel
+ 10160 Verify PROXY_AUTHENTICATION is sent to forward proxies
+ 10211 NPE in ArrayByteBufferPool.findOldestEntry()
+ 10271 jetty.sh does not stop jetty anymore
+ 10312 Remove jetty-home-with-docs to eliminate build time cyclic
dependencies
+ 10350 Support Java 21 virtual threads
+ 10352 Jetty accepts "+" prefixed value in Content-Length (CVE-2023-40167)
+ 10388 Jetty10 inetaccess mod started error
+ 10397 Iso88591StringBuilder.append seems to have a logic error
jetty-9.4.52.v20230823 - 23 August 2023
+ 9476 onCompleteFailure called multiple times
+ 9660 OpenId Revoked authentication allows one request (CVE-2023-41900)
+ 9887 Deprecate CGI Servlet (CVE-2023-36479)
+ 10066 Allow `SAXParserFactory` or `SAXParser` to be configured in Jetty's
`XmlParser` class
+ 10168 NPE in websocket extension startup
+ 10352 Jetty accepts "+" prefixed value in Content-Length (CVE-2023-40167)
+ 10337 SizeLimitHandler does not enforce 0 responseLimit
jetty-11.0.15 - 11 April 2023
+ 6184 Remove usages of classes associated with JEP-411 that deprecate/remove
the SecurityManager from the JVM
+ 6483 Jetty http client SSL connectivity over CNTLM proxy fails
+ 9237 Decouple QTP `idleTimeout` from pool shrink rate
+ 9309 `jetty.sh` cannot handle complex Jetty properties from `start.d/*.ini`
+ 9400 Jetty logs warning with stacktrace when annotation parser encounters
module-info.class file inside elasticsearch-x-content jar
+ 9464 Add optional configuration to log user out after OpenID idToken expires
(CVE-2023-41900)
+ 9468 Jetty 11.0.14 is less tolerant of non-compliant cookies than 11.0.13
+ 9497 Maven plugin effective web xml: add support for jar projects
+ 9501 jetty client with proxy - ssl traffic between both proxy and servers
+ 9517 Jetty 10.0.14 uses wrong pathSpec for request
+ 9556 Password Util does not ask for password
jetty-10.0.15 - 11 April 2023
+ 6184 JEP-411 will deprecate/remove the SecurityManager from the JVM
+ 6483 Jetty http client SSL connectivity over CNTLM proxy fails
+ 9237 Decouple QTP `idleTimeout` from pool shrink rate
+ 9309 `jetty.sh` cannot handle complex Jetty properties from `start.d/*.ini`
+ 9400 Jetty logs warning with stacktrace when annotation parser encounters
module-info.class file inside elasticsearch-x-content jar
+ 9464 Add optional configuration to log user out after OpenID idToken expires
(CVE-2023-41900)
+ 9468 Jetty 11.0.14 is less tolerant of non-compliant cookies than 11.0.13
+ 9497 Maven plugin effective web xml: add support for jar projects
+ 9501 jetty client with proxy - ssl traffic between both proxy and servers
+ 9517 Jetty 10.0.14 uses wrong pathSpec for request
+ 9556 Password Util does not ask for password
jetty-11.0.14 - 22 February 2023
+ 7650 QueuedThreadPool: Stopped without executing or closing null
+ 9059 IteratingCallback not serializing close() and failed()
+ 9119 Wrong value of javax.servlet.forward.context_path attribute
+ 9181 NPE in SessionHandler.checkRequestedSessionId()
+ 9183 ConnectHandler may close the connection instead of sending 200 OK
+ 9285 ContextHandler sends redirect on BaseResponse instead of Wrapped
Response object from Handler chain
+ 9334 Better support for Cookie RFC 2965 (CVE-2023-26048)
+ 9337 LowResourceMonitor.getReasons should include detailed reason instead of
hard-coded message
+ 9339 Cleanup CookieCutter Parsing (CVE-2023-26049) jetty-11.0.13 - 07
December 2022
+ 7117 Timeout with Expect 100 continue when using ProxyServlet
+ 7286 WebSocket write can time out even if the frame / callback has not been
failed.
+ 7993 HttpClient idleTimeout configuration being ignored/overridden
+ 8330 Persistent OpenId sessions can throw IllegalStateException
+ 8460 Log or throw exception if DefaultSessionIdManager is used but has not
been started.
+ 8536 HotSwapHandler race condition
+ 8558 Idle timeout occured sometimes on HTTP/2 client with
`InputStreamResponseListener`
+ 8584 org.eclipse.jetty.client.HttpRequest.send() never returns
+ 8591 Indicate units of HttpClient properties
+ 8623 Use AutoLock in InputStreamResponseListener
+ 8628 Pseudo restore `PathMappings.getMatch(String)` for backwards compat
reasons
+ 8678 Jetty client is not responding to GO_AWAY packet received from (Jetty)
Server and continue to send traffic on same connection
+ 8695 Update quiche to 0.16.0
+ 8712 ELContextCleaner no longer needed
+ 8716 Multiple Host header values handled poorly
+ 8721 jetty:effective-web-xml doesn't generate quickstart information for web
fragment jars that contain META-INF/resources
+ 8723 Provide a thread-safe way to modify HttpClient proxies at runtime
+ 8750 AbstractProxyServlet.onServerResponseHeaders does not support headers
with empty values
+ 8753 Starting HttpClient with destinationIdleTimeout set throws NPE
+ 8770 Review whether to send request body in redirects
+ 8779 CompactPathRule drops query section on use
+ 8786 KeyStoreScanner is not able to monitor a symlink file and always
resolves to the target.
+ 8810 `ArrayRetainableByteBufferPool` inefficiently calculates bucket indices
+ 8811 HTTP/2 session shutdown race may cause `Server.stop()` to block until
stop timeout
+ 8863 Provide a possibility to name virtual threads
+ 8895 Generate downloadable version of javadocs documentation in website
deploy script
+ 8897 Update Conditional request handling for RFC7232
+ 8905 GzipHandler fails to set Vary header on 304 responses
+ 8913 Review Jetty XML syntax to allow calling JDK methods
+ 8942 Use Logback 1.3.x for Jetty 10.0.x
jetty-10.0.14 - 22 February 2023
+ 7650 QueuedThreadPool: Stopped without executing or closing null
+ 9059 IteratingCallback not serializing close() and failed()
+ 9119 Wrong value of javax.servlet.forward.context_path attribute
+ 9181 NPE in SessionHandler.checkRequestedSessionId()
+ 9183 ConnectHandler may close the connection instead of sending 200 OK
+ 9285 ContextHandler sends redirect on BaseResponse instead of Wrapped
Response object from Handler chain
+ 9344 Cleanup Multipart Handling (CVE-2023-26048)
+ 9339 Cleanup CookieCutter Parsing (CVE-2023-26049)
+ 9334 Better support for Cookie RFC 2965 compliance
+ 9337 LowResourceMonitor.getReasons should include detailed reason instead of
hard-coded message
jetty-9.4.51.v20230217 - 17 February 2023
+ 9059 IteratingCallback not serializing close() and failed()
+ 9181 NPE in SessionHandler.checkRequestedSessionId()
+ 9345 Backport Fix for CVE-2023-26048
+ 9352 Backport Fix for CVE-2023-26049
jetty-11.0.13 - 07 December 2022
+ 7117 Timeout with Expect 100 continue when using ProxyServlet
+ 7286 WebSocket write can time out even if the frame / callback has not been
failed.
+ 7993 HttpClient idleTimeout configuration being ignored/overridden
+ 8330 Persistent OpenId sessions can throw IllegalStateException
+ 8460 Log or throw exception if DefaultSessionIdManager is used but has not
been started.
+ 8536 HotSwapHandler race condition
+ 8558 Idle timeout occured sometimes on HTTP/2 client with
`InputStreamResponseListener`
+ 8584 org.eclipse.jetty.client.HttpRequest.send() never returns
+ 8591 Indicate units of HttpClient properties
+ 8623 Use AutoLock in InputStreamResponseListener
+ 8628 Pseudo restore `PathMappings.getMatch(String)` for backwards compat
reasons
+ 8678 Jetty client is not responding to GO_AWAY packet received from (Jetty)
Server and continue to send traffic on same connection
+ 8695 Update quiche to 0.16.0
+ 8712 ELContextCleaner no longer needed
+ 8716 Multiple Host header values handled poorly
+ 8721 jetty:effective-web-xml doesn't generate quickstart information for web
fragment jars that contain META-INF/resources
+ 8723 Provide a thread-safe way to modify HttpClient proxies at runtime
+ 8750 AbstractProxyServlet.onServerResponseHeaders does not support headers
with empty values
+ 8753 Starting HttpClient with destinationIdleTimeout set throws NPE
+ 8770 Review whether to send request body in redirects
+ 8779 CompactPathRule drops query section on use
+ 8786 KeyStoreScanner is not able to monitor a symlink file and always
resolves to the target.
+ 8810 `ArrayRetainableByteBufferPool` inefficiently calculates bucket indices
+ 8811 HTTP/2 session shutdown race may cause `Server.stop()` to block until
stop timeout
+ 8863 Provide a possibility to name virtual threads
+ 8895 Generate downloadable version of javadocs documentation in website
deploy script
+ 8897 Update Conditional request handling for RFC7232
+ 8905 GzipHandler fails to set Vary header on 304 responses
+ 8913 Review Jetty XML syntax to allow calling JDK methods
+ 8942 Use Logback 1.3.x for Jetty 10.0.x
+ 9006 WebSocket Message InputStream read() returns signed byte
jetty-10.0.13 - 07 December 2022
+ 7117 Timeout with Expect 100 continue when using ProxyServlet
+ 7286 WebSocket write can time out even if the frame / callback has not been
failed.
+ 7993 HttpClient idleTimeout configuration being ignored/overridden
+ 8330 Persistent OpenId sessions can throw IllegalStateException
+ 8460 Log or throw exception if DefaultSessionIdManager is used but has not
been started.
+ 8536 HotSwapHandler race condition
+ 8558 Idle timeout occured sometimes on HTTP/2 client with
`InputStreamResponseListener`
+ 8584 org.eclipse.jetty.client.HttpRequest.send() never returns
+ 8591 Indicate units of HttpClient properties
+ 8623 Use AutoLock in InputStreamResponseListener
+ 8628 Pseudo restore `PathMappings.getMatch(String)` for backwards compat
reasons
+ 8678 Jetty client is not responding to GO_AWAY packet received from (Jetty)
Server and continue to send traffic on same connection
+ 8695 Update quiche to 0.16.0
+ 8712 ELContextCleaner no longer needed
+ 8716 Multiple Host header values handled poorly
+ 8721 jetty:effective-web-xml doesn't generate quickstart information for web
fragment jars that contain META-INF/resources
+ 8723 Provide a thread-safe way to modify HttpClient proxies at runtime
+ 8750 AbstractProxyServlet.onServerResponseHeaders does not support headers
with empty values
+ 8753 Starting HttpClient with destinationIdleTimeout set throws NPE
+ 8770 Review whether to send request body in redirects
+ 8779 CompactPathRule drops query section on use
+ 8786 KeyStoreScanner is not able to monitor a symlink file and always
resolves to the target.
+ 8810 `ArrayRetainableByteBufferPool` inefficiently calculates bucket indices
+ 8811 HTTP/2 session shutdown race may cause `Server.stop()` to block until
stop timeout
+ 8863 Provide a possibility to name virtual threads
+ 8895 Generate downloadable version of javadocs documentation in website
deploy script
+ 8897 Update Conditional request handling for RFC7232
+ 8905 GzipHandler fails to set Vary header on 304 responses
+ 8913 Review Jetty XML syntax to allow calling JDK methods
+ 8942 Use Logback 1.3.x for Jetty 10.0.x
+ 9006 WebSocket Message InputStream read() returns signed byte
jetty-9.4.50.v20221201 - 01 December 2022
+ 8774 Added SizeLimitHandler
+ 8678 Jetty client is not responding to GO_AWAY packet received from (Jetty)
Server and continue to send traffic on same connection
jetty-12.0.0.alpha1 - 15 September 2022
+ 8474 Jetty 12 : Resource API Review
+ 8493 Review HTTP client feature `setRemoveIdleDestinations`
+ 8532 Review System.nanoTime() usages
+ 8540 Maven pom is not correct for `org.eclipse.jetty/infinispan-embedded`
and `org.eclipse.jetty/infinispan-remote`
+ 8578 `getRequestURL` can append "null" if `getRequestURI` is unspecified in
an authority-form request-target
jetty-11.0.12 - 14 September 2022
+ 7970 Maven Plugin - the option to set extraClasspath in the plugin
configuration isn't working
+ 8007 Support Loom
+ 8151 `JakartaWebSocketSession.close()` blocks long time when called from
`SendHandlerCallback`
+ 8152 jetty.sh does not read JAVA_OPTIONS anymore
+ 8170 WebSockets closed abruptly when using HTTP/2
+ 8196 Remove unused jetty-plus.xml file
+ 8206 Stopping server from within AbstractConnector#accept fails and results
in a partially stopped QueuedThreadPool
+ 8216 OpenID logout / more extensibible OpenIdConfiguration
+ 8222 Jetty start.jar fails with NullPointerException when referencing a non
existent module and using JVM args
+ 8259 Symlinks cause 404 with DefaultServlet when its "resourceBase" is
different from ContextHandler's
+ 8294 java.lang.ClassCastException: class org.eclipse.jetty.http.HttpField
cannot be cast to class org.eclipse.jetty.http.HttpCookie$SetCookieHttpField
+ 8296 SymlinkAllowedResourceAliasChecker is initialized after checkAlias is
called resulting that access to resource is denied
+ 8319 Allow configuring initial queue size per destination
+ 8353 Automatic pongs should not be sent when connection is closed
+ 8414 BlockingArrayQueue drops all contents on drain
+ 8493 Review HTTP client feature `setRemoveIdleDestinations`
+ 8497 `jetty-bom/11.0.11` depends on `jetty-slf4j-impl/10.0.8-SNAPSHO` that
cause 404 error
+ 8532 Review System.nanoTime() usages
+ 8540 Maven pom is not correct for `org.eclipse.jetty/infinispan-embedded`
and `org.eclipse.jetty/infinispan-remote`
+ 8578 `getRequestURL` can append "null" if `getRequestURI` is unspecified in
an authority-form request-target
jetty-10.0.12 - 14 September 2022
+ 7970 Maven Plugin - the option to set extraClasspath in the plugin
configuration isn't working
+ 8007 Support Loom
+ 8151 `JakartaWebSocketSession.close()` blocks long time when called from
`SendHandlerCallback`
+ 8152 jetty.sh does not read JAVA_OPTIONS anymore
+ 8170 WebSockets closed abruptly when using HTTP/2
+ 8196 Remove unused jetty-plus.xml file
+ 8206 Stopping server from within AbstractConnector#accept fails and results
in a partially stopped QueuedThreadPool
+ 8216 OpenID logout / more extensibible OpenIdConfiguration
+ 8222 Jetty start.jar fails with NullPointerException when referencing a non
existent module and using JVM args
+ 8259 Symlinks cause 404 with DefaultServlet when its "resourceBase" is
different from ContextHandler's
+ 8294 java.lang.ClassCastException: class org.eclipse.jetty.http.HttpField
cannot be cast to class org.eclipse.jetty.http.HttpCookie$SetCookieHttpField
+ 8296 SymlinkAllowedResourceAliasChecker is initialized after checkAlias is
called resulting that access to resource is denied
+ 8319 Allow configuring initial queue size per destination
+ 8353 Automatic pongs should not be sent when connection is closed
+ 8414 BlockingArrayQueue drops all contents on drain
+ 8493 Review HTTP client feature `setRemoveIdleDestinations`
+ 8532 Review System.nanoTime() usages
+ 8540 Maven pom is not correct for `org.eclipse.jetty/infinispan-embedded`
and `org.eclipse.jetty/infinispan-remote`
+ 8578 `getRequestURL` can append "null" if `getRequestURI` is unspecified in
an authority-form request-target
jetty-9.4.49.v20220914 - 14 September 2022
+ 8414 BlockingArrayQueue drops all contents on drain
+ 8493 Review HTTP client feature `setRemoveIdleDestinations`
+ 8578 `getRequestURL` can append "null" if `getRequestURI` is unspecified in
an authority-form request-target
jetty-12.0.0.alpha0 - 22 August 2022
+ First alpha release of Jetty 12. A lot changes but very good changes!
jetty-11.0.11 - 21 June 2022
+ 8184 All suffix globs except first fail to match if path has `.` character
in prefix section
jetty-10.0.11 - 21 June 2022
+ 8184 All suffix globs except first fail to match if path has `.` character
in prefix section
jetty-11.0.10 - 16 June 2022
+ 1771 Add module for SecuredRedirect support
+ 4414 GZipHandler not excluding inflation for specified paths
+ 7635 QPACK decoder should fail connection if the encoder blocks more than
SETTINGS_QPACK_BLOCKED_STREAMS
+ 7748 Allow overriding of url-pattern mapping in ServletContextHandler to
allow for regex or uri-template matching
+ 7754 jetty.sh ignores JAVA_OPTIONS environment variable
+ 7801 Session cookie can be set twice after session id changed
+ 7818 Modifying of HTTP headers in HttpChannel.Listener#onResponseBegin is no
longer possible with Jetty 10
+ 7855 Remove accidentally included package-info.class in all packages
+ 7858 GZipHandler does not play nice with other handlers in HandlerCollection
+ 7863 Default servlet drops first accept-encoding header if there is more
than one.
+ 7880 DefaultServlet should not overwrite programmatically configured
precompressed formats with defaults
+ 7891 Better Servlet PathMappings for Regex
+ 7918 PathMappings.asPathSpec does not allow root ServletPathSpec
+ 7935 Review HTTP/2 error handling (Resolves CVE-2022-2048)
+ 7975 `ForwardedRequestCustomizer` setters do not clear existing handlers
+ 7977 UpgradeHttpServletRequest.setAttribute &
UpgradeHttpServletRequest.removeAttribute can throw NullPointerException
+ 7994 Ability to construct a detached client Request
+ 8014 Review HttpRequest URI construction (Resolves CVE-2022-2047)
+ 8057 Support Http Response 103 (Early Hints)
+ 8067 Wall time usage in DoSFilter RateTracker results in false positive
alert
+ 8088 Add option to configure exitVm on ShutdownMonitor from System
properties
+ 8161 Improve SSLConnection buffers handling (Resolves CVE-2022-2191)
jetty-10.0.10 - 16 June 2022
+ 1771 Add module for SecuredRedirect support
+ 4414 GZipHandler not excluding inflation for specified paths
+ 7635 QPACK decoder should fail connection if the encoder blocks more than
SETTINGS_QPACK_BLOCKED_STREAMS
+ 7748 Allow overriding of url-pattern mapping in ServletContextHandler to
allow for regex or uri-template matching
+ 7754 jetty.sh ignores JAVA_OPTIONS environment variable
+ 7801 Session cookie can be set twice after session id changed
+ 7818 Modifying of HTTP headers in HttpChannel.Listener#onResponseBegin is no
longer possible with Jetty 10
+ 7855 Remove accidentally included package-info.class in all packages
+ 7858 GZipHandler does not play nice with other handlers in HandlerCollection
+ 7863 Default servlet drops first accept-encoding header if there is more
than one.
+ 7880 DefaultServlet should not overwrite programmatically configured
precompressed formats with defaults
+ 7891 Better Servlet PathMappings for Regex
+ 7918 PathMappings.asPathSpec does not allow root ServletPathSpec
+ 7935 Review HTTP/2 error handling (Resolves CVE-2022-2048)
+ 7975 `ForwardedRequestCustomizer` setters do not clear existing handlers
+ 7977 UpgradeHttpServletRequest.setAttribute &
UpgradeHttpServletRequest.removeAttribute can throw NullPointerException
+ 7994 Ability to construct a detached client Request
+ 8014 Review HttpRequest URI construction (Resolves CVE-2022-2047)
+ 8057 Support Http Response 103 (Early Hints)
+ 8067 Wall time usage in DoSFilter RateTracker results in false positive
alert
+ 8088 Add option to configure exitVm on ShutdownMonitor from System
properties
+ 8161 Improve SSLConnection buffers handling (Resolves CVE-2022-2191)
jetty-11.0.9 - 30 March 2022
+ 5681 Unrecognized jetty-home/start.jar command line option not reported
clearly
+ 5965 Option --write-module-graph produces wrong .dot file
+ 6879 Remove jminix (not maintained) module as hawtio provide same features
+ 7182 jetty.sh start process should remove jetty_state whenever deleting the
pid
+ 7344 Incompatible with jacoco due to shutdown race condition
+ 7414 QoSFilter.setMaxRequests throws NullPointerException
+ 7513 Getter/setter type mismatch for mbean attribute file in class
org.eclipse.jetty.deploy.PropertiesConfigurationManager
+ 7517 Some ArrayTrie methods throw StackOverflowError when cointaining a very
large entry
+ 7518 ArrayTrie getBest fails to match the empty string entry in certain
cases
+ 7545 Named arguments do not work in jetty-openid.xml
+ 7548 Interrupt flag is not always cleared in between requests
+ 7567 Gzip compression not working for multipart/form-data when added to the
allowed list using addIncludedMimeTypes.
+ 7573 WebSockets - "Unsupported PathParam Type: java.lang.Integer"
+ 7575 Misleading docs for `HttpClientTransportDynamic`
+ 7613 Configurations.add(Configuration) results in
UnsupportedOperationException
+ 7615 HttpServletResponse.encodeURL not working for URLs starting with ../
+ 7617 Logback-access RequestLog not working
+ 7625 HTTP/3 error against www.google.com
+ 7677 jetty-maven-plugin - maven internal dependencies included on webapp
classloader
+ 7683 GZIPContentDecoder ignores setUseInputDirectByteBuffers setting and
always uses non-direct buffers (causing GC locking)
+ 7688 Read data to native memory from HttpInput
+ 7748 Allow overriding of url-pattern mapping in ServletContextHandler to
allow for regex or uri-template matching
jetty-10.0.9 - 30 March 2022
+ 5681 Unrecognized jetty-home/start.jar command line option not reported
clearly
+ 5965 Option --write-module-graph produces wrong .dot file
+ 6879 Remove jminix (not maintained) module as hawtio provide same features
+ 7182 jetty.sh start process should remove jetty_state whenever deleting the
pid
+ 7344 Incompatible with jacoco due to shutdown race condition
+ 7414 QoSFilter.setMaxRequests throws NullPointerException
+ 7513 Getter/setter type mismatch for mbean attribute file in class
org.eclipse.jetty.deploy.PropertiesConfigurationManager
+ 7517 Some ArrayTrie methods throw StackOverflowError when cointaining a very
large entry
+ 7518 ArrayTrie getBest fails to match the empty string entry in certain
cases
+ 7545 Named arguments do not work in jetty-openid.xml
+ 7548 Interrupt flag is not always cleared in between requests
+ 7567 Gzip compression not working for multipart/form-data when added to the
allowed list using addIncludedMimeTypes.