9.4.58.v20250814

This is a sponsored release for an End of Life version of Jetty.

Changelog

• #13461 - 9.4.x HTTP2Session cleanups - Addresses CVE-2025-5115
• #13261 - Improve handling of failed HTTP/2 requests
• #461 - Move ServletTester to the test source directory

11.0.26

This is a sponsored release for an End of Life version of Jetty.

Changelog

• #6369 Increment default jetty.http2.rateControl.maxEventsPerSecond (@jebeaudet, @slovdahl, @markslater)
• #7818 Modifying of HTTP headers in HttpChannel.Listener#onResponseBegin is no longer possible with Jetty 10
• #13462 HTTP2Session cleanups - Addresses CVE-2025-5115

10.0.26

This is a sponsored release for an End of Life version of Jetty.

Changelog

• #6369 Increment default jetty.http2.rateControl.maxEventsPerSecond (@jebeaudet, @slovdahl, @markslater)
• #7818 Modifying of HTTP headers in HttpChannel.Listener#onResponseBegin is no longer possible with Jetty 10
• #13462 HTTP2Session cleanups - Addresses CVE-2025-5115

12.1.0.beta3

Special Thanks to the following Eclipse Jetty community members

• @afarber (Alexander Farber)
• @trucnguyenlam (Truc Nguyen Lam)
• @sanjerai (Sanjeev Rai)

Changelog

• #13449 - HTTP2Session cleanups. - Addresses CVE-2025-5115
• #13439 - ServletHolder::initJspServlet() throws NPE after #13363
• #13429 - ConnectionLimit has inacurate deprecation version
• #13422 - moved context demo fails with ee10 environment
• #13419 - testRemoveAndReleaseFromCompoundPool fails when user locale is en_DE (@afarber)
• #13405 - Use distinct method names for task consumption in AdaptiveExecutionStrategy
• #13403 - EE8 Servlet API throws exceptions in normal control flow
• #13402 - Use default constructor for Attributes.Mapped (@trucnguyenlam)
• #13395 - EE11 TCK failure: AsyncContext.dispatch(context, path)
• #13393 - EE11 TCK failure: getWriter
• #13386 - Improve javadoc documentation for core API methods (@afarber)
• #13384 - fix mod file name for inclusion
• #13375 - WebSocketClient attempts to use HTTP/2 on servers without SETTINGS_ENABLE_CONNECT_PROTOCOL
• #13368 - Valid query sequences are still reported as violations to ComplianceViolation.Listener
• #13366 - Introduce MimeTypes.Mutable.clear() API
• #13364 - Deploy warnings for ee8 demos
• #13356 - Executing --dry-run via shell $() can fail when certain JVM options are used.
• #13350 - Fixes to ConnectionLimit for use with WebSocket
• #13330 - Content negotiation for Accept-Language (static pages) ?
• #13284 - jetty-openid library swallows provider errors when getting auth code
• #13187 - Missing API to increase QueuedThreadPool maxThreads by leased threads + QoSHandler bug of exceeding maxRequestCount by 1
• #12735 - Provide better documentation of JettyWebSocketServletContainerInitializer and jetty-${ee-version}-websocket-jetty-server modules
• #12300 - Use of RewriteHandler.LastRuleHandler without a child handler should produce a clear error message. (@sanjerai)

12.0.25

Special Thanks to the following Eclipse Jetty community members

• @afarber (Alexander Farber)

Changelog

• #13449 - HTTP2Session cleanups.
• #13439 - ServletHolder::initJspServlet() throws NPE after #13363
• #13429 - ConnectionLimit has inacurate deprecation version
• #13419 - testRemoveAndReleaseFromCompoundPool fails when user locale is en_DE (@afarber)
• #13403 - EE8 Servlet API throws exceptions in normal control flow
• #13187 - Missing API to increase QueuedThreadPool maxThreads by leased threads + QoSHandler bug of exceeding maxRequestCount by 1

12.0.24

Special Thanks to the following Eclipse Jetty community members

• @afarber (Alexander Farber)
• @maarouf-yassine (Maarouf Yassine)
• @trucnguyenlam (Truc Nguyen Lam)

Changelog

• #13402 - Use default constructor for Attributes.Mapped (@trucnguyenlam)
• #13386 - Improve javadoc documentation for core API methods (@afarber)
• #13384 - fix mod file name for inclusion
• #13368 - Valid query sequences are still reported as violations to ComplianceViolation.Listener
• #13364 - Deploy warnings for ee8 demos
• #13363 - Improve JSP scratch directory creation and error message.
• #13356 - Executing --dry-run via shell $() can fail when certain JVM options are used.
• #13354 - Upgrade jasper-jsp 9.0.107, 10.1.43
• #13348 - jetty 12.0.x dependencies upgrade
• #13336 - HTTP/2 - Valid horizontal tab "\t" in http header is coverted into "?"
• #13324 - ConnectionLimit doesn't work with WebSocket connections.
• #13303 - Improved logging and exception handling in HTTP2Producer.
• #13300 - o.e.j.plus.jndi.Resources declared in eeX scope then linked via <resource-ref> or <resource-env-ref> in web.xml not found
• #13299 - Race Condition in WebSocketConnection - Job failed: java.lang.IllegalStateException: FILLING_AND_PARSING
• #13295 - Fix comments in NamingEntry; add support for simple scope name
• #13285 - Upgrade quiche to version 0.24.4
• #13284 - jetty-openid library swallows provider errors when getting auth code
• #13274 - JettyWebSocketTest sometimes fails with ConcurrentModificationException
• #13268 - charset=null is automatically added when using Content-Type: application/problem+json in Servlet ee10
• #13266 - Fix Typo in http.adoc (@maarouf-yassine)
• #13263 - NPE from SslEndPoint.isInputShutdown
• #13261 - Improve handling of failed HTTP/2 requests
• #13259 - org.eclipse.jetty.plus.jndi.Transaction should support javax.naming.Referenceable as a constructor option too.
• #13251 - Jetty 12.0.x use our new release tools
• #13234 - Regression in 12.0.21 on handling empty query parameters
• #13190 - Introduce ability to decode and/or canonicalize URIs in a RewriteRule
• #12818 - NPE with websocket java.lang.NullPointerException: Cannot invoke "org.eclipse.jetty.io.RetainableByteBuffer.hasRemaining()" because "this.networkBuffer" is null
• #9794 - Jetty 12 - jetty-ee9-proxy.xml broken
• #8867 - Jetty maven plugin is not Maven toolchain aware

12.1.0.beta2

Special Thanks to the following Eclipse Jetty community members

• @maarouf-yassine (Maarouf Yassine)

Changelog

• #13363 - Improve JSP scratch directory creation and error message.
• #13354 - Upgrade jasper-jsp 9.0.107, 10.1.43
• #13348 - jetty 12.0.x dependencies upgrade
• #13343 - Module eeN-quickstart should depend on eeN-annotations
• #13336 - HTTP/2 - Valid horizontal tab "\t" in http header is coverted into "?"
• #13330 - Content negotiation for Accept-Language (static pages) ?
• #13321 - Cleanup plus and annotations hierarchy
• #13303 - Improved logging and exception handling in HTTP2Producer.
• #13300 - o.e.j.plus.jndi.Resources declared in eeX scope then linked via <resource-ref> or <resource-env-ref> in web.xml not found
• #13299 - Race Condition in WebSocketConnection - Job failed: java.lang.IllegalStateException: FILLING_AND_PARSING
• #13295 - Fix comments in NamingEntry; add support for simple scope name
• #13291 - Remove unnecessary old slf4j osgi compatibility
• #13288 - jetty 12.0.x 8867 plugin toolchain
• #13285 - Upgrade quiche to version 0.24.4
• #13274 - JettyWebSocketTest sometimes fails with ConcurrentModificationException
• #13268 - charset=null is automatically added when using Content-Type: application/problem+json in Servlet ee10
• #13266 - Fix Typo in http.adoc (@maarouf-yassine)
• #13263 - NPE from SslEndPoint.isInputShutdown
• #13261 - Improve handling of failed HTTP/2 requests
• #13259 - org.eclipse.jetty.plus.jndi.Transaction should support javax.naming.Referenceable as a constructor option too.
• #13251 - Jetty 12.0.x use our new release tools
• #13242 - Keep extracted query params as attribute for jetty-core
• #13238 - stop.host property always uses the default 127.0.0.1
• #13234 - Regression in 12.0.21 on handling empty query parameters
• #13232 - Regression in ee9/ee8 getRequestDispatcher() exceptions
• #13228 - Update Core Deploy Documentation
• #13190 - Introduce ability to decode and/or canonicalize URIs in a RewriteRule
• #13127 - Support Digest authentication with SHA-256
• #13087 - Why doesn't SocketAddressResolver API receive the context map?
• #13043 - Review WebSocket flushers
• #12818 - NPE with websocket java.lang.NullPointerException: Cannot invoke "org.eclipse.jetty.io.RetainableByteBuffer.hasRemaining()" because "this.networkBuffer" is null
• #12735 - Provide better documentation of JettyWebSocketServletContainerInitializer and jetty-${ee-version}-websocket-jetty-server modules
• #11952 - Remove usages of ByteBufferCallbackAccumulator
• #9794 - Jetty 12 - jetty-ee9-proxy.xml broken
• #9632 - Jetty 12 - conditional headers handling for welcome files

12.0.23

Special Thanks to the following Eclipse Jetty community members

• @maarouf-yassine (Maarouf Yassine)
• @kohlschuetter (Dr. Christian Kohlschütter)

Changelog

• #13303 - Improved logging and exception handling in HTTP2Producer.
• #13300 - o.e.j.plus.jndi.Resources declared in eeX scope then linked via <resource-ref> or <resource-env-ref> in web.xml not found
• #13299 - Race Condition in WebSocketConnection - Job failed: java.lang.IllegalStateException: FILLING_AND_PARSING
• #13274 - 13287 Make Environment implementation thread-safe to prevent ConcurrentModificationException
• #13268 - charset=null is automatically added when using Content-Type: application/problem+json in Servlet ee10
• #13266 - Fix Typo in http.adoc (@maarouf-yassine)
• #13263 - NPE from SslEndPoint.isInputShutdown
• #13261 - Improve handling of failed HTTP/2 requests
• #13259 - org.eclipse.jetty.plus.jndi.Transaction should support javax.naming.Referenceable as a constructor option too.
• #13234 - Regression in 12.0.21 on handling empty query parameters
• #13232 - Regression in ee9/ee8 getRequestDispatcher() exceptions
• #13209 - stop throwing ISE when complete() is called after abort()
• #13201 - Fix ReadPendingException warning
• #13196 - Download of large file may get stuck in an infinite loop (bug in IOResources.copy / Content.Source) (@kohlschuetter)
• #13190 - Introduce ability to decode and/or canonicalize URIs in a RewriteRule
• #12818 - NPE with websocket java.lang.NullPointerException: Cannot invoke "org.eclipse.jetty.io.RetainableByteBuffer.hasRemaining()" because "this.networkBuffer" is null

12.1.0.beta1

Special Thanks to the following Eclipse Jetty community members

• @kohlschuetter (Dr. Christian Kohlschütter)

Changelog

• #13244 - Client responses of HTTP conversations have mismatching request
• #13242 - Keep extracted query params as attribute for jetty-core
• #13240 - Fix NPE in HttpReceiver.responseSuccess() when that method is called more than once
• #13230 - Prevent cycles/stackoverflow in dump
• #13218 - Support arbitrary Handlers and core webapp archives in core-deploy
• #13217 - Deployment of XML only with ServletContextHandler sets wrong baseResource
• #13214 - Port async cross context dispatch to ee11
• #13213 - Review WebSocket ClientUpgradeRequest API for 12.1
• #13206 - Improve InputStreamContentSource byte[] handling.
• #13205 - Re-implemented StacklessLogging to be thread safe
• #13196 - Download of large file may get stuck in an infinite loop (bug in IOResources.copy / Content.Source) (@kohlschuetter)
• #13187 - Missing API to increase QueuedThreadPool maxThreads by leased threads + QoSHandler bug of exceeding maxRequestCount by 1
• #13186 - Merge Jetty 12.1.x Support maven.offline property in jetty-start, to control of download of maven files from remote repos during --add-modules (#13147)
• #13181 - Reviewed HTTP/3 API to simplify the implementation.
• #13179 - Fix HTTP/3 behavior in case of client reset.
• #13170 - use real url as this can eventually be used by some tooling
• #13164 - ProxyServlet abort
• #13156 - Force servlet4 demos to be build last, to have ee8 built last
• #13144 - Cross Context Dispatch with Async does not honor context
• #13131 - Surface received GOAWAY in HttpClient
• #13122 - Common Annotation Parser
• #13098 - HTTP2 Server Error Handling is different than HTTP1
• #13057 - InvalidPathException instead of MalformedURLException after switching to jetty12
• #13043 - Review WebSocket flushers
• #13013 - Rework websocket FrameFlusher's expiration
• #12659 - Use websocket over varying http protocols using a single client
• #12453 - Guard against NullPointerException in AnnotationParser
• #11294 - NPE on trying to read uri, headers or attributes from the original HttpServletRequest wrapped in UpgradeRequest on WebSocket server in Jetty 12
• #9632 - Jetty 12 - conditional headers handling for welcome files
• #5442 - Allow multiple authentication options for a web app
• #4493 - Document ThreadPoolBudget behavior

12.0.22

Changelog

• #13182 - Ignore bad cookie names in legacy CookieCutter
• #13164 - ProxyServlet abort
• #13161 - Change default stop timeout value in WebSocketClient
• #13147 - Support maven.offline property in jetty-start, to control of download of maven files from remote repos during --add-modules
• #13144 - Cross Context Dispatch with Async does not honor context
• #13136 - Do not abort response in nested HttpChannelState.onError if sendError
• #13135 - Allow onSuccess to abort Iterating Callback
• #13131 - Surface received GOAWAY in HttpClient
• #13128 - Merge back Release/12.0.21
• #13126 - Fix shared blocking callback hang
• #13098 - HTTP2 Server Error Handling is different than HTTP1
• #13057 - InvalidPathException instead of MalformedURLException after switching to jetty12
• #13013 - Rework websocket FrameFlusher's expiration
• #12918 - NullPointerException with ServeAs requests (with FormAuthenticator)
• #12659 - Use websocket over varying http protocols using a single client