/
VERSION.txt
13814 lines (13122 loc) · 657 KB
/
VERSION.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
jetty-12.0.10-SNAPSHOT
jetty-12.0.9 - 03 May 2024
+ 5944 Introduce alias --files for --download
+ 5945 Introduce alias --skip-create-files to replace --skip-file-validation
+ 5946 Introduce alias for --include-jetty-dir
+ 9487 Jetty 12 - Upgrade Infinispan to version 15.x
+ 11026 Start Stop issue with Jetty 12 - state file not deleted every time
+ 11420 HTTP/3 Race with Dynamic Table referencing in QPackDecoder
+ 11488 Inconsistent default port number in HttpURI and HostPort
+ 11490 CustomRequestLog.ignorePath doesn't work as documented
+ 11514 Start properties `jetty.webapp.addServerClasses` and
`jetty.webapp.addSystemClasses` are not applied during ee8/ee9 deployments
+ 11573 Introduce new `disable-urlcache` module to globally disable JVM URL
caching of `jar` protocol references
+ 11597 Document Request Customizers
+ 11631 NPE in error handling leading to 100% CPU
+ 11634 Socks5Proxy does not support IP addresses with IP segments above 127
+ 11642 Restore jetty-ee8-runner
+ 11648 Introduce new HttpDateTime class for parsing obsolete Date formats in
HTTP and Cookie
+ 11656 Upgrade jetty-quiche-native to version 0.21.0
+ 11659 HTTP Fields with OWS (Optional WhiteSpace) in value are not properly
parsed in Jetty 12
+ 11679 Jetty 12.0.8 seems to leak connection when it encounters earlyEOF
+ 11687 `HttpFields$Mutable$Wrapper.computeField()` incorrectly calls
`onAddField()` when null is returned by `computeFn`
+ 11699 new IllegalStateException when attempting to access Request/Response
outside of Request Lifecycle
+ 11705 jetty-decorate.xml and jetty-web-decorate.xml in jetty-deploy
reference ee specific classes
jetty-12.0.8 - 29 March 2024
+ 5857 Deprecate AbstractConnectionPool "callback" methods
+ 7647 Document org.eclipse.jetty.client.Socks4Proxy "secure" parameter
+ 10387 Fix or suppress javadoc warnings
+ 10805 Jetty response with an invalid HTTP2 packet if the client set the
hpack table size as 0
+ 11263 Using `jetty.version` override from jetty-start does not use version
for various environment libs.
+ 11411 Allow non existant resources to be obtained from Resource.resolve()
+ 11482 The StatisticsHandler doesn't count 2xx codes
+ 11495 Add UriCompliance rules that follow the HTTP / URI / Servlet specs for
illegal & suspicious characters
+ 11510 Occasional NPE in ClassMatcher.match() from
WebAppClassLoader.loadClass() usage
+ 11513 Perf regression in the HTTP parser caused by long look-ahead
+ 11527 Reduce ByteBuffer churning in HttpOutput
+ 11539 `Resource.copyTo(Resource)` has different behavior from Jetty 9/10/11
+ 11548 java.nio.file.ClosedFileSystemException on hot redeploy
+ 11553 Restore startWebapp() to WebAppContext
+ 11558 New tmp directory should be created on every `WebAppContext` start, if
not explicitly configured
+ 11563 HttpClient InputStream.read() hangs intermittently before end of
response
+ 11567 DefaultServlet should resolve its resourceBase relative to the
ServletContextHandler resourceBase
+ 11572 Deploy behaves differently when both WAR and XML exist in
${jetty.base}/webapps/ and you update the XML vs updating the WAR.
+ 11574 shibboleth idp webapp under jetty 12.0.7
jetty-12.0.7 - 29 February 2024
+ 6140 Report total number of keys in SelectorManager
+ 7750 HttpURI.toURI() does not copy fragment
+ 8887 Jetty-12 client calls onDataAvailable with producing thread
+ 8979 Jetty 12 - HttpClientTransport network "modes"
+ 10805 Jetty response with an invalid HTTP2 packet if the client set the
hpack table size as 0
+ 11278 500 response when trying to display symlinked directory
+ 11310 Uploading big multipart files via jetty 12.0.5 with spring boot 3.2.1
cause problems
+ 11353 The default virtual thread executor should created named threads
+ 11356 Allow ServerWebSocketContainer to be created without ContextHandler
+ 11361 Update UriCompliance.checkUriCompliance
+ 11363 ContentSourcePublisher throws from request
+ 11370 IllegalStateException when last write fails
+ 11371 Review ArrayByteBufferPool eviction
+ 11372 Scheduler queue in the HTTP client grows infinitely when a server
times out
+ 11377 Jetty 12 fails to start WebApp Bundle with OSGi Boot bundle (or when
packaged)
+ 11387 Reintroduce MultiPartCompliance.LEGACY (not as default) too allow for
parsing of non-compliant `multipart/form-data`
+ 11396 NullPointerException when getting parts from HttpServletRequest
+ 11398 WebSocket ClosedChannelException when demanding frames in onOpen
+ 11401 Replace StringBuffer with StringBuilder
+ 11403 Expose `SslEndPoint` in `SslHandshakeListener`
+ 11410 PathMappingsHandler does not start ResourceHandler properly
+ 11414 When producing URI/URL strings follow spec and produce lowercase
schemes and drop default ports
+ 11424 What is the `jetty.deploy.scanInterval` default? module, ini, code
and documentation do not agree.
+ 11432 Review number of acceptor threads
+ 11441 Quote escaping in HTML file
+ 11448 UriCompliance.Violation ignored despite being set
+ 11465 HttpURI.toURI() sets userInfo to null
jetty-12.0.6 - 29 January 2024
+ 10220 Implement CrossOriginHandler
+ 10870 How to set HttpConfiguration.securePort when the HTTPS port is
dynamic?
+ 11080 Can't able to make multipart request and getting error
+ 11081 Dropped WebSocket messages due to race condition in WebSocket frame
handling
+ 11095 Jetty 12.0.5 (ee10) throws IllegalStateException for completed
requests when Gzip Handler is used
+ 11096 IllegalAccessException when invoking WebSocket end point methods in
Jetty 12
+ 11098 Sporadic NPE in ArrayByteBufferPool.evict()
+ 11213 Improve programming guide WebSocket JPMS documentation
+ 11220 ContextHandler(anyHandler) NPE during .<init> logging 'because
"this._vhosts" is null'
+ 11223 WebSocketClient.connect with URI including query parameters don't work
for HTTP2 connector
+ 11230 Problem with parsing of form parameters without values in Jetty 12?
+ 11253 Jetty 12 ComplianceViolation.Listener not notified for URI, Cookie and
Multipart violations.
+ 11259 HTTP/2 connection not closed after idle timeout when TCP congested
(CVE-2024-22201)
+ 11260 QuickStartConfiguration cannot be mixed with contexts that do not have
a `WEB-INF/quickstart-web.xml`
+ 11263 Using `jetty.version` override from jetty-start does not use version
for various environment libs.
+ 11273 Support BSD expr in startup script
+ 11275 Jakarta websocket @OnMessage with Reader parameter stops working when
there is an unhandled exception
+ 11280 Jetty 12 EE10 OSGi Boot invalid jetty.xml Handler configuration
+ 11281 Failed LOG.debug() with MultiPart
+ 11282 Deadlocks with DEBUG logging enabled in jetty-server testing
+ 11290 HTTP 400 and NPE in HttpParser for blank header value in Jetty 12.x
+ 11296 AbstractLoginModule porting issue
+ 11299 EE8/9 `DefaultServlet.doPost()` doesn't behave like Jetty 10/11
+ 11303 `JettyWebSocketFrameHandler` incorrectly relies on `autoDemand` when
handlers are not registered
+ 11312 baseResource/resourceBase is no longer extracted from ServletContext
+ 11317 Cleanup usages of `addBean(Object)` from constructors
+ 11329 Jetty 11->12 migration guide has incorrect new artifact names
+ 11339 Content-type additional parameters
+ 11349 Update quiche to 0.20.0
jetty-12.0.5 - 18 December 2023
+ 10277 Review read failures impacting writes
+ 10852 `ResourceHandler` could use a `.setUseFileMapping(boolean)` option
+ 10933 Review ServletChannelState.asyncError()
+ 10956 100 Continue handling
+ 11009 Add deployment exception for non Jakarta WebSocket endpoints used in
ServerEndpointConfig
+ 11014 RedirectRegexRule and RewritePatternRule should consider
relativeRedirectAllowed
+ 11016 IllegalStateException when stopping Server with pending requests
+ 11021 Do not call afterResponse() in case of failures
+ 11024 Properly scope jetty-security optional / test dependencies
+ 11031 HttpClient should expose Connection/EndPoint used by HTTP requests
+ 11037 Serialize HttpClient request failures
+ 11039 Memory leak and multiple (Http|Servlet)*Listener invokations after
restart
+ 11040 "not an allowed scheme" for GraalVM Native-Image resource:-URIs
+ 11064 NPE if MultiPartFormData.setFilesDirectory() is not called
jetty-12.0.4 - 30 November 2023
+ 9502 Produce SBOM and deploy to Maven Central
+ 9900 Improve `Request.getBeginNanoTime()` accuracy
+ 10234 Make idle timeouts transient
+ 10384 ServletChannel now using proper state changes for calls to
ErrorHandler to avoid IllegalStateExceptions
+ 10687 Jetty WebSocket remembers mappings on restart
+ 10749 WebSocketClient should expose upgrade request/response
+ 10775 Review ConnectionMetaData.isSecure()
+ 10781 Investigate if the `secondary_super_cache` is stable
+ 10797 Multiple identical `Set-Cookie` response lines produced
+ 10812 jetty-deploy has unnecessary dependency on awaitility/hamcrest pulled
in at runtime
+ 10829 Expired Session timing issue leads to Warning: "Invalidating session
{} found to be expired when requested"
+ 10879 Improve redirect handling with reproducible content
+ 10891 Support the "Partitioned" cookie attribute
+ 10919 EE10 multipart parsing may include '\r' at the front under certain
conditions
+ 10922 Fix NPE on null host when checking virtual host
+ 10926 AttributeNormalizer does not support combined resources
jetty-12.0.3 - 26 October 2023
+ 1256 DoSFilter leaks USER_AUTH entries
+ 10390 Jetty HTTP/3 Client fails when connecting to `nghttpx` server
+ 10477 Jetty 12: Review MBeans for Handlers
+ 10519 java.lang.IllegalStateException: Flusher when using HTTP/3 with Spring
Boot 3.2
+ 10537 HTTP/3: Incomplete Data Transfer When Used with Spring Boot WebFlux
+ 10555 Re-introduce a more complete set of stats in `StatisticsHandler`
+ 10582 NPE when including a directory that should be resolved with
servlet-mapped welcome file
+ 10656 EE10 `ServletRequest.getProtocolRequestId()` impl not spec compliant
when protocol is H1
+ 10661 Ensure jetty api servlets/filters take precedence over
`webdefault.xml` declarations.
+ 10688 Introduce Jetty 12 ee8 osgi layer
+ 10696 jetty.sh doesn't work with JETTY_USER in Jetty 10.0.17 thru Jetty
12.0.2
+ 10699 Jetty HTTP SPI redirects SOAP POST requests to GET requests if URL
does not end with /
+ 10705 Creating a `HTTP3ServerConnector` with a `SslContextFactory` that has
a non-null `SSLContext` makes the server fail to start with an unclear error
message
+ 10716 Incorrect setting of content type with charset encoding before and
after PrintWriter obtained
+ 10726 NPE in ResponseListeners content notification
+ 10731 org.eclipse.jetty.server.Request uses wrong context attribute name
javax.servlet instead of jakarta.servlet
+ 10734 jakarta.websocket.Session.getRequestParameterMap() contains the value
as key
+ 10771 EE10 `ServletRequest.isSecure()` not set by
`ForwardedRequestCustomizer`
+ 10786 TLS handshake failures leak HttpConnection.RequestTimeouts tasks
+ 10794 301 Moved Permanently produces query with `;` instead of `?`
jetty-12.0.2 - 09 October 2023
+ 7408 Change scope of maven plugin dependencies
+ 9665 `HttpCookieStore` incorrectly rejects cookies for domains that are an
IPv6 address
+ 9777 CrossOriginFilter does not return Vary header on no-cors mode
+ 9928 Backport `Request.getBeginNanoTime()`
+ 10219 Review HTTP Cookie parsing
+ 10271 jetty.sh does not stop jetty anymore
+ 10328 Review `ResourceFactory.newSystemResource(String)` behavior & javadoc
+ 10361 Introduce QoSHandler
+ 10388 Jetty10 inetaccess mod started error
+ 10440 ClassCastException with `<jettyEnvXml>` use in
`jetty-ee10-maven-plugin`
+ 10441 Jetty 12 ee8 jaspi is missing
+ 10442 Reduce verbosity when JMX finds overloaded setter
+ 10463 Jetty 12 throws Exception handling static files when using response
wrapper
+ 10466 Review HTTP session documentation
+ 10473 Startup Script reports `ok` too fast, and doesn't wait for actual
start of Jetty
+ 10474 Jetty 12 default error handler throws IllegalStateException for
application/json
+ 10475 Update Jetty 12 MANIFEST's Bundle-Copyright
+ 10482 RewriteHandler with multiple HeaderPatternRules
+ 10490 Jetty 12 Jakarta Websockets user principal is always null
+ 10498 NullPointerException from call to UpgradeRequest#getUserPrincipal with
Jetty 12
+ 10500 Jetty 12 HTTP SPI does not preserve double-quotes on valid request
headers
+ 10508 Jetty 12 IllegalArgumentExeption when setting a HTTP header to null
+ 10513 Lockup processing POST request body with Jetty 12.0.1 using http/2
+ 10543 Review HttpStream.consumeAvailable() implementations
+ 10547 Cannot customize Executor on WebSocketClient
+ 10557 Update quiche to 0.18.0
+ 10558 NPE when forwarding a request to default servlet which should redirect
to a subdirectory with trailing slash
+ 10665 Wrong BREE in Jetty jars
+ 10679 Review HTTP/2 rate control (CVE-2023-44487)
jetty-12.0.1 - 29 August 2023
+ 8926 HttpClient GZIPContentDecoder should remove Content-Length and
Content-Encoding: gzip
+ 9169 Idle timeout is ignored if callback is not completed
+ 9900 Improve `Request.getBeginNanoTime()` accuracy
+ 10158 Deploying on Jetty 12 using context XML files will only work when a
.properties file with the EE details is also present
+ 10207 Update failed JSP deployment message
+ 10213 UnknownFormatConversionException in `start.jar --debug` if path has
`%` sign
+ 10217 Review ProxyConnectionFactory buffer management
+ 10218 NPE in HttpChannelOverFCGI.receive()
+ 10274 java.nio.file.FileSystemNotFoundException when creating a resource
from a JAR URL
+ 10294 Request.getContext().getContextPath()
+ 10295 FormAuthenticator does not dispatch to an error page but redirect
+ 10306 Jetty 12 generates wrong Host header
+ 10309 Jetty 12: X-Powered-By header is added 2 times (if enabled)
+ 10312 Remove jetty-home-with-docs to eliminate build time cyclic
dependencies
+ 10315 ServletInputStream::isReady results in IllegalArgumentException
+ 10323 Jetty 12.0.0 return wrong value for
HttpServletRequest.isRequestedSessionIdValid
+ 10327 Jetty (embedded) rejected warning logs
+ 10330 Jetty 12: ResourceService throws NPE when resource has no filesystem
path
+ 10337 SizeLimitHandler does not enforce 0 responseLimit
+ 10338 ErorrHandler#writeErrorJson is private
+ 10349 Character encoding is reset when setting Content-Type
+ 10350 Support Java 21 virtual threads
+ 10352 Jetty accepts "+" prefixed value in Content-Length (CVE-2023-40167)
+ 10353 Questions about porting WebSocket APIs to jetty-core 12
+ 10356 Deploying WAR with `ee10-cdi-spi` fails with Weld 5/CDI 4
+ 10383 Unsuppressed exceptions from EE10 ServletTest
+ 10397 Iso88591StringBuilder.append seems to have a logic error
+ 10402 Investigate NPE from EE10 AsyncServletIOTest
+ 10411 Review deployment of Jetty Context XML files
+ 10416 EE9 Copies HttpFields in response
jetty-9.4.54.v20240208 - 08 February 2024
+ 1256 DoSFilter leaks USER_AUTH entries
+ 11259 HTTP/2 connection not closed after idle timeout when TCP congested
(CVE-2024-22201)
+ 11389 Strip default ports on ws/wss scheme uris too
jetty-11.0.20 - 29 January 2024
+ 11081 Dropped WebSocket messages due to race condition in WebSocket frame
handling
+ 11223 WebSocketClient.connect with URI including query parameters don't work
for HTTP2 connector
+ 11260 QuickStartConfiguration cannot be mixed with contexts that do not have
a `WEB-INF/quickstart-web.xml`
+ 11273 Support BSD expr in startup script
+ 11349 Update quiche to 0.20.0
jetty-11.0.19 - 15 December 2023
+ 9900 Improve `Request.getBeginNanoTime()` accuracy
+ 10812 jetty-deploy has unnecessary dependency on awaitility/hamcrest pulled
in at runtime
+ 10891 Support the "Partitioned" cookie attribute
+ 11014 RedirectRegexRule and RewritePatternRule should consider
relativeRedirectAllowed
+ 11031 HttpClient should expose Connection/EndPoint used by HTTP requests
+ 11039 Memory leak and multiple (Http|Servlet)*Listener invokations after
restart
+ 11044 Update jetty-11 to apache jasper 10.0.27
jetty-11.0.18 - 26 October 2023
+ 1256 DoSFilter leaks USER_AUTH entries
+ 10390 Jetty HTTP/3 Client fails when connecting to `nghttpx` server
+ 10519 java.lang.IllegalStateException: Flusher when using HTTP/3 with Spring
Boot 3.2
+ 10537 HTTP/3: Incomplete Data Transfer When Used with Spring Boot WebFlux
+ 10696 jetty.sh doesn't work with JETTY_USER in Jetty 10.0.17 thru Jetty
12.0.2
+ 10705 Creating a `HTTP3ServerConnector` with a `SslContextFactory` that has
a non-null `SSLContext` makes the server fail to start with an unclear error
message
+ 10731 org.eclipse.jetty.server.Request uses wrong context attribute name
javax.servlet instead of jakarta.servlet
+ 10786 TLS handshake failures leak HttpConnection.RequestTimeouts tasks
jetty-11.0.17 - 09 October 2023
+ 9777 CrossOriginFilter does not return Vary header on no-cors mode
+ 9928 Backport `Request.getBeginNanoTime()`
+ 10271 jetty.sh does not stop jetty anymore
+ 10473 Startup Script reports `ok` too fast, and doesn't wait for actual
start of Jetty
+ 10547 Cannot customize Executor on WebSocketClient
+ 10679 Review HTTP/2 rate control (CVE-2023-44487)
jetty-10.0.20 - 29 January 2024
+ 11081 Dropped WebSocket messages due to race condition in WebSocket frame
handling
+ 11223 WebSocketClient.connect with URI including query parameters don't work
for HTTP2 connector
+ 11260 QuickStartConfiguration cannot be mixed with contexts that do not have
a `WEB-INF/quickstart-web.xml`
+ 11273 Support BSD expr in startup script
+ 11349 Update quiche to 0.20.0
jetty-10.0.19 - 15 December 2023
+ 9900 Improve `Request.getBeginNanoTime()` accuracy
+ 10812 jetty-deploy has unnecessary dependency on awaitility/hamcrest pulled
in at runtime
+ 10891 Support the "Partitioned" cookie attribute
+ 11014 RedirectRegexRule and RewritePatternRule should consider
relativeRedirectAllowed
+ 11031 HttpClient should expose Connection/EndPoint used by HTTP requests
+ 11039 Memory leak and multiple (Http|Servlet)*Listener invokations after
restart
+ 11043 Update to apache jasper 9.0.83
jetty-10.0.18 - 26 October 2023
+ 1256 DoSFilter leaks USER_AUTH entries
+ 10390 Jetty HTTP/3 Client fails when connecting to `nghttpx` server
+ 10519 java.lang.IllegalStateException: Flusher when using HTTP/3 with Spring
Boot 3.2
+ 10537 HTTP/3: Incomplete Data Transfer When Used with Spring Boot WebFlux
+ 10696 jetty.sh doesn't work with JETTY_USER in Jetty 10.0.17 thru Jetty
12.0.2
+ 10705 Creating a `HTTP3ServerConnector` with a `SslContextFactory` that has
a non-null `SSLContext` makes the server fail to start with an unclear error
message
+ 10786 TLS handshake failures leak HttpConnection.RequestTimeouts tasks
jetty-10.0.17 - 09 October 2023
+ 9777 CrossOriginFilter does not return Vary header on no-cors mode
+ 9928 Backport `Request.getBeginNanoTime()`
+ 10473 Startup Script reports `ok` too fast, and doesn't wait for actual
start of Jetty
+ 10547 Cannot customize Executor on WebSocketClient
+ 10679 Review HTTP/2 rate control (CVE-2023-44487)
jetty-9.4.53.v20231009 - 09 October 2023
+ 10546 backport jetty-http Huffman encoders/decoders from Jetty 10.0.x
+ 10573 backport hpack improvements from Jetty 10.0.x (CVE-2023-36478)
+ 10679 backport HTTP/2 rate control from Jetty 10.0.x (CVE-2023-44487)
jetty-11.0.16 - 25 August 2023
+ 6140 Report total number of keys in SelectorManager
+ 7091 Add SOCKS5 support
+ 8405 Servlet 3.1 ReadListener.onAllDataRead() is called twice under h2 or
h2c if the server doesn't respond within 30s
+ 8556 ServletContext.getSessionTimeout() incorrectly throws
IllegalStateException
+ 8694 Make QuicServerConnector respect configured key store instances
+ 8926 HttpClient GZIPContentDecoder should remove Content-Length and
Content-Encoding: gzip
+ 9150 jetty-http-spi: Jetty's implementation of HttpExchange.setStreams
method faulty
+ 9386 SSL reports deprecated setting, but ssl.ini still uses it
+ 9397 HTTP/3 encryption configuration
+ 9476 onCompleteFailure called multiple times
+ 9524 InputStreamResponseListener's InputStream creates an exception on
close()
+ 9554 Move (qpack/hpack) HuffmanDecoder / HuffmanEncoder / NBitInteger* to
common location
+ 9682 RetainableByteBuffer buffer release bug in WebSocket
+ 9685 Jetty doesn't set the date header on error responses
+ 9720 Http2Session.streamIdleTimeout should permit being disabled from
AbstractHTTP2ServerConnectionFactory
+ 9749 Correct HPACK Integer Overflow (CVE-2023-36478)
+ 9772 Improve Quiche certificates deployment
+ 9777 CrossOriginFilter does not return Vary header on no-cors mode
+ 9795 http3-server is leaking the Jetty logging service to web applications
+ 9887 Deprecate CGI Servlet (CVE-2023-36479)
+ 9895 A MessageTooLargeException doesn't close a WebSocket connection
+ 9947 Cannot invoke "org.eclipse.jetty.io.ManagedSelector.getTotalKeys()"
because "selector" is null
+ 9990 Server rejects certain sizes of streamed request bodies
+ 10066 Allow `SAXParserFactory` or `SAXParser` to be configured in Jetty's
`XmlParser` class
+ 10086 Revisiting ProxyConfiguration.getProxies()
+ 10105 Document that Request objects are not reusable
+ 10120 OutOfMemoryError caused by CyclicTimeouts
+ 10135 Websocket: Using PerMessageDeflateExtension and flush in batchMode
send FLUSH_FRAME to client.
+ 10143 Startup fails due to IllegalArgumentException: Comparison method
violates its general contract
+ 10145 WritePendingException over HTTP/2 tunnel
+ 10160 Verify PROXY_AUTHENTICATION is sent to forward proxies
+ 10211 NPE in ArrayByteBufferPool.findOldestEntry()
+ 10312 Remove jetty-home-with-docs to eliminate build time cyclic
dependencies
+ 10350 Support Java 21 virtual threads
+ 10352 Jetty accepts "+" prefixed value in Content-Length (CVE-2023-40167)
+ 10388 Jetty10 inetaccess mod started error
+ 10397 Iso88591StringBuilder.append seems to have a logic error
jetty-11.0.15 - 11 April 2023
+ 6184 Remove usages of classes associated with JEP-411 that deprecate/remove
the SecurityManager from the JVM
+ 6483 Jetty http client SSL connectivity over CNTLM proxy fails
+ 9237 Decouple QTP `idleTimeout` from pool shrink rate
+ 9309 `jetty.sh` cannot handle complex Jetty properties from `start.d/*.ini`
+ 9400 Jetty logs warning with stacktrace when annotation parser encounters
module-info.class file inside elasticsearch-x-content jar
+ 9464 Add optional configuration to log user out after OpenID idToken expires
(CVE-2023-41900)
+ 9468 Jetty 11.0.14 is less tolerant of non-compliant cookies than 11.0.13
+ 9497 Maven plugin effective web xml: add support for jar projects
+ 9501 jetty client with proxy - ssl traffic between both proxy and servers
+ 9517 Jetty 10.0.14 uses wrong pathSpec for request
+ 9556 Password Util does not ask for password
jetty-11.0.14 - 22 February 2023
+ 7650 QueuedThreadPool: Stopped without executing or closing null
+ 9059 IteratingCallback not serializing close() and failed()
+ 9119 Wrong value of javax.servlet.forward.context_path attribute
+ 9181 NPE in SessionHandler.checkRequestedSessionId()
+ 9183 ConnectHandler may close the connection instead of sending 200 OK
+ 9285 ContextHandler sends redirect on BaseResponse instead of Wrapped
Response object from Handler chain
+ 9334 Better support for Cookie RFC 2965 (CVE-2023-26048)
+ 9337 LowResourceMonitor.getReasons should include detailed reason instead of
hard-coded message
+ 9339 Cleanup CookieCutter Parsing (CVE-2023-26049)
jetty-12.0.0 - 07 August 2023
+ 8405 Servlet 3.1 ReadListener.onAllDataRead() is called twice under h2 or
h2c if the server doesn't respond within 30s
+ 9386 SSL reports deprecated setting, but ssl.ini still uses it
+ 9720 Http2Session.streamIdleTimeout should permit being disabled from
AbstractHTTP2ServerConnectionFactory
+ 10121 ee9 to ee8 conversion not working for JSP files with jakarta imports
+ 10135 Websocket: Using PerMessageDeflateExtension and flush in batchMode
send FLUSH_FRAME to client.
+ 10155 EE10 Servlet include after `HttpServletResponse.getWriter().println()`
omits `Content-Length` from the response
+ 10160 Verify PROXY_AUTHENTICATION is sent to forward proxies
+ 10164 Needless META-INF/resources and web-fragment.xml mounts
+ 10211 NPE in ArrayByteBufferPool.findOldestEntry()
+ 10227 EE10 Unable to use Cookie attributes with
`HttpServletResponse.addCookie(jakarta.servlet.http.Cookie)`
+ 10229 HttpConfiguration.setIdleTimeout() breaks long running requests
+ 10231 DefaultServlet no longer supports POST and OPTIONS and returns a 405
instead
jetty-12.0.0.beta4 - 26 July 2023
+ 8556 ServletContext.getSessionTimeout() incorrectly throws
IllegalStateException
+ 9444 Unexpected encoding in request.getPathInfo() with Jetty 12 beta 0
+ 9910 Inconsistent handling of welcome files between Jetty 10 and 12
+ 10055 Deployment of static files does not work with --dry-run Jetty-12
+ 10066 Allow `SAXParserFactory` or `SAXParser` to be configured in Jetty's
`XmlParser` class
+ 10068 Jetty 12: instantiation of `HashLoginService`
+ 10084 ServletApiContext.getResourcePaths() doesn't respect the spec
+ 10086 Revisiting ProxyConfiguration.getProxies()
+ 10105 Document that Request objects are not reusable
+ 10120 OutOfMemoryError Upgrading from 9.4.49.v20220914 to 12.0.0.beta3
+ 10122 in jetty12 beta build error-page redirects wrongly?
+ 10123 in jetty12 beta partial http data request can get stuck now
+ 10131 Review ERROR query-string handling
+ 10134 `Server.stop()` and `WebInfConfiguration.deconfigure()` can throw a
`ClosedFileSystemException` when restoring the original base resource
+ 10139 DefaultServlet not working with named dispatch in Jetty-12 EE10
+ 10141 welcome-file ignored on jetty12ee10 on exploded deploy, works on ee9
and older jettys
+ 10142 req.getRequestDispatcher("/test.htm").include(req, resp); does not go
anywhere on jetty12ee10 on exploded deploy, works on ee9 and older jetty
+ 10143 Jetty12 startup fails randomly on JRebel
+ 10145 WritePendingException over HTTP/2 tunnel
jetty-12.0.0.beta3 - 03 July 2023
+ 9919 Jetty-12 creates two instances of ArrayByteBufferPool
+ 9925 Bring back Jetty <12 flexibility of "current context / context handler"
+ 9944 Remove integer for demand in websocket in Jetty-12
+ 9946 Handler passed to Handler in constructor a parent or child?
+ 9947 Cannot invoke "org.eclipse.jetty.io.ManagedSelector.getTotalKeys()"
because "selector" is null
+ 9953 Jetty 12.0 Handle HEAD requests in Handler
+ 9955 Jetty 12.0 beta 2 HttpServletResponse::getStatus returns 0 by default
+ 9960 Custom logging in Jetty 12 beta2 can fail due to NullPointerException
in org.eclipse.jetty.server.Request
+ 9965 prevent multiple websocket frames from being demanded in Jetty-12
+ 9966 NullPointerException with default servlet, include and welcome pages
+ 9972 getResourcePaths fails when a META-INF resource has reserved characters
in its filename
+ 9973 Creating a Resource for an entry in a nested jar file in Jetty 12
+ 9984 URLResource.isDirectory() throws a NullPointerException when created
from a jar:file: URL
+ 9990 Server rejects certain sizes of streamed request bodies
jetty-12.0.0.beta2 - 16 June 2023
+ 6140 Report total number of keys in SelectorManager
+ 7091 Add SOCKS5 support
+ 8694 Make QuicServerConnector respect configured key store instances
+ 8819 Jetty-12 Improve CustomRequestLog efficiency
+ 8885 Jetty-12, replacement for HttpChannel.Listener
+ 9072 The great Jetty-12 renaming omnibus
+ 9150 jetty-http-spi: Jetty's implementation of HttpExchange.setStreams
method faulty
+ 9173 Configuring SameSite on a per-cookie basis in Jetty 12
+ 9397 HTTP/3 encryption configuration
+ 9524 InputStreamResponseListener's InputStream creates an exception on
close()
+ 9554 Move (qpack/hpack) HuffmanDecoder / HuffmanEncoder / NBitInteger* to
common location
+ 9630 Jetty 12 - Make Context dumpable
+ 9631 Update jaspi jar for jetty-10 and verify permission names
+ 9637 jetty-12 ee10 ServletRequestListeners called too many times on
sendError
+ 9639 Deprecated properties used in jetty-12 demos
+ 9648 jetty-12 ee10 ServletApiResponse.sendError does not check for the
response already being committed
+ 9649 jetty-12 ee10 ServletApiResponse.addIntHeader does not ignore headers
after response committed
+ 9650 jetty-12 ee10 `ServletApiResponse.resetBuffer` does not check for
response being committed
+ 9657 jetty-12 ee9 & ee10 Request.upgrade returns null
+ 9680 Jetty-12 QuickStartTest leaking resources
+ 9682 A possible native memory leak through RetainableByteBuffers
+ 9685 Jetty doesn't set the date header on error responses
+ 9731 Infinite loop with mapped roles
+ 9734 Cookie config can be set after SessionHandler is started
+ 9743 jetty-12 ee9 changeSessionId should throw ISE if no exception
+ 9745 jetty-12 SecurityHandler role checking with * not correct
+ 9750 jetty-12 ee10 wrong authType for CLIENT-CERT
+ 9760 jetty-12 ee9 Omnibus tck failure analysis
+ 9762 jetty-12 ee9 Double parsing of cookies
+ 9766 jetty-12 ee9 ServerPush failures
+ 9767 jetty-12 ee10 ServerPush failures
+ 9770 Pictures are missed in documentation
+ 9772 Improve Quiche certificates deployment
+ 9774 jetty-12 ee10 Cross context dispatch is not supported
+ 9777 CrossOriginFilter does not return Vary header on no-cors mode
+ 9785 jetty-12 ee9 contextPath not set correctly on nested ContextHandler
+ 9795 http3-server is leaking the Jetty logging service to web applications
+ 9879 Jetty-12 rewrite demo not working
+ 9880 Jetty 12 - jetty.sh does not work on Ubuntu
+ 9881 H2 perf can be pathologically bad
+ 9887 Deprecate CGI Servlet (CVE-2023-36479)
+ 9895 A MessageTooLargeException doesn't close a WebSocket connection
+ 9906 Inconsistent handling of empty "path info" between Jetty 10 and 12
+ Jan (@janbartel) is now using IntelliJ!
jetty-12.0.0.beta1 - 02 May 2023
+ 6184 Remove usages of classes associated with JEP-411 that deprecate/remove
the SecurityManager from the JVM
+ 6483 Jetty http client SSL connectivity over CNTLM proxy fails
+ 7608 Jetty-12 MetaData cleanup needed
+ 8740 Jetty 12 - Move org.eclipse.jetty.server.context.ManagedAttributes to
core
+ 9237 Decouple QTP `idleTimeout` from pool shrink rate
+ 9309 `jetty.sh` cannot handle complex Jetty properties from `start.d/*.ini`
+ 9311 Performance of `ArrayRetainableByteBufferPool.acquire()` can degenerate
pathologically as the buckets grow in size
+ 9391 Jetty 12: port/move Jetty WebSocket APIs, client and server to
jetty-core
+ 9400 Jetty logs warning with stacktrace when annotation parser encounters
module-info.class file inside elasticsearch-x-content jar
+ 9408 HugeResourceTest failing
+ 9410 Jetty 12: review locking in `MultiPartFormData` and
`MultiPartByteRanges`
+ 9412 Jetty 12: WebSocket hangs when
ServerEndpointConfig.Configurator.getEndpointInstance() throws
+ 9438 Jetty 12: Review JakartaWebSocketClientContainer use of reflection
+ 9440 Jetty 12: HttpCookieStore should return cookies for "ws" schemes
+ 9442 Jetty 12 Documentation Html artifact not populated
+ 9444 Unexpected encoding in request.getPathInfo() with Jetty 12 beta 0
+ 9459 Path is missing from JSESSIONID cookie in 12 beta 0
+ 9463 NPE when starting jetty-ee10-maven-plugin
+ 9464 Add optional configuration to log user out after OpenID idToken expires
(CVE-2023-41900)
+ 9466 WebSocket `DeploymentException` is not thrown by client nor server
+ 9467 Jetty 12 - Review BOMs
+ 9468 Jetty 11.0.14 is less tolerant of non-compliant cookies than 11.0.13
+ 9497 Maven plugin add support for jar projects in `:effective-web-xml`
+ 9501 jetty client with proxy - ssl traffic between both proxy and servers
+ 9516 Remove CGI Servlet (CVE-2023-36479)
+ 9537 "error-on-el-not-found" behavior is not as specified
+ 9552 Jetty 12 - Rewrite of the Jetty WebSocket APIs
+ 9554 Move (qpack/hpack) HuffmanDecoder / HuffmanEncoder / NBitInteger* to
common location
+ 9556 Password Util does not ask for password
+ 9617 Update to apache jasper 10.1.7 for jetty-12 ee10
+ 9656 jetty-12 ee10 PushBuilderImpl.push must throw IllegalStateException
+ 9685 Jetty doesn't set the date header on error responses
jetty-12.0.0.beta0 - 23 February 2023
+ 7650 QueuedThreadPool: Stopped without executing or closing null
+ 8069 Jetty 12 is missing a way to record server latencies
+ 8984 Jetty 12 - Attributes dump is not working
+ 8991 Review naming of FrameHandler.isDemanding() in Jetty 12
+ 8993 `Content.Chunk.isTerminal()` cannot discriminate `EOF` from chunks
containing a pooled empty buffer
+ 9038 Jetty 12 - Review EE10 Http[Input|Output].Interceptor APIs
+ 9046 Fix jetty-12 tck tests
com.sun.ts.tests.servlet.api.jakarta_servlet_http.httpsessionx.URLClient.invalidateHttpSessionTest
and
com.sun.ts.tests.servlet.api.jakarta_servlet_http.httpsessionx.URLClient.invalidateHttpSessionxTest
+ 9051 Review Jetty-12 DelayedHandler
+ 9059 IteratingCallback not serializing close() and failed()
+ 9066 TCK multipart not set as request parameter
+ 9067 TCK DefaultServlet handling of dispatch include incorrect
+ 9078 Header image for Jetty demo page fails on hard refresh
+ 9119 Wrong value of javax.servlet.forward.context_path attribute
+ 9141 Thread-safe Content.Chunk#slice
+ 9145 Failure when running `add-module` for openid, websocket, and stats
modules
+ 9166 Jetty 12: review/remove ByteBufferPool
+ 9173 Configuring SameSite on a per-cookie basis in Jetty 12
+ 9181 NPE in SessionHandler.checkRequestedSessionId()
+ 9182 Jetty 12 - Public version of JakartaWebSocketServerContainer
+ 9183 ConnectHandler may close the connection instead of sending 200 OK
+ 9210 Jetty 12 - Review Pool and Pool.Entry
+ 9240 Jetty 12 - `AbstractConnectionPool.toString()` can trigger NPE
+ 9275 Jetty-12 H3 tests passing after 30s timeout
+ 9285 ContextHandler sends redirect on BaseResponse instead of Wrapped
Response object from Handler chain
+ 9288 Jetty 12 - Use oej.http.HttpCookie in jetty-client
+ 9293 Jetty 12 - Relax JPMS dependencies
+ 9301 JSTL fails in JPMS
+ 9322 404 handler not working in jetty-12
+ 9326 Jetty 12 - Rename DecryptedEndPoint to SslEndPoint
+ 9334 Better support for Cookie RFC 2965 compliance (CVE-2023-26049)
+ 9336 Review LifeCycle of Parts in Jetty 12
+ 9337 LowResourceMonitor.getReasons should include detailed reason instead of
hard-coded message
+ 9387 Remove Request.__defaultLocale
+ 9398 DefaultHandler does not list contexts
+ 9403 TCK failure: DefaultServlet only sets status 404 instead of sending 404
response
jetty-11.0.13 - 07 December 2022
+ 7117 Timeout with Expect 100 continue when using ProxyServlet
+ 7286 WebSocket write can time out even if the frame / callback has not been
failed.
+ 7993 HttpClient idleTimeout configuration being ignored/overridden
+ 8330 Persistent OpenId sessions can throw IllegalStateException
+ 8460 Log or throw exception if DefaultSessionIdManager is used but has not
been started.
+ 8536 HotSwapHandler race condition
+ 8558 Idle timeout occured sometimes on HTTP/2 client with
`InputStreamResponseListener`
+ 8584 org.eclipse.jetty.client.HttpRequest.send() never returns
+ 8591 Indicate units of HttpClient properties
+ 8623 Use AutoLock in InputStreamResponseListener
+ 8628 Pseudo restore `PathMappings.getMatch(String)` for backwards compat
reasons
+ 8678 Jetty client is not responding to GO_AWAY packet received from (Jetty)
Server and continue to send traffic on same connection
+ 8695 Update quiche to 0.16.0
+ 8712 ELContextCleaner no longer needed
+ 8716 Multiple Host header values handled poorly
+ 8721 jetty:effective-web-xml doesn't generate quickstart information for web
fragment jars that contain META-INF/resources
+ 8723 Provide a thread-safe way to modify HttpClient proxies at runtime
+ 8750 AbstractProxyServlet.onServerResponseHeaders does not support headers
with empty values
+ 8753 Starting HttpClient with destinationIdleTimeout set throws NPE
+ 8770 Review whether to send request body in redirects
+ 8779 CompactPathRule drops query section on use
+ 8786 KeyStoreScanner is not able to monitor a symlink file and always
resolves to the target.
+ 8810 `ArrayRetainableByteBufferPool` inefficiently calculates bucket indices
+ 8811 HTTP/2 session shutdown race may cause `Server.stop()` to block until
stop timeout
+ 8863 Provide a possibility to name virtual threads
+ 8895 Generate downloadable version of javadocs documentation in website
deploy script
+ 8897 Update Conditional request handling for RFC7232
+ 8905 GzipHandler fails to set Vary header on 304 responses
+ 8913 Review Jetty XML syntax to allow calling JDK methods
+ 8942 Use Logback 1.3.x for Jetty 10.0.x
+ 9006 WebSocket Message InputStream read() returns signed byte
jetty-11.0.12 - 14 September 2022
+ 7970 Maven Plugin - the option to set extraClasspath in the plugin
configuration isn't working
+ 8007 Support Loom
+ 8151 `JakartaWebSocketSession.close()` blocks long time when called from
`SendHandlerCallback`
+ 8152 jetty.sh does not read JAVA_OPTIONS anymore
+ 8170 WebSockets closed abruptly when using HTTP/2
+ 8196 Remove unused jetty-plus.xml file
+ 8206 Stopping server from within AbstractConnector#accept fails and results
in a partially stopped QueuedThreadPool
+ 8216 OpenID logout / more extensibible OpenIdConfiguration
+ 8222 Jetty start.jar fails with NullPointerException when referencing a non
existent module and using JVM args
+ 8259 Symlinks cause 404 with DefaultServlet when its "resourceBase" is
different from ContextHandler's
+ 8294 java.lang.ClassCastException: class org.eclipse.jetty.http.HttpField
cannot be cast to class org.eclipse.jetty.http.HttpCookie$SetCookieHttpField
+ 8296 SymlinkAllowedResourceAliasChecker is initialized after checkAlias is
called resulting that access to resource is denied
+ 8319 Allow configuring initial queue size per destination
+ 8353 Automatic pongs should not be sent when connection is closed
+ 8414 BlockingArrayQueue drops all contents on drain
+ 8493 Review HTTP client feature `setRemoveIdleDestinations`
+ 8497 `jetty-bom/11.0.11` depends on `jetty-slf4j-impl/10.0.8-SNAPSHO` that
cause 404 error
+ 8532 Review System.nanoTime() usages
+ 8540 Maven pom is not correct for `org.eclipse.jetty/infinispan-embedded`
and `org.eclipse.jetty/infinispan-remote`
+ 8578 `getRequestURL` can append "null" if `getRequestURI` is unspecified in
an authority-form request-target
jetty-10.0.16 - 25 August 2023
+ 6140 Report total number of keys in SelectorManager
+ 7091 Add SOCKS5 support
+ 8405 Servlet 3.1 ReadListener.onAllDataRead() is called twice under h2 or
h2c if the server doesn't respond within 30s
+ 8556 ServletContext.getSessionTimeout() incorrectly throws
IllegalStateException
+ 8694 Make QuicServerConnector respect configured key store instances
+ 8926 HttpClient GZIPContentDecoder should remove Content-Length and
Content-Encoding: gzip
+ 9150 jetty-http-spi: Jetty's implementation of HttpExchange.setStreams
method faulty
+ 9386 SSL reports deprecated setting, but ssl.ini still uses it
+ 9397 HTTP/3 encryption configuration
+ 9476 onCompleteFailure called multiple times
+ 9524 InputStreamResponseListener's InputStream creates an exception on
close()
+ 9554 Move (qpack/hpack) HuffmanDecoder / HuffmanEncoder / NBitInteger* to
common location
+ 9682 RetainableByteBuffer buffer release bug in WebSocket
+ 9685 Jetty doesn't set the date header on error responses
+ 9749 Correct HPACK Integer Overflow (CVE-2023-36478)
+ 9720 Http2Session.streamIdleTimeout should permit being disabled from
AbstractHTTP2ServerConnectionFactory
+ 9772 Improve Quiche certificates deployment
+ 9777 CrossOriginFilter does not return Vary header on no-cors mode
+ 9795 http3-server is leaking the Jetty logging service to web applications
+ 9887 Deprecate CGI Servlet (CVE-2023-36479)
+ 9895 A MessageTooLargeException doesn't close a WebSocket connection
+ 9947 Cannot invoke "org.eclipse.jetty.io.ManagedSelector.getTotalKeys()"
because "selector" is null
+ 9990 Server rejects certain sizes of streamed request bodies
+ 10055 Deployment of static files does not work with --dry-run Jetty-12
+ 10066 Allow `SAXParserFactory` or `SAXParser` to be configured in Jetty's
`XmlParser` class
+ 10086 Revisiting ProxyConfiguration.getProxies()
+ 10105 Document that Request objects are not reusable
+ 10120 OutOfMemoryError caused by CyclicTimeouts
+ 10135 Websocket: Using PerMessageDeflateExtension and flush in batchMode
send FLUSH_FRAME to client.
+ 10143 Startup fails due to IllegalArgumentException: Comparison method
violates its general contract
+ 10145 WritePendingException over HTTP/2 tunnel
+ 10160 Verify PROXY_AUTHENTICATION is sent to forward proxies
+ 10211 NPE in ArrayByteBufferPool.findOldestEntry()
+ 10271 jetty.sh does not stop jetty anymore
+ 10312 Remove jetty-home-with-docs to eliminate build time cyclic
dependencies
+ 10350 Support Java 21 virtual threads
+ 10352 Jetty accepts "+" prefixed value in Content-Length (CVE-2023-40167)
+ 10388 Jetty10 inetaccess mod started error
+ 10397 Iso88591StringBuilder.append seems to have a logic error
jetty-9.4.52.v20230823 - 23 August 2023
+ 9476 onCompleteFailure called multiple times
+ 9660 OpenId Revoked authentication allows one request (CVE-2023-41900)
+ 9887 Deprecate CGI Servlet (CVE-2023-36479)
+ 10066 Allow `SAXParserFactory` or `SAXParser` to be configured in Jetty's
`XmlParser` class
+ 10168 NPE in websocket extension startup
+ 10352 Jetty accepts "+" prefixed value in Content-Length (CVE-2023-40167)
+ 10337 SizeLimitHandler does not enforce 0 responseLimit
jetty-11.0.15 - 11 April 2023
+ 6184 Remove usages of classes associated with JEP-411 that deprecate/remove
the SecurityManager from the JVM
+ 6483 Jetty http client SSL connectivity over CNTLM proxy fails
+ 9237 Decouple QTP `idleTimeout` from pool shrink rate
+ 9309 `jetty.sh` cannot handle complex Jetty properties from `start.d/*.ini`
+ 9400 Jetty logs warning with stacktrace when annotation parser encounters
module-info.class file inside elasticsearch-x-content jar
+ 9464 Add optional configuration to log user out after OpenID idToken expires
(CVE-2023-41900)
+ 9468 Jetty 11.0.14 is less tolerant of non-compliant cookies than 11.0.13
+ 9497 Maven plugin effective web xml: add support for jar projects
+ 9501 jetty client with proxy - ssl traffic between both proxy and servers
+ 9517 Jetty 10.0.14 uses wrong pathSpec for request
+ 9556 Password Util does not ask for password
jetty-10.0.15 - 11 April 2023
+ 6184 JEP-411 will deprecate/remove the SecurityManager from the JVM
+ 6483 Jetty http client SSL connectivity over CNTLM proxy fails
+ 9237 Decouple QTP `idleTimeout` from pool shrink rate
+ 9309 `jetty.sh` cannot handle complex Jetty properties from `start.d/*.ini`
+ 9400 Jetty logs warning with stacktrace when annotation parser encounters
module-info.class file inside elasticsearch-x-content jar
+ 9464 Add optional configuration to log user out after OpenID idToken expires
(CVE-2023-41900)
+ 9468 Jetty 11.0.14 is less tolerant of non-compliant cookies than 11.0.13
+ 9497 Maven plugin effective web xml: add support for jar projects
+ 9501 jetty client with proxy - ssl traffic between both proxy and servers
+ 9517 Jetty 10.0.14 uses wrong pathSpec for request
+ 9556 Password Util does not ask for password
jetty-11.0.14 - 22 February 2023
+ 7650 QueuedThreadPool: Stopped without executing or closing null
+ 9059 IteratingCallback not serializing close() and failed()
+ 9119 Wrong value of javax.servlet.forward.context_path attribute
+ 9181 NPE in SessionHandler.checkRequestedSessionId()
+ 9183 ConnectHandler may close the connection instead of sending 200 OK
+ 9285 ContextHandler sends redirect on BaseResponse instead of Wrapped
Response object from Handler chain
+ 9334 Better support for Cookie RFC 2965 (CVE-2023-26048)
+ 9337 LowResourceMonitor.getReasons should include detailed reason instead of
hard-coded message
+ 9339 Cleanup CookieCutter Parsing (CVE-2023-26049) jetty-11.0.13 - 07
December 2022
+ 7117 Timeout with Expect 100 continue when using ProxyServlet
+ 7286 WebSocket write can time out even if the frame / callback has not been
failed.
+ 7993 HttpClient idleTimeout configuration being ignored/overridden
+ 8330 Persistent OpenId sessions can throw IllegalStateException
+ 8460 Log or throw exception if DefaultSessionIdManager is used but has not
been started.
+ 8536 HotSwapHandler race condition
+ 8558 Idle timeout occured sometimes on HTTP/2 client with
`InputStreamResponseListener`
+ 8584 org.eclipse.jetty.client.HttpRequest.send() never returns
+ 8591 Indicate units of HttpClient properties
+ 8623 Use AutoLock in InputStreamResponseListener
+ 8628 Pseudo restore `PathMappings.getMatch(String)` for backwards compat
reasons
+ 8678 Jetty client is not responding to GO_AWAY packet received from (Jetty)
Server and continue to send traffic on same connection
+ 8695 Update quiche to 0.16.0
+ 8712 ELContextCleaner no longer needed
+ 8716 Multiple Host header values handled poorly
+ 8721 jetty:effective-web-xml doesn't generate quickstart information for web
fragment jars that contain META-INF/resources
+ 8723 Provide a thread-safe way to modify HttpClient proxies at runtime
+ 8750 AbstractProxyServlet.onServerResponseHeaders does not support headers
with empty values
+ 8753 Starting HttpClient with destinationIdleTimeout set throws NPE
+ 8770 Review whether to send request body in redirects
+ 8779 CompactPathRule drops query section on use
+ 8786 KeyStoreScanner is not able to monitor a symlink file and always
resolves to the target.
+ 8810 `ArrayRetainableByteBufferPool` inefficiently calculates bucket indices
+ 8811 HTTP/2 session shutdown race may cause `Server.stop()` to block until
stop timeout
+ 8863 Provide a possibility to name virtual threads
+ 8895 Generate downloadable version of javadocs documentation in website
deploy script
+ 8897 Update Conditional request handling for RFC7232
+ 8905 GzipHandler fails to set Vary header on 304 responses
+ 8913 Review Jetty XML syntax to allow calling JDK methods
+ 8942 Use Logback 1.3.x for Jetty 10.0.x
jetty-10.0.14 - 22 February 2023
+ 7650 QueuedThreadPool: Stopped without executing or closing null
+ 9059 IteratingCallback not serializing close() and failed()
+ 9119 Wrong value of javax.servlet.forward.context_path attribute
+ 9181 NPE in SessionHandler.checkRequestedSessionId()
+ 9183 ConnectHandler may close the connection instead of sending 200 OK
+ 9285 ContextHandler sends redirect on BaseResponse instead of Wrapped
Response object from Handler chain
+ 9344 Cleanup Multipart Handling (CVE-2023-26048)
+ 9339 Cleanup CookieCutter Parsing (CVE-2023-26049)
+ 9334 Better support for Cookie RFC 2965 compliance
+ 9337 LowResourceMonitor.getReasons should include detailed reason instead of
hard-coded message
jetty-9.4.51.v20230217 - 17 February 2023
+ 9059 IteratingCallback not serializing close() and failed()
+ 9181 NPE in SessionHandler.checkRequestedSessionId()
+ 9345 Backport Fix for CVE-2023-26048
+ 9352 Backport Fix for CVE-2023-26049
jetty-11.0.13 - 07 December 2022
+ 7117 Timeout with Expect 100 continue when using ProxyServlet
+ 7286 WebSocket write can time out even if the frame / callback has not been
failed.
+ 7993 HttpClient idleTimeout configuration being ignored/overridden
+ 8330 Persistent OpenId sessions can throw IllegalStateException
+ 8460 Log or throw exception if DefaultSessionIdManager is used but has not
been started.
+ 8536 HotSwapHandler race condition
+ 8558 Idle timeout occured sometimes on HTTP/2 client with
`InputStreamResponseListener`
+ 8584 org.eclipse.jetty.client.HttpRequest.send() never returns
+ 8591 Indicate units of HttpClient properties
+ 8623 Use AutoLock in InputStreamResponseListener
+ 8628 Pseudo restore `PathMappings.getMatch(String)` for backwards compat
reasons
+ 8678 Jetty client is not responding to GO_AWAY packet received from (Jetty)
Server and continue to send traffic on same connection
+ 8695 Update quiche to 0.16.0
+ 8712 ELContextCleaner no longer needed
+ 8716 Multiple Host header values handled poorly
+ 8721 jetty:effective-web-xml doesn't generate quickstart information for web
fragment jars that contain META-INF/resources
+ 8723 Provide a thread-safe way to modify HttpClient proxies at runtime
+ 8750 AbstractProxyServlet.onServerResponseHeaders does not support headers
with empty values
+ 8753 Starting HttpClient with destinationIdleTimeout set throws NPE
+ 8770 Review whether to send request body in redirects
+ 8779 CompactPathRule drops query section on use
+ 8786 KeyStoreScanner is not able to monitor a symlink file and always
resolves to the target.
+ 8810 `ArrayRetainableByteBufferPool` inefficiently calculates bucket indices
+ 8811 HTTP/2 session shutdown race may cause `Server.stop()` to block until
stop timeout
+ 8863 Provide a possibility to name virtual threads
+ 8895 Generate downloadable version of javadocs documentation in website
deploy script
+ 8897 Update Conditional request handling for RFC7232
+ 8905 GzipHandler fails to set Vary header on 304 responses
+ 8913 Review Jetty XML syntax to allow calling JDK methods
+ 8942 Use Logback 1.3.x for Jetty 10.0.x
+ 9006 WebSocket Message InputStream read() returns signed byte
jetty-10.0.13 - 07 December 2022
+ 7117 Timeout with Expect 100 continue when using ProxyServlet
+ 7286 WebSocket write can time out even if the frame / callback has not been
failed.
+ 7993 HttpClient idleTimeout configuration being ignored/overridden
+ 8330 Persistent OpenId sessions can throw IllegalStateException
+ 8460 Log or throw exception if DefaultSessionIdManager is used but has not
been started.
+ 8536 HotSwapHandler race condition
+ 8558 Idle timeout occured sometimes on HTTP/2 client with
`InputStreamResponseListener`
+ 8584 org.eclipse.jetty.client.HttpRequest.send() never returns
+ 8591 Indicate units of HttpClient properties
+ 8623 Use AutoLock in InputStreamResponseListener
+ 8628 Pseudo restore `PathMappings.getMatch(String)` for backwards compat
reasons
+ 8678 Jetty client is not responding to GO_AWAY packet received from (Jetty)
Server and continue to send traffic on same connection
+ 8695 Update quiche to 0.16.0
+ 8712 ELContextCleaner no longer needed
+ 8716 Multiple Host header values handled poorly
+ 8721 jetty:effective-web-xml doesn't generate quickstart information for web
fragment jars that contain META-INF/resources
+ 8723 Provide a thread-safe way to modify HttpClient proxies at runtime
+ 8750 AbstractProxyServlet.onServerResponseHeaders does not support headers
with empty values
+ 8753 Starting HttpClient with destinationIdleTimeout set throws NPE
+ 8770 Review whether to send request body in redirects
+ 8779 CompactPathRule drops query section on use
+ 8786 KeyStoreScanner is not able to monitor a symlink file and always
resolves to the target.
+ 8810 `ArrayRetainableByteBufferPool` inefficiently calculates bucket indices
+ 8811 HTTP/2 session shutdown race may cause `Server.stop()` to block until
stop timeout