Log message:
Update to 8.0.32

Changelog:
Tomcat 8.0.32 (markt)
General

    Add: Allow to configure multiple JUnit test class patterns with the build \ 
property test.name and document the property in BUILDING.txt. (rjung)
    Fix: 58768: Log a warning if a redirect fails because of an invalid \ 
location. (markt)

Catalina

    Fix: Fix class loader decision on the delegation for class loading and \ 
resource lookup and make it faster too. (rjung)
    Fix: 58946: Ensure that the request parameter map remains immutable when \ 
processing via a RequestDispatcher. (markt)
    Fix: 58827: Deprecate what is left of the JSR 77 implementation. (markt)
    Fix: 58905: Ensure that Tomcat.silence() silences the correct logger and \ 
respects the current setting. (markt)

Coyote

    Add: New configuration option ajpFlush for the AJP connectors to disable the \ 
sending of AJP flush packets. (rjung)

Cluster

    Fix: Correct a regression in the session attribute filtering that prevented \ 
clustering from starting in the default configuration. (kfujino)

WebSocket

    Fix: Fix a timing issue on session close that could result in an exception \ 
being thrown for an incomplete message even through the message was completed. \ 
(markt)

not released Tomcat 8.0.31 (markt)
Catalina

    Fix: Correct implementation of validateClientProvidedNewSessionId so client \ 
provided session IDs may be rejected if validation is enabled. (markt)
    Fix: Add path parameter handling to HttpServletRequest.getContextPath(). \ 
This is a follow-up to the fix for 57215. (markt)
    Fix: 58692: Make StandardJarScanner more robust. Log a warning if a class \ 
path entry cannot be scanned rather than triggering the failure of the web \ 
application. Includes a test case written by Derek Abdine. (markt)
    Fix: 58701: Reset the instanceInitialized field in StandardWrapper when \ 
unloading a Servlet so that a new instance may be correctly initialized. (markt)
    Fix: 58702: Ensure an access log entry is generated if the client aborts the \ 
connection. (markt)
    Fix: Fixed various issues reported by Findbugs. (violetagg)
    Fix: 58735: Add support for the X-XSS-Protection header to the \ 
HttpHeaderSecurityFilter. Patch provided by Jacopo Cappellato. (markt)
    Fix: 58751: Correctly handle the case where an AsyncListener dispatches to a \ 
Servlet on an asynchronous timeout and the Servlet uses sendError() to trigger \ 
an error page. Includes a test case based on code provided by Andy \ 
Wilkinson.(markt)
    Fix: 58765: Change default for mapperContextRootRedirectEnabled to true \ 
since this is required for correct session management because of the default for \ 
sessionCookiePathUsesTrailingSlash. (markt)
    Fix: Add the StatusManagerServlet to the list of Servlets that can only be \ 
loaded by privileged applications. (markt)
    Fix: Simplify code and fix messages in \ 
org.apache.catalina.core.DefaultInstanceManager class. (kkolinko)
    Code: Deprecate InstanceListener, InstanceEvent and InstanceSupport prior to \ 
removal in 9.0.x. (markt)
    Fix: Ensure that the proper file encoding if specified will be used when a \ 
readme file is served by DefaultServlet. (violetagg)
    Fix: Fix declaration of localPort attribute of Connector MBean: it is \ 
read-only. (kkolinko)
    Fix: 58766: Make skipping non-class files during annotation scanning faster \ 
by checking the file name first. Improve debug logging. (kkolinko)
    Fix: 58809: Correctly recycle cookies when mapping requests for parallel \ 
deployment. As a side-effect of this fix, the system property \ 
org.apache.tomcat.util.http.ServerCookie.PRESERVE_COOKIE_HEADER is no longer \ 
used. From this release, Tomcat will always preserve the cookie header. (markt)
    Fix: 58836: Correctly merge query string parameters when processing a \ 
forwarded request where the target includes a query string that contains a \ 
parameter with no value. (markt/kkolinko)
    Fix: Make sure that shared Digester is reset in an unlikely error case in \ 
HostConfig.deployWAR(). (kkolinko)
    Fix: 58867: Improve checking on Host start for WAR files that have been \ 
modified while Tomcat has stopped and re-expand them if unpackWARs is true. \ 
(markt)
    Fix: Fix a potential JDBC resource leak in DataSourceRealm. (schultz)
    Fix: 58900: Correctly undeploy symlinked resources and prevent an infinite \ 
cycle of deploy / undeploy. (markt)
    Fix: Protect initialization of ResourceLinkFactory when running with a \ 
SecurityManager. (kkolinko)
    Add: Extend the feature available in the cluster session manager \ 
implementations that enables session attribute replication to be filtered bases \ 
on attribute name to all session manager implementations. Note that \ 
configuration attribute name has changed from sessionAttributeFilter to \ 
sessionAttributeNameFilter. Apply the filter on load as well as unload to ensure \ 
that configuration changes made while the web application is stopped are applied \ 
to any persisted data. (markt)
    Add: Extend the session attribute filtering options to include filtering \ 
based on the implementation class of the value and optional WARN level logging \ 
if an attribute is filtered. These options are available for all of the Manager \ 
implementations that ship with Tomcat. When a SecurityManager is used filtering \ 
will be enabled by default. (markt)

Jasper

    Fix: Fix handling of missing messages in org.apache.el.util.MessageFactory. \ 
(violetagg)

Cluster

    Fix: In order to avoid that the heartbeat thread and the background thread \ 
to run Channel.heartbeat simultaneously, if heartbeatBackgroundEnabled of \ 
SimpleTcpCluster set to true, ensure that the heartbeat thread does not start. \ 
(kfujino)
    Code: Simplify the code of JvmRouteBinderValve.ed directly at Engine \ 
element. (kfujino)

WebSocket

    Fix: 57489: Ensure onClose() is called when a WebSocket connection is closed \ 
even if the sending of the close message fails. Includes test cases by Barry \ 
Coughlan. (markt)

Web Applications

    Addl docs. (kfujino)
    Fix: Correct some typos in the JNDI resources How-To. (markt)
    Fix: Don't create sessions unnecessarily in the Manager application. (markt)
    Fix: Don't create sessions unnecessarily in the Host Manager application. (markt)
    referencing contexts deployed using parallel deployment. (markt)

Tribes

    Fix: Fix potential NPE in AbstractReplicatedMap.breakdown(). (kfujino)
    Fix: Add support for the startup notification of local members in the static \ 
cluster. (kfujino)
    Fix: Ignore the unnecessary member remove operation from different domain. \ 
(kfujino)
    Fix: Add support for the shutdown notification of local members in the \ 
static cluster. (kfujino)
    Fix: Ensure that asynchronous session replication thread is a daemon thread. \ 
(kfujino)

Other

    Update: Remove native code (Windows Service Wrapper, APR/native connector) \ 
support for Windows Itanium. (markt)
    Update: Update the packaged version of the Tomcat Native Library to 1.2.4 to \ 
pick up the Windows binaries that are based on OpenSSL 1.0.2e and APR 1.5.1. \ 
(markt)
    Update: Update the NSIS Installer used to build the Windows Installers to \ 
version 2.50. (markt/kkolinko)
    Update: Update optional Checkstyle library to 6.14.1. (kkolinko)

Log message:
Update to 8.0.30

Changelog:
Tomcat 8.0.30 (markt)
Catalina

    Fix: 34319: Only load those keys in StoreBase.processExpire from JDBCStore, \ 
that are old enough, to be expired. Based on a patch by Tom Anderson. \ 
(fschumacher)
    Add: 56917: As per RFC7231 (HTTP/1.1), allow HTTP/1.1 and later redirects to \ 
use relative URIs. This is controlled by a new attribute useRelativeRedirects on \ 
the Context and defaults to true. (markt)
    Fix: 58629: Allow an embedded Tomcat instance to start when the Service has \ 
no Engine configured. (markt)
    Fix: 58635: Enable break points to be set within agent code when running \ 
Tomcat with a Java agent. Based on a patch by Huxing Zhang. (markt)
    Fix: 58660: Correct a regression in 8.0.29 caused by the change that moved \ 
the redirection for context roots from the Mapper to the Default Servlet. \ 
(markt)
    Fix: Fixed potential NPE in HostConfig while deploying an application. Issue \ 
reported by coverity scan. (violetagg)
    Fix: 58655: Fix an IllegalStateException when calling \ 
HttpServletResponse.sendRedirect() with the RemoteIpFilter. This was caused by \ 
trying to correctly generate the absolute URI for the redirect. With the fix for \ 
56917, redirects may now be relative making the sendRedirect() implementation \ 
for the RemoteIpFilter much simpler. This also addresses issues where the \ 
redirect may not have behaved as expected when redirecting from http to https to \ 
from https to http. (markt)
    Fix: 58657: Exceptions in a Servlet 3.1 ReadListener or WriteListener do not \ 
need to be immediately fatal to the connection. Allow an error response to be \ 
written. (markt)

Coyote

    Fix: Improve upgrade context classloader handling by using Context.bind and \ 
unbind. (remm)

Jasper

    Fix: 57136#c25: Change default value of quoteAttributeEL setting in Jasper \ 
to be true for better compatibility with other implementations and older \ 
versions of Tomcat (8.0.26/7.0.64 and earlier). Add command line option \ 
-no-quoteAttributeEL in JspC. (kkolinko)

Cluster

    Fix: Fix potential integer overflow in DeltaSession. Reported by coverity \ 
scan. (fschumacher)

WebSocket

    Add: 55006: The WebSocket client now honors the \ 
java.net.java.net.ProxySelector configuration (using the HTTP type) when \ 
establishing WebSocket connections to servers. Based on a patch by Niki \ 
Dokovski. (markt)
    Fix: 58624: Correct a thread safety issue that meant that blocking message \ 
writes could block indefinitely if the WebSocket connection was closed while a \ 
message write was in progress. (markt)

Web Applications

    Fix: 58631: Correct the continuation character use in the Windows Service \ 
How-To page of the documentation web application. (markt)

Tribes

    Fix: Ensure that the static member is registered to the add suspect list \ 
even if the static member that is registered to the remove suspect list has \ 
disappeared. (kfujino)
    Fix: Correct the warning log of when the member that is not registered in \ 
the membership is detected. (kfujino)
    Fix: When using a static cluster, add the members that have been cached in \ 
the membership service to the map members list in order to ensure that the map \ 
member is a static member. (kfujino)

jdbc-pool

    Fix: Correct evaluation of system property \ 
org.apache.tomcat.jdbc.pool.onlyAttemptCurrentClassLoader. It was basically \ 
ignored before. Reported by coverity scan. (fschumacher)
    Fix: Fix potential integer overflow in ConnectionPool and PooledConnection. \ 
Reported by coverity scan. (fschumacher)

Other

    Update: Update optional Checkstyle library to 6.13. (kkolinko)

2015-11-24 Tomcat 8.0.29 (markt)
General

    Update: 58596: Clarify the description in RUNNING.txt of how environment \ 
variables are used. (markt)

Catalina

    Add: Extend the fix for 57136 to provide a JSP Servlet initialisation \ 
parameter per web application that controls whether or not EL in JSP attributes \ 
is processed as if it uses JSP attribute quoting. By default, EL does not use \ 
JSP attribute quoting. (markt)
    Fix: 57799: InputStream.available() was causing an IO operation to occur \ 
even in blocking mode, which caused problems with NIO2. (remm)
    Add: Extend the fix for 58228 to include ServletContext.getRealPath(). (markt)
    Add: 58486: Protect against two further possible memory leaks associated \ 
with XML parsing. (markt)
    Fix: 58490: Fixed NPE thrown when scanning for \ 
javax.servlet.ServletContainerInitializer in case the web application is not \ 
extracted. (violetagg)
    Code: 58497: Make AbstractHttp11Processor easy to extend. (markt)
    Fix: 58508: Escape role names when generating associated MBeans in case the \ 
role name contains characters not permitted in an MBean name. (markt)
    Fix: 58518: Correct a regression in the fix for 56777 that added support for \ 
URIs in config file locations. File paths on Windows could previously be \ 
specified with \ or / as the separator. 56777 broke that. (markt)
    Fix: 58519: Fix ISE thrown by web application classloader in some error \ 
conditions due to trying to call initCause() on a ClassNotFoundException which \ 
is not permitted. (markt)
    Fix: 58534: Removed repeated conditional tests in \ 
o.a.tomcat.websocket.pojo.PojoMethodMapping and o.a.tomcat.util.net.AprEndpoint \ 
Patch provided by Anthony Whitford. (violetagg)
    Fix: 58535: Use Collections.reverseOrder when a reverse ordering is needed. \ 
(violetagg)
    Fix: 58537, 58546: Some of the inner classes in \ 
o.a.catalina.valves.ExtendedAccessLogValve and \ 
o.a.tomcat.util.net.SecureNio2Channel are made static. Patch provided by Anthony \ 
Whitford. (violetagg)
    Fix: 58540: Removed unused code from o.a.catalina.connector.Request. Patch \ 
provided by Anthony Whitford. (violetagg)
    Fix: 58541, 58544: It is more efficient to call Integer.toString(int) \ 
instead of Integer.valueOf(int).toString() when only a string representation of \ 
a primitive is needed. Based on a patch provided by Anthony Whitford. \ 
(violetagg)
    Fix: 58541, 58547: It is more efficient to call valueOf(...) instead of \ 
Number constructor. Based on a patch provided by Anthony Whitford. (violetagg)
    Fix: 58545: In some use cases it is more efficient to use Map.entrySet() \ 
instead of Map.keySet() Based on a patch provided by Anthony Whitford. \ 
(violetagg)
    Fix: Ensure that ServletRequest.getContentLengthLong is used instead of \ 
ServletRequest.getContentLength for servlets and valves provided by Tomcat. The \ 
API is available since Servlet specification 3.1. (violetagg)
    Add: Add a new RestCsrfPreventionFilter that provides basic CSRF protection \ 
for REST APIs. (violetagg)
    Fix: 58578: Avoid NPE accessing cookies during access logging for request \ 
that had no context mapping. (remm)
   error page fails, fall back to the standard error page rather than throwing \ 
an NPE. Based on a patch by Huxing Zhang. (markt)
    Fix: 58582: Combined realm should perform background processing on its \ 
sub-realms. Based upon a patch provided by Aidan. (schn additional check that a \ 
client provided session ID is in use in at least one other web application \ 
before allowing it to be used as the ID for a new session in the current web \ 
application. (markt)
    Add: Add support for DIGEST authentication to the JN
    Fix: Ensure that in an embedded Tomcat the logging configuration is not lost \ 
during garbage collection. (violetagg)
    Add: Move the functionality that provides redirects for context roots and \ 
directories where a trailing / is added from the Mapper to the DefaultServlet. \ 
This enables such requests to be processed by any configured Valves and Filters \ 
before the redirect is made. This behaviour is configurable via the \ 
mapperContextRootRedirectEnabled and mapperDirectoryRedirectEnabled attributes \ 
of the Context which may be used to restore the previous behaviour. (markt)

Coyote

    Fix: Cancel pending blocking IO operation following a timeout in the NIO2 \ 
connector. (remm)
    Fix: Add instance manager support for upgrade handlers, and set context \ 
class loader. (remm)
    Update: Synchronize OpenSSL to JSSE cipher mapping to recent OpenSSL \ 
changes. In particular, TLSv1.0 is now an alias for those ciphers that require \ 
TLSv1 and will not work with SSLv3. TLSv1 remains an alias for SSLv3. (markt)

Jasper

    Add: Deprecate the STRICT_QUOTE_ESCAPING system property and replace it with \ 
an initialisation parameter for the JSP Servlet. This enables per web \ 
application control of this configuration setting. (markt)

Cluster

    Fix: Optimize the session lock range in DeltaManager.requestCompleted. (kfujino)
    Fix: Enable an explicit configuration of local member in the static cluster \ 
membership. (kfujino)

Tribes

    Code: Distinguish the handling of the shutdown payload and member \ 
verification clearly. When handling shutdown payload, verification completion \ 
message is not required. (kfujino)
    Fix: When starting the StaticMembershipInterceptor, \ 
StaticMembershipInterceptor checks the required Interceptors. If the required \ 
Interceptor does not exist, it issues warning logs. (kfujino)

WebSocket

    Fix: Use instance manager for server endpoint instances. (remm)

Web applications

    Add: Make it clear in the documentation for the CGI servlet that the debug \ 
page is not considered secure and should not be used in production. (markt)
    Fix: The domain attribute of StaticMember is not required but optional. (kfujino)

jdbc-pool

    Fix: 58489: Correct QueryStatsComparator to hold up the general contract for \ 
Comparator. (fschumacher)
    Fix: When creating a QueryStats object, ensure that maxQueries is checked. \ 
If maxQueries is a value less than or equal to 0, QueryStats are never created. \ 
(kfujino)

Other

    Update: Update optional Checkstyle library to 6.12.1. (kkolinko)
    Add: Add support for creating a FindBugs report when building Tomcat. It is \ 
disabled by default. (violetagg)

2015-10-12 Tomcat 8.0.28 (markt)
Catalina

    Add: Add support for the custom classpath protocol in URLs. It an be used \ 
anywhere Tomcat accepts a URL for a configuration parameter. (markt)
    Fix: 56777: Allow file based configuration resources (user database, \ 
certificate revocation lists, keystores and trust stores) to be configured using \ 
URLs as well as files. (markt)
    Fix: Perform null-checking on input and stored credentials in all Realms \ 
before passing credentials off to CredentialHandlers for matching. (schultz)

Coyote

    Update: Add the new ciphers from RFC6655 and RFC7251 to the OpenSSL to JSSE \ 
cipher mapping. (markt)
    Update: Remove DES, RC2 and RC4 from DEFAULT for the OpenSSL to JSSE cipher \ 
mapping to align with the OpenSSL development branch. (markt)

Jasper

    Fix: Improve the error message when JSP parser encounters an error parsing \ 
an attribute value. (markt)

Web applications

    Update: 58474: Provide a reference to the differences between CATALINA_HOME \ 
and CATALINA_BASE in the sample application that is part of the documentation \ 
web application. (markt)

Extras

    Fix: Ensure JULI adapters does not include the LogFactoryImpl class. Patch \ 
provided by Benjamin Gandon. (markt)

2015-10-01 Tomcat 8.0.27 (markt)
Catalina

    Fix: 58187: Correct a regression in the fix for 57765 that meant that \ 
deployment of web applications deployed via the Manager application was delayed \ 
until the next execution of the automatic deployment background process. (markt)
    Fix: 58284: Correctly implement session serialization so non-serializable \ 
attributes are skipped with a warning. Patch provided by Andrew Shore. (markt)
    Fix: 58313: Fix concurrent access of encoders map when clearing encoders \ 
prior to switch to async. (markt)
    Fix: 58320: Fix concurrent access of request attributes which is possible \ 
during asynchronous processing. (markt)
    Fix: 58352: Always trigger a thread dump if Tomcat fails to stop gracefully \ 
from catalina.sh even if using -force. Patch provided by Alexandre Garnier. \ 
(markt)
    Fix: 58368: Fix a rare data race in the code that obtains the \ 
ApplicationFilterFactory instance. (markt)
    Fix: 58369: Fix a rare data race in the code that obtains the \ 
CookieProcessor for a StandardContext instance. (markt)
    Fix: Ensure the JAASRealm uses the configured CredentialHandler. (markt)
    Fix: 58372: Fix rare data races closed and suspended flags that could be \ 
triggered by async and/or comet processing. (markt)
    Fix: 58373: Fix rare data race with the application event listeners for \ 
StandardContext. (markt)
    Fix: 58374: Fix a rare data race in the AsyncContext implementation for \ 
access to the internal Tomcat request object to which it holds a reference. \ 
(markt)
    Fix: 58380: Fix two rare data races in the standard session implementation \ 
on the flag that tracks if the session is new and on the field that tracks the \ 
maximum inactive period. (markt)
    Fix: 58385: Fix a rare data race in the internal flag Tomcat uses to keep \ 
track of whether or not a request is being used for Comet processing. (markt)
    Fix: 58394: Fix a rare data race in Mapper when adding or removing a host. \ 
(markt)
    Fix: 58398: Fix a rare data race in LifecycleSupport. (markt)
    Fix: 58412: Ensure that the AsyncFileHandler has the source class and method \ 
name available for logging. (fschumacher)
    Fix: 58416: Correctly detect when a forced stop fails to stop Tomcat because \ 
the Tomcat process is waiting on some system call or is uninterruptible. (markt)
    Fix: 58436: Fix some rare data races in JULI's ClassLoaderLogManager during \ 
shutdown. (markt)
    Fix: 58845: Fix off-by one error in calculation of valid characters in a \ 
cookie domain. Patch provided by Thorsten Ehlers. (markt)

Coyote

    Fix: Correct some edge cases in RequestUtil.normalize(). (markt)
    Fix: 58275: The IBM JREs accept cipher suite names starting with TLS_ or \ 
SSL_ but when listing the supported cipher suites only the SSL_ version is \ 
reported. This can break Tomcat's check that at least one requested cipher suite \ 
is supported. Tomcat now includes a work-around so either form of the cipher \ 
suite name can be used when running on an IBM JRE. (markt)
    Fix: 58357: For reasons not currently understood when the APR/native \ 
connector is used with OpenSSL reads can return an error code when there is no \ 
apparent error. This was work-around for HTTP upgrade connections by treating \ 
this as EAGAIN. The same fix has now been applied to the standard HTTP \ 
connector. (markt)
    Code: Minor clean-up in NIO2 SSL handshake code to address some theoretical \ 
concurrency issues. (markt)
    Fix: 58367: Fix a rare data race in the code that obtains the reason phrase \ 
for a given HTTP response code. (markt)
    Fix: 58370: Fix a rare data race in the connector shutdown code. (markt)
    Fix: 58371: Fix a rare data race when accessing request URI in String form \ 
when switching from non-async to async due to early triggering of the gathering \ 
of request statistics. (markt)
    Fix: 58375: Fix a rare data race on the internal flag Tomcat uses to mark a \ 
response as committed. (markt)
    Fix: 58377: Fix a rare data race on the internal flag Tomcat uses to mark a \ 
request as using HTTP keep-alive when switching to asynchronous processing. \ 
(markt)
    Fix: 58379: Fix a rare data race on the internal reference Tomcat retains to \ 
the socket when switching to asynchronous processing. (markt)
    Fix: 58387: Fix a rare data race when closing Comet connections. (markt)
    Fix: 58388: Fix a data race when determining if Comet processing is \ 
occurring on a container or non-container thread. (markt)
    Fix: 58389: Fix a rare data race while shutting down the thread pools on \ 
Connector stop. (markt)
    Code: Clean up use of error flag on socket wrapper prompted by 58390. (markt)
    Code: Remove some unnecessary code from the NIO Poller and fix 58396 as a \ 
side-effect. (markt)
    Fix: 57799: Remove useless sendfile check for NIO SSL. (remm)

Jasper

    Fix: 57136: Correct a regression in the previous fix for this issue. \${ \ 
should only be an escape for ${ within an EL expression. Within a JSP page \$ \ 
should be an escape for $. The EL specification applies when parsing the \ 
expression delimited by ${ and }. Parsing of the delimiting ${ and } is the \ 
responsibility of the JSP specification. (markt)
    Fix: 58296: Fix a memory leak in the JSP unloading feature that meant that \ 
using a value other than -1 for maxLoadedJsps triggered a memory leak once the \ 
limit was reached. (markt)
    Fix: 58327: Cache the expression string for value expression literals since \ 
it is frequently used and may be expensive to evaluate. Patch provided by \ 
Andreas Kohn. (markt)
    Fix: 58340: Improve error reporting for tag files packaged in JARs. (markt)
    Fix: 58424: When parsing TLD files, allow whitespace around boolean \ 
configuration values. (schultz)
    Fix: Fix a possible resource leak reported by coverity scan. (fschumacher)
    Fix: 58427: Enforce the JSP specification defined limitations of which \ 
elements are allowed in an implicit.tld file. (markt)
    Fix: 58444: Ensure that JSPs work with any custom base class that meets the \ 
requirements defined in the JSP specification without requiring that base class \ 
to implement Tomcat specific code. (markt)

Cluster

    Fix: Fix a default clusterListeners in SimpleTcpCluster. The optimal default \ 
value is different for each session manager. ClusterSessionListener is never \ 
used in BackupManager. (kfujino)
    Fix: Correct log messages in case of using BackupManager. (kfujino)

WebSocket

    Fix: 58342: Fix a copy and paste error that meant MessageHandler removal \ 
could fail for binary and pong MessageHandlers. Patch provided by DJ. (markt)
    Fix: Data races detected by RV-Predict, mostly caused by completion handlers \ 
running in separate threads. (markt)
    Fix: 58414: Correctly handle sending zero length messages when using per \ 
message deflate. (markt)

Web applications

    Fix: Correct documentation for cluster-howto. (kfujino)
    Fix: Add missing documentation for property alwaysAddExpires for the \ 
LegacyCookieProcessor. (markt)

Tribes

    Add: Add support for configurations of ChannelListener and \ 
MembershipListener in server.xml. (kfujino)
    Fix: Correct log messages in case of using ReplicatedMap. (kfujino)
    Fix: 58381: Fix a rare data race in the NioReceiver. (markt)
    Fix: 58382: Fix multiple rare data races in the default membership \ 
implementation. (markt)
    Fix: 58383: Fix a data race in SenderState. (markt)
    Fix: 58386: Fix a data race in ObjectReader. (markt)
    Fix: 58391: Fix multiple data races in NonBlockingCoordinator, most of which \ 
were associated with ensuring that log messages contained the correct \ 
information. (markt)
    Fix: 58392: Fix a data race in DomainFilterInterceptor. (markt)
    Fix: 58393: Fix a data race on the listener in McastService. (markt)
    Fix: 58395: Fix multiple data races in MemberImpl that were likely to cause \ 
issues if certain properties were updated concurrently (such updates are \ 
unlikely in normal usage). (markt)
    Code: Remove some unnecessary code from PooledParallelSender and fix 58397. \ 
(markt)

jdbc-pool

    Fix: Make sure the pool has been properly configured when attributes that \ 
related to the pool size are changed via JMX. (kfujino)

Other

    Fix: Ensure logging works for all tests in a class rather than just the \ 
first one executed. (markt)
    Add: 58344: Add build properties to enable tests to be executed against \ 
alternative binaries. Based on a patch by Petr Sumbera. (markt)

Log message:
Add SHA512 digests for distfiles for www category

Problems found locating distfiles:
	Package haskell-cgi: missing distfile haskell-cgi-20001206.tar.gz
	Package nginx: missing distfile array-var-nginx-module-0.04.tar.gz
	Package nginx: missing distfile encrypted-session-nginx-module-0.04.tar.gz
	Package nginx: missing distfile headers-more-nginx-module-0.261.tar.gz
	Package nginx: missing distfile nginx_http_push_module-0.692.tar.gz
	Package nginx: missing distfile set-misc-nginx-module-0.29.tar.gz
	Package nginx-devel: missing distfile echo-nginx-module-0.58.tar.gz
	Package nginx-devel: missing distfile form-input-nginx-module-0.11.tar.gz
	Package nginx-devel: missing distfile lua-nginx-module-0.9.16.tar.gz
	Package nginx-devel: missing distfile nginx_http_push_module-0.692.tar.gz
	Package nginx-devel: missing distfile set-misc-nginx-module-0.29.tar.gz
	Package php-owncloud: missing distfile owncloud-8.2.0.tar.bz2

Otherwise, existing SHA1 digests verified and found to be the same on
the machine holding the existing distfiles (morden).  All existing
SHA1 digests retained for now as an audit trail.

Log message:
Update to 8.0.26

Changelog:
Tomcat 8.0.26 (markt)
Web applications

    Add: 58255: Document the Semaphore valve. Patch provided by Kyohei Nakamura. \ 
(markt)

not released Tomcat 8.0.25 (markt)
Catalina

    Fix: Make the WAR manifest file available for WebResource instances from an \ 
unpacked WAR in the same way the manifest is available if the WAR is not \ 
unpacked. (markt)
    Fix: Ensure that only /WEB-INF/classes/ and /WEB-INF/lib/ are excluded from \ 
the web resource caching. (Resources loaded from these locations are cached by \ 
the web application class loader.) (markt)
    Add: 57741: Enable the CGI servlet to use the standard error page mechanism. \ 
Note that if the CGI servlet's debug init parameter is set to 10 or higher then \ 
the standard error page mechanism will be bypassed and a debug response \ 
generated by the CGI servlet will be returned instead. (markt)
    Fix: 58031: Make the (first) reason parameter parsing failed available as a \ 
request attribute and then use it to provide a better status code via the \ 
FailedRequstFilter (if configured). (markt)
    Fix: 58086: Correct a regression in the fix for 58086 that incorrectly \ 
handled WAR URLs. (violetagg)
    Fix: 58096: Classes loaded from /WEB-INF/classes/ should use that directory \ 
as their code base. (markt)
    Fix: Fix possible resource leaks by closing streams properly. Issues \ 
reported by Coverity Scan. (violetagg)
    Fix: 58116: Fix regression in the fix for 57281 that broke Comet support \ 
when running under a security manager. Based on a patch provided by Johno \ 
Crawford. (markt)
    Fix: 58125: Avoid a possible ClassCircularityError when running under a \ 
security manager. (markt)
    Fix: 58179: Fix a thread safety issues that could mean concurrent threads \ 
setting the same attribute on a ServletContext could both see null as the old \ 
value. (markt)
    Fix: Allow web archives bigger than 2G to be deployed using ANT tasks. \ 
(violetagg)
    Fix: 58192: Correct a regression in the previous fix for 58023. Ensure that \ 
classes are associated with their manifest even if the class file is first read \ 
(and cached) without the manifest. (markt)
    Fix: Fix thread safety issue in the AsyncContext implementation that meant a \ 
sequence of start();dispatch(); calls using non-container threads could result \ 
in a previous dispatch interfering with a subsequent start. (markt)
    Fix: 58228: Make behaviour of ServletContext.getResource() and \ 
ServletContext.getResourceAsStream() consistent with each other and the expected \ 
behaviour of the GET_RESOURCE_REQUIRE_SLASH system property. (markt)
    Fix: 58230: Fix input stream corruption if non-blocking I/O is used and the \ 
first read is made immediately after the switch to async mode rather than in \ 
response to onDataAvaiable() and that read does not read all the available data. \ 
(markt)
    Fix: Ensure that log4javascript*.jar was not excluded from the standard JAR \ 
scanning by default. (markt)

Coyote

    Fix: 57943: Prevent the same socket being added to the cache twice. Patch \ 
based on analysis by Ian Luo / Sun Qi. (markt)
    Fix: Add text/javascript,application/javascript to the default list of \ 
compressable MIME types. (violetagg)
    Fix: 58103: When pipelining requests, and the previous request was an async \ 
request, ensure that the socket is removed from the waiting requests so that the \ 
async timeout thread doesn't process it during the next request. (markt)
    Fix: 58151: Correctly handle EOF in the AJP APR/native connector to prevent \ 
the connector entering a loop and generate excessive CPU load. (markt)
    Fix: In the AJP and HTTP NIO connectors, ensure that the socket timeout is \ 
correctly set before adding the socket back to the poller for read. (markt)
    Fix: 58157: Ensure that the handling of async timeouts does not result in an \ 
unnecessary dispatch to a container thread that could result in the current \ 
socket being added to the Poller multiple times with multiple attempts to \ 
process the same event for the same socket. (markt)
    Fix: Correct a coupe of edge cases in RequestUtil.normalize(). (markt)

Jasper

    Fix: 58110: Like scriptlet sections, declaration sections of JSP pages have \ 
a one-to-one mapping of lines to the generated .java file. Use this information \ 
to provide more accurate error messages if a compilation error occurs in a \ 
declaration section. (markt)
    Fix: 58119: When tags are compiled they must be placed in the \ 
org/apache/jsp/tag/web directory. Correct a regression in the fix for 52725. \ 
(violetagg)
    Fix: Fix a resource leak in JspC identified by Eclipse. (markt)
    Fix: 58178: Expressions in a tag file should use the tag file's PageContext \ 
rather than that of the containing page. (markt)
    Fix: Following on from the fix for 58178, expressions in a tag file should \ 
use the tag file's imports rather than those of the containing page. (markt)

WebSocket

    Fix: 58166: Allow applications to send close codes in the range 3000-4999 \ 
inclusive. (markt)
    Fix: 58232: Avoid possible NPE when adding endpoints programmatically to the \ 
javax.websocket.server.ServerContainer. Based on a patch provided by \ 
bastian.(violetagg)

Web applications

    Fix: Correct the incorrect document of QueryTimeoutInterceptor. The setting \ 
value is not in milliseconds but in seconds. (kfujino)
    Fix: 58112: Update the documentation for using the Catalina tasks in an \ 
Apache Ant build file. (markt)
    Fix: Imve the Javadoc for some of the APR socket read functions that have \ 
inconsistent behaviour for return values. (markt)

jdbc-pool

    Fix: 58042: The default value of logFailed attribute of SlowQueryReport is \ 
changed to false so that the failed queries arejino)
    Fix: The fairness attribute and ignoreExceptionOnPreLoad attribute do not \ 
allow a change via JMX. (kfujino)
    Fix: If the timeBetweenEvictionRunsMillis attribute is changed via jmx, it \ 
should restart the pool cleaner because this attribute affia JMX. (kfujino)

Other

    Update: Update optional Checkstyle library to 6.8.1. (kkolinko)
    Fix: Update sample Eclipse IDE configuration to exclude test/webapp* and \ 
similar paths from compiler sourcepath. (kkolinko)
    Update: Update package renameote that using this with a value of greater \ 
than one will disbale Cobertura code coverage. (markt)

2015-07-06 Tomcat 8.0.24 (markt)
Catalina

    Fix: 57938: Correctly handle empty form fields when a form is submitted as \ 
multipart/form-data, the maxPostSize attribute of the Connector has been set to \ 
a negative value and the Context has been configured with a value of true for \ 
allowCasualMultipartParsing. The meaning of the value zero for the maxPostSize \ 
has also been changed to mean a limit of zero rather than no limit to align it \ 
with maxSavePostSize and to be more intuitive. (markt)
    Fix: 57977: Correctly bind and unbind the web application class loader \ 
during execution of the PersistentValve. (markt)
    Fix: Remove some unnecessary code from the web application class loader and \ 
deprecate the now unused validate() method since the requirements of SRV.10.7.2 \ 
are met using cleaner code in loadClass(String, boolean) and filter(). (markt)
    Fix: Correct a bug that prevented the web application class loader's \ 
filter() from working correctly. It only returned true for classes in \ 
sub-packages of the listed packages, but not classes located in the packages \ 
themselves. (markt)
    Fix: Add the WebSocket API classes to the list of classes that the web \ 
application class loader will always delegate to its parent for loading first. \ 
(markt)
    Fix: 58015: Ensure that whenever the web application class loader checks to \ 
see if it should delegate first, it also checks the result of the filter() \ 
method which may indicate that it should always delegate first for the current \ 
class/resource regardless of the value of the delegate configuration option. \ 
(markt)
    Fix: 58023: Fix potentially excessive memory usage due to unnecessary \ 
caching of JAR manifests in the web application class loader. (markt)
    Fix: 57700: Ensure that Container event ADD_CHILD_EVENT will be sent in all \ 
cases. (violetagg)
    Fix: 58086: Ensure that WAR URLs are handled properly when using ANT for web \ 
application deployment. Based on a patch provided by Lukasz Jader. (violetagg)
    Fix: Fix CredentialHandler element handling in storeconfig. (remm)

Coyote

    Fix: 57265: Further fix to address a potential threading issue when sendfile \ 
is used in conjunction with TLS. (markt)
    Fix: 57936: Improve robustness of the acceptor thread count parameter for \ 
NIO2, since it must be set to 1. Submitted by Oliver Kant. (remm)
    Add: 57943: Added a work-around to catch ConcurrentModificationExceptions \ 
during Poller timeout processing that were causing the Poller thread to stop. \ 
The root cause of these exceptions is currently unknown. (markt)
    Fix: 57944: Ensure that if non-blocking I/O listeners are set on a \ 
non-container thread that the expected listener events are still triggered. \ 
(markt)
    Fix: Fix possible very long (1000 seconds) timeout with APR/native \ 
connector. (markt)
    Add: Support "-" separator in the SSLProtocol configuration of the \ 
APR/native connector for protocol exclusion. (rjung)
    Fix: 58004: Fix AJP buffering output data even in blocking mode. (remm)

WebSocket

    Fix: 57969: Provide path parameters to POJO via per session \ 
javax.websocket.server.ServerEndpointConfig as they vary between different \ 
requests. (violetagg)
    Fix: 57974: Session.getOpenSessions should return all sessions associated \ 
with a given endpoint instance, rather than all sessions from the endpoint \ 
class. (remm)

Web applications

    Fix: 57282: Update request processing sequence diagrams. Updated diagrams \ 
provided by Stephen Chen. (markt)
    Fix: 57971: Correct the documentation for the cluster configuration setting \ 
recoverySleepTime. (markt)
    Add: 57758: Add document of testOnConnect attribute in jdbc-pool doc. (kfujino)
    Add: Add description of validatorClassName attribute to testXXXX attributes \ 
in jdbc-pool docs. (kfujino)

Tribes

    Code: Use StringManager to provide i18n support in the \ 
org.apache.catalina.tribes packages. (kfujino)
    Fix: Do not set the nodes that failed to replication to the backup nodes. \ 
Ensure that the nodes that the data has been successfully replicated are set to \ 
the backup node. (kfujino)
    Fix: When failed to replication, rather than all member is handled as a \ 
failed member, exclude the failure members from backup members. (kfujino)

jdbc-pool

    Fix: Refactoring of the removeOldest method in SlowQueryReport to behave as \ 
expected. (kfujino)
    Fix: 57783: Fix NullPointerException in SlowQueryReport. To avoid this NPE, \ 
Refactor SlowQueryReport#removeOldest and handle the abandoned connection \ 
properly. (kfujino)
    Fix: 58042: In SlowQueryReportJmx, the LogSlow and logFailed attributes that \ 
inherited from SlowQueryReport are used as a condition of whether JMX \ 
notifications are sent. (kfujino)
    Fix: Ensure that specified Boolean attribute values of SlowQueryReport \ 
reflect correctly. The LogSlow and the logFailed are not system property, these \ 
are attributes of SlowQueryReport. (kfujino)

Other

    Update: Update package renamed Apache Commons BCEL to r1682271 to pick up \ 
some some code clean up. (markt)
    Update: Update package renamed Apache Commons DBCP to r1682314 to pick up \ 
the DBCP 2.1 release and additional fixes since then. (markt)
    Update: Update package renamed Apache Commons Pool to the 2.4 release. (markt)
    Update: Update package renamed Apache Commons File upload to r1682322 to \ 
pick up the post 1.3.1 fixes. (markt)
    Update: Update package renamed Apache Commons Codec to r1682326. No \ 
functional changes. Javadoc only. (markt)
    Update: Update optional Checkstyle library to 6.7. (kkolinko)

Log message:
Update to 8.0.23

Changelog:
The Apache Tomcat Project is proud to announce the release of version
8.0.23 of Apache Tomcat. Apache Tomcat 8.0.23 includes a numerous fixes
for issues identified in 8.0.22 as well as a number of other enhancements
and changes. The notable changes since 8.0.22 include:

    Fixed corruption issues with NIO2 and TLS
    Added a workaround for SPNEGO authentication and a JRE regression in Java 8 \ 
update 40 onwards
    Added the new HttpHeaderSecurityFilter

Log message:
Uodate to 8.0.22

Changelog:
    Change the format of the Tomcat specific URLs for resources inside JARs that \ 
are in turn packed in a WAR. The ^/ sequence has been replaced by */ so that the \ 
resulting URLs are compliant with RFC 2396 and do not trigger exceptions when \ 
converted to URIs. The old format will continue to be accepted.
    Allow logging of the remote port in the access log using the format pattern \ 
%{remote}p.
    When checking last modified times as part of the automatic deployment \ 
process, account for the fact that File.lastModified() has a resolution of one \ 
second to ensure that if a file has been modified within the last second, the \ 
latest version of the file is always used. Note that a side-effect of this \ 
change is that files with modification times in the future are treated as if \ 
they are unmodified.
    Align redeploy resource modification checking with reload modification \ 
checking so that now, in both cases, a change in modification time rather than \ 
an increase in modification time is used to determine if the resource has \ 
changed.

Note: There is a known issue with NIO2 and SSL/TLS in this and previous releases \ 
that can result in dropped connections. It is not recommended that NIO2 is used \ 
in production with SSL/TLS until this issue is resolved (the fix is expected in \ 
8.0.23).

Log message:
Import apache-tomcat-8.0.21 as www/apache-tomcat8.

Apache Tomcat is an implementation of the Java Servlet and JavaServer Pages
technologies. The Java Servlet and JavaServer Pages specifications are
developed under the Java Community Process.

Apache Tomcat is developed in an open and participatory environment and
released under the Apache Software License. Apache Tomcat is intended to
be a collaboration of the best-of-breed developers from around the world.
We invite you to participate in this open development project.

Apache Tomcat powers numerous large-scale, mission-critical web applications
across a diverse range of industries and organizations.

This package tracks 8.x release branch.