Re: [VOTE] Release Apache Tomcat 9.0.121

Rémy,


Thanks for RM'ing.

On 8/12/26 4:08 PM, Rémy Maucherat wrote:
> The proposed Apache Tomcat 9.0.121 release is now available for voting.
> 
> The notable changes compared to 9.0.120 are:
> 
> - Add a new attribute to the Context, urlPatternsProvidedInDecodedForm.
>     This attribute controls whether URLs and URL patterns provided in the
>     deployment descriptor (web.xml), annotations and/or their programmatic
>     equivalents are treated as being provided in URL-encoded form (i.e.
>     using %nn encoding) or in decoded form. The Servlet specification
>     requires that they are provided in decoded form. However, Tomcat has
>     historically treated them as if they are provided in encoded form. In
>     Tomcat 12, they will always be treated as if they are provided in
>     decoded form. This setting enables migration from encoded form to
>     decoded form on an application by application basis. This attribute
>     will be removed in Tomcat 12 where it will effectively be hard-coded
>     to true.
> - Require every HTTP/2 request to provide an authority (either an
>     :authority pseudo header or a Host header)
> - Change the default encryptionAlgorithm for the EncryptInterceptor to
>     AES/GCM/NoPadding. This is a breaking change for the
>     EncryptInterceptor.
> 
> For full details, see the changelog:
> https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
> 
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.121/
> 
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1601
> 
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.121
> dc00a53100b38c8eb8befce5855e3b152eed9353
> 
> The proposed 9.0.121 release is:
> [ ] -1, Broken - do not release
> [ ] +1, Stable - go ahead and release as 9.0.121
+1 for stable release.

The build is 100% reproducible on MacOS aarch64, and the unit test all pass.

Details:

* Environment
*  Java (build):    openjdk version "25.0.4" 2026-07-21 LTS OpenJDK 
Runtime Environment Temurin-25.0.4+7 (build 25.0.4+7-LTS) OpenJDK 64-Bit 
Server VM Temurin-25.0.4+7 (build 25.0.4+7-LTS, mixed mode, sharing)
*  Java (test):     openjdk version "25.0.4" 2026-07-21 LTS OpenJDK 
Runtime Environment Temurin-25.0.4+7 (build 25.0.4+7-LTS) OpenJDK 64-Bit 
Server VM Temurin-25.0.4+7 (build 25.0.4+7-LTS, mixed mode, sharing)
*  Ant:             Apache Ant(TM) version 1.10.17 compiled on April 6 2026
*  OS:              Darwin 25.3.0 arm64
*  cc:              Apple clang version 21.0.0 (clang-2100.1.1.101)
*  make:            GNU Make 3.81
*  OpenSSL:         OpenSSL 3.6.3 9 Jun 2026 (Library: OpenSSL 3.6.3 9 
Jun 2026)
*  APR:             1.7.6
*
* Valid SHA-512 signature for apache-tomcat-9.0.121.zip
* Valid GPG signature for apache-tomcat-9.0.121.zip
* Valid SHA-512 signature for apache-tomcat-9.0.121.tar.gz
* Valid GPG signature for apache-tomcat-9.0.121.tar.gz
* Valid SHA-512 signature for apache-tomcat-9.0.121.exe
* Valid GPG signature for apache-tomcat-9.0.121.exe
* Valid Windows Digital Signature for apache-tomcat-9.0.121.exe
* Valid SHA512 signature for apache-tomcat-9.0.121-src.zip
* Valid GPG signature for apache-tomcat-9.0.121-src.zip
* Valid SHA512 signature for apache-tomcat-9.0.121-src.tar.gz
* Valid GPG signature for apache-tomcat-9.0.121-src.tar.gz
*
* Binary Zip and tarball: Same
* Source Zip and tarball: Same
*
* Building dependencies returned: 0
* Tomcat builds cleanly
* tcnative builds cleanly
* Junit Tests: PASSED