Re: Apache Tomcat 9.1.x release timeframe

16 Jul 2026 18:27:57 Lisa Sayre <[email protected]>:

> Hi,
> My application is currently using Apache Tomcat 9.0.120 on a RHEL 9.2.
> We plan to utilize Apache Tomcat 9.1.x once it is released.
>
> We are concerned about the timing of the 9.1.x release and if we will=20
> have enough time to migrate/upgrade our application to using 9.1 before=
=20
> 9.0.x is officially EOL - which we see on Apache's website states that=20
> 9.0 EOL is no earlier than March 31st 2027.
>
> I understand that no release date has been provided for 9.1, but can=20
> you provide guidance as to how long of a window or timeline software=20
> vendors like us will have to migrate our applications before 9.0 is=20
> EOL?=C2=A0 The issue is security vulnerabilities.

12 months.

We have stated multiple times, on this mailing list, starting in March /=20
April this year that the first 9.1.x release will follow the final 9.0.x=20
release and that you will be able to treat it exactly like a 9.0.x to=20
9.0.x+1 update providing:
- you aren't using the APR connector
- if you are using Tomcat Native, you are using 2.0.x

You have from now (actually since ~April this year) to migrate off the=20
APR connector if you are using APR and to Native 2.0 x if you are using=20
Native 1.x.

The only reason there is a minor version bump is dropping APR support and=
=20
dropping Native 1.x support.

> For example, we get notification from Apache on March 20th 2027 for a=20
> 9.0.x release - which is presumably the last 9.0 release before it is=20
> EOL on March 31st 2027.=C2=A0 We then get a notification from Apache on=
=20
> March 27th for the 9.1.x release.=C2=A0 This gives us three days to migra=
te,=20
> test, and deliver our software to our customer base, and it gives them=20
> very little time to upgrade so that they are covered in terms of=20
> security vulnerabilities.=C2=A0 Our customer's security teams are stating=
=20
> that at midnight, March 31st, if Apache Tomcat is not upgraded to 9.1,=20
> then the company will have to shut the application/system down to avoid=
=20
> being vulnerable.

Then those security teams need to rethink their plans based on what is=20
actually happening rather than their misunderstanding of what is=20
happening.

All they need to do is treat it like just another point release. There=20
won't be any security vulnerabilities announced for the final 9.0.x=20
release until the first 9.1.x release is available with fixes for those=20
issues (unless the issue is in APR or Native 1.3.x in which case it won't=
=20
get fixed).

Better yet, tell them to buy some tickets to CoC Glasgow and they can=20
listen to me talking about the migration process and, if they still have=20
questions, I can answer them in person.

> Any guidance on how much time will be given from the time Tomcat 9.1 is=
=20
> released to the time 9.0 is EOL would be appreciated.
> Thank you,
> Lisa Sayre

I expect that last 9.0.x release will be in March 2027 and the first=20
9.1.x release will be in April 2027.

Mark