Re: Apache Tomcat 9.1.x release timeframe

Mark,

On 7/17/26 11:26 AM, Mark Thomas wrote:
> 17 Jul 2026 16:57:16 Eddie Rowe via users <[email protected]>:
> 
>> The helpful links posted again indicate there will be a "few weeks" of 
>> overlap between the release of 9.1 and the EOL of 9.0.  Does a "few 
>> weeks" mean 2 weeks or does it mean like 8 weeks?  I can appreciate 
>> this 9.1 being treated like a normal maintenance release in the 9.0.x 
>> series but I don't think there is an appreciation that upgrading to 
>> those minor releases can be painful for some of us.  (Ignoring for the 
>> moment that some are using connectors that are being removed in 9.1 
>> which breaks things for us.)  Each release of Tomcat, despite the hard 
>> work of several persons, has bugs.  If the first release of 9.1 has a 
>> bug that affects someone they might have to stay on 9.0.x and if 9.1 
>> corrects a security issue that puts people in a difficult position. 
>> And there are going to be more than a few persons who try to upgrade 
>> only to learn their AJP connectors no longer work. 8-(
> 
> None of the above is any different to any other point release upgrade.

+100

I was going to say exactly this, so I'll reinforce Mark's statement 
above and re-phrase the idea of "end of support / end of life" in more 
concrete terms.

The Apache Tomcat team does not provide patches, period. Instead, we 
provide new releases, mostly with a regular (monthly) cadence.

So, technically, when Tomcat 9.0.121 comes out next month, Tomcat 
9.0.120 is immediately "end of life" because we will never, ever publish 
a patch for any problem found with that release. You could get a little 
crazier and say that "Tomcat 9.0.120 is already EOL because Tomcat will 
already never, ever produce a patch for it" but that's probably a little 
edgy for publication.

But it's entirely true: every point-release of Tomcat is immediately out 
of support, from a certain perspective.

So, back to Tomcat 9.0 vs 9.1. Let's say that the final version of 
Tomcat 9.0.x is (counts on fingers) 9.0.128. We've already promised that 
9.1.0 is going to *essentially* be the same thing as 9.0.129 (which we 
will never release under that version number) -- with some restrictions 
because of APR and tcnative.

So the "gulf between 9.0.128 and 9.1.0" is equivalent to the "gulf 
between 9.0.120 and 9.0.121". So if you are comfortable with the gap 
between 9.0.120 and 9.0.121, you should feel the same comfort between 
9.0.128 and 9.1.0.

"Oh, but our security people say it's unsupported for 30 days."

That perspective assumes that the 9.0.x product is significantly 
distinct from the 9.1.x product, which it is not. If you want to be able 
to treat an upgrade from 9.0.last to 9.1.first as a point-release, all 
you need to do is make sure you migrate away from APR and tcnative 1.x 
in the next 8 months, and then it's a "point upgrade".

Hopefully, seen from this perspective, it's not scary at all.

-chris