Apache Tomcat 9.0.41

Tomcat 9.0.41 (markt)

Catalina

•  56181: Update the RemoteIpValve and RemoteIpFilter so that calls to ServletRequest.getRemoteHost() are consistent with the return value of ServletRequest.getRemoteAddr() rather than always returning a value for the proxy. (markt)
•  56890: Align the behaviour of ServletContext.getRealPath(String path) with the recent clarification from the Servlet specification project. If the path parameter does not start with / then Tomcat processes the call as if / is appended to the beginning of the provided path. (markt)
•  64080: Enhance the graceful shutdown feature. Includes a new option for StandardService, gracefulStopAwaitMillis, that allows a time to be specified to wait for client connections to complete and close before the Container hierarchy is stopped. (markt)
•  64921: Ensure that the LoadBalancerDrainingValve uses the correct setting for the secure attribute for any session cookies it creates. Based on a pull request by Andreas Kurth. (markt)
•  64947: Don't assume that the Upgrade header has been set on the HttpServletResponse before any call is made to HttpServletRequest.upgrade(). (markt)
•  Ensure that values are not duplicated when manipulating the vary header. Based on a pull request by Fredrik Fall. (markt)

  Coyote

•  64944: Ensure that the bytesSent metric is correctly updated when compression is enabled. (markt)

  WebSocket

•  64951: Fix a potential file descriptor leak when WebSocket connections are attempted and fail. Patch provided by Maurizio Adami. (markt)

  Web applications

•  Correct a regression in the addition of the HTTP header security filter to the examples web application that prevented the Servlet examples that depend on the asynchronous API from functioning correctly. (kkolinko/markt)

  Tribes

•  Start all core threads when starting the receiver and dispatch interceptor. (kfujino)

  Other

•  Update the OWB module to Apache OpenWebBeans 2.0.20. (remm)
•  Update the CXF module to Apache CXF 3.4.1. (remm)
•  64931: Implement validation of changelog.xml file at build time. (kkolinko)
•  Update to Maven Ant Resolver Tasks 1.3.0. (markt)
•  62695: Provide SHA-256 and SHA-512 checksums for files published via Maven. (markt)