[packages/tomcat/TOMCAT_9] Up to 9.0.123
arekm
arekm at pld-linux.org
Wed Oct 14 21:48:48 CEST 2026
commit df87ae07af344fdbd06faeababc2772d638ce723
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Wed Oct 14 21:43:49 2026 +0200
Up to 9.0.123
CVE-2026-24880, CVE-2026-25854, CVE-2026-29129, CVE-2026-29145,
CVE-2026-29146, CVE-2026-32990, CVE-2026-34483, CVE-2026-34487,
CVE-2026-34500, CVE-2026-41284, CVE-2026-41293, CVE-2026-42498,
CVE-2026-43512, CVE-2026-43513, CVE-2026-43514, CVE-2026-43515,
CVE-2026-50229, CVE-2026-53404, CVE-2026-53434, CVE-2026-55276,
CVE-2026-55955, CVE-2026-55956, CVE-2026-59083, CVE-2026-59084,
CVE-2026-65182, CVE-2026-65183, CVE-2026-65637, CVE-2026-65905,
CVE-2026-65927, CVE-2026-66299, CVE-2026-66422, CVE-2026-68525,
CVE-2026-68569, CVE-2026-68763, CVE-2026-73180, CVE-2026-73581,
CVE-2026-75973, CVE-2026-76183, CVE-2026-77756, CVE-2026-77762,
CVE-2026-77791, CVE-2026-78383, CVE-2026-79677, CVE-2026-86248,
CVE-2026-87022
no-bnd-osgi.patch | 64 +++++++++++++++++++++++++++----------------------------
tomcat.spec | 17 +++++++++++----
2 files changed, 45 insertions(+), 36 deletions(-)
---
diff --git a/tomcat.spec b/tomcat.spec
index 411b7e2..580d436 100644
--- a/tomcat.spec
+++ b/tomcat.spec
@@ -7,7 +7,8 @@
%define elapiver 3.0
%define wsapiver 1.1
-%define tomcatnatver 1.3.5
+# TCN_REQUIRED_* in AprLifecycleListener; older tomcat-native is refused at startup
+%define tomcatnatver 1.3.9
%define orgname tomcat
@@ -16,12 +17,12 @@
Summary: Web server and Servlet/JSP Engine, RI for Servlet %{servletapiver}/JSP %{jspapiver} API
Summary(pl.UTF-8): Serwer www i silnik Servlet/JSP będący wzorcową implementacją API Servlet %{servletapiver}/JSP %{jspapiver}
Name: %{orgname}9
-Version: 9.0.115
-Release: 10
+Version: 9.0.123
+Release: 1
License: Apache v2.0
Group: Networking/Daemons/Java
Source0: https://archive.apache.org/dist/tomcat/tomcat-9/v%{version}/src/apache-%{orgname}-%{version}-src.tar.gz
-# Source0-md5: 61faef8bf9d849da8e114460ce034709
+# Source0-md5: 5548bae41efe4b5f8a4dd587fe33bf57
Source1: apache-%{orgname}.init
Source2: apache-%{orgname}.sysconfig
Source3: %{orgname}-build.properties
@@ -255,6 +256,14 @@ cp -p %{SOURCE15} $RPM_BUILD_ROOT/etc/logrotate.d/%{orgname}
cp -a bin lib webapps $TOMCATDIR
cp -a temp $CATALINADIR
+%if %{with javadoc}
+# output/build carries only "install fulldocs" placeholders, ant javadoc writes to output/dist
+for api in annotationapi api elapi jaspicapi jspapi servletapi websocketapi; do
+ rm -r $TOMCATDIR/webapps/docs/$api
+ cp -a ../dist/webapps/docs/$api $TOMCATDIR/webapps/docs
+done
+%endif
+
ln -sf $CATALINADIRREV%{_logdir}/tomcat $CATALINADIR/logs
ln -sf $TOMCATDIRREV%{_logdir}/tomcat $TOMCATDIR/logs
ln -sf $TOMCATDIRREV%{_vardir}/work $TOMCATDIR/work
diff --git a/no-bnd-osgi.patch b/no-bnd-osgi.patch
index deddf9b..2abf197 100644
--- a/no-bnd-osgi.patch
+++ b/no-bnd-osgi.patch
@@ -3,9 +3,9 @@
# bundles, and the OSGi ecosystem has largely been superseded by Java 9+
# modules (JPMS). Not worth packaging bnd/osgi just for unused manifest
# entries.
---- a/build.xml 2026-01-21 09:17:26.000000000 +0100
-+++ b/build.xml 2026-03-10 20:18:14.243315621 +0100
-@@ -1124,7 +1124,7 @@
+--- a/build.xml 2026-10-06 20:59:20.000000000 +0200
++++ b/build.xml 2026-10-14 21:22:26.270297697 +0200
+@@ -1134,7 +1134,7 @@
filesDir="${tomcat.classes}"
filesId="files.annotations-api"
manifest="${tomcat.manifests}/annotations-api.jar.manifest"
@@ -14,7 +14,7 @@
<!-- Servlet Implementation JAR File -->
<jarIt jarfile="${servlet-api.jar}"
-@@ -1133,41 +1133,41 @@
+@@ -1143,41 +1143,41 @@
manifest="${tomcat.manifests}/servlet-api.jar.manifest"
notice="${tomcat.manifests}/servlet-api.jar.notice"
license="${tomcat.manifests}/servlet-api.jar.license"
@@ -62,7 +62,7 @@
<!-- Bootstrap JAR File -->
<jarIt jarfile="${bootstrap.jar}"
-@@ -1179,68 +1179,68 @@
+@@ -1189,68 +1189,68 @@
<jarIt jarfile="${tomcat-util.jar}"
filesDir="${tomcat.classes}"
filesId="files.tomcat-util"
@@ -142,7 +142,7 @@
<!-- Catalina Ant Tasks JAR File -->
<jarIt jarfile="${catalina-ant.jar}"
-@@ -1251,27 +1251,27 @@
+@@ -1261,27 +1261,27 @@
<jarIt jarfile="${catalina-storeconfig.jar}"
filesDir="${tomcat.classes}"
filesId="files.catalina-storeconfig"
@@ -174,7 +174,7 @@
<!-- i18n JARs -->
<jar jarfile="${tomcat.build}/lib/tomcat-i18n-cs.jar"
-@@ -1724,7 +1724,7 @@
+@@ -1734,7 +1734,7 @@
filesId="files.tomcat-embed-core"
notice="${tomcat.manifests}/servlet-api.jar.notice"
license="${tomcat.manifests}/servlet-api.jar.license"
@@ -183,7 +183,7 @@
addGraal="true"
graalPrefix="org.apache.tomcat.embed/tomcat-embed-core"
graalFiles="res/graal/tomcat-embed-core/native-image"
-@@ -1732,7 +1732,7 @@
+@@ -1742,7 +1742,7 @@
<jarIt jarfile="${tomcat-embed-el.jar}"
filesDir="${tomcat.classes}"
filesId="files.tomcat-embed-el"
@@ -192,7 +192,7 @@
addGraal="true"
graalPrefix="org.apache.tomcat.embed/tomcat-embed-el"
graalFiles="res/graal/tomcat-embed-el/native-image"
-@@ -1741,7 +1741,7 @@
+@@ -1751,7 +1751,7 @@
filesDir="${tomcat.classes}"
filesId="files.tomcat-embed-jasper"
meta-inf="${tomcat.manifests}/jasper.jar"
@@ -201,7 +201,7 @@
addGraal="true"
graalPrefix="org.apache.tomcat.embed/tomcat-embed-jasper"
graalFiles="res/graal/tomcat-embed-jasper/native-image"
-@@ -1750,7 +1750,7 @@
+@@ -1760,7 +1760,7 @@
filesDir="${tomcat.classes}"
filesId="files.tomcat-embed-websocket"
meta-inf="${tomcat.manifests}/tomcat-websocket.jar"
@@ -210,7 +210,7 @@
addGraal="true"
graalPrefix="org.apache.tomcat.embed/tomcat-embed-websocket"
graalFiles="res/graal/tomcat-embed-websocket/native-image"
-@@ -4307,25 +4307,12 @@
+@@ -4419,25 +4419,12 @@
<taskdef name="jsign" classname="net.jsign.JsignTask" classpathref="jsign.classpath" />
</target>
@@ -240,28 +240,28 @@
</target>
<macrodef name="jarIt" description="utility macro for standard JAR packaging">
---- a/java/org/apache/tomcat/websocket/WsContainerProvider.java 2026-01-21 09:17:26.000000000 +0100
-+++ b/java/org/apache/tomcat/websocket/WsContainerProvider.java 2026-03-10 20:18:29.099982280 +0100
-@@ -19,7 +19,6 @@
- import javax.websocket.ContainerProvider;
- import javax.websocket.WebSocketContainer;
-
+--- a/java/org/apache/tomcat/websocket/WsContainerProvider.java 2026-10-06 20:59:20.000000000 +0200
++++ b/java/org/apache/tomcat/websocket/WsContainerProvider.java 2026-10-14 21:22:32.963732273 +0200
+@@ -22,7 +22,6 @@
+ /**
+ * WebSocket container provider for Tomcat.
+ */
- at aQute.bnd.annotation.spi.ServiceProvider(value = ContainerProvider.class)
public class WsContainerProvider extends ContainerProvider {
- @Override
---- a/java/org/apache/tomcat/websocket/server/DefaultServerEndpointConfigurator.java 2026-01-21 09:17:26.000000000 +0100
-+++ b/java/org/apache/tomcat/websocket/server/DefaultServerEndpointConfigurator.java 2026-03-10 20:18:42.896648945 +0100
-@@ -26,7 +26,6 @@
- import javax.websocket.server.HandshakeRequest;
- import javax.websocket.server.ServerEndpointConfig;
-
+ /**
+--- a/java/org/apache/tomcat/websocket/server/DefaultServerEndpointConfigurator.java 2026-10-06 20:59:20.000000000 +0200
++++ b/java/org/apache/tomcat/websocket/server/DefaultServerEndpointConfigurator.java 2026-10-14 21:22:32.963926075 +0200
+@@ -30,7 +30,6 @@
+ * Default implementation of {@link ServerEndpointConfig.Configurator} for WebSocket server endpoints.
+ */
+ @SuppressWarnings("javadoc") // Eclipse bug - the Javadoc is fine
- at aQute.bnd.annotation.spi.ServiceProvider(value = ServerEndpointConfig.Configurator.class)
public class DefaultServerEndpointConfigurator extends ServerEndpointConfig.Configurator {
- @Override
---- a/java/org/apache/juli/logging/LogFactory.java 2026-01-21 09:17:26.000000000 +0100
-+++ b/java/org/apache/juli/logging/LogFactory.java 2026-03-10 20:18:58.029982275 +0100
+ /**
+--- a/java/org/apache/juli/logging/LogFactory.java 2026-10-06 20:59:20.000000000 +0200
++++ b/java/org/apache/juli/logging/LogFactory.java 2026-10-14 21:22:26.272301803 +0200
@@ -21,8 +21,6 @@
import java.util.ServiceLoader;
import java.util.logging.LogManager;
@@ -271,7 +271,7 @@
/**
* This is a modified LogFactory that uses a simple {@link ServiceLoader} based discovery mechanism with a default of
* using JDK based logging. An implementation that uses the full Commons Logging discovery mechanism is available as
-@@ -50,7 +48,6 @@
+@@ -48,7 +46,6 @@
* <strong>IMPLEMENTATION NOTE</strong> - This implementation is heavily based on the SAXParserFactory and
* DocumentBuilderFactory implementations (corresponding to the JAXP pluggability APIs) found in Apache Xerces.
*/
@@ -279,13 +279,13 @@
public class LogFactory {
private static final LogFactory singleton = new LogFactory();
---- a/java/org/apache/el/ExpressionFactoryImpl.java 2026-01-21 09:17:26.000000000 +0100
-+++ b/java/org/apache/el/ExpressionFactoryImpl.java 2026-03-10 20:19:06.806648937 +0100
+--- a/java/org/apache/el/ExpressionFactoryImpl.java 2026-10-06 20:59:20.000000000 +0200
++++ b/java/org/apache/el/ExpressionFactoryImpl.java 2026-10-14 21:22:26.272708343 +0200
@@ -31,7 +31,6 @@
/**
- * @see javax.el.ExpressionFactory
+ * Implementation of {@link javax.el.ExpressionFactory}.
*/
- at aQute.bnd.annotation.spi.ServiceProvider(value = ExpressionFactory.class)
public class ExpressionFactoryImpl extends ExpressionFactory {
- static {
+ /**
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/tomcat.git/commitdiff/df87ae07af344fdbd06faeababc2772d638ce723
More information about the pld-cvs-commit
mailing list