Special Thanks to the following Eclipse Jetty community members

• @stefanroex (Stefan Roex)
• @sharanggupta (Sharang Gupta)
• @adityaanikam (adityaanikam)
• @Bhav-ya-H (Bhavya H)

Changelog

• #16068 - Servlet 6.1 TCK Failure Fix - Synthetic Expires Attribute in Set-Cookie
• #16066 - rework H2 reset
• #16062 - Support dynamic modification of KeyStore entries in SslContextFactory
• #16021 - jetty-security declares junit-jupiter-engine / junit-jupiter-params as compile dependencies
• #16020 - Origin.Address.asString(), Strict-Transport-Security and Alt-Svc are formatted with the default Locale (non-ASCII digits)
• #16001 - ee11 ResourceServlet aborts the connection on a conditional GET of a large welcome file when async-supported
• #15941 - permessage-deflate keeps a Deflater per session even with server_no_context_takeover (@stefanroex)
• #15939 - Allow per-request form limits to be set from a Handler
• #15932 - honor date-time offsets in SignInWithEthereumToken.validate (@Bhav-ya-H)
• #15929 - SessionHandler.SessionRequest.getSession(true) returns null after the session was invalidated in the same request
• #15888 - EagerContentHandler swallows Callback.failed(), leaving QoSHandler permits occupied (@adityaanikam)
• #15883 - Review EE10+ DefaultServlet's 405 Method Not Allowed response when POST method is used
• #15877 - fix off-by-one bounds check in HttpURI path character validation (@Bhav-ya-H)
• #15762 - Rework ${jetty.home}/lib/ for isolated environment libs, and introduce jetty-core-home archive.
• #15760 - Positive Max-Age does not take precedence over an expired Expires attribute
• #15718 - HttpCookieUtils ignores expires attribute
• #14536 - Jetty 12.1.6 ResourceHandler not respecting start of byte range request when setUseFileMapping is true (@sharanggupta)
• #14127 - Jetty Core webapps not deployed when directory contains dots (@sharanggupta)

Special Thanks to the following Eclipse Jetty community members

• @stefanroex (Stefan Roex)

Changelog

• #16067 - 12.0.x: rework H2 reset
• #16020 - Origin.Address.asString(), Strict-Transport-Security and Alt-Svc are formatted with the default Locale (non-ASCII digits)
• #16001 - ee11 ResourceServlet aborts the connection on a conditional GET of a large welcome file when async-supported
• #15941 - permessage-deflate keeps a Deflater per session even with server_no_context_takeover (@stefanroex)
• #15929 - SessionHandler.SessionRequest.getSession(true) returns null after the session was invalidated in the same request
• #15883 - Review EE10+ DefaultServlet's 405 Method Not Allowed response when POST method is used

Special Thanks to the following Eclipse Jetty community members

• @adityaanikam (Aditya Nikam)
• @wendigo (Mateusz "Serafin" Gajewski)

Changelog

• #15874 - [12.1.x] Introduced recursion depth limit in JSON parsing.
• #15871 - SessionHandler uses ConnectionMetaData.isSecure() instead of Request.isSecure(), breaking secure session cookies behind ForwardedRequestCustomizer (@adityaanikam)
• #15869 - PathResource incorrectly treats a classpath resource inside a JAR under a non-ASCII path as an alias
• #15852 - Upgrade quiche to version 0.30.0
• #15846 - Allow per-request form limits to be used with EE8/EE9
• #15840 - HTTP/1 response header overflow retry loses previously determined connection persistence
• #15839 - Simplified callback method notifications.
• #15822 - Introduce flag in Rewrite Rules to preserve UriCompliance Violations when rewriting URIs
• #15807 - ArrayByteBufferPool.clear() leaves the bucket's secondary QueuedPool poisoned: NPE on the next acquire()
• #15733 - ee11 servlet: ServletRequest.getServletContext() returns the source context, not the target, after a cross-context RequestDispatcher.include()
• #15679 - Fixes race for HTTP3StreamConnection release of Chunk
• #15678 - CompressionHandler randomly truncates output
• #15675 - Optimize Huffman codec (@wendigo)
• #15674 - Optimize HPack (@wendigo)
• #15432 - BrotliEncoderSink drops all but the last pulled buffer, silently truncating large Brotli responses
• #15386 - Issues in http2 stream idle timeouts
• #15368 - HTTP/2 client aborts exchange and loses response completed during server graceful shutdown (regression in 12.1.10 / 12.0.36 from #15134 / #14692)

Special Thanks to the following Eclipse Jetty community members

• @adityaanikam (Aditya Nikam)

Changelog

• #15875 - [12.0.x] Introduced recursion depth limit in JSON parsing.
• #15871 - SessionHandler uses ConnectionMetaData.isSecure() instead of Request.isSecure(), breaking secure session cookies behind ForwardedRequestCustomizer (@adityaanikam)
• #15869 - PathResource incorrectly treats a classpath resource inside a JAR under a non-ASCII path as an alias
• #15807 - ArrayByteBufferPool.clear() leaves the bucket's secondary QueuedPool poisoned: NPE on the next acquire()
• #15678 - CompressionHandler randomly truncates output
• #15386 - Issues in http2 stream idle timeouts
• #15368 - HTTP/2 client aborts exchange and loses response completed during server graceful shutdown (regression in 12.1.10 / 12.0.36 from #15134 / #14692)

Special Thanks to the following Eclipse Jetty community members

• @DragonFSKY (DragonFSKY)
• @kamilkrzywanski (Kamil Krzywanski)

Changelog

• #15668 - Strengthened connection failure handling.
• #15649 - Various improvements for SignInWithEthereum Authentication
• #15633 - Fixes for MultiPartCompliance configuration
• #15631 - Allow customizing GracefulHandler's shutdown rejection response
• #15629 - [12.1.x] Improve *AuthenticationProtocolHandler.accept()
• #15612 - Reuses URIUtil.canonicalPath() for URI matching.
• #15591 - Fixes FCGI's "try-files" query handling.
• #15590 - Making CIDR pattern matching case insensitive
• #15582 - Add additional configuration for SessionAuthentication persistence (12.1)
• #15556 - Fix the use of quickstart with a combined base resource.
• #15548 - AbstractProxyServlet.filterServerResponseHeader returns existing value
• #15504 - BouncyCastleClientALPNProcessor does not have a fallback for empty protocol string. (@DragonFSKY)
• #15459 - Add a Jetty module for the HashLoginService
• #15454 - Fix for 15420 (add support for HttpClient.maxDestinations)
• #15385 - Streamline dependencies for HTTP/3 Server with Quiche
• #14930 - SymlinkAllowedResourceAliasChecker.check() fails with NPE (@kamilkrzywanski)
• #14906 - Flaky test: RedispatchTests.testEe8FilterWithAwkwardRequestURI() — fails in 45% of CI builds (@DragonFSKY)
• #14403 - RoundRobinConnectionPoolTest.testMultiplexWithMaxUsage() on FCGI is flaky (@DragonFSKY)

Changelog

• #15682 - Fixes for MultiPartCompliance configuration (12.0)
• #15681 - Fix the use of quickstart with a combined base resource (12.0)
• #15680 - [12.0.x] Strengthened connection failure handling. (#15668)
• #15630 - [12.0.x] Improve *AuthenticationProtocolHandler.accept()
• #15615 - [12.0.x] Reuses URIUtil.canonicalPath() for URI matching.
• #15592 - [12.0.x] Fixes FCGI's "try-files" query handling.
• #15583 - Add additional configuration for SessionAuthentication persistence (12.0)
• #15551 - [Backport] Updating ConstraintTest
• #15550 - [Backport] Use IncludeExclude instead for Host filtering
• #15549 - [Backport] Improve IPv6 support in HttpURI

Special Thanks to the following Eclipse Jetty community members

• @zenios (Dimitris Zenios)

Changelog

• #15496 - mime-type filtering by IncludeExclude should always be case-insensitive
• #15456 - Fragments in redirects not supported by default in standalone Jetty installation
• #15453 - HttpServletResponse: setHeader("Content-Length", N) should be treated like setContentLengthLong(N)
• #13970 - ForwardedRequestCustomizer uses connection port instead of proto default when host lacks port (@zenios)
• #577 - AbstractProxyServlet onServerResponseHeaders addHeader rather than setHeader

Changelog

• #15503 - Remove LF_CHUNK_TERMINATION from non-legacy HttpCompliance modes (12.0)
• #15501 - cleanups to WebSocket RFC6455Handshaker and Parser (12.0)
• #15428 - Backport of #15307.

Changelog

• #15345 - Move RateControl to jetty-io
• #15308 - CachingWebAppClassLoader is not registering as parallel capable
• #15267 - Introduce module for MinimumDataRateHandler
• #15234 - Review error response codes from EagerContentHandler
• #15232 - Jetty 12.1.x EE11 doesn't handle Session attributes properly
• #15228 - Fix increased in memory usage between 12.1.8 and 12.1.10 caused by ZipFileSystems
• #15226 - Server becomes inaccessible with thousands of qtp threads blocked in HttpChannelState.onIdleTimeout ReentrantLock
• #15217 - jetty-quic-quiche-foreign fails on Windows due to eager resolution of Unix-only quiche_conn_set_keylog_fd
• #15156 - Injecting authentication headers using request filters

Changelog

• #15289 - FileSystemPool fails to mount a jar located under a non-ASCII path ("Bad escape")
• #15226 - Server becomes inaccessible with thousands of qtp threads blocked in HttpChannelState.onIdleTimeout ReentrantLock