Apache Tomcat for Mac

Catalina

• Fix: When starting a web application, don't try and use the web application class loader until after the web application class loader has started.
• Fix: Fix various concurrency issues around adding and removing Realms from a CombinedRealm, in particular doing so while the CombinedRealm is in use. Note that once a Realm instance has been removed from a CombinedRealm instance at run-time, the removed Realm instance may not be reused apart from re-adding it to the same CombinedRealm.
• Update: When StoreConfig re-writes an existing server.xml or context configuration file, preserve the layout of the existing file (comments, blank lines and attribute order) on a best effort basis.
• Fix: Track in StandardContext whether the context was deployed from a Context element in server.xml. Use it to have StoreConfig save to a new config file.
• Fix: Improve error handling on start-up.
• Fix: Fix byte range responses generated by DefaultServlet so a short resource stream read does not truncate the response. Treat a premature end of stream as an I/O error.
• Fix: Align OpenSSLLifecycleListener with AprLifecycleListener and throw an Error when FIPS is requested but not available.
• Fix: Ensure that, as per the documentation, a simple bind is always used when the JNDI realm binds using the user provided name and password to authenticate the user.
• Update: Optimize Accept-Language header processing and use of resource bundles for localization.

Coyote

• Fix: Fix a stalled TLS handshake with the OpenSSL based implementations of SSLEngine when the first flight of handshake messages sent by the server is too large to fit in the buffer used by the BIO pair.
• Fix: Fix possible corruption when using HTTP/2 and async IO on uploads.
• Fix: Avoid very rare race between async write notification and completion. Skip the write notification in these cases since it would be useless.
• Fix: Fix a timing issue that could cause large non-blocking writes to stall for AJP connections.
• Fix: Improve the handling of the requirements for response closure in section 5.7 of the Servlet specification. If a non-blocking write writes exactly content-length bytes to the response, allow that write to complete in a non-blocking manner before the response is closed.
• Fix: Ensure that the non-blocking write buffer is empty before sending an AJP end response message.
• Fix: Fix CharChunk.indexOf(char) so that it searches from the start of the chunk rather than from twice the chunk's start offset when the chunk does not begin at the start of its buffer.
• Fix: Fix a leak in the HTTP/2 connection flow control window when part of the HTTP request body is received but not read.
• Fix: Avoid closing a JarFile in CloseableURLConnection unless it is certain the JAR is not shared.
• Fix: Fix possible corruption of HTTP/1.1 chunked response bodies if a previous write to a chunked body fails.

Full list of changes available here