Introducing Jetty 12.1.0

New Features:

• New Jakarta EE11 Server Environment
• New Compression layer with support for gzip, brotli, and zstandard compression and decompression. Available on Server via a new CompressionHandler and HttpClient APIs.
• New Server WebApp Deployment layer. Gone are the multiple scanners and multiple directories, now only 1 directory is scanned, along with support for Jetty Server Environment (ee8, ee9, ee10, ee11, etc) configuration files that apply to all webapps deployed in that environment.
• New Jetty Start Modules for easier management of environment specific configurations (see start.jar --help for details)

Special Thanks to the following Eclipse Jetty community members

• @afarber (Alexander Farber)
• @kohlschuetter (Christian Kohlschütter)
• @lijinliangyihao (lijinliang)
• @maarouf-yassine (Maarouf Yassine)
• @sanjerai (Sanjeev Rai)
• @scrat98 (Artem Golovko)
• @trucnguyenlam (Truc Nguyen Lam)

Changelog

• #842 - Implement RFC7239 support in Proxy and Middleman

• #2717 - Async requests are not considered when shutting down gracefully
• #3377 - Improve jetty-ssl-context.xml
• #4493 - Document ThreadPoolBudget behavior
• #5308 - Extract httpConfig and scheduler configuration out of jetty.xml
• #5442 - Allow multiple authentication options for a web app

• #5685 - AsyncProxyServlet calls onProxyResponseSuccess() when internally it throws "Response header too large" exception
• #5888 - Limit usage of HTTP/2 connections
• #6328 - High CPU usage of method handle invocations in Jetty 10

• #8715 - Jetty 12 - Optimize RequestLog information retrieval
• #8768 - JSON support for Java 16+ Records

• #8769 - Introduce new Compression Handler with support for gzip, brotli, and zstandard
• #8790 - Jetty-12 HttpContent should have an async API

• #9051 - Review Jetty-12 DelayedHandler
• #9529 - Expose TCP connection establishment information
• #9632 - Jetty 12 - conditional headers handling for welcome files
• #9632 - Jetty 12 - conditional headers handling for welcome files

• #9778 - Jetty 12 - Remove WriteFlusher.Listener

• #9794 - Jetty 12 - jetty-ee9-proxy.xml broken

• #9980 - Add format option to CustomRequestLog for request authority and request authority scheme+ #10608 - DefaultServlet behaviour wrong for welcomeFiles

• #11289 - Embedded jetty doesn't set the charset to content-type header
• #11294 - NPE on trying to read uri, headers or attributes from the original HttpServletRequest wrapped in UpgradeRequest on WebSocket server in Jetty 12
• #11307 - Explicit demand control in WebSocket endpoints with only onWebSocketFrame()
• #11307 - Explicit demand control in WebSocket endpoints with only onWebSocketFrame()
• #11320 - Review callers of HttpChannelState.onIdleTimeout()
• #11325 - Review content-length check in ServletChannel

• #11358 - Jetty Websocket should have some API to handle timeouts

• #11413 - Conscrypt does not support server-side SNI
• #11425 - Review Handler Collection logic around InvocationType
• #11492 - Auto add AliasChecker for custom Base Resource in DefaultServlet

• #11514 - Start properties jetty.webapp.addServerClasses and jetty.webapp.addSystemClasses are not applied during ee8/ee9 deployments
• #11560 - Implement Web3 OAuth/Sign-In Functionality

• #11579 - Introduce UriCompliance.Violation.FRAGMENT to reject HTTP Request Line that includes fragment section.

• #11741 - Review case of MimeType.Type charsets
• #11749 - InvalidArgumentExceptions due to invalid status codes are not handled properly
• #11815 - Servlet spec 6.1 issue 300

• #11947 - Jetty12: HttpConfiguration#_relativeRedirectAllowed flipped to true per default
• #11947 - Jetty12: HttpConfiguration#_relativeRedirectAllowed flipped to true per default
• #11952 - Remove usages of ByteBufferCallbackAccumulator

• #11956 - Consider re-introducing ByteBufferPool.NON_POOLING constant
• #12023 - [12.1.x] Remove deprecated classes/methods
• #12082 - RetainableByteBuffer.DynamicCapacity enters a corrupt state when released

• #12106 - Document protected and hidden classes
• #12153 - Failed to serve resource java.lang.IllegalStateException: s=HANDLING rs=ASYNC os=OPEN is=IDLE awp=false se=false i=true al=0
• #12266 - InvocationType improvements and cleanups
• #12266 - InvocationType improvements and cleanups

• #12268 - IteratingCallback may iterate too much when process() returns Action.IDLE

• #12272 - Potential deadlock with Vaadin
• #12300 - Use of RewriteHandler.LastRuleHandler without a child handler should produce a clear error message. (@sanjerai)

• #12313 - Jetty 12 ee9/ee10 doesn't invoke callbacks when h2 client sends RST_STREAM
• #12318 - SecurityUtils should not elminate calls to existing methods

• #12323 - AsyncMiddleManServlet response flushing
• #12324 - Response compression does not work when the Accept-Encoding: * request header is used.
• #12324 - Response compression does not work when the Accept-Encoding: * request header is used.

• #12339 - Default session configuration parameter flushOnResponseCommit to true rather than false
• #12341 - QPack encoder must not send any encoder instructions when SETTINGS_QPACK_MAX_TABLE_CAPACITY is 0
• #12348 - HttpClientTransportDynamic does not initialize low-level clients
• #12350 - LdapLoginModule support for Jetty Password obfuscation
• #12356 - RuntimeIOException: Parser is terminated when doing lots of requests with Connection: Keep-Alive

• #12361 - ErrorHandler#getShowMessageInTitle() is ignored

• #12378 - Change default value for SslContextFactory.renegotiationAllowed to false
• #12397 - .tgz files are double-gzipped
• #12404 - Parsing URI with HttpUri.from(String uri) throws "IllegalArgumentException: Bad authority" when path is empty

• #12428 - No ALPNProcessor for org.bouncycastle.jsse.provider.ProvSSLEngine error with jetty http2 client
• #12429 - HandshakeRequest getHeaders are case sensitive.
• #12436 - Allow headers size extend to maxRequestHeadersSize in http client
• #12436 - Allow headers size extend to maxRequestHeadersSize in http client (@shaoxt)
• #12453 - Guard against NullPointerException in AnnotationParser
• #12469 - Content.Sink.write(sink, last, utf8Content, callback) could become faster
• #12481 - Exception when a Content-Length is set on a 304 response
• #12482 - CustomRequestLog %q inconsistency with a doc
• #12486 - Undisable and fix PartialRFC2616Test
• #12488 - HTTP/2 headers may not be split in CONTINUATION frames
• #12496 - MultiPartFormData.Parser question.
• #12502 - Undisable WebAppContextTest.testGetResourcePaths
• #12505 - ErrorPageErrorHandler does not use the proper attributes for error handling
• #12520 - Numerous stack traces logged at warning level when running under HTTP/2 (regression in 12.0.15)
• #12529 - Undisable ee9 BlockingTest and fix HttpChannel.produceContent
• #12530 - Make HttpOutput.println() simpler and faster
• #12531 - Reworking jetty-compression for JPMS
• #12534 - Jetty 12.1.x ee9 ee10 ee11 default servlet test resource servlet test
• #12537 - org.eclipse.jetty.server.LowResourceMonitor#setMonitorThreads seems not right (@lijinliangyihao)
• #12546 - Added documentation for DoSHandler.
• #12547 - Improve module deprecation
• #12553 - Execute immediately HTTP/2 failures
• #12558 - Document graceful shutdown
• #12564 - Enhance HTTP Compliance CRLF modes
• #12577 - org.eclipse.jetty.http.HttpURI.getDecodedPath() throws an NPE when there is no path
• #12578 - HttpServletRequest.getParameterMap - UnmodifiableMap does not wrap a jetty MultiMap
• #12588 - oejhs.AbstractHTTP2ServerConnectionFactory installs the HTTP2SessionContainer bean twice
• #12593 - Create start.d/*.ini for [ini-template] modules
• #12603 - ee9 / UnsupportedOperationException: Read Only
• #12609 - Change of behaviour with HttpServletResponse.sendError(0) in EE10
• #12611 - Supporting Compression discovery with ServiceLoader.
• #12612 - Use Compression classes for client decoding
• #12625 - Request.getBeginNanoTime returns invalid values
• #12639 - Request.Content.getContentType()'s Javadoc contradicts HttpConnection.normalizeRequest()
• #12644 - use a builder API for OpenIdConfiguration
• #12646 - CompleteListener may be invoked twice
• #12650 - Attribute org.eclipse.jetty.multipartConfig is null
• #12652 - Jetty Reactive client hangs for HTTP 401 responses
• #12659 - Use websocket over varying http protocols using a single client
• #12663 - Improve scalability of HttpCookieStore.Default
• #12670 - Improve buffer management of HTTP/1 response headers
• #12674 - EE8 has reference to Xalan jars that are no longer needed on new JVMs
• #12680 - ResourceHandler cannot handle files over 2GB in size.
• #12681 - CachingHttpContentFactory$CachedHttpContent already released buffer
• #12683 - Cross context dispatch to root context uses incorrect target path
• #12687 - Buffer reusal in the BufferingResponseListener
• #12689 - Add statistics about ByteBufferPool.acquire() calls made for which there is no bucket
• #12690 - Add configurable capping for values of H2 MAX_HEADER_LIST_SIZE settings frames
• #12695 - 12.1.0 - ResourceHandler is unable to serve content from PathResource that doesn't support mapped file buffers.
• #12697 - Servlet error pages do not work when Response.writeError is called before entering the ServletChannel
• #12700 - ResourceHandler & ResourceServlet (all envs) do not agree on UseFileMapping default
• #12705 - Orphaned sessions are never deleted at runtime in the SessionDataStore.
• #12706 - Export ArrayByteBufferPool statistics via JMX
• #12714 - MongoSessionDataStore can't upsert sessions if workerName contains token deliminators
• #12723 - Only on Windows: Failed startup of context oeje8w.WebAppContext
• #12730 - RegexRule needs configurable to include query (or not) in match logic
• #12735 - Provide better documentation of JettyWebSocketServletContainerInitializer and jetty-${ee-version}-websocket-jetty-server modules
• #12739 - Regression in handing CombinedResource WEB-INF between Jetty 11 and Jetty 12
• #12746 - Sporadic NPE in HttpChannelState.onFailure
• #12750 - UriCompliance is ignored for query string parsing
• #12760 - Jetty snapshot process publishes incorrect BOMs that are different from the release BOMs
• #12768 - Static HTML in demos still refer to Jetty 10/11 and earlier concepts.
• #12775 - EE9 Servlet API throws exceptions in normal control flow
• #12790 - Cannot invoke "org.eclipse.jetty.io.RetainableByteBuffer.getByteBuffer()" because "buffer" is null
• #12792 - Issue when scrolling around in embedded videos
• #12802 - Make Server::setDefaultHandler and Server::setErrorHandler arguments consistent
• #12810 - Add jetty-ee to a BOM
• #12818 - NPE with websocket java.lang.NullPointerException: Cannot invoke "org.eclipse.jetty.io.RetainableByteBuffer.hasRemaining()" because "this.networkBuffer" is null
• #12821 - Restore ee9/ee8 ContextHandler.setCompactPath(boolean) behavior for backward compat reasons
• #12824 - Pairing ee{8,9,10} environemnt class loading with additionaljar/modules
• #12828 - HttpServletResponse.encodeURL() does not support relative paths
• #12834 - Quotes should be escaped in request logs
• #12852 - Jetty's 12.1.0 ArrayByteBufferPool.Quadratic java.lang.ArrayIndexOutOfBoundsException
• #12855 - ContentSourceTransformer.read() may call release() more than once
• #12875 - Fixes for EE11 Jakarta WebSocket implementation to fix TCK failures.
• #12882 - HttpConfiguration setResponseHeaderSize is ineffective in 12.0.17
• #12888 - ErrorPageHandler dispatcher returns incorrect 405 for failing POST requests (e.g. JAX-RS)
• #12892 - Module http-forwarded does not appear to be able to use the IP in X-Forwarded-For header with any TLS HTTP request if the module http2 is also loaded
• #12900 - Make JPMS work with new Environments features
• #12906 - URIUtil#correctURI throws StringIndexOutOfBoundsException - Jetty 12 regression
• #12913 - Resource located inside JAR file is wrongfully treated as an alias
• #12916 - Bad example in JavaDoc of InputStreamResponseListener
• #12918 - NullPointerException with ServeAs requests (with FormAuthenticator)
• #12919 - Reduce some OSGi code duplication with core Activator.
• #12923 - Introduce Bouncy Castle Jetty module
• #12926 - maxFormContentSize doesn't count "=" characters
• #12936 - UnsupportedOperationException when modifying HttpServletResponse after commit
• #12943 - Unable to handle - IllegalStateException in Jetty Client Request send()
• #12958 - Discrepancy between Jetty 9 and Jetty 12 when setting the base resource to a path containing ..
• #12961 - Different results for getRequestURL in filters with async requests
• #12963 - Slow transfers on custom / non-Path Resource instances (@kohlschuetter)
• #12965 - Allow Resource instances to provide Content.Source directly
• #12981 - MultiPart annotation scanning not done if metadata-complete==true
• #12985 - Optimize memory usage of FrameFlusher.timeoutExpired
• #12988 - Introduce an HTTP/2 frame listener
• #12990 - Jetty CoreContextHandler needs to support simple static directory deployment
• #12992 - Deployment Scanner is still performing hot deploy by default, contrary to documentation
• #12993 - Improve Hot Redeployment Information logging
• #12995 - Clarify deployment of foo/ and foo.d/ directories
• #12997 - DeploymentScanner should only act on *.xml or *.properties changes in environments/ directory.
• #13000 - Remove environment XML properties functionality from deployer
• #13002 - HugeResourceTest.testUploadDelayed() fails when RetainedContentLoaderFactory's reject is not explicitly disabled
• #13003 - Avoid cycles in bean dumps
• #13004 - QueuedThreadPool throws error on quick successive execute calls if initialized with BlockingArrayQueue or ArrayBlockingQueue
• #13008 - Introduce HttpClient's Request.onResponseListener()
• #13011 - Review changes in org.eclipse.jetty.server.Deployable in 12.1.x and apply appropriate deprecations and warnings
• #13012 - Refine Deferred Authentication
• #13013 - Rework websocket FrameFlusher's expiration
• #13019 - [util-ajax] Support CharSequence instead of String for JSON.parse (@scrat98)
• #13029 - Web-socket that use permessage-deflate extensions are keeping in memory the last message sent to the client
• #13031 - SessionHandlerTest.testFlushOnResponseCommit is flaky
• #13040 - Introduce Deploy property baseResource for use in 12.1.x deploy
• #13043 - Review WebSocket flushers
• #13046 - Restore ee9 (and ee8) behaviors with parsing application/x-www-form-urlencoded parameters
• #13048 - Exception from oeje11wjt.JakartaClientClassLoaderTest#websocketProvidedByServer
• #13051 - Jetty 12.1.x build stuck because of waiting on the Class initialization monitor for org.eclipse.jetty.io.RetainableByteBuffer$Abstract
• #13057 - InvalidPathException instead of MalformedURLException after switching to jetty12
• #13064 - Jetty 12.0.x/12.1.x: ShutdownMonitorTest is stuck
• #13069 - Deploy Environment Weights
• #13078 - Remove deprecated jetty-runner
• #13084 - Documented the new web application deployer.
• #13087 - Why doesn't SocketAddressResolver API receive the context map?
• #13090 - Replace RuntimeIOException with UncheckedIOException
• #13095 - Common RFC tests
• #13098 - HTTP2 Server Error Handling is different than HTTP1
• #13101 - Implement rejection RFC9110 Bad White Space
• #13104 - Change DeploymentScanner monitoredDir names to webappsDir
• #13121 - Deploy Dump & cleanup
• #13122 - Common Annotation Parser
• #13127 - Support Digest authentication with SHA-256
• #13131 - Surface received GOAWAY in HttpClient
• #13144 - Cross Context Dispatch with Async does not honor context
• #13156 - Force servlet4 demos to be build last, to have ee8 built last
• #13164 - ProxyServlet abort
• #13170 - use real url as this can eventually be used by some tooling
• #13179 - Fix HTTP/3 behavior in case of client reset.
• #13181 - Reviewed HTTP/3 API to simplify the implementation.
• #13186 - Merge Jetty 12.1.x Support maven.offline property in jetty-start, to control of download of maven files from remote repos during --add-modules (#13147)
• #13187 - Missing API to increase QueuedThreadPool maxThreads by leased threads + QoSHandler bug of exceeding maxRequestCount by 1
• #13190 - Introduce ability to decode and/or canonicalize URIs in a RewriteRule
• #13196 - Download of large file may get stuck in an infinite loop (bug in IOResources.copy / Content.Source) (@kohlschuetter)
• #13205 - Re-implemented StacklessLogging to be thread safe
• #13206 - Improve InputStreamContentSource byte[] handling.
• #13213 - Review WebSocket ClientUpgradeRequest API for 12.1
• #13214 - Port async cross context dispatch to ee11
• #13217 - Deployment of XML only with ServletContextHandler sets wrong baseResource
• #13218 - Support arbitrary Handlers and core webapp archives in core-deploy
• #13228 - Update Core Deploy Documentation
• #13230 - Prevent cycles/stackoverflow in dump
• #13232 - Regression in ee9/ee8 getRequestDispatcher() exceptions
• #13234 - Regression in 12.0.21 on handling empty query parameters
• #13238 - stop.host property always uses the default 127.0.0.1
• #13240 - Fix NPE in HttpReceiver.responseSuccess() when that method is called more than once
• #13242 - Keep extracted query params as attribute for jetty-core
• #13244 - Client responses of HTTP conversations have mismatching request
• #13251 - Jetty 12.0.x use our new release tools
• #13259 - org.eclipse.jetty.plus.jndi.Transaction should support javax.naming.Referenceable as a constructor option too.
• #13261 - Improve handling of failed HTTP/2 requests
• #13263 - NPE from SslEndPoint.isInputShutdown
• #13266 - Fix Typo in http.adoc (@maarouf-yassine)
• #13268 - charset=null is automatically added when using Content-Type: application/problem+json in Servlet ee10
• #13274 - JettyWebSocketTest sometimes fails with ConcurrentModificationException
• #13284 - jetty-openid library swallows provider errors when getting auth code
• #13285 - Upgrade quiche to version 0.24.4
• #13288 - jetty 12.0.x 8867 plugin toolchain
• #13291 - Remove unnecessary old slf4j osgi compatibility
• #13295 - Fix comments in NamingEntry; add support for simple scope name
• #13299 - Race Condition in WebSocketConnection - Job failed: java.lang.IllegalStateException: FILLING_AND_PARSING
• #13300 - o.e.j.plus.jndi.Resources declared in eeX scope then linked via <resource-ref> or <resource-env-ref> in web.xml not found
• #13303 - Improved logging and exception handling in HTTP2Producer.
• #13321 - Cleanup plus and annotations hierarchy
• #13330 - Content negotiation for Accept-Language (static pages)
• #13336 - HTTP/2 - Valid horizontal tab "\t" in http header is coverted into "?"
• #13343 - Module eeN-quickstart should depend on eeN-annotations
• #13348 - jetty 12.0.x dependencies upgrade
• #13350 - Fixes to ConnectionLimit for use with WebSocket
• #13354 - Upgrade jasper-jsp 9.0.107, 10.1.43
• #13356 - Executing --dry-run via shell $() can fail when certain JVM options are used.
• #13363 - Improve JSP scratch directory creation and error message.
• #13364 - Deploy warnings for ee8 demos
• #13366 - Introduce MimeTypes.Mutable.clear() API
• #13368 - Valid query sequences are still reported as violations to ComplianceViolation.Listener
• #13375 - WebSocketClient attempts to use HTTP/2 on servers without SETTINGS_ENABLE_CONNECT_PROTOCOL
• #13384 - fix mod file name for inclusion
• #13386 - Improve javadoc documentation for core API methods (@afarber)
• #13393 - EE11 TCK failure: getWriter
• #13395 - EE11 TCK failure: AsyncContext.dispatch(context, path)
• #13402 - Use default constructor for Attributes.Mapped (@trucnguyenlam)
• #13403 - EE8 Servlet API throws exceptions in normal control flow
• #13405 - Use distinct method names for task consumption in AdaptiveExecutionStrategy
• #13419 - testRemoveAndReleaseFromCompoundPool fails when user locale is en_DE (@afarber)
• #13422 - moved context demo fails with ee10 environment
• #13429 - ConnectionLimit has inacurate deprecation version
• #13439 - ServletHolder::initJspServlet() throws NPE after #13363
• #13449 - HTTP2Session cleanups. - Addresses CVE-2025-5115