Apache Tomcat full changelog

Catalina:
Fix: When starting a web application, don't try and use the web application class loader until after the web application class loader has started. (markt)
Fix: Fix various concurrency issues around adding and removing Realms from a CombinedRealm, in particular doing so while the CombinedRealm is in use. Note that once a Realm instance has been removed from a CombinedRealm instance at run-time, the removed Realm instance may not be reused apart from re-adding it to the same CombinedRealm. (markt)
Update: When StoreConfig re-writes an existing server.xml or context configuration file, preserve the layout of the existing file (comments, blank lines and attribute order) on a best effort basis. (remm)
Fix: Track in StandardContext whether the context was deployed from a Context element in server.xml. Use it to have StoreConfig save to a new config file. (remm)
Fix: Improve error handling on start-up. (markt)
Fix: Fix byte range responses generated by DefaultServlet so a short resource stream read does not truncate the response. Treat a premature end of stream as an I/O error. Based on pull request #1067 by aoto-tech. (markt)
Fix: Align OpenSSLLifecycleListener with AprLifecycleListener and throw an Error when FIPS is requested but not available. (markt)
Fix: Ensure that, as per the documentation, a simple bind is always used when the JNDI realm binds using the user provided name and password to authenticate the user. (markt)
Update: Optimize Accept-Language header processing and use of resource budles for localization. (remm)
Coyote:
Fix: 70236: Fix a stalled TLS handshake with the OpenSSL based implementations of SSLEngine when the first flight of handshake messages sent by the server is too large to fit in the buffer used by the BIO pair. Patch submitted by Lukas Hellebrandt. (remm)
Fix: #1073: Fix possible corruption when using HTTP/2 and async IO on uploads. Submitted by Tim Burke. (remm)
Fix: Avoid very rare race between async write notification and comple

Enhance version.sh and version.bat to display APR, Tomcat Native, and OpenSSL version information.
Free private keys, keys and certificates after use in FFM based connector configuration.
Various HTTP/2 validation improvements and a broader change to use stream resets rather than connection closures where appropriate.

Fix a bug in the non-blocking flushing code for NIO+TLS that meant that a response may not have been fully written until the connection was closed. Pull request 966 provided by Phil Clay.
Improved HTTP/2 error handling
Better error handling for the EncryptInterceptor

Relax HTTP/2 header validation and respond to invalid requests with a stream reset or a 400 response as appropriate rather then with a connection reset.
Fix bug 69964: Respect the configured cipher order, which was no longer respected following the addition of TLS 1.3 specific cipher configuration. TLS 1.3 ciphers will always be first in the list.
Update Tomcat Native to 2.0.14 and increase the recommended version to 2.0.14.

Fix regression in request-end time in access logging which would instead log the request start-time.
Fix regression where ClassLoader.getResource().getContent() failed under certain circumstances.
Update Tomcat Native to 2.0.12 and increase the minimum version to 2.0.12 / 1.3.4.
Expand OCSP support to JSSE-based connections and expand OCSP configuration options.
Update Commons Daemon to 1.5.1.

Add strictSNI attribute on the Connector to allow matching the SSLHostConfig configuration associated with the SNI host name to the SSLHostConfig configuration matched from the HTTP protocol host name. Non matching configurations will cause the request to be rejected. The attribute default value is true, enabling the matching.
Correct a regression introduced in 11.0.11 that broke some clustering configurations.
Update Commons Daemon to 1.5.0.

Fix copy/paste refactoring errors in 11.0.12 that meant DELETE requests received via the AJP connector were processed as OPTIONS requests and PROPFIND requests were processed as TRACE.
Add CIDR support to the RemoteIp[Filter|Valve] and deprecate the RemoteAddr[Filter|Valve] in favour of the RemoteCIDR[Filter|Valve]
Log warnings when the SSO configuration does not comply with the documentation.

The notable changes in this release are:
Add specific certificate selection code for TLS 1.3 supporting post quantum cryptography. Certificates defined with type MLDSA will be selected depending on the TLS client hello.
Add groups attribute on SSLHostConfig allowing to restrict which groups can be enabled on the SSL engine.
Store HTTP/1.1 request headers using the original case for the header name rather than forcing it to lower case.

Correct a regression in the fix for 69781 that broke FileStore
Change the digest used to calculate strong ETags (if enabled) for the default Servlet from SHA-1 to SHA-256
Add hybrid PQC support to OpenSSL-based connectors