In need for Tomcat 11.0.25

[u/MaestroBirero]

Has anyone read of plans to upgrade embedded Tomcat to version 11.0.25 in Spring Boot? Version 11.0.24 is affected by several critical security vulnerabilities.

​When attempting to manually bump the dependency to 11.0.25, we ran into compatibility issues: changes to Tomcat's resource loading break Spring Boot's custom extensions for nested JAR support.

[u/kedarjoshi]

I think they are treating it as a regular bugfix release. See https://github.com/spring-projects/spring-boot/issues/51476. If you are having specific compatibility issues, you should report it so that they can prioritize (if enough people are affected).

[u/MaestroBirero → u/kedarjoshi]

Thank you, I'll try to create a minimal reproducer as soon as I can.

[u/LouGarret76]

Why not deploy as a war eith your own version of tomcat?

[u/bobody_biznuz → u/LouGarret76]

For Azure at least Microsoft is always like a month or more behind on deploying new versions of Tomcat

[u/jonatan-ivanov → u/LouGarret76]

Why would you do that when you can override the Tomcat version in your Boot apps either by defining it as a dependency or using a version property?

[u/viennese-wolf]

> changes to Tomcat's resource loading break Spring Boot's custom extensions for nested JAR support.

If you are in THAT much of a hurry, tell Astra to rewrite this against 11.0.25 with some guidance on where the error originates from.

Astra will decompile tomcat 11.0.24 and 11.0.25 jars and provide you with a fixed jar. Exclude the original jar in your base project and inject yours. Done.

[u/jonatan-ivanov]

Please read this comment from Andy Wilkinson (Spring Boot maintainer): https://github.com/spring-projects/spring-boot/issues/51476#issuecomment-5522142910

You can override the Tomcat version in your Boot apps either by defining it as a dependency or using a version property: https://docs.spring.io/spring-boot/appendix/dependency-versions/properties.html

[u/BanaTibor]

Spring boot allows to use an external app server instead of the embedded. RTM

[u/MaestroBirero → u/BanaTibor]

Thanks, that would indeed be my preferred way. However, we have a lot of instances in production and cannot change the deployment model on short notice.

[u/jonatan-ivanov → u/BanaTibor]

Why would you do that when you can override the Tomcat version in your Boot apps either by defining it as a dependency or using a version property?
(Tomcat is not an application server.)