Jetty Releases 9.4.57

[olamy]

Jetty Versions:
This release process will produce releases: 9.4.57

Target Date:
Unspecified. Branch 9.4.x is now at End of Open Source/Community Support.

• EoCS (End of Community Support) for Jetty 9 - June 2022 #7958

Tasks:

• Create the release(s) issue.
• Update the target Jetty version(s) in the issue.
• Link this issue to the target GitHub Project(s).
• Assign this issue to a "release manager".
• Review draft security advisories. Ensure that issues are created and assigned to GitHub Projects to capture any advisories that will be announced.
• Update GitHub Project(s)
  • Create new project for the next releases (not this release).
  • Ensure new project is public (not private)
  • Freeze the target GitHub Project(s) by editing their names to "Jetty X.Y.Z FROZEN"
  • Review the issues/PRs assigned to the target GitHub Project(s). Any tasks that are not-yet-started are moved to next releases.
• Review dependabot status. Manually run dependabot if needed and review resulting PRs for inclusion.
  Such updates should only be included in the week before a release if there is a compelling security or stability reason to do so.
• Wait 24 hours from last change to the issues/PRs included in FROZEN GitHub Project(s).
• Verify target project(s) are complete.
• Assign issue to "build manager", who will stage the releases.
  • Create and use branches release/<ver> to perform version specific release work from.
  • Ensure git fetch --tags (as we potentially rewrite tag when re staging local tag can be out of sync and this command will fail and so fail the release script)
  • Ensure VERSION.txt additions for each release will be meaningful, descriptive, correct text.
  • Stage 9.4 release with Java 11.
  • Push release branches release/<ver> to to https://github.com/jetty/jetty.project
  • Push release tags jetty-<ver> to https://github.com/jetty/jetty.project
  • Edit a draft release (for each Jetty release) in GitHub (https://github.com/jetty/jetty.project/releases). Content is generated with the "changelog tool".
• Assign issue to "test manager", who will oversee the testing of the staged releases.
  • Test CometD.
  • Test Reactive HttpClient.
  • Test Jetty Docker images.
  • Check TCK CI.
  • Assign issue back to "release manager".
• Collect release votes from committers.
• Promote staged releases.
• Merge release branches back to main branches and delete release branches.
• Verify release existence in Maven Central by triggering the Jenkins builds of CometD.
• Update Jetty versions on the website ( follow instructions in jetty-website ).
  • Update (or check) Download page is updated.
  • Update (or check) documentation page(s) are updated (if applicable for supported versions of Jetty).
• Publish GitHub Releases.
• Publish any security advisories.
  • Edit VERSION.txt to include any actual CVE number next to correspondent issue.
  • Edit any issues for CVEs in github with their CVE number
• Notify downstream maintainers.
  • Docker maintainer.

[JackieTien97]

Hi, I'm a PMC member of Apache IoTDB in which we have a dependency on jetty 9.4.56.
However, there still exists a CVE in that version which seems to be resolved in v9.4.57.
So, I’d like to ask about the progress of the 9.4.57 release. When can it be available for dependency in the Maven repository?

[olamy]

@JackieTien97, this has been delayed. You should better understand that 9.x versions have been EoCS (End of Community Support) #7958 for more than two years now.
In your interest, it would be better to upgrade to 12 (with ee8 support if you cannot upgrade to a more recent servlet API)

[JackieTien97]

ok... thx

[tarunkalra7]

@olamy Could you please update the targeted date for this?

[joakime]

@tarunkalra7 the target date is unspecified for any open source release of 9.4.x

[joakime]

@tarunkalra7 you should be using a supported version of Jetty at this point in time.
Jetty 12 is that version.

Note: if you need to stick with javax.servlet and cannot upgrade to jakarta.servlet yet, then use the ee8 environment on Jetty 12, as that still supports the older javax.servlet namespace.