7.0.10

Eclipse GlassFish is an application server, implementing Jakarta EE. This release is corresponding with the Jakarta EE 10 specification, which is a major new feature release. Jakarta EE 10 requires JDK 11 as a minimum, but also works on JDK 17.

GlassFish 7.0.10 is a final release, containing final Jakarta EE 10 APIs. It compiles and runs on JDK 11 to JDK 21. MicroProfile support requires JDK 17 or higher.

Release overview

In this release a 10 months long operation to get an internal dependency to the slf4j-api removed finally got to fruition. This involved the intense cooperation of multiple teams, and we're exceptionally happy to have finally been able to do this. We also did a lot of work to make our builds repeatable (big thanks to @hboutemy), and we did a ton of refactoring to the internal security packages of GlassFish, making them easier to understand and therefor easier to maintain. Any external code depending on these internal packages (such as potentially custom LoginModules/Realms) may have to update (we recommend of course not depending on internal packages and using public APIs). As every release, we integrated many component updates, and did a number of smaller fixes.

Fixes

• Fixed CVE - Avoid protocol relative redirects by @arjantijms in #24655
• Fixed admin console - replace gf.redirect to gf.navigate where it needs to be replaced by @kaido207 in #24607
• Fix #24641 Cannot filter deployed applications by Engines in Admin Console by @kaido207 in #24642
• Fixed osgi-shell asadmin command by @avpinchuk in #24610
• Fixed list-persistence-types asadmin command by @avpinchuk in #24628
• Fixed dependency on OS settings of java by @dmatej in #24617
• Fixed resource cleanup in Embedded - Improve GlassFish process runtime type detection by @avpinchuk in #24611
• Fixed builds on Windows by @dmatej in #24606
• Fixed the startserv script for macOS by @OndroMih in #24639
• Fixed NPE - the unusedJarsCheck is sometimes null by @dmatej in #24627
• Fixed instance synchronization by @avpinchuk in #24631

Component updates

• Integrate Weld 5.1.2 by @arjantijms in #24634
• Integrate WaSP 3.2.1 by @arjantijms in #24624
• Integrate Jakarta JSON-P 2.1.3 and implementation Parsson 1.1.5 by @arjantijms in #24650
• Integrate Jakarta SOAP (XMLWSAPI) 4.0.1 and JAXB implementation 4.0.4 by @arjantijms in #24649
• Integrate Grizzly 4.0.1 by @pzygielo in #24614
• Integrate HK2 3.0.5 and ASM 9.6 by @arjantijms in #24620
• Integrate EclipseLink ASM 9.6.0 by @arjantijms in #24648
• Integrate Stax 2 API 4.2.2 by @arjantijms in #24633
• Integrate Commons IO 2.14.0 by @arjantijms in #24651
• Integrate Classmate 1.6.0 by @arjantijms in #24652
• Integrate Nimbus Jose JWT 9.37 by @arjantijms in #24654
• Integrate JLine 3.23 by @arjantijms in #24658
• Integrate Commons IO 2.15 by @arjantijms in #24659
• Integrate JSCH 0.2.12 by @arjantijms in #24660
• Update glassfishbuild-maven-plugin 4.0.0-M1 + fixes by @dmatej in #24605
• Update GlassFish Build Maven plugin 4.0.0 by @arjantijms in #24661
• Update test tools checkstyle and jacoco by @arjantijms in #24656
• Update pom.xml EE4J parent to 1.0.9 by @arjantijms in #24657

Project refactoring and maintenance

• New XmlSec4 without mandatory SLF4J by @dmatej in #24225
• Improve reproducible builds by @hboutemy in #24462
• Disable date in hk2 generated files by @hboutemy in #24372
• Move and rename security packages by @arjantijms in #24640
• Streamline security APIs by @arjantijms in #24637
• Refactor Realm and related code by @arjantijms in #24630
• Refactor and clean login modules by @arjantijms in #24635
• Disable lockAndRenameTest on Mac. The OS just doesn't guarantee this. by @arjantijms in #24623
• Deprecated XMLInputFactory.newInstance replaced by newFactory by @dmatej in #24625
• Docs pushed to the end of the build by @dmatej in #24629

Full Changelog**: 7.0.9...7.0.10