Changelog

⚠️ Important Security related Changes

CVE-2021-28165 - #6072 - jetty server high CPU when client send data length > 17408
CVE-2021-28164 - #6101 - Normalize ambiguous URIs
CVE-2021-28163 - #6102 - Exclude webapps directory from deployment scan

#4275 - Path Normalization/Traversal - Context Matching
#5828 - Allow to create a WebSocketContainer passing HttpClient
#5832 - Ctrl-C after jetty:run produces NoClassDefFoundError
#5977 - Cache-Control header set by a filter is override by the value from DefaultServlet configuration
#5994 - QueuedThreadPool "free" threads
#5996 - ERROR : No module found to provide logback-impl for logback-access{enabled}
#5999 - HttpURI ArrayIndexOutOfBounds
#6001 - Ambiguous URI legacy compliance mode
#6008 - Allow absolute paths to be provided in start.ini for request log directory.
#6011 - OSGi Cannot start Jetty with osgi.boot - Configurations add wrong method taken
#6020 - Review Jetty Maven Plugin scanning defaults
#6021 - Standardize Path resolution in XmlConfiguration
#6024 - Error starting jetty-10: Provider org.eclipse.jetty.websocket.javax.client.JavaxWebSocketShutdownContainer not found
#6026 - the jvm DEBUG flag is not working org.eclipse.jetty.LEVEL=DEBUG
#6034 - SslContextFactory may select a wildcard certificate during SNI selection when a more specific SSL certificate is present
#6037 - Review logging modules for j.u.l.
#6050 - Websocket: NotUtf8Exception after upgrade 9.4.35 -> 9.4.36 or newer
#6063 - Allow override of hazelcast version when using module
#6076 - Embedded Jetty throws null pointer exception
#6082 - SslConnection compacting
#6085 - Jetty keeps Sessions in use after "Duplicate valid session cookies" Message