Azul Payara Community 7.2026.7

link_to_pdf:/payara-community/pdfs/7/azul-payara-community-documentation-7.2026.7.pdf[Full Documentation PDF]

Supported APIs and Applications

• Jakarta EE 11

• Jakarta EE 11 Applications

• MicroProfile 6.1

Security Fixes

• [FISH-13687] Brute Force Attack Prevention

Bug Fixes

• [FISH-12353] Fix IBM MQ Resource Adapter Failing to Deploy When Using a Custom metrics.xml File

• [FISH-13041] [Community Contribution - lprimak] Prevent Stack Trace Caching by JVM Thread Stats Provider

• [FISH-13207] Fix restart-deployment-group Command Not Showing Progress

• [FISH-13878] Fix Attributes Removed from org.glassfish.grizzly.config.dom.Http Remaining in httpAttr.inc

• [FISH-13896] Fix SLF4J NOP Instantiation Errors

Improvements

• [FISH-13490] Add Backwards Compatibility for Defining Implicit CDI via glassfish-application.xml

• [FISH-13913] SSH Nodes No Longer Require Elevated Permissions

• [FISH-13982] Add Payara Major Versioned Deployment Descriptors

• [FISH-13989] Remove EclipseLink Moxy

Component Upgrades

• [FISH-13426] Upgrade Grizzly to 5.0.2

• [FISH-13780] Upgrade com.fasterxml.woodstox:woodstox-core from 7.2.0 to 7.2.1

• [FISH-13786] Upgrade jakarta.mvc:jakarta.mvc-api from 3.0.0 to 3.0.1

• [FISH-13812] Upgrade net.java.dev.jna:jna from 5.18.1 to 5.19.1

• [FISH-13819] Upgrade io.projectreactor:reactor-core from 3.8.5 to 3.8.6

• [FISH-13821] Upgrade smallrye-common.version from 2.18.1 to 2.19.0

• [FISH-13822] Upgrade apache.sshd.version from 2.17.1 to 2.18.0

• [FISH-13884] Upgrade jline.version from 3.30.13 to 3.30.15

• [FISH-13965] Upgrade smallrye-config.version from 3.17.2 to 3.18.0

• [FISH-13987] Upgrade com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1

Azul Payara Community 7.2026.6

Supported APIs and Applications

• Jakarta EE 11

• Jakarta EE 11 Applications

• MicroProfile 6.1

Security Fixes

• [FISH-13637] Fix CSRF + SSRF in Admin Console / REST Management Interface

Bug Fixes

• [FISH-10485] Fix Payara Micro Boot Properties Not Applied With the Right Timing

• [FISH-11896] Fix Quoted-Argument Parsing in prebootCommandFile (asadmin) and PREBOOT_COMMANDS (Docker)

• [FISH-12270] Fix Misleading Log Entries Generated While Configuring Additional Properties for Virtual Servers

• [FISH-12800] Fix MicroProfile /metrics Endpoint Containing Duplicate Metrics

• [FISH-13058] [Community Contribution - lprimak] Fix Missing JSESSIONIDVERSION Leading to Session Not Being Correctly Retrieved in Relaxed Mode

• [FISH-13091] Assorted Deployment Group Fixes

• [FISH-13137] Fix Prometheus Metrics to Report Histogram Times in Seconds

• [FISH-13138] Fix Payara Micro’s --outputlauncher to Respect payara-boot.properties

• [FISH-13400] Fix WELD-001408 Unsatisfied Dependency for Repository Injection in CDI Bean

• [FISH-13447] Fix Micro NullPointerException with log-to-console Access Log Option

• [FISH-13779] Fix Changing the Admin Password in the Admin Console Not Working

Improvements

• [FISH-11606] Avoid Parsing Method Names on Every Jakarta Data HTTP Request

• [FISH-12426] Reintroduce Standalone OpenMQ Support for Windows

• [FISH-13097] Add Default OpenMQ Credentials Warning

• [FISH-13339] Add warlibs Support to remove-library Command

• [FISH-13340] Add warlibs Support to list-libraries Command

• [FISH-13475] Support Method-Level @Transactional Overrides on Repository Interfaces in Jakarta Data

• [FISH-13532] Update SSH Provider and Add Windows SSH Support

• [FISH-13649] Define jakarta.security.jacc.policy.provider for Payara Micro

• [FISH-13707] Add Alternate Parsson to BOM

Component Upgrades

• [FISH-12986] Upgrade EclipseLink from 5.0.0-B11 to 5.0.0

• [FISH-13427] Upgrade HK2 to 4.0.1

• [FISH-13477] Upgrade commons-io:commons-io from 2.21.0 to 2.22.0

• [FISH-13521] Upgrade pfl.version from 5.1.0 to 5.1.1

• [FISH-13522] Upgrade payara.security-connectors.version from 4.0.0.Alpha3 to 4.0.0

• [FISH-13540] Upgrade org.glassfish:genericra from 2.0-20081121 to 2.1-20100913

• [FISH-13568] Upgrade com.fasterxml.jackson:jackson-bom from 2.21.2 to 2.21.3

• [FISH-13569] Upgrade gmbal.version from 4.1.1 to 4.1.2

• [FISH-13609] Upgrade jline.version from 3.30.11 to 3.30.13

• [FISH-13667] Upgrade org.jvnet.mimepull:mimepull from 1.10.0 to 1.11.0

• [FISH-13669] Upgrade asm.version from 9.9.1 to 9.10.1

• [FISH-13704] Upgrade jaxb-impl.version from 4.0.7 to 4.0.9

• [FISH-13705] Upgrade com.fasterxml.woodstox:woodstox-core from 7.1.1 to 7.2.0

• [FISH-13710] Upgrade jakarta.json.bind:jakarta.json.bind-api from 3.0.1 to 3.0.2

• [FISH-13744] Upgrade org.eclipse.persistence:org.eclipse.persistence.asm from 9.9.0 to 9.10.0

• [FISH-13747] Upgrade org.glassfish.jaxb:codemodel from 4.0.7 to 4.0.9

• [FISH-13748] Upgrade Jersey to 4.0.2

• [FISH-13758] Upgrade com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.0

• [FISH-13759] Upgrade org.glassfish.grizzly:grizzly-npn-osgi from 2.0.0 to 2.0.1

• [FISH-13760] Upgrade com.nimbusds:nimbus-jose-jwt from 10.9 to 10.9.1

• [FISH-13761] Upgrade org.jetbrains.kotlin:kotlin-stdlib from 2.3.20 to 2.4.0

Azul Payara Community 7.2026.5

Supported APIs and Applications

• Jakarta EE 11

• Jakarta EE 11 Applications

• MicroProfile 6.1

Security Fixes

• [FISH-13096] CVE-2026-24457 - Remote Attacker Can Read Arbitrary Files via Unsafe Parsing of OpenMQ Configuration

• [FISH-13363] Restrict Access to Vulnerable EL Expressions

Bug Fixes

• [FISH-13385] Fix Admin Console Freezing After Upgrading from Payara 6 to 7

Improvements

• [FISH-10287] Update JaccProviderCompatibilityStartup Service

• [FISH-11069] Remove Audit Modules

• [FISH-12092] Add warlibs Support to Redeployment via Admin Console

• [FISH-13090] Reduce INFO Logging for Jakarta Data Impl

• [FISH-13126] Create New Deployment Descriptors with Deprecated Properties Removed

• [FISH-13193] Fix @Repository methods not throwing UnsupportedOperationException when no implementation logic can be injected at deploy time

• [FISH-12430] Remove Container Managed Persistence (CMP) Implementation

Component Upgrades

• [FISH-13231] Upgrade org.glassfish:jakarta.faces from 4.1.6 to 4.1.7

• [FISH-13357] Upgrade smallrye-common.version from 2.17.0 to 2.17.1

• [FISH-13360] Upgrade ant.version from 1.10.16 to 1.10.17

• [FISH-13394] Upgrade org.apache.felix:org.apache.felix.scr from 2.2.14 to 2.2.18

• [FISH-13395] Upgrade io.projectreactor:reactor-core from 3.8.4 to 3.8.5

• [FISH-13424] Upgrade org.javassist:javassist from 3.30.2-GA to 3.31.0-GA

• [FISH-13433] Upgrade org.eclipse.microprofile.config:microprofile-config-api from 3.1 to 3.1.1

• [FISH-13437] Upgrade Docker JDK to 21.0.11

• [FISH-13441] Upgrade Docker JDK to 25.0.3

• [FISH-13462] Upgrade jline.version from 3.30.9 to 3.30.11

Payara Platform Community 7.2026.4

Supported APIs and Applications

• Jakarta EE 11

• Jakarta EE 11 Applications

• MicroProfile 6.1

Improvements

• [FISH-10031] Remove start-domain --upgrade Services

• [FISH-10866] Remove all @Deprecated Methods

• [FISH-12987] Remove all Deprecated Properties

Bug Fixes

• [FISH-5749] Fix Asadmin Recorder Generating Invalid Commands for MicroProfile Properties at the Server Level

• [FISH-12191] Fix Admin Console Advanced Tab in Connection Pools

• [FISH-12975] Fix Broken Payara News Link in Admin Console

• [FISH-13005] Resolve Concurrency Issues With Application-Scoped QueryData Instances

• [FISH-13014] [Community Contribution - Lprimak] Correct CDI Annotation Type Resolution From WAR Libraries

• [FISH-13057] [Community Contribution - Lprimak] Fix SLF4J Class Loader Leak

• [FISH-13185] Fix Unclosed Stream Warnings From OpenMQ

Component Upgrades

• [FISH-13147] Upgrade io.projectreactor:reactor-core from 3.8.3 to 3.8.4

• [FISH-13148] Upgrade jline.version from 3.30.7 to 3.30.8

• [FISH-13194] Upgrade org.jetbrains.kotlin:kotlin-stdlib from 2.3.10 to 2.3.20

• [FISH-13196] Upgrade org.glassfish.jaxb:codemodel from 4.0.6 to 4.0.7

• [FISH-13199] Upgrade jaxb-impl.version from 4.0.6 to 4.0.7

• [FISH-13210] Upgrade org.jboss.logging:jboss-logging from 3.6.2.Final to 3.6.3.Final

• [FISH-13212] Upgrade jline.version from 3.30.8 to 3.30.9

• [FISH-13233] Upgrade com.fasterxml.jackson:jackson-bom from 2.21.1 to 2.21.2

• [FISH-13298] Update OpenMQ to 6.8.0 and Reapply Patches

• [FISH-13331] Upgrade ant.version from 1.10.15 to 1.10.16

• [FISH-13337] Upgrade org.codehaus.woodstox:stax2-api from 4.2.2 to 4.3.0

• [FISH-13343] Upgrade com.nimbusds:nimbus-jose-jwt from 10.8 to 10.9

• [FISH-13351] Upgrade EclipseLink from 5.0.0-B08 to 5.0.0-B11

Payara Platform Community 7.2026.3

Supported APIs and Applications

• Jakarta EE 11

• Jakarta EE 11 Applications

• MicroProfile 6.1

Improvements

• [FISH-10759] Deprecate Support for Old Deployment Descriptors

• [FISH-10865] Remove all @Deprecated and Obsolete Asadmin Parameters

• [FISH-11066] Remove JVM Profiler Configuration

• [FISH-12774] Validate @Repository dataStore property to resolve the persistence unit name when multiple units are configured.

• [FISH-13103] Add Help Text for Configuring admin-session-timeout And session-token-timeout

Bug Fixes

• [FISH-9701] Fix Admin Console Help Home Page resolving to 404

• [FISH-12472] Fix Broken Admin Console Help Index

• [FISH-12903] [Community Contribution - svendiedrichsen] Fix org.glassfish.admin.payload.PayloadFilesManager Potential Memory Leak

• [FISH-12904] [Community Contribution - svendiedrichsen] Fix com.sun.enterprise.deployment.deploy.shared.InputJarArchive Potential Memory Leak

• [FISH-12905] [Community Contribution - svendiedrichsen] Fix com.sun.jdo.spi.persistence.support.sqlstore.connection.ConnectionImpl Potential Memory Leak

• [FISH-12906] [Community Contribution - svendiedrichsen] Fix com.sun.jdo.spi.persistence.support.sqlstore.connection.ConnectionManager Potential Memory Leak

• [FISH-12951] Fix Loading of payara-mp-jwt.properties File Without Leading Slash

• [FISH-12972] Stopping or Restarting the DAS via the Admin Console Requires Clicking an Additional "Submit Query" Button

• [FISH-13037] [Community Contribution - svendiedrichsen] Fix com.sun.enterprise.loader.ASURLClassLoader Potential Memory Leak

• [FISH-13038] [Community Contribution - svendiedrichsen] Fix org.glassfish.deployment.common.ClientArtifactsManager Potential Memory Leak

• [FISH-13040] [Community Contribution - svendiedrichsen] Fix com.sun.jts.CosTransactions.LogFileHandle Potential Memory Leak

Component Upgrades

• [FISH-12948] Upgrade jakarta.xml.bind:jakarta.xml.bind-api from 4.0.4 to 4.0.5

• [FISH-12970] Upgrade io.projectreactor:reactor-core from 3.8.2 to 3.8.3

• [FISH-13028] Upgrade gmbal.version from 4.1.0 to 4.1.1

• [FISH-13029] Upgrade jakarta.xml.ws:jakarta.xml.ws-api from 4.0.2 to 4.0.3

• [FISH-13031] Upgrade com.nimbusds:nimbus-jose-jwt from 10.7 to 10.8

• [FISH-13044] Upgrade com.fasterxml.jackson:jackson-bom from 2.21.0 to 2.21.1

• [FISH-13053] Upgrade org.yaml:snakeyaml from 2.5 to 2.6

• [FISH-13087] Upgrade jline.version from 3.30.6 to 3.30.7

Payara Platform Community 7.2026.2

Supported APIs and Applications

• Jakarta EE 11

• Jakarta EE 11 Applications

• MicroProfile 6.1

Improvements

• [FISH-8650] Remove Lifecycle Listeners

• [FISH-8651] Remove DCOM

• [FISH-8948] Remove Deployment Transformer Integration

• [FISH-10454] Add more configuration options to System Logging

• [FISH-10915] Remove redundant ClassGraph dependency

• [FISH-11067] Remove Load Balancer settings

• [FISH-11068] Remove support for WebLogic deployment descriptors

• [FISH-11607] Optimize L1/2 cache clearing to only clear related entity types/instances following mutating Jakarta Data requests

• [FISH-12442] Create Java 25 Docker Image for Payara Community 7

Bug Fixes

• [FISH-7515] Fix HTTP 403 Forbidden response for correctly authenticated and authorized calls to protected JAX-RS resources

• [FISH-12303] Fix Payara Platform’s OpenAPI extension to be compatible with specification

Component Upgrades

• [FISH-12747] Upgrade com.nimbusds:nimbus-jose-jwt from 10.6 to 10.7

• [FISH-12749] Upgrade org.glassfish.woodstock.external:dojo from 6.0.2 to 6.0.3

• [FISH-12761] Upgrade Mojarra to 4.1.6

• [FISH-12767] Upgrade io.projectreactor:reactor-core from 3.8.1 to 3.8.2

• [FISH-12777] Upgrade weld.version from 6.0.3.Final to 6.0.4.Final

• [FISH-12795] Upgrade com.fasterxml.jackson:jackson-bom from 2.20.1 to 2.21.0

• [FISH-12807] Upgrade Docker JDK to 21.0.10

• [FISH-12832] Upgrade org.apache.bcel:bcel from 6.11.0 to 6.12.0

• [FISH-12895] Upgrade org.jboss.logging:jboss-logging from 3.6.1.Final to 3.6.2.Final

• [FISH-12937] Upgrade jsftemplating.version from 4.1.0-M1 to 4.1.0

• [FISH-12941] Upgrade org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.3.10

• [FISH-12944] Upgrade Tyrus to 2.2.2

Payara Platform Community 7.2026.1

Supported APIs and Applications

• Jakarta EE 11

• Jakarta EE 11 Applications

• MicroProfile 6.1

Improvements

• [FISH-12609] PartItem Review Improvements

Security Fixes

• [FISH-12433] CVE-2020-27511 Upgrade prototype

• [FISH-12434] CVE-2020-5258 Upgrade dojo.js

• [FISH-12613] CVE-2025-14340 Vulnerability - Admin Account Takeover via malicious URL payload

Bug Fixes

• [FISH-11409] Fix JDK 24 EJB Deployment Failure

• [FISH-12561] Fix duplicate class definition GenericEJBHome_Generated_DynamicStub during EJB Redeployment

• [FISH-12719] [Community Contribution - lprimak] Fix EJB Class Loader Leaks on Deployment Failure

Component Upgrades

• [FISH-10141] Upgrade Parsson to 1.1.7

• [FISH-10671] Upgrade gmbal to 4.1.0

• [FISH-11421] Upgrade PFL to 5.1.0

• [FISH-12402] Upgrade Corba to 5.0.0

• [FISH-12576] Upgrade com.nimbusds:nimbus-jose-jwt from 10.5 to 10.6

• [FISH-12633] Upgrade Payara Arquillian Version in BOM to 4.0.alpha4

• [FISH-12667] Upgrade org.eclipse.angus:angus-activation from 2.0.2 to 2.0.3

• [FISH-12695] Upgrade org.glassfish.epicyro:epicyro from 3.1.0 to 3.1.1

• [FISH-12698] Upgrade io.github.classgraph:classgraph from 4.8.179 to 4.8.184

• [FISH-12700] Upgrade org.glassfish.exousia:exousia from 3.0.0-M3 to 3.0.1

• [FISH-12701] Upgrade asm.version from 9.9 to 9.9.1

• [FISH-12723] Upgrade org.glassfish.woodstock.external:dojo from 6.0.2 to 6.0.3

• [FISH-12724] Upgrade commons-io:commons-io from 2.20.0 to 2.21.0

• [FISH-12727] Upgrade io.projectreactor:reactor-core from 3.7.12 to 3.8.1

• [FISH-12728] Upgrade com.fasterxml:classmate from 1.7.1 to 1.7.3

• [FISH-12730] Upgrade org.samba.jcifs:jcifs from 1.2.19 to 1.3.3

• [FISH-12732] Upgrade org.jetbrains.kotlin:kotlin-stdlib from 2.2.21 to 2.3.0

Payara Platform Community 7.2025.2

Supported APIs and Applications

• Jakarta EE 11

• Jakarta EE 11 Applications

• MicroProfile 6.1

Improvements

• [FISH-11210] Add support to use cached remote public keys retain on error mechanism as fallback for MicroProfile JWT

• [FISH-12483] Sync Asadmin Help Doc Improvements

• [FISH-12539] [Community Contribution - lprimak] Trim Whitespace in DataSourceDefinition Properties

Security Fixes

• [FISH-12431] Fix CVE-2020-36843 - Upgrade net-i2p-crypto-eddsa to 0.3.1

Bug Fixes

• [FISH-7667] Fix File Upload Memory Leak

• [FISH-11389] Fix Monitoring Certain Database Metrics Showing Wrong Output

• [FISH-11911] Fix missing implementation of ClassAnalyzer with name CdiInjecteeSkippingClassAnalyzer under high load

• [FISH-12537] [Community Contribution - lprimak] Fix Class Loader Leaks

• [FISH-12538] [Community Contribution - lprimak] Clean Up Better After Failed EAR Deployment

• [FISH-12540] [Community Contribution - lprimak] Prevent Injection for EAR-root Deployments in NonModuleInject

Component Upgrades

• [FISH-12403] Upgrade org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to 2.2.21

• [FISH-12470] Upgrade com.fasterxml.jackson:jackson-bom from 2.20.0 to 2.20.1

• [FISH-12484] Upgrade Jersey to 4.0.0

Payara Platform Community 7.2025.1

Supported APIs and Applications

• Jakarta EE 11

• Jakarta EE 11 Applications

• MicroProfile 6.1

Improvements

• [FISH-12115] Fully Remove Monitoring Console

Bug Fixes

• [FISH-10833] Fixed redeploying applications to deployment groups breaking virtual servers when used as Default Module

• [FISH-10834] Fixed enabling/disabling Virtual Threads not indicating restart required

• [FISH-12069] Fixed unexpected BASIC auth prompt with HTTPS relating to domain initialisation

Component Upgrades

• [FISH-8914] Reapply Eclipselink Patches

• [FISH-9896] Update Mojarra to 4.1.4 and Reapply Patches

• [FISH-10668] Upgrade osgi-resource-locator to 3.0.0

• [FISH-10669] Upgrade woodstox-jsf to 6.0.1

• [FISH-10670] Upgrade woodstox-jsf-suntheme to 6.0.1

• [FISH-10672] Upgrade hk2 to 4.0.0-M3.payara-p1

• [FISH-10673] Upgrade expressly to 6.0.0-M2

• [FISH-10674] Upgrade jersey to 4.0.0-M2.payara-p1

• [FISH-10675] Upgrade jakarta-validation to 3.1.1

• [FISH-10676] Upgrade jakarta-authorization to 3.0.0

• [FISH-10677] Upgrade jakartaee-api to 11.0.0.RC1

• [FISH-10678] Upgrade wasp to 4.0.0

• [FISH-10679] Upgrade glassfish-management to 3.3.0.payara-p1

• [FISH-10680] Upgrade logging-annotation-processor to 1.10

• [FISH-10681] Upgrade jsftemplating to 4.1.0-M1

• [FISH-10682] Upgrade jakarta-faces to 4.1.2

• [FISH-10683] Upgrade hk2-core to 2.4.0-b14

• [FISH-11544] Update OpenMQ to 6.7.0 and Reapply Patches

• [FISH-11545] Correct Grizzly Version and Reapply Patches

• [FISH-11546] Update Hibernate Validator to 9.0.1 and Reapply Patches

• [FISH-12188] Upgrade to Concurro 3.1.0 Final

• [FISH-12438] Upgrade Docker JDK to 21.0.9

Payara Platform Community 6.2025.11

Supported APIs and Applications

• Jakarta EE 10

• Jakarta EE 10 Applications

• MicroProfile 6.1

Improvements

• [FISH-10151] Add --no-validation flag for setting up JDBC Connection

Bug Fixes

• [FISH-8542] Fixed Prime Faces Autocomplete in composite components breaking Select Event when upgrading from Payara 4.x to Payara 6

• [FISH-10833] Fixed redeploying applications to deployment groups breaking virtual servers when used as Default Module

• [FISH-11683] Fixed undeploying older versions breaking routing to active versions in Payara versioned deployment (HTTP 503)

• [FISH-11911] Fixed "Could not find an implementation of ClassAnalyzer with name CdiInjecteeSkippingClassAnalyzer" error under high load

• [FISH-12153] Fixed OpenAPI generation failing when bean validation is used without PathParam annotation

Component Upgrades

• [FISH-12230] Upgrade asm.version from 9.8 to 9.9

• [FISH-12246] Upgrade org.eclipse.persistence:org.eclipse.persistence.asm from 9.8.0 to 9.9.0

• [FISH-12290] Upgrade org.apache.bcel:bcel from 6.10.0 to 6.11.0

• [FISH-12291] Upgrade io.projectreactor:reactor-core from 3.7.11 to 3.7.12

• [FISH-12436] Upgrade Docker JDK to 11.0.29

• [FISH-12437] Upgrade Docker JDK to 17.0.17

• [FISH-12438] Upgrade Docker JDK to 21.0.9

• [FISH-12440] Upgrade HK2 to 3.1.1