Spring boot does not work with Tomcat 10

[dimaa6]

I had to change Tomcat version used with Spring boot from 9.0.36 to 10.0.0-M7. Spring boot found dependencies, I see them in class path:

C:\Users....m2\repository\org\apache\tomcat\embed\tomcat-embed-core\10.0.0-M7\tomcat-embed-core-10.0.0-M7.jar

However Tomcat initialization section is missing from the application logs, and there is no listener on configured port.

When I added @ServletComponentScan annotation to my application class, application failed to start:

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'servletComponentRegisteringPostProcessor': Bean instantiation via constructor failed; nested exception is java.lang.NoClassDefFoundError: javax/servlet/annotation/WebServlet

It looks like Spring boot is not aware of javax -> jakarta change in Tomcat 10 APIs. I'm using the latest 2.3.1-RELEASE version of Spring Boot.

[bclozel]

Spring Boot is not yet compatible with the jakarta namespace change.
This change needs to be first implemented in Spring Framework - see spring-projects/spring-framework#25354

[dimaa6]

@bclozel Does that mean that even without @ServletComponentScan, which I don't really need, it will not work with Tomcat 10? All I need is working @RestController and @GetMapping annotations.

[bclozel]

Spring MVC depends on the javax.servlet namespace in its programming model and infrastructure, so no, this won't be working.
Could elaborate on why you've chosen Tomcat 10 for your deployments - any particular reason?

[dimaa6]

Sure. Customer executed intrusion prevention software on our product and it revealed some vulnerabilities in Tomcat 9.0.36 which are fixed in 10.0.0-M7.

[bclozel]

Both 9.x and 10.x should be equivalent (besides the namespace change), so I guess the security fix made its way into 9.0.37 as well?

[bclozel]

Since this is not strictly related to Tomcat 10 or the jakarta namespace change, I'm closing this issue and pointing other contributors to spring-projects/spring-framework#25354 as the blocker for any related change in Spring Boot.