Upgrading org.eclipse.jetty:jetty-servlet 9 to 10
Breaking9.4.58.v20250814 → 10.0.26Breaking1Security2New1Changed6Fixed10Other2
Fetching 34 releases from GitHub…7 / 34
BreakingUpgrade verdict
1 breaking change and 2 security fixes.
In plain terms
- Code that changed HTTP response headers inside the onResponseBegin listener callback will no longer work.
- Internal HTTP/2 session handling is cleaned up to fix a security vulnerability.
- A security flaw could leave HTTP/2 connections open longer than intended when the network is congested.
Must act 3 items need code or config changes
Adds org.slf4j:slf4j-api 2.0.13.
Drops org.eclipse.jetty:jetty-util-ajax.
What you must change
Breaking1
Modifying HTTP headers in HttpChannel.Listener#onResponseBegin is no longer possible with Jetty 10.
HttpChannel.Listener#onResponseBeginSecurity2
HTTP2Session cleanups that address CVE-2025-5115.
HTTP2SessionFixes CVE-2024-22201, where HTTP/2 connections are not closed after idle timeout when TCP is congested.
API changes
Generated by DepDelta from published JVM bytecode. Not mixed with prose notes.
- removed:
field ServletContextHandler._gzipHandler: GzipHandler - removed:
interface ServletContextHandler.Decorator extends Decorator - removed:
method ServletContextHandler.addDecorator(ServletContextHandler.Decorator): void - removed:
method ServletContextHandler.getDecorators(): List - removed:
method ServletContextHandler.getGzipHandler(): GzipHandler - removed:
method ServletContextHandler.setDecorators(List): void - removed:
method ServletHandler.addFilter(String, String, EnumSet): FilterHolder - removed:
method ServletHandler.insertFilterMapping(FilterMapping, int, boolean): FilterMapping[] - removed:
method ServletHolder.ensureInstance(): Servlet - removed:
method ServletHolder.initMultiPart(): void - removed:
method ServletMapping.isDefault(): boolean - removed:
method ServletMapping.setDefault(boolean): void - removed:
static field ServletContextHandler.GZIP: int - removed:
static field ServletHandler.__DEFAULT_SERVLET: String - changed:
method ServletContextHandler.addEventListener(EventListener): void → method ServletContextHandler.addEventListener(EventListener): boolean - changed:
method ServletHandler.getMappedServlet(String): MappedResource → method ServletHandler.getMappedServlet(String): ServletHandler.MappedServlet - changed:
method ServletHandler.initializeHolders(BaseHolder[]): void → method ServletHandler.initializeHolders(Collection): void - added:
class ServletContainerInitializerHolder extends BaseHolder - added:
class ServletTester extends ContainerLifeCycle - added:
ctor ServletContainerInitializerHolder() - added:
ctor ServletContainerInitializerHolder(Class) - added:
ctor ServletContainerInitializerHolder(Class, Class[]) - added:
ctor ServletContainerInitializerHolder(ServletContainerInitializer, Class[]) - added:
ctor ServletContainerInitializerHolder(Source) - added:
ctor ServletContainerInitializerHolder(Source, ServletContainerInitializer, Class[]) - added:
ctor ServletContainerInitializerHolder.Wrapper(ServletContainerInitializer) - added:
ctor ServletContextHandler.ServletContainerInitializerStarter() - added:
ctor ServletTester() - added:
ctor ServletTester(String) - added:
ctor ServletTester(String, int) - added:
field ServletContainerInitializerHolder._startupClassNames: Set - added:
field ServletContainerInitializerHolder._startupClasses: Set - added:
interface ServletContainerInitializerHolder.WrapFunction - added:
method BaseHolder.createInstance(): Object - added:
method BaseHolder.getServletContext(): ServletContext - added:
method ErrorPageErrorHandler.isUnwrapServletException(): boolean - added:
method ErrorPageErrorHandler.setUnwrapServletException(boolean): void - added:
method FilterHolder.createInstance(): Filter - added:
method ListenerHolder.createInstance(): EventListener - added:
method ServletContainerInitializerHolder.WrapFunction.wrapServletContainerInitializer(ServletContainerInitializer): ServletContainerInitializer - added:
method ServletContainerInitializerHolder.Wrapper.getWrapped(): ServletContainerInitializer - added:
method ServletContainerInitializerHolder.Wrapper.onStartup(Set, ServletContext): void - added:
method ServletContainerInitializerHolder.Wrapper.toString(): String - added:
method ServletContainerInitializerHolder.addStartupClasses(Class[]): void - added:
method ServletContainerInitializerHolder.addStartupClasses(String[]): void - added:
method ServletContainerInitializerHolder.doStart(): void - added:
method ServletContainerInitializerHolder.resolveStartupClasses(): Set - added:
method ServletContainerInitializerHolder.toString(): String - added:
method ServletContextHandler.Context.addJspFile(String, String): ServletRegistration.Dynamic - added:
method ServletContextHandler.Context.createFilter(Class): Filter - added:
method ServletContextHandler.Context.createInstance(BaseHolder): Object - added:
method ServletContextHandler.Context.createListener(Class): EventListener - added:
method ServletContextHandler.Context.createServlet(Class): Servlet - added:
method ServletContextHandler.Context.getInitParameter(String): String - added:
method ServletContextHandler.Context.getRequestCharacterEncoding(): String - added:
method ServletContextHandler.Context.getResponseCharacterEncoding(): String - added:
method ServletContextHandler.Context.getSessionTimeout(): int - added:
method ServletContextHandler.Context.setRequestCharacterEncoding(String): void - added:
method ServletContextHandler.Context.setResponseCharacterEncoding(String): void - added:
method ServletContextHandler.Context.setSessionTimeout(int): void - added:
method ServletContextHandler.ServletContainerInitializerStarter.addServletContainerInitializerHolders(ServletContainerInitializerHolder[]): void - added:
method ServletContextHandler.ServletContainerInitializerStarter.doStart(): void - added:
method ServletContextHandler.ServletContainerInitializerStarter.doStop(): void - added:
method ServletContextHandler.ServletContainerInitializerStarter.getServletContainerInitializerHolders(): Collection - added:
method ServletContextHandler.addServletContainerInitializer(ServletContainerInitializer): ServletContainerInitializerHolder - added:
method ServletContextHandler.addServletContainerInitializer(ServletContainerInitializer, Class[]): ServletContainerInitializerHolder - added:
method ServletContextHandler.addServletContainerInitializer(ServletContainerInitializerHolder[]): void - added:
method ServletContextHandler.setParent(HandlerContainer): void - added:
method ServletHandler.MappedServlet.getPathSpec(): PathSpec - added:
method ServletHandler.MappedServlet.getServletHolder(): ServletHolder - added:
method ServletHandler.MappedServlet.getServletPathMapping(String, MatchedPath): ServletPathMapping - added:
method ServletHandler.MappedServlet.toString(): String - added:
method ServletHandler.prependFilter(FilterHolder): void - added:
method ServletHandler.removeFilterHolder(FilterHolder): void - added:
method ServletHandler.removeFilterMapping(FilterMapping): void - added:
method ServletHolder.createInstance(): Servlet - added:
method ServletMapping.isFromDefaultDescriptor(): boolean - added:
method ServletMapping.setFromDefaultDescriptor(boolean): void - added:
method ServletTester.addFilter(Class, String, EnumSet): FilterHolder - added:
method ServletTester.addFilter(FilterHolder, String, EnumSet): void - added:
method ServletTester.addFilter(String, String, EnumSet): FilterHolder - added:
method ServletTester.addServlet(Class, String): ServletHolder - added:
method ServletTester.addServlet(ServletHolder, String): void - added:
method ServletTester.addServlet(String, String): ServletHolder - added:
method ServletTester.addVirtualHosts(String[]): void - added:
method ServletTester.createConnector(boolean): String - added:
method ServletTester.createLocalConnector(): LocalConnector - added:
method ServletTester.getAttribute(String): Object - added:
method ServletTester.getAttributeNames(): Enumeration - added:
method ServletTester.getAttributes(): Attributes - added:
method ServletTester.getBaseResource(): Resource - added:
method ServletTester.getConnector(): LocalConnector - added:
method ServletTester.getContext(): ServletContextHandler - added:
method ServletTester.getContextPath(): String - added:
method ServletTester.getInitParameter(String): String - added:
method ServletTester.getInitParameterNames(): Enumeration - added:
method ServletTester.getInitParams(): Map - added:
method ServletTester.getResourceBase(): String - added:
method ServletTester.getResponses(ByteBuffer): ByteBuffer - added:
method ServletTester.getResponses(ByteBuffer, long, TimeUnit): ByteBuffer - added:
method ServletTester.getResponses(String): String - added:
method ServletTester.getResponses(String, long, TimeUnit): String - added:
method ServletTester.getServer(): Server - added:
method ServletTester.removeAttribute(String): void - added:
method ServletTester.setAttribute(String, Object): void - added:
method ServletTester.setBaseResource(Resource): void - added:
method ServletTester.setContextPath(String): void - added:
method ServletTester.setInitParameter(String, String): String - added:
method ServletTester.setResourceBase(String): void - added:
method ServletTester.setVirtualHosts(String[]): void - added:
static class ServletContainerInitializerHolder.Wrapper implements ServletContainerInitializer, BaseHolder.Wrapped - added:
static class ServletContextHandler.ServletContainerInitializerStarter extends ContainerLifeCycle implements ServletContextHandler.ServletContainerInitializerCaller - added:
static class ServletHandler.MappedServlet - added:
static field ServletContainerInitializerHolder.__pattern: Pattern - added:
static method ServletContainerInitializerHolder.fromString(ClassLoader, String): ServletContainerInitializerHolder - added:
static method ServletContextHandler.getServletContextHandler(ServletContext, String): ServletContextHandler