Psi Probe Versions Save

Upload changes

• Tomcat forced back changes that tomcat 10/11 use for file upload. This resulted in finding a solution that was a blocker for tomcat 10/11 migration. This was resolved by copying a part of Tomcat code and combining two different methods there to account for our usage. This this is the first release to support tomcat 9.0.88 and is required for 9.0.88 but was tested to work as far back as tomcat 9.0.52. See #3239

Others

• Library Updates
• Plugin Updates
• non impacting: port forwards test adjustments for tomcat 10/11 modules
• Fixed GHA for codeql as build requires java 17

• Library updates
• Plugin updates
• Fixed #3154 Size param position in requests
• Move jetty jspc to jetty 12 for ee8
• Drop java 11 from github actions build cycle as jetty jspc requires java 17. The runtime is still java 8.
• Move coverity action to java 21 build now
• Update renovate config
• Fix taglib xmlns to be javaee not j2ee (old bug)
• Make whitespace and open rewrite run during normal build cycles
• Trim left over whitespace
• Drop legacy maven compiler version as not needed
• Change modernizer plugin to use compiler release instead of target
• Adjust GHA CI build so java 23 will run with bytebuddy

• library updates
• plugin updates
• Removed distribution management added to all modules as it did not help solve site issues and made it worse. We continue to use GHA to do this.
• Added notes to readme regarding fact that tomcat newer versions add a number of add-opens, some of which are required to run this product. See catalina.sh or catalina.bat are up to date with tomcat requirements.
• Add a wait delay in the WAR controller of 10 seconds due to issues seen with #1961

• fix deletion logic on temp file processing of war upload
• library updates
• few fixes per codeql

• Library updates
• Correct issue #2982 due to invalid import usage
• Set urls in all poms to avoid incorrect inheritance

Consumer

• Update all libraries
• Minor code cleanup
• Remove old IE pages handling as no longer supported
• Update tomcat support levels
• Fix many checkstyle / spotbug issues

Build

• Remove jdeps from site as not site plugin
• Correct pmd plugin setup
• Move to site 2.0 for maven site
• Changes for nvd api usage on dependency check
• Redirect test output to file
• Require maven 3.9.6 to build
• Remove dependency details ignore on site pages
• Make pmd, checkstyle, and spotbugs run during builds as 'check', do not fail as a result as lots to fix still.
• Fixup future tomcat 10/11 builds
• Adjust tomcat 11 to require jdk 21 to build but do note that tomcat 11 openssl in coyote is requiring java 22

Psi Probe 4.1.0

• Update dependencies
• Remove obsolete dependency exclusions
• More exclusions on items from openejb
• Cleanup tomcat fileupload support
• Many small code cleanups
• Make most lists / maps in objects immutable
• Use non deprecated imports on jhighlight
• Change datasource calls on deprecated 'getUsername' to 'getUserName'
• Cleanup all calls on getStringParamter to stop passing 'null' at end as that is the default.
• Fix jsp reader to use utf-8 encoding
• Fix potential null pointers
• Use proper 'lock' for stats
• Fix tomcatEE datasource detection
• Fix hikari to get jmx data via its api rather than attempted direct reader
• Remove unused 'contextBound' from many methods
• Remove unused 'url' from upload war
• Correct scanner logic used to check for primatives, was passing to wrapper classes for handling rather than returning the value
• Remove unused 'request' from hasAttributeValueRole
• Change flap linked list to use computeIfAbsent
• Remove jmx usage from vibur datasource and instead use its direct api
• Many adjustments to using correct Exception handling instead of Exception for everything (longer running process to complete over next few releases)
• Internalize much of the jmx exception handling including internalizing more
• Add tomcat jdbc XADataSource support
• [fix] From 4.0.0 release, make sure prototype.js is on all pages needed so the automatic updating of uptime persists (was disappearing)
• [fix] Long standing bug on error page in app, make sure stylesheets reachable for our general look and feel
• [fix] From 4.0.0 release, correct empty check on certs but then remove it since the defect actually improved user experience. Now certs will simple indicate not found if missing via displaytag.
• Remove tomcat 7 and 8.0 old certificate handling as we only support tomcat 8.5 and higher.
• [fix] From 4.0.0 release, revert SecurityContextHolderFilter back to SecurityContextPersistenceFilter as work on that was not finished and it broke session creation and thus made JSPs unable to be seen.
• Includes all CVE fixes including recent logback issues

Build

• Dependency check now moved into direct build rather than profile
• Adjust m2e settings to force java to test level on import to Eclipse
• Remove license plugin override from m2e as in plugin now
• Add impsort plugin override to m2e to force it to run
• Add whitespace plugin
• Add open rewrite plugin to prevent star imports
• Quiet error prone on auto generated code
• Adjust javadoc plugin
• Adjust sortpom plugin
• Use 'boms' for major dependencies
• General cleanup of plugins
• Move coveralls to my hard fork which removes reliance on javax namespace and does not use jakarta namespace either
• Move site to 4.x
• Drop changelog plugin
• Change all negative datasource tests from using c3p0 to using hikari to allow for future removal of c3p0
• Drop unused javax persistence
• Fix up rewrite configuration profiles
• Test cleanup in tomcat modules
• Remove old test checking that we used correct slf4j libraries as inaccurate way to handle libraries
• Fully get coverity working
• Add byte buddy to agent <argLine> as needed for newer jdks as auto agent detection now disabled
• Start using mockito as eventually replacement of jmockit
• Cleanup deprecated sonar options in GHA
• Stub out a few more parts for jakarta namespace upcoming changes
• Add commit id to timestamp data on top of pages when development testing is going on. This is useful when loading multiple versions of psi probe
• Setup nvd api for dependency check 9.x

Docs

• Update support for various tomcats

*** Javax Namespace has now been moved to branch 'javax' going forwards. If any defects need to be resolved, please send pull requests to that branch. ***

code

• Correct all spring splitters to avoid unexpected behaviour
• Stop using objects.equals on primatives
• Use direct calls instead of getters when in same class
• Make use of Locale.ENGLISH where needed
• Use map instead of hashmap for interfaces
• Wrape async socket factory wait in a while loop
• Fixes on mbean usage
• Avoid lossy on ints
• Use finals where appropriate
• Use proper package types
• Use asSubclass instead of casting on for name
• Switch to my highly updated fork of sitemesh at 2.5.x. Upstream was dead but back but has not integrated it all yet.
• Add lang as dynamically set and doc type to all jsp pages
• For resolver processing make sure cookie seure and http only set
• Add back session cookie config as secure now that https required
• Update url for silk icons as original site no longer exists
• Make sure any threa interrupts are restored
• Make sure proper exceptions are thrown
• In async socket factory make sure notify all used instead of just notify
• Cleanup default char encoding
• Make adapter classes configurable via 'adapters.prperties' (ie which tomcats, which order). Tomcat 9 is default currently.
• Cleanup adapter / stdout loops during probe config initialization
• Cleanup entry set usage
• Remove tomcat 7 based code as no longer part of project and long end of life
• Remove earlier tomcat code for early versions of 7, 8.0, 8.5, and 9 milestones
• Drop support for logback 1.0.x
• Retool log4j2 logic
• Cleanup empty checks to remove nulls
• Cleanup timestamp used on logger accessor
• Avoid null pointers when working with logs
• Cleanup various logging on rethrows
• Clarify transient usage
• Add gc.log and localhost-access.log to stdout.properties
• Split probe scheduler out of the probe config module
• Split probe stats out of the probe config module
• Make sitemesh use UTF-8 not ISO-8859-1
• Remove 'c3p0' from naming on datasource rest to be more generic
• Move openejb to 8.0.15. This is provided scope but matches tomcat 9 in usage.
• Override mchane commons java to 0.2.20
• Drop xpp3_min as no longer used
• Bring back psi probe ojdbc module into core as oracle has long since open sourced it removing restrictions we had to work around on builds.
• Cleanup exceptions on all datasources
• Add sameSiteCoolies to strict
• Drop text/javascript from javascript usage
• Format all jsp pages (tabs to spaces)
• Fix various null pointer potential per sonar
• Cleanup some deprecations around spring security filter chain
• Fix ansi encoding to utf-8 encoding in es properties file
• Extract out loggers to make large if statement cleaner
• Adjust names on beans
• Updated deprecated propety place holder configurer to latest and dropped support on system properties which was not used
• Other small code cleanups
• Move to quartz 2.4.0-rc2
• Update most every library
• Make uptime ajaxified running at every minute

deprecations

• deprecate oracle datasource accessor as its deleted by oracle in 21c and ucp should be used which we also support here

build

• Remove left over old exclusion on commons-logging from spring 4 days that no longer exists in spring (they use spring-jcl)
• Reenable tests previously broken at junit 5.1.1 that now work again
• Add more tests
• Add spotless
• cleanup tomat tests
• ensure junit 5 testing style throughout

future

• cleaned up tomcat 10/11 modules that will be part of jakarta release
• going forwards master will be reserved for 'jakarta namespace'
• expect mid 2024 that tomcat 8.5 will be removed from javax namespace as tomcat is retiring it. A few more releases will be made before that occurs.

• Library updates
• Updated maven wrapper for build
• Added stub for tomcat 11 module (not live yet)
• Merged tomcat 10.0 and 10.1 to simply 10 (not live yet)
• Bump copyright to 2023

note: While minor release, https is now required. This is to fix a long outstanding defect with spring in this project as well as fact that http is so out of favor and vulnerable. When using this update, you can use self signed cert and its super easy to create a cert for testing purposes. Any other usage should already be https for a long time.

• Supports tomcat 9.0.75
• Supports tomcat 8.5.88
• Spring and Spring security CVEs addressed to latest javaEE releases