build: Jakarta EE namespace migration and lint fix (PRs 1-3 of jakarta migration #861) by ismisepaul · Pull Request #946 · OWASP/SecurityShepherd

ismisepaul · 2026-10-23T06:59:21Z

Bottom of the Jakarta migration stack (#861)

Replaces #881 as the stack's base PR: #881's branch was fast-forwarded to the top of the stack, which auto-merged #935 and dissolved the original stack. This PR carries the same first three steps:

PR 1 (build: jakarta-ready dependencies (PR 1 of jakarta migration #861) #877): Jakarta-ready build config: jakarta.servlet-api, Jakarta JSTL, Angus Mail, javax:javaee-api removed.
PR 2 (refactor: mechanical javax->jakarta import rename (PR 2 of jakarta migration #861) #878): mechanical OpenRewrite javax.* → jakarta.* import rename across 170 files.
PR 3 (build: sync dev and fix lint (PR 3 of jakarta migration #861) #935): mvn spotless:apply import re-sort so lint-java passes.

Stack (merge with "Squash and merge stack")

PR	What
this	PRs 1–3 above
#936	Jakarta EE 11 / Servlet 6.1 / Tomcat 11 / Spring 7, plus Tomcat 11 config patches
#939	SAML SSO on pac4j-saml (makes the build compile), Shibboleth repository restriction and PGP verification
#940	`web.xml` on the Servlet 6.1 schema
#941	JSTL `jakarta.tags.*` URIs (closes #880)
#942	Docs and upgrade notes

Building on its own

Every PR in the stack passes CI by itself:

java-saml removed (it has no Jakarta release). The SSO endpoints (ACS, SSOLogin, SLS, SSOMetadata) answer 503 "SAML SSO is unavailable during migration", and Logout keeps its non-SSO path. SSO is off unless sso.enabled=true, and feat: reimplement SAML SSO on pac4j-saml (PR 5 of jakarta migration #861) #939 reimplements it on pac4j-saml, so the code on dev after a stack merge is unchanged.
Tomcat 10.1 config patches regenerated against Tomcat 10.1.61 (<SSLHostConfig> HTTPS connector), with the matching Dockerfile substitutions; both apply exactly.

Verified locally on this head (44f3a45), with no test files changed: spotless, 169 unit tests, 312 integration tests (incl. LogoutIT), mvn -Pdocker install, docker compose build, and a Tomcat 10.1.61 smoke test (deploys, HTTP→HTTPS, TLS 1.3, login page, SSO 503).

Refs #861

🤖 Generated with Claude Code

@disabled

Build-config-only step of the javax -> jakarta migration. Does not compile on its own (source still imports javax.*); the mechanical import rename follows in the next sub-PR. - jakarta.servlet:jakarta.servlet-api:6.0.0 (was javax.servlet:javax.servlet-api:4.0.1) - jakarta JSTL 3.0 api + glassfish impl (was jstl:jstl:1.2) - org.eclipse.angus:angus-mail:2.0.3 (was com.sun.mail:javax.mail:1.6.2) - remove javax:javaee-api:8.0.1 (pulls the legacy javax namespace back in) - align Spring to 6.1.21 (spring-test 5.3.31, spring-core 6.0.2, spring-context 5.3.31 were inconsistent) - remove spring-mock:2.0.8 (Spring 6 spring-test provides the Jakarta mocks) - remove fongo (unused; tests @disabled, rescue tracked in #876) - .env Tomcat base image 9.0 -> 10.1 (first Jakarta-namespace Tomcat) Refs #861. Targets Spring 6.1.x (not 7) per discussion on #869.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

@disabled

) * build: jakarta-ready dependencies (PR 1 of jakarta migration #861) Build-config-only step of the javax -> jakarta migration. Does not compile on its own (source still imports javax.*); the mechanical import rename follows in the next sub-PR. - jakarta.servlet:jakarta.servlet-api:6.0.0 (was javax.servlet:javax.servlet-api:4.0.1) - jakarta JSTL 3.0 api + glassfish impl (was jstl:jstl:1.2) - org.eclipse.angus:angus-mail:2.0.3 (was com.sun.mail:javax.mail:1.6.2) - remove javax:javaee-api:8.0.1 (pulls the legacy javax namespace back in) - align Spring to 6.1.21 (spring-test 5.3.31, spring-core 6.0.2, spring-context 5.3.31 were inconsistent) - remove spring-mock:2.0.8 (Spring 6 spring-test provides the Jakarta mocks) - remove fongo (unused; tests @disabled, rescue tracked in #876) - .env Tomcat base image 9.0 -> 10.1 (first Jakarta-namespace Tomcat) Refs #861. Targets Spring 6.1.x (not 7) per discussion on #869. * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…gration #861) (#878) * refactor: javax->jakarta imports in servlets/module/challenge (PR2 #861) Mechanical OpenRewrite rename (JavaxMigrationToJakarta), imports only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: javax->jakarta imports in servlets/admin (PR2 #861) Mechanical OpenRewrite rename, imports only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: javax->jakarta imports in remaining servlets (module/lesson, api, root) (PR2 #861) Mechanical OpenRewrite rename, imports only. The invalidate()->logout() behavioral change OpenRewrite bundled into Login/Logout/MobileLogin/SLS/ACS was reverted; these commits are pure import renames. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: javax->jakarta imports in remaining src/main (PR2 #861) Mechanical OpenRewrite rename, imports only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: javax->jakarta imports in src/it and src/test (PR2 #861) Mechanical OpenRewrite rename, imports only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…a-migration Brings the mechanical javax->jakarta import rename onto the integration branch so it carries the jakarta-ready dependencies (#877) and the renamed source (#878) together. Completes #861's integration branch. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The OpenRewrite rename left jakarta.* imports ordered where javax.* used to sit, which fails google-java-format's import ordering in the lint-java job. Import order only; no code changes. Refs #861 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…t/jakarta-03-pom-fix

Copilot

🔵 Needs a closer look

Standalone compilation intentionally depends on the SAML migration in #939, so approval requires human review of the complete migration stack.

No open issues 🎉

What changed in this PR

This PR establishes the base of Security Shepherd’s Jakarta migration (#861), updating dependencies and Java imports for the modern servlet platform. Later stacked PRs complete SAML compatibility and deployment changes.

Changes:

Replaces legacy Java EE dependencies with Jakarta Servlet, JSTL, and Angus Mail; aligns Spring to 6.1.21 and removes obsolete test dependencies.
Migrates servlet and mail imports to jakarta.* and reorders imports, preserving application logic and JDK-owned javax.* packages.
Updates the Docker Tomcat baseline from 9.0 to 10.1.

File	Description
src/test/java/testUtils/TestProperties.java	Migrates test helper exception import.
src/test/java/listeners/DatabaseLifecycleListenerTest.java	Migrates listener test event import.
src/main/java/utils/Validate.java	Migrates mail and servlet imports.
src/main/java/servlets/SSOMetadata.java	Migrates metadata servlet imports.
src/main/java/servlets/SSOLogin.java	Migrates SSO login servlet imports.
src/main/java/servlets/SLS.java	Migrates SAML logout servlet imports.
src/main/java/servlets/SetupFilter.java	Migrates filter interfaces and request imports.
src/main/java/servlets/Setup.java	Migrates setup servlet imports.
src/main/java/servlets/Register.java	Migrates registration servlet imports.
src/main/java/servlets/module/SolutionSubmit.java	Migrates solution submission servlet imports.
src/main/java/servlets/module/RefreshMenu.java	Migrates menu servlet imports.
src/main/java/servlets/module/ModuleServletTemplate.java	Migrates module template servlet imports.
src/main/java/servlets/module/lesson/XxeLesson.java	Migrates servlet imports; retains JDK XML API.
src/main/java/servlets/module/lesson/XssLesson.java	Migrates lesson servlet imports.
src/main/java/servlets/module/lesson/UnvalidatedForwardsLesson.java	Migrates lesson servlet imports.
src/main/java/servlets/module/lesson/SqlInjectionLesson.java	Migrates lesson servlet imports.
src/main/java/servlets/module/lesson/SessionManagementLesson.java	Migrates lesson servlet imports.
src/main/java/servlets/module/lesson/SecurityMisconfigLesson.java	Migrates lesson servlet imports.
src/main/java/servlets/module/lesson/RedirectLessonTarget.java	Migrates lesson target servlet imports.
src/main/java/servlets/module/lesson/Redirect.java	Migrates redirect servlet imports.
src/main/java/servlets/module/lesson/PoorValidationLesson.java	Migrates lesson servlet imports.
src/main/java/servlets/module/lesson/DirectObjectLesson.java	Migrates lesson servlet imports.
src/main/java/servlets/module/lesson/CsrfLessonTarget.java	Migrates lesson target servlet imports.
src/main/java/servlets/module/lesson/CsrfLesson.java	Migrates lesson servlet imports.
src/main/java/servlets/module/GetModule.java	Migrates module retrieval servlet imports.
src/main/java/servlets/module/GetCheat.java	Migrates cheat retrieval servlet imports.
src/main/java/servlets/module/FeedbackSubmit.java	Migrates feedback servlet imports.
src/main/java/servlets/module/challenge/XxeChallenge1OldWebService.java	Migrates and expands servlet imports.
src/main/java/servlets/module/challenge/XxeChallenge1.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/XssChallengeTwo.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/XssChallengeThree.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/XssChallengeSix.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/XssChallengeOne.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/XssChallengeFour.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/XssChallengeFive.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/UrlAccess3UserList.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/UrlAccess3.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/UrlAccess2Admin.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/UrlAccess2.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/UrlAccess1Admin.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/UrlAccess1.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SqlInjectionStoredProcedure.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SqlInjectionEscaping.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SqlInjectionEmail.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SqlInjection7.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SqlInjection6.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SqlInjection5VipCheck.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SqlInjection5CouponCheck.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SqlInjection5.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SqlInjection4.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SqlInjection3.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SqlInjection1.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SessionManagement8.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SessionManagement7SecretQuestion.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SessionManagement7.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SessionManagement6SecretQuestion.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SessionManagement6.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SessionManagement5SetToken.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SessionManagement5ChangePassword.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SessionManagement5.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SessionManagement4.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SessionManagement3ChangePassword.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SessionManagement3.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SessionManagement2ChangePassword.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SessionManagement2.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SessionManagement1.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/SecurityMisconfigStealTokens.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/PoorValidation2.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/PoorValidation1.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/NoSqlInjection1.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/DirectObjectBankTransfer.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/DirectObjectBankRegistration.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/DirectObjectBankLogout.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/DirectObjectBankLogin.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/DirectObjectBankCurrentBalance.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/DirectObject2.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/DirectObject1.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeTwo.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeThree.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeTargetTwo.java	Migrates challenge target servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeTargetThree.java	Migrates challenge target servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeTargetSix.java	Migrates challenge target servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeTargetSeven.java	Migrates challenge target servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeTargetOne.java	Migrates challenge target servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeTargetJSON.java	Migrates challenge target servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeTargetFour.java	Migrates challenge target servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeTargetFive.java	Migrates challenge target servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeSixGetToken.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeSix.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeSevenGetToken.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeSeven.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeOne.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeJSON.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeFour.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/CsrfChallengeFive.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/BrokenCryptoHomeMade.java	Migrates servlet imports; retains JDK crypto APIs.
src/main/java/servlets/module/challenge/BrokenCrypto4.java	Migrates challenge servlet imports.
src/main/java/servlets/module/challenge/BrokenCrypto3.java	Migrates challenge servlet imports.
src/main/java/servlets/MobileLogin.java	Migrates mobile login servlet imports.
src/main/java/servlets/Logout.java	Migrates logout servlet imports.
src/main/java/servlets/Login.java	Migrates login servlet imports.
src/main/java/servlets/GetJsonScore.java	Migrates score servlet imports.
src/main/java/servlets/ChangeUsername.java	Migrates username servlet imports.
src/main/java/servlets/ChangePassword.java	Migrates password servlet imports.
src/main/java/servlets/api/Scoreboard.java	Migrates API servlet and annotation imports.
src/main/java/servlets/api/Levels.java	Migrates API servlet and annotation imports.
src/main/java/servlets/api/Cheats.java	Migrates API servlet and annotation imports.
src/main/java/servlets/admin/userManagement/UpgradePlayer.java	Migrates user administration servlet imports.
src/main/java/servlets/admin/userManagement/UnSuspendUser.java	Migrates user administration servlet imports.
src/main/java/servlets/admin/userManagement/SuspendUser.java	Migrates user administration servlet imports.
src/main/java/servlets/admin/userManagement/SetDefaultClass.java	Migrates class administration servlet imports.
src/main/java/servlets/admin/userManagement/GiveTakePoints.java	Migrates points administration servlet imports.
src/main/java/servlets/admin/userManagement/GetPlayersByClass.java	Migrates player listing servlet imports.
src/main/java/servlets/admin/userManagement/DowngradeAdmin.java	Migrates user administration servlet imports.
src/main/java/servlets/admin/userManagement/DeletePlayers.java	Migrates user administration servlet imports.
src/main/java/servlets/admin/userManagement/CreateNewAdmin.java	Migrates user administration servlet imports.
src/main/java/servlets/admin/userManagement/CreateClass.java	Migrates class administration servlet imports.
src/main/java/servlets/admin/userManagement/ChangeUserPassword.java	Migrates password administration servlet imports.
src/main/java/servlets/admin/userManagement/AssignPlayers.java	Migrates player assignment servlet imports.
src/main/java/servlets/admin/userManagement/AddPlayer.java	Migrates player creation servlet imports.
src/main/java/servlets/admin/moduleManagement/SetModuleStatus.java	Migrates module administration servlet imports.
src/main/java/servlets/admin/moduleManagement/RemoveModuleLock.java	Migrates module administration servlet imports.
src/main/java/servlets/admin/moduleManagement/OpenWebModules.java	Migrates module administration servlet imports.
src/main/java/servlets/admin/moduleManagement/OpenOrCloseByCategory.java	Migrates module administration servlet imports.
src/main/java/servlets/admin/moduleManagement/OpenMobileModules.java	Migrates module administration servlet imports.
src/main/java/servlets/admin/moduleManagement/OpenAllModules.java	Migrates module administration servlet imports.
src/main/java/servlets/admin/moduleManagement/GetProgress.java	Migrates progress servlet imports.
src/main/java/servlets/admin/moduleManagement/GetJsonProgress.java	Migrates progress servlet imports.
src/main/java/servlets/admin/moduleManagement/GetFeedback.java	Migrates feedback servlet imports.
src/main/java/servlets/admin/moduleManagement/EnableModuleBlock.java	Migrates module administration servlet imports.
src/main/java/servlets/admin/moduleManagement/CloseAllModules.java	Migrates module administration servlet imports.
src/main/java/servlets/admin/config/ToggleRegistration.java	Migrates configuration servlet imports.
src/main/java/servlets/admin/config/SetTournamentMode.java	Migrates configuration servlet imports.
src/main/java/servlets/admin/config/SetOpenFloorMode.java	Migrates configuration servlet imports.
src/main/java/servlets/admin/config/SetCtfMode.java	Migrates configuration servlet imports.
src/main/java/servlets/admin/config/SetCountdown.java	Migrates configuration servlet imports.
src/main/java/servlets/admin/config/EnableScoreboard.java	Migrates configuration servlet imports.
src/main/java/servlets/admin/config/EnableFeedback.java	Migrates configuration servlet imports.
src/main/java/servlets/admin/config/EnableCheats.java	Migrates configuration servlet imports.
src/main/java/servlets/admin/config/DisableScoreboard.java	Migrates configuration servlet imports.
src/main/java/servlets/admin/config/DisableFeedback.java	Migrates configuration servlet imports.
src/main/java/servlets/admin/config/DisableCheats.java	Migrates configuration servlet imports.
src/main/java/servlets/admin/config/ChangeCoreDatabase.java	Migrates database configuration servlet imports.
src/main/java/servlets/ACS.java	Migrates SAML callback servlet imports.
src/main/java/listeners/DatabaseLifecycleListener.java	Migrates listener interfaces and annotation.
src/it/java/servlets/SetupIT.java	Migrates integration test exception import.
src/it/java/servlets/module/lesson/SessionManagementLessonIT.java	Migrates integration test cookie import.
src/it/java/servlets/module/lesson/CsrfLessonIT.java	Migrates integration test exception import.
src/it/java/servlets/module/GetModuleIT.java	Migrates integration test exception import.
src/it/java/servlets/module/challenge/NoSqlInjection1IT.java	Migrates integration test exception import.
src/it/java/servlets/module/challenge/BrokenCryptoHomeMadeIT.java	Migrates integration test exception import.
src/it/java/servlets/LogoutIT.java	Migrates integration test session import.
src/it/java/servlets/LoginIT.java	Migrates integration test session import.
src/it/java/servlets/api/LevelsIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/userManagement/DeletePlayersIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/moduleManagement/OpenOrCloseByCategoryIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/moduleManagement/OpenAllModulesIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/moduleManagement/GetJsonProgressIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/moduleManagement/GetFeedbackIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/moduleManagement/EnableModuleBlockIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/moduleManagement/CloseAllModulesTestIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/config/ToggleRegistrationIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/config/SetTournamentModeIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/config/SetOpenFloorModeIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/config/SetCtfModeIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/config/EnableFeedbackIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/config/EnableCheatsIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/config/DisableScoreboardIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/config/DisableFeedbackIT.java	Migrates integration test exception import.
src/it/java/servlets/admin/config/DisableCheatsIT.java	Migrates integration test exception import.
pom.xml	Adds Jakarta dependencies, aligns Spring, removes legacy dependencies.
.env	Selects Tomcat 10.1 with Java 17.

_{Review effort: Balanced}

… java-saml) Every PR in the Jakarta migration stack must pass CI by itself. This one didn't compile: ACS, Logout, SLS and SSOLogin passed jakarta servlet types to java-saml 2.9.0, which only accepts javax.servlet and has no Jakarta release. Its Docker build would also have failed: the Tomcat 9 era server.xml patch doesn't apply to Tomcat 10.1. - Remove java-saml. The SSO endpoints (ACS, SSOLogin, SLS, SSOMetadata) answer 503 "SAML SSO is unavailable during migration", and Logout drops its java-saml branch. SSO is off unless sso.enabled=true, and is reimplemented on pac4j-saml in #939 further up the stack, so the final code on dev is unchanged. - Regenerate serverxml.patch / webxml.patch against Tomcat 10.1.61's conf files (HTTPS via <SSLHostConfig>/<Certificate>), with the matching Dockerfile substitutions. Both apply exactly with the image's GNU patch. Verified locally: spotless, 169 unit tests, 312 integration tests, mvn -Pdocker install, docker compose build, and a Tomcat 10.1.61 smoke test (deploys, HTTP->HTTPS, TLS 1.3, login page, SSO endpoints 503). Refs #861 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot

🔵 Needs a closer look

The redirect substitution needs correction, and temporary SAML disablement requires human verification of the complete stack before merging.

1 open issue

HTTPS port substitution fails with multiline redirectPort attribute · New

_{Review effort: Balanced}

Addresses review on #946. Tomcat 10.1's server.xml puts the HTTP connector's attributes on separate lines, so in the regenerated serverxml.patch redirectPort="HTTPS_PORT" is not followed by " />". The Dockerfile's sed required that suffix, left the literal HTTPS_PORT in conf/server.xml, and HTTP->HTTPS redirects ignored the configured port (it went unnoticed with the default 443). The sed now matches just the attribute, which works for both the Tomcat 10.1 and 11 patch layouts. Test: src/test/scripts/tomcat-config-test.sh, run in CI's build job after docker compose build, checks the built image's conf/server.xml redirects to HTTPS_PORT and has no HTTPS_PORT / TLS_KEYSTORE_* / ALIAS placeholders left. It fails on the previous Dockerfile (HTTPS_PORT=8443) and passes with the fix for 8443 and 443. Refs #861 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot

🔵 Needs a closer look

The runtime migration and temporary SAML shutdown require human confirmation of deployment compatibility and coordinated merging of the complete stack.

No open issues 🎉

1 resolved since last review

HTTPS port substitution fails with multiline redirectPort attribute

_{Review effort: Balanced}

Copilot

🔵 Needs a closer look

The application-wide runtime migration and temporary SAML shutdown require human confirmation of coordinated stack deployment and compatibility.

No open issues 🎉

_{Review effort: Balanced}

ismisepaul and others added 10 commits June 4, 2026 22:34

Potential fix for pull request finding

c53f6d3

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Merge branch 'dev' into feat/jakarta-migration

5193789

Merge remote-tracking branch 'origin/dev' into feat/jakarta-03-pom-fix

e2ccca1

Merge branch 'dev' into feat/jakarta-migration

9ff22eb

Merge remote-tracking branch 'origin/feat/jakarta-migration' into fea…

b75d08a

…t/jakarta-03-pom-fix

Copilot AI balanced review requested due to automatic review settings October 23, 2026 06:59

github-project-automation Bot added this to Security Shepherd Oct 23, 2026

github-project-automation Bot moved this to Backlog in Security Shepherd Oct 23, 2026

ismisepaul mentioned this pull request Oct 23, 2026

Migrate javax.* → jakarta.* (Jakarta EE 9+ / Servlet 6.0 / Tomcat 10.1) #881

Closed

Copilot started reviewing on behalf of ismisepaul October 23, 2026 06:59

View session

Copilot AI reviewed Oct 23, 2026

View reviewed changes

ismisepaul added this pull request to stack #947 October 23, 2026 10:38

Copilot AI balanced review requested due to automatic review settings October 23, 2026 16:01

Copilot started reviewing on behalf of ismisepaul October 23, 2026 16:02

View session

ismisepaul mentioned this pull request Oct 23, 2026

build: target Jakarta EE 11 / Servlet 6.1 / Tomcat 11 / Spring 7 (PR 4 of jakarta migration #861) #936

Merged

Copilot AI reviewed Oct 23, 2026

View reviewed changes

Comment thread Dockerfile Outdated

Copilot AI balanced review requested due to automatic review settings October 23, 2026 16:12

Copilot started reviewing on behalf of ismisepaul October 23, 2026 16:13

View session

Copilot AI reviewed Oct 23, 2026

View reviewed changes

Merge remote-tracking branch 'origin/dev' into feat/jakarta-03-pom-fix

5a2fa73

Copilot AI balanced review requested due to automatic review settings October 23, 2026 17:33

Copilot started reviewing on behalf of ismisepaul October 23, 2026 17:34

View session

Copilot AI reviewed Oct 23, 2026

View reviewed changes

ismisepaul moved this from Backlog to In Progress in Security Shepherd Oct 23, 2026

ismisepaul mentioned this pull request Oct 23, 2026

Docker build passes even though landing page does not load #554

Open

ismisepaul merged commit 0558c59 into dev Oct 23, 2026
10 checks passed

ismisepaul moved this from In Progress to Done in Security Shepherd Oct 23, 2026

Navigation Menu

Repository navigation

build: Jakarta EE namespace migration and lint fix (PRs 1-3 of jakarta migration #861) - #946

build: Jakarta EE namespace migration and lint fix (PRs 1-3 of jakarta migration #861)#946
ismisepaul merged 13 commits into
devfrom
feat/jakarta-03-pom-fix

ismisepaul commented Oct 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

ismisepaul commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bottom of the Jakarta migration stack (#861)

Stack (merge with "Squash and merge stack")

Building on its own

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ismisepaul commented Oct 23, 2026 •

edited

Loading