Maven Central · #1149 by repository stars

org.eclipse.jetty:jetty-demos

12.1.14jetty/jetty.project ↗New releases in your daily digest, changelog included.

Last release 2 days ago
06 Oct 2026
Ships on a steady schedule
a new release about every 4 weeks
Some releases are documented
notes for 7 of 15 stable releases
Nothing withdrawn
no release was ever pulled
2 years old
22 releases · first in 2024

Release timeline

22 releases since 2024

202420252026

20242026

One column per month.

Releases

12.1.146 Oct 2026
Special Thanks to the following Eclipse Jetty community members
Special Thanks to the following Eclipse Jetty community members

@adityaanikam (Aditya Nikam)

@wendigo (Mateusz "Serafin" Gajewski)

Changelog

#15874 - [12.1.x] Introduced recursion depth limit in JSON parsing.

#15871 - SessionHandler uses ConnectionMetaData.isSecure() instead of Request.isSecure(), breaking secure session cookies behind ForwardedRequestCustomizer (@adityaanikam)

#15869 - PathResource incorrectly treats a classpath resource inside a JAR under a non-ASCII path as an alias

#15852 - Upgrade quiche to version 0.30.0

#15846 - Allow per-request form limits to be used with EE8/EE9

#15840 - HTTP/1 response header overflow retry loses previously determined connection persistence

#15839 - Simplified callback method notifications.

#15822 - Introduce flag in Rewrite Rules to preserve UriCompliance Violations when rewriting URIs

#15807 - ArrayByteBufferPool.clear() leaves the bucket's secondary QueuedPool poisoned: NPE on the next acquire()

#15733 - ee11 servlet: ServletRequest.getServletContext() returns the source context, not the target, after a cross-context RequestDispatcher.include()

#15679 - Fixes race for HTTP3StreamConnection release of Chunk

#15678 - CompressionHandler randomly truncates output

#15675 - Optimize Huffman codec (@wendigo)

#15674 - Optimize HPack (@wendigo)

#15432 - BrotliEncoderSink drops all but the last pulled buffer, silently truncating large Brotli responses

#15386 - Issues in http2 stream idle timeouts

#15368 - HTTP/2 client aborts exchange and loses response completed during server graceful shutdown (regression in 12.1.10 / 12.0.36 from #15134 / #14692)

From the same repository

jetty/jetty.project

12.1.134 Sept 2026

Special Thanks to the following Eclipse Jetty community members

@DragonFSKY (DragonFSKY)
@kamilkrzywanski (Kamil Krzywanski)

Changelog

#15668 - Strengthened connection failure handling.
#15649 - Various improvements for SignInWithEthereum Authentication
#15633 - Fixes for MultiPartCompliance configuration
#15631 - Allow customizing GracefulHandler's shutdown rejection response
#15629 - [12.1.x] Improve *AuthenticationProtocolHandler.accept()
#15612 - Reuses URIUtil.canonicalPath() for URI matching.
#15591 - Fixes FCGI's "try-files" query handling.
#15590 - Making CIDR pattern matching case insensitive
#15582 - Add additional configuration for SessionAuthentication persistence (12.1)
#15556 - Fix the use of quickstart with a combined base resource.
#15548 - AbstractProxyServlet.filterServerResponseHeader returns existing value
#15504 - BouncyCastleClientALPNProcessor does not have a fallback for empty protocol string. (@DragonFSKY)
#15459 - Add a Jetty module for the HashLoginService
#15454 - Fix for 15420 (add support for HttpClient.maxDestinations)
#15385 - Streamline dependencies for HTTP/3 Server with Quiche
#14930 - SymlinkAllowedResourceAliasChecker.check() fails with NPE (@kamilkrzywanski)
#14906 - Flaky test: RedispatchTests.testEe8FilterWithAwkwardRequestURI() — fails in 45% of CI builds (@DragonFSKY)
#14403 - RoundRobinConnectionPoolTest.testMultiplexWithMaxUsage() on FCGI is flaky (@DragonFSKY)

Open source →

12.1.123 Aug 2026

Special Thanks to the following Eclipse Jetty community members

@zenios (Dimitris Zenios)

Changelog

#15496 - mime-type filtering by IncludeExclude should always be case-insensitive
#15456 - Fragments in redirects not supported by default in standalone Jetty installation
#15453 - HttpServletResponse: setHeader("Content-Length", N) should be treated like setContentLengthLong(N)
#13970 - ForwardedRequestCustomizer uses connection port instead of proto default when host lacks port (@zenios)
#577 - AbstractProxyServlet onServerResponseHeaders addHeader rather than setHeader

Open source →

12.1.112 Jul 2026

Changelog #15345 - Move RateControl to jetty-io #15308 - CachingWebAppClassLoader is not registering as parallel capable #15267 - Introduce module for

Changelog

#15345 - Move RateControl to jetty-io
#15308 - CachingWebAppClassLoader is not registering as parallel capable
#15267 - Introduce module for MinimumDataRateHandler
#15234 - Review error response codes from EagerContentHandler
#15232 - Jetty 12.1.x EE11 doesn't handle Session attributes properly
#15228 - Fix increased in memory usage between 12.1.8 and 12.1.10 caused by ZipFileSystems
#15226 - Server becomes inaccessible with thousands of qtp threads blocked in HttpChannelState.onIdleTimeout ReentrantLock
#15217 - jetty-quic-quiche-foreign fails on Windows due to eager resolution of Unix-only quiche_conn_set_keylog_fd
#15156 - Injecting authentication headers using request filters

Open source →

12.1.1031 May 2026

Changelog #15180 - Upgrade to Quiche version 0.29.1 #15161 - Reduce memory footprint for persistent HttpConnections #15136 - Refresh Digest authentica

Changelog

#15180 - Upgrade to Quiche version 0.29.1
#15161 - Reduce memory footprint for persistent HttpConnections
#15136 - Refresh Digest authentication implementation
#15118 - Upgrade to Quiche version 0.29.0
#15094 - Jetty 12.1 Regression: Deferred Authentication provides Callback.NOT_CALLED leading to errors
#15074 - HTTP/2 extended connect responses contain Content-Length: 0
#15031 - IOResources#toRetainableByteBuffer data loss when using resources without path
#15021 - Resource handling regression in 12.1.9
#15011 - PathResource.resolve() fails on Microsoft Windows due to Illegal char <:>
#15009 - Make processing of RST_STREAM more lenient
#14984 - XmlConfiguration emits "Deprecated method ... setMaxThreads" WARN from shipped jetty-threadpool-virtual.xml
#14745 - NPE in HttpChannelState.completeStream() when _request is null during multipart cleanup
#14528 - BinaryStreamTest.testMoreThanLargestMessageOneByteAtATime() is flaky
#14522 - Bundle org.eclipse.jetty.websocket.server OSGI metadata exports internal instead of public package
#14006 - How to handle "Warning Logs in org.eclipse.jetty.ee8.nested.HttpChannelState and org.eclipse.jetty.server.internal.HttpChannelState"
#9799 - Declare EncodingException for HPACK/QPACK encoders and decoders

Open source →

12.1.91 May 2026

Changelog #14972 - Jetty 12.1.8 jetty-home has lib/*-config.jar files #14913 - Upgrade to Quiche version 0.28.0 #14870 - Refactor compliance checks #1

Changelog

#14972 - Jetty 12.1.8 jetty-home has lib/*-config.jar files
#14913 - Upgrade to Quiche version 0.28.0
#14870 - Refactor compliance checks
#14853 - CombinedResource.getRealURI() returns null when multiple members exist, causing 404 for all static resources
#14846 - NPE in MimeTypes$Mutable.getMimeByExtension on startup with web-fragment with mime mapping
#14824 - FileSystemPool doesn't always own its filesystems
#14821 - Websocket IllegalStateException ('Demand already fulfilled') since Jetty 12.1
#14805 - HTTP/3 server crashes on quiche_header_info
#14646 - Regression in Jetty 12.1: Invalid UTF-8 exception for application/x-www-form-urlencoded; charset=iso-8859-1
#14564 - Jetty 12.1.x TLS connections hang after several requests with internal HTTPS self-requests
#14541 - Jetty HTTP Client - setMaxRequestHeadersSize resulting in java.lang.OutOfMemoryError
#14196 - Using passivation with eviction: HttpServletRequest.getSession() may return null due to race-condition
#12110 - Request Authority checks needed
#8876 - Jetty 12 - JMX-ify HttpContent.Factory implementations

Open source →

12.1.81 Apr 2026Security

14757 Fixes for JASPI isMandatory, authType and isAuthenticationRequest params - Addresses CVE-2026-5795

Special Thanks to the following Eclipse Jetty community members

@afarber (Alexander Farber)

Changelog

14757 Fixes for JASPI isMandatory, authType and isAuthenticationRequest params - Addresses CVE-2026-5795
#14752 - Jetty 12.1 Violation of RFC9113 with Host and :authority headers
#14747 - Revert usage of SLF4J2 fluent APIs
#14732 - possible race condition in jetty 12.x code
#14694 - Sync jetty-ee11 with jetty-ee10
#14689 - ThreadIdPool.take() bottlenecks QueuedThreadPool.tryExecute()
#14687 - Destinations don't keep track of redirections.
#14685 - CachingHttpContentFactory#getContent may return null if httpContent size is not set
#14651 - Retain negative Max-Age cookie attribute
#14494 - Review use of CharsetStringBuilder subclasses
#14431 - ServletContainerInitializers are always excluded when used with absolute-ordering
#14332 - Complete mess with idleTimeout
#13685 - Infinite loop on Content.copy() with Content.Source.from(... , Path, ) when Path has size 0.
#13513 - Make MemoryEndPoint use RBB.DynamicCapacity (@afarber)
#10906 - Add Slf4j ConsoleRequestLog (JettySlf4jRequestLog) module

Open source →