Migrate to Jetty 10/11

[mcorbin]

Hello,

The Ring Jetty adapter uses Jetty 9.4.38. Jetty 10 and 11 are available. I would liek to know if you would be interested to migrate to one of these versions. The main difference between 10 and 11 seems to be the renaming of the javax.servlet packages to jakarta.servlet.

I'm not a Jetty expert but I think I can find some time to do the migration if you are interested.

[weavejester]

It would mean updating the minimum JVM version from 8 to 11. Are there any benefits to upgrading before 9.4 is officially deprecated?

[mcorbin]

The most interesting thing is I think the websocket refactoring (https://webtide.com/jetty-10-and-11-have-arrived/).

[iorena]

9.4.38 also has a serious vulnerability https://nvd.nist.gov/vuln/detail/CVE-2021-28165

[weavejester]

9.4.38 also has a serious vulnerability https://nvd.nist.gov/vuln/detail/CVE-2021-28165

I'll update to 9.4.40.

[Juholei]

9.4.40 seems to have two vulnerabilities https://nvd.nist.gov/vuln/detail/CVE-2021-28169 https://nvd.nist.gov/vuln/detail/CVE-2021-34428

[antonmos]

FYI, Jetty 9.x Community support ended on 6/1/22, but security updates will continue probably until 2025. See more at https://github.com/eclipse/jetty.project/issues/7958

[ieugen]

I think Jetty will have at least 2 supported stable versions for some time. Perhaps ring could also support all of them. Here is a table with some information on why you should use a version over the other: https://www.eclipse.org/jetty/download.php .

Jetty 10 also comes with servlet 4 API . According to this Java 8 will receive security support until 2026 but no active development: https://endoflife.date/java .

Instead of migration, maybe supporting multiple versions concurrently is better. I imagine they can glue layer is not that big, hence maintenance should not be that difficult.

WDYT?

[weavejester]

If you want to create and maintain a Ring adapter for Jetty 10, then by all means feel free to do so.

[mcorbin]

There's already https://github.com/sunng87/ring-jetty9-adapter available (the project name is misleading).

[ieugen]

Thanks, I just found the project after James mentioned it just now on slack. Looks pretty sweet.

If ring has the default jetty adapter here, people will feel the impulse to ask for upgrade / features since they are going to use it. If this is mostly a reference implementation maybe this can be mentioned. Eventually a link to good alternatives (like the one above) can also be provided.

Hopefully this will help with managing expectations.

[tychedelia]

Supporting loom would be one good reason to upgrade: https://github.com/eclipse/jetty.project/issues/8007