apache · mraible · Aug 11, 2026 · Aug 11, 2026 · Aug 11, 2026 · Aug 11, 2026
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -21,7 +21,7 @@ on:
   push:
     branches: [master]
   pull_request:
-    branches: [master]
+    branches: [master, 'feature/**']
 
 jobs:
   build-test:
@@ -32,7 +32,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        java: [ '11', '17', '21', '23' ]
+        java: [ '17', '21', '25' ]
 
     steps:
       - name: Set up JDK ${{ matrix.java }} 
@@ -75,7 +75,7 @@ jobs:
 
       # only on integration and only once in this matrix
       - name: Upload Dev Build on Integration
-        if: ${{ (matrix.java == '11') && (github.event_name == 'push') }}
+        if: ${{ (matrix.java == '17') && (github.event_name == 'push') }}
         uses: actions/upload-artifact@v4
         with:
           name: dev-build

diff --git a/.gitignore b/.gitignore
@@ -28,3 +28,4 @@ docker/postgresql-data
 docker/roller-data
 assembly-release/release.sh
 it-selenium/overlays/
+logs/
diff --git a/Dockerfile b/Dockerfile
@@ -21,7 +21,7 @@
 
 # STAGE 1 - BUILD ------------------------------------------------
 
-FROM maven:3-openjdk-17-slim as builder
+FROM maven:3-eclipse-temurin-17 AS builder
 
 COPY ./docker /project/docker
 
@@ -38,7 +38,7 @@ mvn -Duser.home=/builder/home -DskipTests=true -B clean install
 
 # STAGE 2 - PACKAGE ------------------------------------------------
 
-FROM tomcat:9-jdk17-openjdk-slim
+FROM tomcat:11.0-jdk17-temurin
 
 # Remove existing Tomcat webapps
 
@@ -70,9 +70,11 @@ RUN mkdir -p data/mediafiles data/searchindex
 
 WORKDIR /usr/local/tomcat/lib
 RUN apt-get update && apt-get install -y wget
-RUN wget -O postgresql.jar https://jdbc.postgresql.org/download/postgresql-42.3.1.jar
-RUN wget https://repo1.maven.org/maven2/javax/mail/mail/1.4.7/mail-1.4.7.jar
-#RUN wget https://repo1.maven.org/maven2/javax/activation/activation/1.1.1/activation-1.1.1.jar
+RUN wget -O postgresql.jar https://jdbc.postgresql.org/download/postgresql-42.7.4.jar
+RUN wget https://repo1.maven.org/maven2/org/eclipse/angus/angus-mail/2.0.3/angus-mail-2.0.3.jar
+RUN wget https://repo1.maven.org/maven2/jakarta/mail/jakarta.mail-api/2.1.3/jakarta.mail-api-2.1.3.jar
+RUN wget https://repo1.maven.org/maven2/jakarta/activation/jakarta.activation-api/2.1.3/jakarta.activation-api-2.1.3.jar
+RUN wget https://repo1.maven.org/maven2/org/eclipse/angus/angus-activation/2.0.2/angus-activation-2.0.2.jar
 
 # Add Roller entry-point and go!
 

diff --git a/app/pom.xml b/app/pom.xml
@@ -33,10 +33,9 @@ limitations under the License.
     <packaging>war</packaging>
 
     <properties>
-        <servlet.version>4.0.1</servlet.version>
-        <jsp-api.version>2.2</jsp-api.version>
-        <java-activation.version>1.2.0</java-activation.version>
-        <jstl.version>1.2</jstl.version>
+        <servlet.version>6.1.0</servlet.version>
+        <jsp-api.version>4.0.0</jsp-api.version>
+        <jstl.version>3.0.1</jstl.version>
         <angular.version>1.7.8</angular.version>
         <ant.version>1.10.15</ant.version>
         <asm.version>9.7.1</asm.version>
@@ -46,21 +45,20 @@ limitations under the License.
         <commons-codec.version>1.18.0</commons-codec.version>
         <commons-text.version>1.13.0</commons-text.version>
         <commons-lang3.version>3.17.0</commons-lang3.version>
-        <eclipse-link.version>4.0.5</eclipse-link.version>
+        <eclipse-link.version>5.0.1</eclipse-link.version>
         <guice.version>7.0.0</guice.version>
         <log4j2.version>2.24.3</log4j2.version>
         <lucene.version>9.12.1</lucene.version> <!-- lucene 10 requires JDK 21 -->
-        <oauth-core.version>20100527</oauth-core.version>
-        <maven-war.version>3.4.0</maven-war.version>
+<maven-war.version>3.4.0</maven-war.version>
         <maven-surefire.version>3.5.2</maven-surefire.version>
         <maven-antrun.version>1.0b3</maven-antrun.version>
         <rome.version>1.19.0</rome.version> <!-- locked in place since next version removes popono -->
         <slf4j.version>2.0.16</slf4j.version>
-        <spring.version>5.3.39</spring.version>
-        <spring.security.version>5.8.14</spring.security.version>
-        <struts.version>2.5.29</struts.version> <!-- .30+ breaks selenium tests -->
+        <spring.version>7.0.8</spring.version>
+        <spring.security.version>7.0.6</spring.security.version>
+        <struts.version>7.1.1</struts.version>
+        <struts-bootstrap.version>6.1.0</struts-bootstrap.version>
         <velocity.version>2.4.1</velocity.version>
-        <webjars.version>1.6</webjars.version>
         <ws-commons-util.version>1.0.2</ws-commons-util.version>
         <xmlrpc-version>3.1.3</xmlrpc-version>
     </properties>
@@ -70,55 +68,58 @@ limitations under the License.
         <!-- Java EE deps -->
 
         <dependency>
-            <groupId>javax.servlet</groupId>
-            <artifactId>javax.servlet-api</artifactId>
+            <groupId>jakarta.servlet</groupId>
+            <artifactId>jakarta.servlet-api</artifactId>
             <version>${servlet.version}</version>
             <scope>provided</scope>
         </dependency>
 
         <dependency>
-            <groupId>javax.servlet.jsp</groupId>
-            <artifactId>jsp-api</artifactId>
+            <groupId>jakarta.servlet.jsp</groupId>
+            <artifactId>jakarta.servlet.jsp-api</artifactId>
             <version>${jsp-api.version}</version>
             <scope>provided</scope>
         </dependency>
 
         <dependency>
-            <groupId>javax.servlet</groupId>
-            <artifactId>jstl</artifactId>
+            <groupId>jakarta.servlet.jsp.jstl</groupId>
+            <artifactId>jakarta.servlet.jsp.jstl-api</artifactId>
+            <version>${jstl.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.glassfish.web</groupId>
+            <artifactId>jakarta.servlet.jsp.jstl</artifactId>
             <version>${jstl.version}</version>
         </dependency>
 
         <dependency>
-            <groupId>javax.mail</groupId>
-            <artifactId>mail</artifactId>
-            <version>${java-mail.version}</version>
+            <groupId>jakarta.mail</groupId>
+            <artifactId>jakarta.mail-api</artifactId>
+            <version>2.1.3</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.eclipse.angus</groupId>
+            <artifactId>angus-mail</artifactId>
+            <version>2.0.3</version>
             <scope>provided</scope>
-            <exclusions>
-                <exclusion>
-                    <groupId>javax.activation</groupId>
-                    <artifactId>activation</artifactId>
-                </exclusion>
-            </exclusions>
         </dependency>
 
         <dependency>
-            <groupId>com.sun.activation</groupId>
-            <artifactId>javax.activation</artifactId>
-            <version>${java-activation.version}</version>
+            <groupId>jakarta.activation</groupId>
+            <artifactId>jakarta.activation-api</artifactId>
+            <version>2.1.3</version>
         </dependency>
 
         <dependency>
-            <groupId>javax.xml.bind</groupId>
-            <artifactId>jaxb-api</artifactId>
-            <version>${jaxb.version}</version>
-            <exclusions>
-                <exclusion>
-                    <!--api is already in the javax.activation artifact-->
-                    <groupId>javax.activation</groupId>
-                    <artifactId>javax.activation-api</artifactId>
-                </exclusion>
-            </exclusions>
+            <groupId>jakarta.xml.bind</groupId>
+            <artifactId>jakarta.xml.bind-api</artifactId>
+            <version>4.0.2</version>
+        </dependency>
+        <dependency>
+            <groupId>org.glassfish.jaxb</groupId>
+            <artifactId>jaxb-runtime</artifactId>
+            <version>4.0.5</version>
         </dependency>
 
         <!-- Eclipselink JPA is the default JPA implementation used by
@@ -246,12 +247,16 @@ limitations under the License.
         </dependency>
 
         <!-- note: update head.jsp on webjar version change -->
+        <!-- Supplies the "bootstrap" form theme templates the JSPs render with.
+             Maintained at github.com/struts-community-plugins/struts2-bootstrap. -->
         <dependency>
-            <groupId>org.webjars</groupId>
-            <artifactId>webjars-servlet-2.x</artifactId>
-            <version>${webjars.version}</version>
+            <groupId>com.jgeppert.struts2.bootstrap</groupId>
+            <artifactId>struts2-bootstrap-plugin</artifactId>
+            <version>${struts-bootstrap.version}</version>
         </dependency>
 
+        <!-- WebJar assets live under META-INF/resources, which Servlet 3.0+
+             containers serve from the docroot, so no webjars servlet is needed -->
         <dependency>
             <groupId>org.webjars</groupId>
             <artifactId>bootstrap</artifactId>
@@ -309,6 +314,12 @@ limitations under the License.
             <version>${lucene.version}</version>
         </dependency>
 
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-api</artifactId>
+            <version>${slf4j.version}</version>
+        </dependency>
+
         <!-- slf4j implementing the apache commons-logging interfaces -->
         <!-- note: commons-logging needs to be excluded in all dependencies transitive depending on it.
         See 2006 RFE https://issues.apache.org/jira/browse/MNG-1977 for maven's missing feature of global exclusions -->
@@ -328,7 +339,7 @@ limitations under the License.
         <!-- the actual logging impl below slf4j: log4j2 -->
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-slf4j-impl</artifactId>
+            <artifactId>log4j-slf4j2-impl</artifactId>
             <version>${log4j2.version}</version>
         </dependency>
 
@@ -387,6 +398,12 @@ limitations under the License.
             <version>${xmlrpc-version}</version>
         </dependency>
 
+        <!-- Still needed: RollerXmlRpcServlet/RollerXmlRpcServletServer use
+             server-side classes (PropertyHandlerMapping, XmlRpcHttpServer, etc.)
+             that live in this artifact. The servlet classes themselves have been
+             forked into Roller so their javax.servlet imports can be migrated
+             to jakarta.servlet in Phase 2. TODO ROL-2183: evaluate whether
+             these server classes can also be forked to fully drop this dep. -->
         <dependency>
             <groupId>org.apache.xmlrpc</groupId>
             <artifactId>xmlrpc-server</artifactId>
@@ -450,22 +467,6 @@ limitations under the License.
             <version>${spring.security.version}</version>
         </dependency>
 
-        <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-openid</artifactId>
-            <version>${spring.security.version}</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>com.google.inject</groupId>
-                    <artifactId>guice</artifactId>
-                </exclusion>
-                <exclusion>
-                    <groupId>commons-logging</groupId>
-                    <artifactId>commons-logging</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-taglibs</artifactId>
@@ -503,12 +504,6 @@ limitations under the License.
             </exclusions>
         </dependency>
 
-        <dependency>
-            <groupId>com.jgeppert.struts2.bootstrap</groupId>
-            <artifactId>struts2-bootstrap-plugin</artifactId>
-            <version>4.0.0</version>
-        </dependency>
-
         <dependency>
             <groupId>com.rometools</groupId>
             <artifactId>rome</artifactId>
@@ -536,13 +531,6 @@ limitations under the License.
             </exclusions>
         </dependency>
 
-        <dependency>
-            <groupId>net.oauth.core</groupId>
-            <artifactId>oauth-provider</artifactId>
-            <scope>compile</scope>
-            <version>${oauth-core.version}</version>
-        </dependency>
-
         <dependency>
             <groupId>org.bouncycastle</groupId>
             <artifactId>bcpkix-jdk15on</artifactId>
@@ -581,7 +569,7 @@ limitations under the License.
         <dependency>
             <groupId>org.mockito</groupId>
             <artifactId>mockito-core</artifactId>
-            <version>5.15.2</version>
+            <version>5.23.0</version>
             <scope>test</scope>
         </dependency>
 
@@ -610,13 +598,15 @@ limitations under the License.
             </plugin>
 
             <plugin>
-                <groupId>org.eclipse.jetty</groupId>
-                <artifactId>jetty-maven-plugin</artifactId>
+                <groupId>org.eclipse.jetty.ee11</groupId>
+                <artifactId>jetty-ee11-maven-plugin</artifactId>
                 <configuration>
                     <webApp>
                         <contextPath>/roller</contextPath>
                     </webApp>
-                    <jettyXmls>src/test/resources/jetty.xml</jettyXmls>
+                    <jettyXmls>
+                        <jettyXml>src/test/resources/jetty.xml</jettyXml>
+                    </jettyXmls>
                     <systemProperties>
                         <roller.custom.config>
                             ${project.build.directory}/test-classes/roller-jettyrun.properties
@@ -630,9 +620,9 @@ limitations under the License.
                         <version>6.1.5</version>
                     </dependency>
                     <dependency>
-                        <groupId>commons-dbcp</groupId>
-                        <artifactId>commons-dbcp</artifactId>
-                        <version>1.4</version>
+                        <groupId>org.apache.commons</groupId>
+                        <artifactId>commons-dbcp2</artifactId>
+                        <version>2.13.0</version>
                     </dependency>
                     <dependency>
                         <groupId>org.apache.derby</groupId>
@@ -645,9 +635,9 @@ limitations under the License.
                         <version>${derby.version}</version>
                     </dependency>
                     <dependency>
-	                    <groupId>javax.mail</groupId>
-	                    <artifactId>mail</artifactId>
-	                    <version>${java-mail.version}</version>
+                        <groupId>org.eclipse.angus</groupId>
+                        <artifactId>angus-mail</artifactId>
+                        <version>2.0.3</version>
                     </dependency>
                 </dependencies>
             </plugin>
@@ -732,6 +722,7 @@ limitations under the License.
                         </property>
                     </systemProperties>
                     <trimStackTrace>false</trimStackTrace>
+                    <argLine>-Djavax.xml.accessExternalSchema=all</argLine>
                 </configuration>
             </plugin>
 

diff --git a/app/src/main/java/org/apache/roller/planet/util/MailUtil.java b/app/src/main/java/org/apache/roller/planet/util/MailUtil.java
@@ -20,14 +20,14 @@
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
-import javax.mail.Message;
-import javax.mail.MessagingException;
-import javax.mail.SendFailedException;
-import javax.mail.Session;
-import javax.mail.Transport;
-import javax.mail.Address;
-import javax.mail.internet.InternetAddress;
-import javax.mail.internet.MimeMessage;
+import jakarta.mail.Message;
+import jakarta.mail.MessagingException;
+import jakarta.mail.SendFailedException;
+import jakarta.mail.Session;
+import jakarta.mail.Transport;
+import jakarta.mail.Address;
+import jakarta.mail.internet.InternetAddress;
+import jakarta.mail.internet.MimeMessage;
 
 import org.apache.commons.lang3.StringUtils;
 

diff --git a/app/src/main/java/org/apache/roller/weblogger/business/MailProvider.java b/app/src/main/java/org/apache/roller/weblogger/business/MailProvider.java
@@ -19,9 +19,9 @@
 package org.apache.roller.weblogger.business;
 
 import java.util.Properties;
-import javax.mail.MessagingException;
-import javax.mail.Session;
-import javax.mail.Transport;
+import jakarta.mail.MessagingException;
+import jakarta.mail.Session;
+import jakarta.mail.Transport;
 import javax.naming.Context;
 import javax.naming.InitialContext;
 import javax.naming.NamingException;