Eclipse GlassFish is an application server, implementing Jakarta EE and MicroProfile. This release corresponds with the Jakarta EE 11 specification. Eclipse GlassFish 8 is production ready, commercially supported by OmniFish, and requires JDK 21 or higher.

Formal release notes document with high-level overview of changes: Eclipse GlassFish Release Notes, Release 8

Read about what's new in GlassFish 8.0.0 in this OmniFish blog article.

Security Fixes

• CVE-2020-5258 - HIGH, 7.7 - Upgrade dojo.js to 1.16.5 by @aubi in #25805
• CVE-2020-27511 - HIGH, 7.5 - Upgrade Woodstock to 6.0.3 with a security fix for prototype by @OndroMih in #25878
• CVE-2022-46337 CRITICAL, 9.8 - Not exploitable. GlassFish not affected because bundled Derby DB does not authenticate database users via LDAP. Derby DB upgraded to 10.17.1.0 with a fix by @arjantijms in #25434

Breaking Changes

• Compliance with Jakarta EE 11
  • Add missing EE 11 schemas by @OndroMih in #25533
  • See New Features and Updates for more
• Minimal supported version is Java 21
• Removed the Java SE SecurityManager based code level security accoding to JEP 486
  • Removed security tests depending on SecurityManager by @dmatej in #25098
  • Remove security manager usage from several additional packages by @arjantijms in #25111
  • Remove some more usages of the Java SE security manager by @arjantijms in #25418
  • Removal of SecurityManager usages by @dmatej in #25898
  • Remove policy files in default domains by @OndroMih in #25893
  • Refactored out the policy files and their usages by @Ariho-Seth in #25646

New Features

• Virtual thread support
  • Virtual threads by @aubi in #25432
  • Integrate Grizzly 5 virtual thread pool - support for virtual threads for HTTP and IIOP requests by @OndroMih in #25859
• Jakarta Data support
  • Add data api by @arjantijms in #25512
  • Add manifest for jakarta data api jar by @arjantijms in #25516
  • Initial rough integration of JNoSQL Jakarta Data by @arjantijms in #25587
  • A working integration of Data into GlassFish (multiple EM support) by @OndroMih in #25597
  • Data tck runner by @arjantijms in #25598
  • Execute SQL against JDBC datasources by @arjantijms in #25608
  • Improve Data TCK Runner to add a default persistence unit by @OndroMih in #25611
  • Patch manifest of hibernate validator to support annotations 4 by @arjantijms in #25439
  • Added transaction dependency to data tck runner by @arjantijms in #25614
  • Jakarta Data transactional interceptor plus fixes in class scanner by @OndroMih in #25613
  • Simplify the Data TCK runner by @OndroMih in #25624
  • More on Jakarta Data - respect provider, fix validation by @OndroMih in #25645
  • Upgrade JNoSQL to 1.1.10. Move OSGi bundle to GlassFish by @OndroMih in #25647
  • Upgrade JNoSQL to 1.1.12 by @OndroMih in #25874
  • Trivial smoke test for Jakarta Data by @arjantijms in #25796
  • Improvements of Jakarta Data, documentation in app developer guide by @OndroMih in #25694
  • Jakarta Data NoSQL support by @OndroMih in #25826
  • Some finetuning for closing jar and when undeploying by @arjantijms in #25835
  • MP Config tests and cleanup of TCK runners by @OndroMih in #25834
  • Update docs for GlassFish 8 and Jakarta Data by @OndroMih in #25850
• Add link to thread pool page in Admin UI by @OndroMih in #25856
• Selected distribution artifacts now use flat poms - so their usages don't have to download "The Universe"
  • Flatten poms for distribution and API artifacts by @OndroMih in #25900
  • Add elements to flattened poms required by Maven Central by @OndroMih in #25913
  • Flatten by @dmatej in #25914

Fixes

• Fix a typo of the WebappClassLoader delegation settings by @dmiya3 in #25257
• Migrate away from deprecated WeldListener by @pzygielo in #25306
• Set XML parsing totalEntitySizeLimit to larger value by @arjantijms in #25314
• Fix web.xml overriding concurrency qualifiers with empty list by @arjantijms in #25392
• Deploy datasource for Jakarta Persistence early by @arjantijms in #25430
• Handle covariant return types in TypeUtil.sameMethodSignature by @arjantijms in #25510
• Destroy on EJB security manager should call destroy on service, not refresh by @arjantijms in #25691
• Fix bug where security policy context was not cleared before policy retranslate by @arjantijms in #25728
• Fixed stopping domain - we have to bound to 4848 before we ask server to stop by @dmatej in #25827
• Start CDI container before MP Config container by @OndroMih in #25831
• Fixes for MP Config by @arjantijms in #25833
• Prevent ClassCastException below by @pzygielo in #25847
• Fix requirement check by @pzygielo in #25848
• Fix --target option of asadmin delete-jdbc-resource command is ignored by @tnagao7 in #25853
• Fix Warning message "Attempt to use non-existent auth token ????" when starting cluster with multiple instances by @tnagao7 in #25888
• startserv script didn't work if path contained spaces by @OndroMih in #25889
• Fix: nadmin correctly identifying itself by @joestr in #25894
• Fixed missing curly brace - fixes issue #25897 by @dmatej in #25899
• Avoid JAR file locking in WebappClassLoader by @avpinchuk in #25904

Maintenance

• Removed jar files committed by mistake by @dmatej in #24975
• Add missing license header by @OndroMih in #25101
• Split up build pipeline some more by @arjantijms in #25376
• Streamline and somewhat update MP TCKs by @arjantijms in #25403
• Remove doc of missing params by @pzygielo in #25849
• SPARC support was already removed (but Solaris still lives) by @dmatej in #25879
• Multirelease tests updated from 11+17 to 21+25 by @dmatej in #25886
• Document that Admin Console shouldn't be enabled in production by @OndroMih in #25907
• Update references to Jakarta EE tutorial by @OndroMih in #25909
• Updated references to Jakarta EE and GlassFish versions by @dmatej in #25906

Updates

• Integrate Jakarta Authorization M4 API and other updated EE 11 APIs by @arjantijms in #24890
  • Fixed package name of the Audit class by @dmatej in #24921
  • Continue to remove references to the security manager by @arjantijms in #24981
  • Even more security manager removals by @arjantijms in #24983
  • Remove @secure annotation which was used for SE SecurityManager checks by @arjantijms in #24986
  • Remove some more instances of access controller (Security manager) by @arjantijms in #24994
  • Update Authorization TCK to 3.0.0 by @arjantijms in #24998
• Update Authentication TCK to 3.1.0 by @arjantijms in #24996
  • Fix the JWT authentication mechanism. TCK passes. by @arjantijms in #25035
  • Fix running of the authentication TCK. by @arjantijms in #25070
  • Fix JWT TCK not running fully on non-default base URL by @arjantijms in #25829
  • MicroProfile JWT injection as Jakarta Security authentication mechanism by @OndroMih in #25880
• Update runner pom for Concurrency TCK for new 3.1.0 version by @arjantijms in #24797
• Concurro 3.1.0 and Tyrus 2.2.1 by @arjantijms in #25761
• Fix microprofile config again by @arjantijms in #25629
• MicroProfile Config instance always scoped per application by @OndroMih in #25818
• MP Config: Fix a concurrency issue in a recent change by @OndroMih in #25825
• Helidon updates
  • Fixed ejb_group_embedded tests after Helidon update by @dmatej in #24881
  • Update Helidon config to actually work again by @arjantijms in #25325
  • Upgrade Helidon to 4.3.3 by @OndroMih in #25882
• Update various versions in pom.xml to their latest in 8.0 by @arjantijms in #24892
• Integrate Epicyro 3.1.0 by @arjantijms in #24945
• Updated TCK to Servlet 6.1 by @arjantijms in #24958
  • Configure Servlet 6.1 TCK to run SSL/Certificate tests by @arjantijms in #24960
  • Fixed dependencies for Servlet TCK by @dmatej in #25082
  • Update Servlet/JSP versions in X-Powered-By header for Jakarta EE 11 by @tnagao7 in #25854
• Update various versions by @arjantijms in #24948
• Concurrency for GlassFish 8 by @dmatej in #24954
  • Update Concurrency TCK to 3.1.1 by @arjantijms in #25006
  • Integrate Concurro 3.1.0-M5 by @arjantijms in #25375
• Update Pages TCK to 4.0.0 by @arjantijms in #24988
• 8 0 cdi 4 1 0 tck by @arjantijms in #24989
  • Fixed for CDI 4.1 TCK. Now passes all tests. by @arjantijms in #24991
• Update Faces TCK to 4.1.0 by @arjantijms in #24995
  • Fix run of faces TCK by @arjantijms in #24999
  • Add profiles to Faces TCK to run subsets by @arjantijms in #25081
  • Integrate Mojarra 4.1.2 and WaSP-M2 by @arjantijms in #25108
  • Fix #25260 Deprecated settings in Admin Console by @dmiya3 in #25261
  • Update Faces to 4.1.1 by @arjantijms in #25040
• Jakarta Persistence
  • Cherrypick Inject EntityManager changes from 8.0-JDK17 by @arjantijms in #25213
  • Support injecting entity manager factory, and some utils from it by @arjantijms in #25267
• Fix download of javatest and tsharness from Autorization TCK archive by @arjantijms in #25001
• Update several versions in poms by @arjantijms in #25002
• Update REST TCK to 4.0.0 by @arjantijms in #25007
• Update client libs for REST TCK by @arjantijms in #25010
• Update WebSocket TCK to 2.2.0 by @arjantijms in #25011
• Fixed CDI TCK signature test by @dmatej in #25023
• Bump OpenMQ version by @pzygielo in #25000
• Weld updates
  • Update Weld to 6 beta 4 by @arjantijms in #25040
  • Integrate Weld 6.0.0.Final by @arjantijms in #25328
  • Update Weld and remove unnecessary patch file by @arjantijms in #25385
• Parsson now supports Annotations 3.0, no need for patch anymore. by @arjantijms in #25045
• Update Expression Language TCK to 6.0.0 by @arjantijms in #25041
• Integrate Exousia 3.0.0 by @arjantijms in #25721
• Integrate Exousia 3.0.1 by @arjantijms in #25793
• Integrate Expression Language API 6.0.1 by @arjantijms in #25051
• Integrate Expessly 6.0.0-M2 by @arjantijms in #25071
• Integrate Expressly 6.0.0 by @arjantijms in #25511
• Integrate Tyrus 2.2.0 by @arjantijms in #25072
• Update Jakarta Validation TCK to 3.1.1 by @arjantijms in #25077
• Integrate Tags (JSTL) API 3.0.2 by @arjantijms in #25112
• Integrate PFL 5.0.0 by @arjantijms in #25105
• Integrate WaSP 4.0.0 by @arjantijms in #25299
• Jersey and REST updates
  • Fix restclient by @arjantijms in #25327
  • Integrate Jersey 4.0.0-M3 by @senivam in #25684
  • integrate Jersey 4.0.0 by @senivam in #25767
  • Add required dependency to pass REST tests by @arjantijms in #25743
• Integrate Soteria, JWT and Nimbus in updated versions by @arjantijms in #25425
• Fix custom principal via Soteria by @arjantijms in #25741
• Soteria 4.0.2 and EclipseLink 5.0.0-B11 by @arjantijms in #25742
• Bump eclipselink from 5.0.0-B12 to 5.0.0-B13 by @pzygielo in #25845
• Bump eclipselink from 5.0.0-B11 to 5.0.0-B13 by @pzygielo in #25844
• Integrate ASM 9.9.1 by @arjantijms in #25885
• Update derby and asm by @arjantijms in #25434
• Updated Derby to 10.17.1.0 by @dmatej in #25739
• Use final 6.6.0 OpenMQ release by @pzygielo in #25528
• Update various versions in poms by @arjantijms in #25622
• Fixed MicroProfile Rest TCK by @arjantijms in #25637
  • Add comment and fix import by @arjantijms in #25638
• Add MVC TCK and a patch for Krazo by @arjantijms in #25839
• Add copy class command for Krazo jar by @arjantijms in #25840
• Update TCK Arquillian container to 2.1.1 by @arjantijms in #25682
• Update command security plugin to 1.0.20 by @arjantijms in #25683
• Upgrade Woodstock to 6.0.3 with a security fix for prototype by @OndroMih in #25878
• Update versions in pom by @arjantijms in #25513
• Update various Maven plugins and remove unused one by @arjantijms in #25049
• Update various dependencies by @arjantijms in #25050
• Update various versions in pom.xml by @arjantijms in #25168
• Update versions of dependencies and increase timeouts in OSGi tests by @arjantijms in #25192
• Increase more versions in pom.xml by @arjantijms in #25196
• Various updates, specifically to enhance JDK 24 support by @arjantijms in #25317
• Add OSGI profiles / settings for JDK 24 and 25 by @arjantijms in #25311
• Update several dependencies and plugins by @arjantijms in #25720
• 8.0 Update versions in pom, specifically Hibernate Validation by @arjantijms in #25814
• Explicit version of o.g.hk2:osgiversion-m-p by @pzygielo in #25821
• Update various versions in pom by @arjantijms in #25902
• Updated Junit, Ant, Postgres and Checkstyle and few maven plugins by @dmatej in #25910

Build

• Update runner pom for Concurrency TCK for new 3.1.0 version by @arjantijms in #24797
• Fixed runtests.sh script after switching to Java 21 by @dmatej in #24882
• Testing 8.0 branch + reenabled tests by @dmatej in #25483
• Add release profile to pom by @arjantijms in #25717
• Fix TestNG execution for the MP TCKs by @arjantijms in #25820
• Do not set fixed values for MP TCKs via Arquillian XML by @arjantijms in #25823
• Fixed URLS to TCK by @dmatej in #25824
• Fix MP TCK arquillian override by @arjantijms in #25828
• Add exclusions for EE 12 versions by @arjantijms in #25832
• Update documentation building for 8.x by @arjantijms in #25838
• Trigger workflows for PRs that target new default branch by @pzygielo in #25857
• Website updates for docs and downloads to align with existing versions by @OndroMih in #25871
• Website: Add links to docs for older versions by @OndroMih in #25873
• Updated links from Java 17 to Java 21 by @dmatej in #25890
• Removed generated files by @dmatej in #25901
• Rebuild documentation just if the docs directory changed. by @dmatej in #25905
• Replace hard-coded version references in docs with existing properties defined in pom.xml by @OndroMih in #25908

Synchronization with Master/Main branch

• Merge master into 8.0 - attempt 2 by @arjantijms in #24777
• Merge master into 8.0 by @arjantijms in #24779
• Latest 8.0 updates from own branch by @arjantijms in #24795
• Merge master to 8.0 by @dmatej in #24927
• Merge master into 8.0 by @arjantijms in #24799
• 8.0 by @arjantijms in #24818
• Sync of the master branch to 8.0.0 by @dmatej in #24819
• Merge latest changes from master into 8.0 by @arjantijms in #24836
• Merge latest 8.0 updates and changes from master by @arjantijms in #24856
• Latest 8.0 updates and commits from master by @arjantijms in #24862
• Post M3 merges from master by @arjantijms in #24865
• Merge latest changes from master into 8.0 by @arjantijms in #24878
• Another sync with master by @dmatej in #24885
• 8.0 by @arjantijms in #24899
• Merge master into 8.0 by @arjantijms in #24904
• Merge master to 8.0 by @dmatej in #24927
• GF8 merge by @dmatej in #24936
• Merge main branch and local updates by @arjantijms in #24950
• Remove duplicate nimbus by @arjantijms in #24952
• Fixed version references + added check to avoid repeating by @dmatej in #24953
• Merge of master branch to branch 8.0 by @dmatej in #24979
• Merge of master to 8.0 by @dmatej in #25024
• Merge of master to 8.0 by @dmatej in #25036
• Merge master 21-07 into 8.0 by @arjantijms in #25057
• Merge from master to 8.0 + fixed nucleus/parent/pom.xml by @dmatej in #25060
• Merge from master to 8.0 by @arjantijms in #25068
• Merge master into 8.0 by @arjantijms in #25069
• Merge of master by @dmatej in #25091
• Syncing with master by @dmatej in #25095
• Merge master into 8.0 by @arjantijms in #25104
• Merge master into 8.0 by @arjantijms in #25109
• Sync with master by @dmatej in #25127
• Merging master to 8.0 by @dmatej in #25150
• Merge master into 8.0 by @arjantijms in #25167
• Merge from master to 8.0 by @dmatej in #25178
• Merge master into 8.0 by @arjantijms in #25191
• Merge master into 8.0 by @arjantijms in #25265
• Merge master into 8.0 by @arjantijms in #25266
• Merge master into 8.0 by @arjantijms in #25329
• Merge master into 8.0 by @arjantijms in #25359
• Merge master after 7.0.22 into 8.0 by @arjantijms in #25363
• JDK 24 changes and merge master by @arjantijms in #25309
• Merge master 4ef1e79 into 8.0 by @arjantijms in #25379
• Merge again into 8.0 by @arjantijms in #25380
• Merge master into 8.0 by @arjantijms in #25395
• Merge main into 8.0 by @arjantijms in #25431
• Merge main into 8.0 by @arjantijms in #25435
• Merge remote-tracking branch 'origin/master' into 8.0 by @arjantijms in #25440
• Merge main into 8.0 by @arjantijms in #25480
• Merge more main into 8.0 by @arjantijms in #25481
• Merge main into 8.0 by @arjantijms in #25482
• Merge of current master to 8.0 by @dmatej in #25506
• Merge master to 8 by @dmatej in #25640
• Merge from master to 8.0 by @dmatej in #25711
• Fixed JDBC tests after merge from master branch by @dmatej in #25712
• Merge 7.1 into 8.0 branch by @arjantijms in #25719
• 8M13 was released, merge the branch by @dmatej in #25722
• Merge from master by @dmatej in #25733
• Merge from master by @dmatej in #25738
• Merge master into 8.0 by @arjantijms in #25753
• Merge main into 8.0 by @arjantijms in #25755
• Merge master into 8.0 by @arjantijms in #25760
• Merge branch 'master' into 8.0 by @arjantijms in #25792
• merge master in 8.0 by @arjantijms in #25808
• merge main in 8.0 by @arjantijms in #25810
• Merge master into 8.0 by @arjantijms in #25812
• Merge master into 8.0 by @arjantijms in #25822
• Merge main into 8.0 by @arjantijms in #25830
• Merge 8.0 in master by @arjantijms in #25841

New Contributors

• @joestr made their first contribution in #25894

Full Changelog: 7.1.0...8.0.0