All pull requests

Pull requests

• Require a secret for stop requests on the admin port

  #3087·rzo1 opened Oct 9, 2026Contributor·

  ·
  

• [tomee-10.x] Update the systemd service example

  #3086·rzo1 opened Oct 9, 2026Contributor·

  ·
  

• Update the systemd service example

  #3085·rzo1 opened Oct 9, 2026Contributor·

  ·
  

• Clear the WS-Security caller identity after the JAX-WS request

  #3084·rzo1 opened Oct 9, 2026Contributor·

  ·
  

• Do not return EJB exception messages from the default JAX-RS mapper

  #3083·rzo1 opened Oct 9, 2026Contributor·

  ·
  

• Keep RAFPassivater files in a private temp directory

  #3082·rzo1 opened Oct 9, 2026Contributor·

  ·
  

• TOMEE-4730 - Apply class-level security annotations of a resource superclass

  #3081·rzo1 opened Oct 9, 2026Contributor·

  ·
  

• TOMEE-4729 - Restore MP-JWT security state for asynchronous requests

  #3080·rzo1 opened Oct 9, 2026Contributor·

  ·
  

• Reject archive entries escaping the target in tomee-maven-plugin

  #3079·rzo1 opened Oct 9, 2026Contributor·

  ·
  

• Warn when tomee-maven-plugin sends credentials over plain HTTP

  #3078·rzo1 opened Oct 9, 2026Contributor·

  ·
  

• Passivate stateful beans to a private directory by default

  #3077·rzo1 opened Oct 9, 2026Contributor·

  ·
  

• Warn that the Static3DES password cipher only obfuscates

  #3076·rzo1 opened Oct 9, 2026Contributor·

  ·
  

• Make only_from authoritative for server services

  #3075·rzo1 opened Oct 9, 2026Contributor·

  ·
  

• Verify Tomcat user identity store passwords with the realm CredentialHandler

  #3074·rzo1 opened Oct 7, 2026Contributor·

  ·
  

• Validate stored parameters in TomEEPbkdf2PasswordHash

  #3073·rzo1 opened Oct 7, 2026Contributor·

  ·
  

• Bind the LiveReload connector to loopback and check the websocket origin

  #3072·rzo1 opened Oct 7, 2026Contributor·

  ·
  

• Keep Debian package configuration read-only for the service group

  #3071·rzo1 opened Oct 7, 2026Contributor·

  ·
  

• Do not map the caller principal to a role by name in getLogicalRoles

  #3070·rzo1 opened Oct 7, 2026Contributor·

  ·
  

• Log webapp jars skipped by the scan exclusion list

  #3069·rzo1 opened Oct 7, 2026Contributor·

  ·
  

• Resolve MP-JWT security constraints per resource class

  #3068·rzo1 opened Oct 7, 2026Contributor·

  ·
  

• Register the MP-JWT filter only for the MP-JWT auth method

  #3067·rzo1 opened Oct 7, 2026Contributor·

  ·
  

• TOMEE-4643 - discover Feature/DynamicFeature from META-INF/services

  #2877·jungm opened Aug 1, 2026Member·

  ·
  5

• TOMEE-4648 - BASIC mechanism rejects valid credentials with an application IdentityStore

  #2851·jungm opened Jul 23, 2026Member·

  ·
  5

• TOMEE-4652 - roll back UserTransaction left over by a request

  #2849·jungm opened Jul 23, 2026Member·

  ·
  5

• TOMEE-4650 - Guard undeploy against an already-closed EntityManagerFactory

  #2847·jungm opened Jul 23, 2026Member·

  ·
  4