Re: [jstl-dev] Query about javax to jakarta

[Volodymyr Siedlecki <volosied@xxxxxxxxx>]

Hello Maggie,

The jstl projects under org.glassfish.web are the implementations.

I believe the last release under “org.glassfish.web : javax.servlet.jsp.jstl” was 1.2.5.  (As seen here: https://repo1.maven.org/maven2/org/glassfish/web/javax.servlet.jsp.jstl/1.2.5/ )

The implementations were then released under jakarta.servlet.jsp.jstl when these projects were moved over to the Eclipse Foundation.  The first release looks to be 1.2.6 (I'm not sure of the changes between 1.2.5 and 1.2.6 though)  

https://repo1.maven.org/maven2/org/glassfish/web/jakarta.servlet.jsp.jstl/1.2.6/

However, the "javax" to "jakarta" namespace (if you look at the imports) occurred with the 2.0.0 release.  As the stack overflow post you linked said, 2.0.0 can be used with Tomcat 10.  However, Tomcat 9 and below should use 1.2.x or earlier as they still use the older javax imports.  If using 2.0.0, remember to upgrade the JSTL API.  See https://repo1.maven.org/maven2/jakarta/servlet/jsp/jstl/jakarta.servlet.jsp.jstl-api/2.0.0/

It just depends on which version of Tomcat you're using.  If you're using 8 / 9, you should upgrade to the latest jakarta.servlet.jsp.jstl 1.2.x version ( which looks to be 1.2.6 as linked above).  

As for support, I believe you should upgrade to a version under jakarta.servlet.jsp.jstl .  As far as I know, no more releases will be done under org.glassfish.web : javax.servlet.jsp.jstl. However, I'll have to ask the community about potential 1.2.7 or 1.2.8 releases (assuming we have enough bug fixes / improvements / high CVE).

Hope this helps,
Vlad

On Thu, Jul 7, 2022 at 10:56 PM 林梅琴 <linlinmq@xxxxxxx> wrote:

Hi team,

This is Maggie from sap. I hope this is the right mail that I can query about the migration from javax to Jakarta.

 

In one of our service, we import the following dependency:

<dependency>

            <groupId>org.glassfish.web</groupId>

            <artifactId>javax.servlet.jsp.jstl</artifactId>

            <version>1.2.5</version>

        </dependency>

 

We noticed that the javax.servlet.jsp.jstl latest release is 1.2.5 and then the namespace is changed, the newer artifact is “Jakarta.servlet.jsp.jstl”.

 

Our tomcat version is 8.5.78, even we want to upgrade the dependency version, according to the post, we can only use version 1.2.6 of “Jakarta.servlet.jsp.jstl”.

 

<dependency>

            <groupId>org.glassfish.web</groupId>

            <artifactId>jakarta.servlet.jsp.jstl</artifactId>

            <version>1.2.6</version>

        </dependency>

 

 

 

My question is that do me need to update our dependency from “javax.servlet.jsp.jstl” to “Jakarta.servlet.jsp.jstl” in order to get better support (e.g. security issue fix). If we use version 1.2.6 of “Jakarta.servlet.jsp.jstl”, does this version under supported?

 

 

Thanks a lot.

Maggie Lin

_______________________________________________
jstl-dev mailing list
jstl-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jstl-dev