Wildfly

wildfly/wildfly last check 56 releases
Notes
no notes yet
Release notes
view on github
42.0.0

Release Notes - WildFly - 42.0.0.Final

For the most up-to-date list of all issues resolved, including those resolved as fixed in WildFly 42 after the release date, see the release notes in JIRA.

For all changes since WildFly 41.0.0.Final, see the full changelog.

Changes in the underlying WildFly Core 34 release are listed in the WildFly Core JIRA.

Feature Request

WFLY-19563 Support use of virtual threads in the Jakarta Concurrency 3.1. implementation

WFLY-21526 Promote "WFLY-20918 Add idle time-based eviction configuration for distributable HttpSessions, SFSBs, Timers" to DEFAULT stability

Enhancement

WFLY-19812 Quickstarts move to JUnit 6

WFLY-20418 Shared include file describing observability options

WFLY-22003 servlet-security: replace JPA-based DB initialization with JDBC startup bean to fix Glow unbound datasource warning

WFLY-22219 Allow support for automatic meter management when resources are added/removed at runtime

Bug

WFLY-14509 Exception while exporting metrics during WildFly boot (round 2)

WFLY-16521 FaceletsViewMappingsTestCase fails with Faces 4

WFLY-16570 Inconsistent SecurityIdentity when switching domain

WFLY-17451 Undertow subsystem lacks capability references between its filter and filter-ref

WFLY-18314 DistributedTimerServiceTestCase is failing intermittently

WFLY-19117 CWE-611 issues in FileTimerPersistence

WFLY-19125 CWE-611 issues in deployment descriptor parsing

WFLY-20566 RBAC access control interfering with Micrometer metrics

WFLY-20876 Correct wrong server version info in docs; remove version info when it doesn't add value

WFLY-21094 Transition EJB services to ON_DEMAND

WFLY-21273 Manual mode tests leave untracked git file in CosServices.cfg file

WFLY-21350 LegacyConnectionFactoryService produces malformed HTTP Host header for bare IPv6 addresses on Windows

WFLY-21659 Stuck message after failover of JMS bridge

WFLY-21732 ClassNotFoundException: org.infinispan.lock.exception.ClusteredLockException

WFLY-21767 CLI batch of Undertow commands now fails

WFLY-21813 Move ejb3 subsystem services for incoming remote EJB invocations to the "remote" resource

WFLY-21930 HTTP invoker session cookie path missing leading `/` breaks EJB-over-HTTP stickiness through mod_cluster

WFLY-21965 Distributable session leaks transactional batch's pessimistic lock on SessionMetaDataKey (ISPN000299) — regression in WildFly 40

WFLY-22026 IIOP SSLSocketFactory accesses serverSSLContext before null check

WFLY-22034 Testsuite parent POMs leak shared dependencies to all child modules

WFLY-22037 Infinispan SIFS Compactor throws ArrayIndexOutOfBoundsException during server shutdown

WFLY-22076 Bootable Jar CI jobs failing due to wildfly-cleanup-marker not being deleted in time

WFLY-22077 Expansion provisioning should provision base example configs when expansion examples are provisioned

WFLY-22085 Add startup retries to Kafka Testcontainers to avoid intermittent "Text file busy" failures

WFLY-22095 Intermittent failures in UndertowSSLv2HelloTestCase

WFLY-22098 Use ServerReload instead of CLIWrapper.sendLine in CommonBase used by OCSP and CRL tests to prevent intermittent failures

WFLY-22099 Cache listeners not re-registered on resume.

WFLY-22103 Deprecated resources in Undertow and EJB3 subsystems do not emit deprecation warnings on server start

WFLY-22122 OIDC logout tests need to be updated for default stability level

WFLY-22128 Quickstarts: todo-backend fails to build when configuring undertow

WFLY-22134 The idle-threshold transformer for distributable-web and distributable-ejb subsystems is registered for previous model version

WFLY-22136 The elytron-oidc-client subsystem doesn't parse/marshal OIDC logout attributes when the community:2.0 schema is used

WFLY-22141 JGroups diagnostics cannot be enabled via diagnostics-socket-binding

WFLY-22156 CVE-2026-15560 openjdk-orb: unauthed class loading via IIOP in EAP

WFLY-22157 CVE-2026-15563 wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

WFLY-22158 CVE-2026-15567 wildfly-iiop-openjdk: Wildfly: Pre-auth denial of service on the IIOP listener

WFLY-22162 DefaultCacheContainerAdmin#getOrCreateCache has inverted ternary condition

WFLY-22165 PowerShell scripts do not process JAVA_OPTS from the environment as its .bat counterpart

WFLY-22189 Unexpected messaging-activemq warning WFLYMSGAMQ0120 in server log after reload

WFLY-22198 Race condition in mod_cluster startup: STOP-APP can be sent before CONFIG

WFLY-22207 SFSB idle-timeout passivation timer not reset on access for local caches with passivation

WFLY-22230 Idle SFSB not found if invoked while passivating

WFLY-22240 Any provisioning that don't contain core-tools produces a server that can't be started with standalone.sh

WFLY-22245 Fix broken code samples and cross-references in the Domain Mode Subsystem Transformers guide

WFLY-22250 Incorrect usage of "if errorlevel" on Windows batch scripts

WFLY-22280 Upgrade the JUnit BOM from 5.14.4 to 6.1.3

WFLY-22283 `WildFlyRecoveryRegistry` supplier is pinned to a single service

WFLY-22287 Undertow subsystem is missing capabilities that identify default server/host combinations

WFLY-22312 Fix the Jakarta EE Pages 4.0 TCK failure ee.jakarta.tck.pages.spec.configuration.elevaluation.URLClientIT.elEvaluation23WebApplicationTest

WFLY-22319 Error WFLYMODCLS0004 is logged even when advertise mechanism is disabled when no multicast interface is available

WFLY-22320 CDIFailoverTestCase deploys two servlets mapped to /simple, logging WFLYUT0101

WFLY-22322 JMS XA transaction recovery fails after connection/network failure since artemis broker 2.57.0

WFLY-22351 The journal importing operation should use a default parser

Component Upgrade

WFLY-15867 Upgrade org.xipki.pki/ocsp-server

WFLY-21447 Upgrade Infinispan to 16.2.2

WFLY-21929 Upgrade wildfly-clustering to 12.0

WFLY-22028 Upgrade WildFly Preview to CDI 5.0.0 and Weld 7.0

WFLY-22090 Upgrade wildfly-producers to 1.4.2.Final

WFLY-22093 Upgrade Galleon to 7.0.9.Final and WildFly Galleon plugins to 8.1.7.Final

WFLY-22102 Update WildFly to Mojarra 4.0.20 and 4.1.11

WFLY-22105 Upgrade WildFly Core to 34.0.0.Beta1

WFLY-22106 Upgrade wildfly licenses-plugin to 2.4.6.Final

WFLY-22109 Upgrade to Galleon 7.0.10.Final and WildFly Galleon Plugins 8.2.0.Beta1

WFLY-22110 Upgrade to Apache Artemis 2.55.0

WFLY-22111 Upgrade RESTEasy to 7.0.3.Final

WFLY-22113 Upgrade the wildfly-maven-plugin to 6.0.1.Final

WFLY-22115 Upgrade io.prometheus to 1.4.3

WFLY-22116 Upgrade Yasson from 3.0.4 to 3.0.5

WFLY-22117 Update to Micrometer 1.17.0

WFLY-22121 Upgrade WildFly Core to 34.0.0.Beta3

WFLY-22123 Upgrade Vert.x to 4.5.31

WFLY-22130 (resolves CVE-2026-46581) Update Mojarra to WildFly to 4.0.22 and 4.1.13

WFLY-22132 Upgrade ironjacamar to 3.0.22.Final

WFLY-22146 Upgrade SmallRye Reactive Messaging to 4.37.0

WFLY-22147 Upgrade SmallRye Config to 3.18.1

WFLY-22150 Upgrade Apache CXF components from 4.1.8-jbossorg-1 to 4.1.8 (resolves CVE-2026-66909)

WFLY-22151 Upgrade org.apache.qpid:proton-j from 0.34.1 to 0.35.0 (resolves CVE-2026-66274)

WFLY-22153 Bump org.jboss.activemq.artemis.integration:artemis-wildfly-integration from 2.0.4.Final to 2.0.5.Final

WFLY-22154 Upgrade JBossWS-CXF from 7.4.0 to 7.4.1

WFLY-22160 [42.0.0.Beta1] Upgrade HAL to 3.7.21.Final

WFLY-22163 Bump io.netty:netty-bom from 4.1.136.Final to 4.1.137.Final (resolves numerous CVEs)

WFLY-22167 Upgrade lz4-java to 1.11.1 - resolves CVE-2026-59949

WFLY-22169 Upgrade Jastow from 2.3.0.Final to 2.3.1.Final (Jakarta EE 11) and from 2.2.9.Final to 2.2.10.Final (Jakarta EE 10)

WFLY-22170 Upgrade Apache Neethi to 3.2.3 (resolves https://nvd.nist.gov/vuln/detail/CVE-2026-66142/66143/66144)

WFLY-22171 Upgrade lz4-java to 1.11.2 (resolves GHSA-6cx8-rjf8-pr8g and GHSA-4v53-57pg-c464)

WFLY-22172 Upgrade com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-13

WFLY-22173 Upgrade Vert.x to 4.5.32

WFLY-22179 Bump org.jctools:jctools-core from 4.0.6 to 4.0.7

WFLY-22186 Bump version.io.micrometer from 1.17.0 to 1.17.1 (resolves CVE-2026-59296)

WFLY-22187 Upgrade WildFly Core to 34.0.0.Beta4

WFLY-22188 Upgrade Jakarta Data API to 1.0.2

WFLY-22194 Upgrade jsoup to 1.23.2

WFLY-22195 Upgrade Jakarta JSONB API to 3.0.3

WFLY-22196 Upgrade Jackson to 2.21.6 (resolves numerous CVEs and GHSAs)

WFLY-22202 Upgrade RESTEasy to 7.0.4.Final

WFLY-22204 Bump com.github.luben:zstd-jni from 1.5.7-13 to 1.5.7-16

WFLY-22205 Upgrade Galleon Plugins to 8.2.0.Beta2

WFLY-22206 Upgrade elytron-oid-client testsuite to Keycloak 26.7.3 and keycloak-admin-client 26.0.12

WFLY-22211 Upgrade wildfly-clustering to 12.0.0.CR2

WFLY-22212 Upgrade Infinispan to 16.2.3

WFLY-22213 Upgrade JGroups to 5.5.7.Final

WFLY-22214 Bump org.cryptacular:cryptacular from 1.2.5 to 1.2.7

WFLY-22216 Upgrade Artemis from 2.55 to 2.57, warn on insecure UDP multicast

WFLY-22224 Upgrade HAL to 3.7.22.Final

WFLY-22225 Bump io.netty:netty-bom from 4.1.137.Final to 4.1.138.Final

WFLY-22226 Upgrade vert.x to 4.5.34

WFLY-22227 Upgrade smallrye-mutiny-vertx to 3.23.1

WFLY-22231 Upgrade wildfly-clustering to 12.0.0.CR5

WFLY-22232 Update WildFly Preview to Jakarta JSON Binding and Yasson 3.1.0-M1

WFLY-22233 Upgrade WildFly Core to 34.0.0.Beta5

WFLY-22235 Bump version.io.smallrye.smallrye-config from 3.18.1 to 3.18.3

WFLY-22237 Upgrade SmallRye Fault Tolerance to 6.11.4 and 7.0.0 (Preview)

WFLY-22239 Upgrade SmallRye Config to 4.0.0

WFLY-22241 Upgrade RESTEasy to 7.0.5.Final

WFLY-22242 Bump version.org.apache.james.apache-mime4j from 0.8.14 to 0.8.15

WFLY-22244 Upgrade to Galleon plugins 8.2.0.Beta3

WFLY-22246 Upgrade jboss-ejb-client to 5.0.9.Final

WFLY-22249 Upgrade lz4-java to 1.11.3

WFLY-22255 Upgrade WildFly Core to 34.0.0.Beta6

WFLY-22258 Upgrade Jackson to 2.21.7 (resolves several CVEs)

WFLY-22259 Upgrade Web Services Security and OpenSAML dependencies (resolves CVE-2026-85532/88920/92899)

WFLY-22261 Upgrade WildFly HTTP Client to 2.1.5.Final

WFLY-22265 Update jose4j to 0.9.7

WFLY-22267 Upgrade MicroProfile Config API to 3.1.2

WFLY-22269 Upgrade JBossWS-CXF from 7.4.1.Final to 8.0.0.Beta1

WFLY-22273 Upgrade luben-zstd-jni to 1.5.7-20

WFLY-22275 Bump org.apache.neethi:neethi from 3.2.3 to 3.2.4 (resolves CVE-2026-91863...91866)

WFLY-22277 Upgrade Kafka to 4.2.2

WFLY-22278 Upgrade lz4-java to 1.11.4

WFLY-22281 Bump org.apache.ws.xmlschema:xmlschema-core from 2.3.2 to 2.3.3 (Resolves CVE-2026-102496, CVE-2026-102495)

WFLY-22284 Upgrade mod_cluster to 2.1.1.Final (resolves CVE-2026-76166)

WFLY-22288 Upgrade WildFly Galleon Plugins to 8.2.0.Beta6

WFLY-22294 Upgrade WildFly Core to 34.0.0.Beta7

WFLY-22295 Upgrade to WildFly Galleon Plugins 8.2.1.Final and Galleon 7.0.11.Final

WFLY-22296 Upgrade Undertow EE to 1.0.3.Final (Jakarta EE 10) and EE 2.0.3.Final (Jakarta EE 11)

WFLY-22302 Upgrade WildFly to Hibernate Models 1.1.2, ByteBuddy 1.18.14 and Hibernate ORM 7.4.13 for Java 27 support

WFLY-22303 Upgrade ASM to 9.11

WFLY-22305 Bump org.xerial.snappy:snappy-java from 1.1.10.8 to 1.1.10.11 (Resolves multiple CVEs)

WFLY-22313 Upgrade to WildFly Maven Plugin 6.0.2.Final

WFLY-22315 Upgrade JGroups AWS to 4.0.2.Final and software.amazon.awssdk to 2.55.14

WFLY-22316 Upgrade JBoss WS CXF to 8.0.0.Final

WFLY-22317 Upgrade WildFly Maven Plugin to 6.0.3.Final

WFLY-22318 Bump com.github.luben:zstd-jni from 1.5.7-20 to 1.5.7-21

WFLY-22321 Upgrade Apache CXF components from 4.1.8 to 4.1.9 (CVE-2026-97791, CVE-2026-97468, CVE-2026-78384, CVE-2026-107937, CVE-2026-108039)

WFLY-22323 Bump io.netty:netty-bom from 4.1.138.Final to 4.1.139.Final (resolves numerous unpublished CVEs)

WFLY-22327 Upgrade to WildFly galleon-plugins 8.2.2.Final

WFLY-22328 Bump version.io.vertx.vertx from 4.5.34 to 4.5.35 (resolve multiple vulnerabilities)

WFLY-22329 Upgrade jboss-ejb-client to 5.0.10.Final

WFLY-22332 Upgrade snappy-java to 1.1.10.12

WFLY-22333 Upgrade zstd-jni to 1.5.7-23

WFLY-22336 Upgrade WildFly HTTP Client to 2.1.6.Final

WFLY-22337 Update guava from 33.0.0-jre to 33.7.2-jre (resolves CVE-2026-102554)

WFLY-22339 Upgrade WildFly Maven Plugin to 6.1.0.Final

WFLY-22343 Update WildFly Preview to Jakarta JSON Binding and Yasson 3.1.0-M2

WFLY-22344 Upgrade Jakarta JSON Binding API to 3.0.4

WFLY-22345 Upgrade joda-time from 2.12.7 to 2.14.2

WFLY-22346 Upgrade JGroups to 5.5.8.Final

WFLY-22349 Upgrade WildFly Core to 34.0.0.Final

Task

WFLY-19144 Upgrade the org.xipki.ocsp-server and org.glassfish.jaxb.jaxb-runtime versions

WFLY-20213 Migration for Security Manager Subsystem

WFLY-21090 Mention GitHub issues in the Pull Request Standards doc

WFLY-21303 Quickstarts: improve CI testsuite

WFLY-21617 The WildFly Testsuite documentation does not mention how to actually execute the test suite

WFLY-21772 Validate the differences in the domain-profile and domain-ha-profile between standard WildFly and WildFly Preview

WFLY-21910 Replace the use of -proc:full in the maven compiler plugin by providing the annotations processors

WFLY-22020 Standardize installation directory variable naming JBOSS_HOME/ WFLY_HOME/ WILDFLY_HOME/ YOUR_JBOSS_HOME/ JBOSSHOME/ EAP_HOME / etc in documentation

WFLY-22048 Remove uses of org.jboss.as.test.shared.SecurityManagerFailure

WFLY-22074 Remove Dependency Check Files from WildFly

WFLY-22080 XSite tcp-bridge test stack is missing UFC protocol

WFLY-22088 Update the Different_Flavors_of_WildFly doc for WF 42

WFLY-22094 Disable building WildFly EE 10

WFLY-22096 Use ServerReload instead of CLIWrapper.sendLine("reload")

WFLY-22126 WFLY-21930 follow-up

WFLY-22129 Add WildFly 41 transform/reject tests for clustering subsystems

WFLY-22138 Document how to configure JGroups diagnostics

WFLY-22143 Remove the com.ibm.async.asyncutil module

WFLY-22155 Improve OIDC logout tests

WFLY-22159 Fix powershell script test failures in advance of wildfly-core upgrade for WFCORE-7670

WFLY-22166 Tidy up launch scripts

WFLY-22190 Remove support for using the SecurityManger from the startup scripts

WFLY-22203 Remove the redundant arquillian.servlet.protocol property and defaultProtocol overrides from the testsuite

WFLY-22220 Remove use of org.wildfly.core:wildfly-patching util classes from mixed domain testsuite

WFLY-22222 Modernize outdated log and code examples in docs

WFLY-22238 Add .serena/ to .gitignore

WFLY-22243 Convert the security-manager subsystem to a model-only subsystem

WFLY-22247 The bin content to be moved to Galleon explicit packages

WFLY-22256 [Weld] Replace deprecated call to `LiteExtensionTranslator(List, ClassLoader)`

WFLY-22263 Update the https://docs.wildfly.org/41/WildFly_Elytron_Security.html#Elytron_Java_Security_Manager

WFLY-22271 Remove the keycloak-admin-client test dependency

WFLY-22282 Add documentation for principal-transformer in token-realm

WFLY-22290 Move testsuite/integration/expansion to JUnit Jupiter

WFLY-22292 Update SameSiteCookieHandlerTestCase to assert the proper attribute name for a secure cookie

WFLY-22293 Add token realm principal-transformer integration test in WildFly testsuite

WFLY-22304 Drop the testsuite/mixed-domain tests of EAP 7.4

WFLY-22310 Set the additional.ee.test.source property in all the 'xxx-server-tests' profiles

WFLY-22311 Fix obvious documentation typos

WFLY-22356 Fix remaining broken external links in documentation

Sub-task

WFLY-21212 Broken docs.jboss.org links in the Web Services documentation

WFLY-21217 Broken docs.jboss.org link in EAP 5.1 migration content

WFLY-22107 Deprecate classes made obsolete by wildfly-subsystem

GitHub Release Notes

In addition to the JIRA-focused notes above, we also provide GitHub generated release notes, which provide links to relevant pull requests. These only reflect work since the WildFly 42.0.0.Beta1 release; the JIRA-based content above covers both 42.0.0 Beta and Final.

What's Changed

New Contributors

Full Changelog: https://github.com/wildfly/wildfly/compare/42.0.0.Beta1...42.0.0.Final