LoginSign Up
← Back to all sparks
W

WildFly

DEVOPS
Velocity2.5

Modular Jakarta EE application server for building and running Java applications

www.wildfly.org ↗

WildFly's quarterly train is really a stability ladder, and OIDC keeps climbing it

jakarta-eeoidcstability-levelsapp-serverjdk-baseline
◆Current state
WildFly is four majors into a metronomic release train — 38 through 41 in about eight months — where each cycle pairs a Beta with a Final roughly two weeks later that restates the same feature list. The substantive work splits cleanly in two: Jakarta EE 11 and MicroProfile spec implementations that land first in WildFly Preview, and an explicit stability ladder (preview to community to default) that individual features climb one release at a time. OIDC is the feature getting the most of that attention, with scope attributes, request/request_uri parameters, and logout each promoted across the last three cycles.
◆Where it's heading
The direction is consolidation rather than expansion: features already written are being graduated to supported status instead of new subsystems appearing. In parallel the runtime baseline is moving underneath users — 40.0.1 shipped container images for JDK 25 on UBI 10 and flagged it as the last release carrying JDK 17 images. Expect the EE 11 work now sitting in Preview to graduate into standard WildFly on the same ladder OIDC has been walking.
◆Prediction
WildFly 42 should ship container images on JDK 21 and JDK 25 only, with the remaining Preview-stability EE 11 integrations promoted toward default.

◆Recent moves

  1. 25d ago

    WildFly 41 promotes OIDC scope and request-object support

    The Final restates the feature set its Beta already carried two weeks earlier: OIDC scope attributes and request/request_uri parameters move to community stability, and the Maven plugin gains bootable-JAR packaging aimed at cloud deploys. It is another rung on the stability ladder rather than new capability.

    View source ↗
  2. 1mo ago

    WildFly 41 Beta adds transactions during graceful shutdown

    The originating build of the 41 cycle, where the feature list actually lands before the Final repeats it. Transaction handling during graceful shutdown reaches default stability, as does OIDC logout and TLS on the JGroups TCP transport — all promotions of work that already existed at lower stability.

    View source ↗
  3. 1mo ago

    WildFly 40.0.1 moves container images to JDK 25, drops JDK 17

    A patch release of dependency upgrades — Jackson, Netty, Infinispan, Galleon, HAL — with one operationally significant note attached: container images now target JDK 25 on UBI 10, and this is the last release publishing JDK 17 images. The runtime floor is moving even in a point release.

    View source ↗
  4. 2mo ago

    WildFly 40 lands Jakarta Pages 4.0 and WebSocket 2.2 in Preview

    The EE 11 buildout continues in the Preview distribution, adding Jakarta Pages 4.0, WebSocket 2.2 and Authorization 3.0 alongside the first Preview-level OIDC logout support. This is the staging half of the ladder — the same items reappear later as promotions to default.

    View source ↗
  5. 3mo ago

    WildFly 40 Beta fixes an Elytron brute-force CVE

    The 40 cycle's originating build, carrying the fix for CVE-2025-23368 (Elytron brute-force authentication) plus promotions of X-Forwarded rewriting and peer-based SSLContext delegation to default stability. As with the 41 pair, the Final two weeks later repeats this list.

    View source ↗
  6. 6mo ago

    WildFly 39.0.1 backports the Elytron brute-force CVE fix

    A maintenance release on the 39 line whose one item worth acting on is the CVE-2025-23368 backport; the rest is clustering test flakiness and session-handling fixes. It shows the project maintaining the previous major while the next one stages features in Preview.

    View source ↗