Eclipse GlassFish 8.0.4 was released on 3rd August. It took us a little longer to write this post than we wanted, because there has been plenty of work going on since then. In fact, we are already working on GlassFish 8.0.5 and expect to release it very soon.
Still, 8.0.4 deserves a closer look. It is not a release with one flashy new API, but it brings a lot of improvements that make a real difference in everyday work: easier upgrades from GlassFish 7, much faster Jakarta Faces page rendering, important security fixes, and a few usability improvements.
That is the kind of work we like to see in a production platform. It may be less visible than a major new feature, but it saves time for developers and administrators, and makes applications safer and easier to run.
Easier upgrades from GlassFish 7
Some of our customers told us that moving from GlassFish 7.0.x to 7.1 was not completely straightforward. GlassFish already has an upgrade mechanism that we normally recommend, but it did not cover the move from the old JKS/JCEKS security stores to PKCS12. This left administrators with manual keystore and truststore conversion work, which is not something anyone wants to do without expert guidance.
GlassFish 8.0.4 fixes that. When you upgrade a domain from GlassFish 7.0.x, it now migrates the legacy JKS/JCEKS security stores to PKCS12 automatically. Domains containing a cluster can also be upgraded again, and the migrated domain-passwords.p12 file is synchronized to all instances.
We also plan to backport these improvements to GlassFish 7.1, so teams aiming to upgrade first to that release line can benefit as well. See the 8.0.4 release notes for the full upgrade details.
Security fixes that matter in production
For production deployments, security is very important. GlassFish 8.0.4 includes fixes in the core server and in bundled components.
The most serious issue is CVE-2026-12605 (9.6 CRITICAL) in the Admin Console. It involved a combination of CSRF and SSRF that could leak an admin token when the victim was already authenticated in the Admin Console. This is a good reason to upgrade if you expose or use the Admin Console.
We also upgraded Jackson to 2.22.1. This brings fixes for CVE-2026-59889 (6.5 MEDIUM) and CVE-2026-54515 (5.3 MEDIUM), both related to deserialization bypasses.
There is also a security fix in the Metro web services stack, affecting SAAJ, JAX-WS RI, and WSIT. Getting this fix into GlassFish required coordinated releases across several Eclipse Foundation projects. It is the kind of work that is easy to miss in a changelog, but it matters: security maintenance in a production server often depends on several projects moving together.
One of the nicest technical improvements in GlassFish 8.0.4 comes from an upgrade of the Mojarra component. The Mojarra team spent time doing detailed benchmarks and profiling across every phase of the JSF request lifecycle. In Mojarra 4.1.10, they then made a series of targeted changes based on what the measurements showed.
The final benchmark is a very good result: GlassFish 8.0.4 renders the tested JSF pages about three times faster than the previous version. The same benchmark shows that GlassFish now renders JSF pages as fast as WildFly, Payara, and Tomcat. It is a big gain for applications with complex JSF pages or many requests. We are very happy to see GlassFish users get this result as part of a normal GlassFish update, fully tested, with a minimal risk of regressions.
For the details, read Making Mojarra fast: a per-phase performance review by Mojarra core team member Bauke Scholtz. It explains the benchmark setup, profiling process, and the changes that produced the result.
A simpler CDI model for Jakarta REST
GlassFish 8.0.4 also makes Jakarta REST code a little nicer to write. Jakarta REST artifacts can now be injected with standard CDI @Inject out of the box, thanks to the bundled jersey-cdi-rs-inject module. Before this, developers often used the Jakarta REST-specific @Context annotation.
The Jakarta Platform does not require this everywhere yet, but the direction is clear. Jakarta REST plans to move away from @Context injection in favour of CDI. GlassFish already lets you replace @Context with @Inject in most cases.
This release also fixes handling of CDI stereotypes that carry @TransactionalrollbackOn and dontRollbackOn attributes.
Better Embedded GlassFish behaviour
Embedded GlassFish received a few useful improvements too. Deployment failures are now propagated correctly, so an application or test does not quietly continue when deployment has failed. The embedded distributions also now provide proper Javadoc and sources Maven artifacts which makes it easier to develop and debug applications in IDEs.
We also improved how temporary directories are handled. This was mainly a problem in non-standard cases, for example when test code stopped Embedded GlassFish but forgot to dispose of its instance. In that case, the temporary directory stayed behind as filesystem garbage. It was also readable by anyone who had access to the filesystem.
GlassFish now removes these directories through a JVM shutdown hook and creates them with access limited to the current user. It is a small change, but it keeps local development and CI environments tidier and protects temporary files better.
Community contributions make GlassFish stronger
GlassFish is not developed by OmniFish alone. We lead the project and provide commercial support, but the work is made stronger by contributors from the wider community. GlassFish 8.0.4 is a good example of that shared effort.
Bauke Scholtz helped make this release a very strong one for Jakarta Faces. His Mojarra performance work is behind the much faster JSF page rendering described above. GitHub contributor @renatsaf contributed many of the improvements and fixes in this release, including important work around Embedded GlassFish, CDI integration, and the upgrade path. Piotrek Żygieło also contributed to the release, and we are happy to welcome Patrik Duditš, who made his first contribution to GlassFish in 8.0.4.
A growing group of people improving GlassFish is good news for everyone who runs it. It brings more ideas, more improvements, and more people who care about keeping the server reliable and current.
A platform worth trusting
Eclipse GlassFish 8.0.4 is another step toward a more stable, secure, and pleasant platform to run. If you are already running GlassFish, update to 8.0.4 to get the security fixes and improvements. If you are looking at Jakarta EE platforms for a new project, GlassFish is worth a serious look. You get a modern Jakarta EE 11 platform, a growing community, and commercial support from people who work on the software every day.
Claims that GlassFish is not production-ready or supported are outdated and have not been true since 2022. Today, GlassFish is actively maintained and released frequently. OmniFish leads the development, makes sure the releases are fully tested, and provides commercial support by the core GlassFish engineers.
