build: jakarta-ready dependencies (PR 1 of jakarta migration #861)

[ismisepaul]

PR 1 of the Jakarta migration (#861) — build config only

First sub-PR of the stacked javax.* → jakarta.* migration. Targets the integration branch feat/jakarta-migration, not dev.

What this changes (pom.xml + .env only)

• jakarta.servlet:jakarta.servlet-api:6.0.0 (was javax.servlet:javax.servlet-api:4.0.1)
• Jakarta JSTL 3.0 API + Glassfish impl (was jstl:jstl:1.2)
• org.eclipse.angus:angus-mail:2.0.3 (was com.sun.mail:javax.mail:1.6.2)
• Remove javax:javaee-api:8.0.1 — pulls the legacy javax.* namespace back onto the classpath
• Align Spring to 6.1.21 — spring-test (5.3.31), spring-core (6.0.2), spring-context (5.3.31) were inconsistent
• Remove spring-mock:2.0.8 — Spring 6 spring-test provides the Jakarta MockHttpServletRequest / MockServletConfig
• Remove fongo — unused (its only tests are @Disabled); rescue tracked in Modernize MongoDatabase off legacy com.mongodb.DB API + Testcontainers; rescue disabled MongoDatabaseIT tests #876
• .env Tomcat base image 9.0 → 10.1 (first Jakarta-namespace Tomcat)

⚠️ Expected: this does not compile on its own

Source still imports javax.* until the next sub-PR (OpenRewrite mechanical rename). CI will be red on this PR by design — it's intentionally isolated as a small, reviewable build-config delta. Green build returns once the stack is complete.

Scope target

Spring 6.1.x (Jakarta EE 9 / Servlet 6.0 / Tomcat 10.1), not Spring 7 — per discussion on #869.

Refs #861. Rescue of disabled Mongo tests: #876.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Build-configuration-only step toward the javax.* → jakarta.* migration by updating core dependencies to Jakarta-ready equivalents and aligning versions for the upcoming codebase rename work.

Changes:

• Replace legacy Java EE dependencies with Jakarta equivalents (Servlet 6.0, JSTL 3.0, Jakarta Mail via Angus) and remove javax:javaee-api.
• Align Spring dependencies to 6.1.21 and remove obsolete spring-mock and unused fongo.
• Bump the Tomcat Docker base tag to Tomcat 10.1 (Jakarta namespace).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
pom.xml	Updates dependencies to Jakarta-ready artifacts (Servlet/JSTL/Mail), aligns Spring versions, and removes legacy/unused test deps.
.env	Switches the Tomcat Docker tag to 10.1 to match the Jakarta servlet stack.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ismisepaul]

CI dispatch — Build and Test

Manually dispatched "Build and Test" against this branch (sub-PRs into feat/jakarta-migration don't auto-trigger CI; the workflow only fires pull_request on master/dev, but it has workflow_dispatch):

▶️ https://github.com/OWASP/SecurityShepherd/actions/runs/26981822455

⚠️ Expected red: PR 1 is build-config only — the source still imports javax.* on this branch, so it won't compile alone. The green signal is on #878 (PR 1 + PR 2 combined), which compiles.

[SeanDuggan]

JSTL: API jar is redundant alongside the impl

Both are added at compile scope:

jakarta.servlet.jsp.jstl-api
jakarta.servlet.jsp.jstl

Drop the API artifact, keep only the impl

[ismisepaul]

JSTL: API jar is redundant alongside the impl

I verified this and we do need both. The Glassfish impl declares jakarta.servlet.jsp.jstl-api at provided scope, and Maven doesn't propagate provided transitively or package it into the WAR. Resolving the impl alone:

$ mvn dependency:tree   # impl only, no explicit API
\- org.glassfish.web:jakarta.servlet.jsp.jstl:jar:3.0.1:compile
   (no API on the classpath)

Tomcat 10.1 doesn't ship JSTL (it only provides servlet/jsp/el), so the API has to be bundled in the WAR ourselves. Dropping it would give ClassNotFoundException on jakarta.servlet.jsp.jstl.* at JSP render time.