Pin the Docker base images

[slominskir-coding-agent]

The Dockerfile used tomcat:11-jdk21 and gradle:9-jdk21-alpine, so each build took whatever versions were newest at the time:

• Tomcat: tests ran against 11.0.26, while production runs 11.0.10.
• Gradle: the image was built with Gradle 9.8, while the Gradle wrapper, used locally and in CI, pins 9.0.0.

This pins:

• tomcat:11.0.26-jdk21, the latest Tomcat 11 release and what the tests already ran on;
• gradle:9.0.0-jdk21-alpine, matching gradle-wrapper.properties.

Tomcat changes since 11.0.10 that matter for epics2web

From the Tomcat 11 changelog, WebSocket sections:

• 11.0.26, write timeouts now cover the whole message, and aren't lost when two writes share a timeout. That's what drops clients that stop reading (Quickly Drop clients not consuming messages #4, Stop session writers without an interrupt, so channels get destroyed #43; WEBSOCKET_SEND_TIMEOUT_SECONDS).
• 11.0.26, an automatic pong racing with the session closing no longer throws. This race got more likely now that the server pings clients and closes unresponsive ones (Ping WebSocket clients and close sessions that stop answering #39).
• 11.0.26, less CPU used sending the close message.
• 11.0.24 and 11.0.26, fixes to permessage-deflate, which browsers negotiate by default. These are on the receiving side, and client-to-server messages are small, so less likely to matter.
• 11.0.16, writing to a closed session throws IOException instead of IllegalStateException. epics2web already catches both.

The 16 patch releases also include security and connector fixes outside WebSocket.

Deployment

Production installs Tomcat separately, so this doesn't change it. Moving production from 11.0.10 to 11.0.26 would match what's tested.

Checks

With the pinned images:

• the image builds;
• the container reports Tomcat 11.0.26;
• all 22 integration tests pass.

Keeping pins current

The repository has no Dependabot configuration, so these pins will only change when someone updates them. A .github/dependabot.yml covering the docker and gradle ecosystems would open pull requests for new versions. I can add that separately if you'd like.

🤖 Generated with Claude Code