Up to and including tomcat 9.0.65, the report method of ErrorReportValve was invoked for all requests, and subclasses could then decide on the exact conditions when to report an error. The logic at the start of the report method of ErrorReportValve and JsonErrorReportValve was identical, so it was refactored into the invoke method of ErrorReportValve in 9.0.67. However, this changes the behavior of all custom subclasses of ErrorReportValve - their report method now only gets called if the response is explitcitly marked as error. The report method no longer gets called for responses with status code >= 400, but without a Throwable. There is no way to customize this behavior without copy-pasting the whole invoke method. It would be nice if the deduplicated code was not directly a part of the invoke method, but in a separate protected method that could be overridden by subclasses.
I agree this is an important nuance. Given this refactoring is not exactly super critical, I propose simply reverting it.
Ok, it's true that I hadn't considered this. I will simply revert it.
Thanks for the report. Fixed in: - 10.1.x for 10.1.2 onwards - 9.0.x for 9.0.69 onwards - 8.5.x for 8.5.84 onwards