Apache Tommee is Java EE6 web profile certified. (edit)

Apache Tommee is not a new product, but a bundle of Tomcat and Apache Java EE projects (OpenEJB, OpenJPA,...) by the Apache OpenEJB team. The lot is certified as a Java EE 6 Web Profile server.
Tommee is pretty lean (24Mb) and can run embedded.
The server bundles a set of components, all Apache gear: 

EJB	OpenEJB
CDI	OpenWebBeans
JSP/servlet	Tomcat
JSF	MyFaces
JPA	OpenJPA
JTA	Geronimo Transaction
JavaMail	Geronimo JavaMail

Version 1.0 of Tommee was released on april 30th 2012.

standalone tomcat?

A returning topic here is wether you should always run apache httpd as a front end to tomcat for a website.
While apache is more feature rich (non-JVM technologies, URL rewriting, authentication features...) performance is fine on a standalone tomcat:

Java / web application security links

• Java security libraries and frameworks
• Java 6 SE Security
• JEE 5 tutorial security chapters
• Spring Security (formerly acegi)
•  Java security guidelines, vulnerabilities and assessment
• Open Web Application Security Project (OWASP)
• Web application top ten vulnerabilities
• Building Secure Web Applications and Web Services
• Code Review Guide
• Web Application Testing
• Center for Internet Security (CIS)
• apache web server
• tomcat
• U.S. DOD DISA (Defense Information Systems Agency) Security Technical Implementation Guides (STIGS)
• Security checklists (application development, webserver general, tomcat, weblogic, apache...)
• Web server STIG 


• JavaScript (GWT)

SpringSource relaxes maintenance policy

SpringSource is going through the growing pains of a free open source company going for money.
Venture Capitalists Benchmark (they're also in RedHat) and Accel invested $25.000.000 since may 2007, and these guys like to see some return.
Up to then, Interface 21, the company of Spring founder Rod Johnson, made its money mainly from consulting services.
By the end of 2007 the company got rebranded to SpringSource and since then their focus is on making money from the products (and maintenance contracts).
They started using their money to eat Covalent, an Apache support company and contributor. Covalent gave them access to support know how and teams. It also added leading public domain products like the apache webserver and tomcat to their portfolio.
In june SpringSource announced their own application server.
Since then they have been hauling over big heads from competing application server vendors on board: the BEA WebLogic product manager, the JBoss (now a RedHat subsidiary) COO...
They came up with a RedHat-like support policy, where you get major releases for free, but have to pay for minor releases.
After a storm of community protest they have now changed that: the community will get the latest and greatest binaries (source was and remains free), but paying customers get patches incorporated in older builds.
The new policy looks fair.
Still Spring is a one company product in contrast with the Java ecosystem where you have choice. The fact that this company is going commercial only makes the dependency stronger.