In Eclipse Jetty, across various versions of "jetty-annotations", and "jetty-eeN-annotations", the Jakarta Spec authoritative url-pattern rules for mixed "@ServletSecurity" annotation, and "web.xml" defined "security-constraint" on the same "url-pattern" were not being applied if the "web.xml" had more than 1 "url-pattern" for a servlet, and had a "security-constraint" applying to only some of those "url-pattern" definitions.