I have looked through the source code. It has several @deprecated in 
javadoc without @Deprecated
(in addition to HttpServletRequest#isRequestSessionIdFromUrl() from the 
previous email).
I plan to add @Deprecated to those class/methods as follows:
ServletContext: #getServlet(String name), #getServlets(), 
#getServletNames(), #log(Exception exception, String msg)
ServletRequestWrapper: #getRealPath(String path)
SingleThreadModel: (class level)
UnavailableException: (class level), UnavailableException(Servlet 
servlet, String msg), UnavailableException(int seconds, Servlet servlet, 
String msg)
HttpServletResponse: #encodeUrl(String url), #encodeRedirectUrl(String 
url), setStatus(int sc, String sm)
HttpServletResponseWrapper: #encodeUrl(String url), 
#encodeRedirectUrl(String url), setStatus(int sc, String sm)
HttpSession: #getSessionContext(), #getValue(String name), 
#getValueNames(), #putValue(String name, Object value), 
removeValue(String name)
HttpSessionContext: (class level), #getSession(String sessionId), #getIds()
HttpUtils: (class level)
Please let me know if there is any concern.
Thanks.
       Shing Wai Chan