* OWASP + Github workflow updates
* Library updates
* Dependancy suppression cleanup
* #1667 PR Review updates, use NIST_NVD_API_KEY when available else use mirror for forks not configured, remove workflow_call for now since we don't on call
* WW-5653 docs: add Bootstrap 5.3.x sample-app migration design
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 docs: add Bootstrap 5 migration implementation plan
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 build: add Bootstrap 5, Bootstrap Icons, showcase jQuery webjars
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 feat(showcase): serve Bootstrap 5 and jQuery via webjars
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 fix(showcase): serve html5 demo Bootstrap CSS via webjar
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 feat(showcase): migrate navbar and top-level pages to Bootstrap 5
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 fix(showcase): migrate leftover Bootstrap 2 icon and fixed-navbar classes
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 feat(showcase): migrate tag-demo pages to Bootstrap 5
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 feat(showcase): migrate validation-demo pages to Bootstrap 5
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 feat(showcase): migrate fileupload and conversion pages to Bootstrap 5
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 feat(showcase): migrate wait, token and empmanager pages to Bootstrap 5
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 fix(showcase): remove BS3 carets and well class
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 fix(showcase): use ms-auto for right nav and add nav-link to Home
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 feat(rest-showcase): serve Bootstrap 5 CSS via webjars
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 feat(rest-showcase): migrate JSP markup to Bootstrap 5
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 fix(rest-showcase): migrate legacy BS2/BS3 grid classes to Bootstrap 5
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 fix(showcase): drop obsolete css/js excludePattern so webjar JS is served
The old struts.action.excludePattern whitelisted the vendored /styles/*.css
and /js/*.js layout for container serving. After moving Bootstrap/jQuery to
webjars under /static/webjars/**, the '.*/js/.*\.js' entry matched the webjar
JS path (e.g. bootstrap.bundle.min.js) and excluded it from Struts' static
handler, so it fell through to the container and 404'd. Remaining webapp assets
(prettify.js, main.css) are served via default-servlet fall-through.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 fix(samples): migrate remaining BS2/BS3 classes (tables, buttons, progress, forms, navbar)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 chore(showcase): comment out verbose debug loggers
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 fix(showcase): migrate Bootstrap 5 markup in ftl/vm/html templates
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 test(showcase): disable JS in FreeMarkerManagerTest for Bootstrap 5
HtmlUnit's JS engine cannot parse Bootstrap 5's ES6 (bootstrap.bundle.min.js
uses 'class'), and the decorator now serves it, so the default WebClient threw
on script error. The test only asserts server-rendered FreeMarker output, so
JavaScript is disabled (matching Html5TagExampleTest).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 fix(showcase): replace dead Bootstrap 2 form and alert classes
Migrate new-person.ftl form off BS2 control-group/controls/form-actions to
Bootstrap 5 (mb-3, form-label, form-control), and replace the dead alert-error
class with alert-danger across the showcase pages.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 test(showcase): make integration tests tolerate Bootstrap 5 under HtmlUnit
HtmlUnit 5.2.0 cannot parse Bootstrap 5's minified ES6 (bootstrap.bundle.min.js
uses 'class'), which broke the showcase HtmlUnit integration tests once the
decorator started serving the bundle.
- Add ParameterUtils.createWebClient() which disables throwExceptionOnScriptError,
and route all integration tests through it (they assert server-rendered output,
not Bootstrap's client-side behaviour).
- Load bootstrap.bundle.min.js with 'defer' so a page's own inline scripts (e.g.
the async chat demo) still execute before HtmlUnit hits the bundle's parse
error; defer is also the recommended real-browser loading strategy.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 test(showcase): poll for async chat result instead of fixed sleep
AsyncTest relied on a fixed Thread.sleep(4000) for the server-push chat
round-trip, which is not enough on slower/newer JVMs (reproduced failing on
JDK 25). Poll the result element for up to ~30s via waitForBackgroundJavaScript
instead, making the test robust across JVMs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 test(showcase): drive AsyncTest via HTTP instead of HtmlUnit
The browser-driven chat test was flaky on JDK 25 in CI: HtmlUnit's handling of
the async server-push long-poll timed out (message never rendered), even with
polling. The test's purpose is to validate the Servlet 3 async endpoints, which
needs no browser or JavaScript. Rewrite it to POST /async/sendMessage and read
/async/receiveNewMessages directly over HTTP and assert the JSON, making it
deterministic and independent of Bootstrap/HtmlUnit JS parsing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 fix(showcase): drop progressbar role from wait progress bar
Resolves a SonarCloud accessibility finding (S6819) introduced by the Bootstrap 5
migration. The BS5 progress component is styled on .progress/.progress-bar divs;
the role/aria attributes were newly added (the BS3 original had none), so removing
them clears the finding while keeping the Bootstrap 5 styling.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 fix(showcase): correct BS5 alert wrapper and drop stray table tag
Address Copilot review on PR #1793:
- decorators/main.jsp: the dismissible wrapper was a second .alert with no
variant while the variant class (alert-danger, etc.) stayed on the inner
<ul>, producing a nested, uncoloured alert box. Move the alert* classes
onto the wrapper and strip them from the <ul> so the wrapper is the single
alert container.
- orders-edit.jsp: remove the stray, unclosed <table> start tag before
</s:form> (pre-existing invalid markup carried over during the migration).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 fix(showcase): remove BS3 navbar-header wrapper and orphan dropdown-submenu
Clean up two leftover Bootstrap 3 artifacts in the showcase decorator navbar:
- Drop the `navbar-header` wrapper (no BS5 CSS behind it) and make the brand
and toggler direct children of the `.container-fluid` flex container
(justify-content: space-between), with the brand first per BS5 convention.
- Remove the empty, unclosed `<li class="dropdown-submenu">` orphan before the
first item in the Examples menu; BS5 has no dropdown-submenu feature.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 fix(showcase): replace soft-deprecated navbar-light with data-bs-theme
navbar-light is soft-deprecated in Bootstrap 5.3. Switch the showcase navbar
to the current data-bs-theme="light" idiom; bg-light is retained for the
background.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 fix(showcase): normalize page-header replacement to border-bottom utilities
A handful of showcase pages replaced the BS3 page-header with a bare <div>
while the rest used <div class="border-bottom pb-2 mb-3">. Normalize those 35
header wrappers to the same border-bottom pb-2 mb-3 utilities so all showcase
page headers render consistently.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5653 fix(rest-showcase): add mb-3 to page-header replacement
Align rest-showcase order page headers with the showcase standard by using
border-bottom pb-2 mb-3 (was border-bottom pb-2), so header spacing is
consistent across both sample apps.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5620 docs: add Log4j2 logging standardization design spec
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5620 docs: add Log4j2 logging standardization implementation plan
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5620 Migrate FinalizableReferenceQueue to Log4j2
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5620 Migrate AbstractDefaultToStringRenderable to Log4j2
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5620 Remove unused injectable j.u.l.Logger DI factory from ContainerBuilder
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5620 Remove dead first-party SLF4J dependency declarations
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5640 docs: design for WebJars support in Struts core
Adds first-class WebJars support so client-side libraries can be
referenced by a version-less logical path and served through the
existing static-content pipeline. Grounded against 7.2.x source.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5640 docs: implementation plan for WebJars support
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5640 build: add webjars-locator-lite dependency
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5640 feat: add webjars config constants and defaults
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5640 docs: correct plan test framework to JUnit 4
core uses JUnit 4 + AssertJ + Mockito, not JUnit 5 Jupiter (no
Jupiter engine on the classpath). Test tasks translate accordingly.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5640 feat: add WebJarUrlProvider resolution seam
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5640 feat: register WebJarUrlProvider bean
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5640 feat: extend static content-type map for webjar assets
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5640 feat: serve webjar assets via static content loader
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5640 feat: add <s:webjar> tag and <@s.webjar> macro
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5640 docs: add generated tag reference for <s:webjar>
Annotation-processor-generated tag reference (attributes + description),
tracked like every other tag's docs under core/src/site/resources/tags/.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5640 fix: address final review (log level, resolveUrl traversal test, javadoc)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5640 refactor: address SonarCloud code smells
- getContentType: replace long if/else chain with a static extension->
MIME map (S3776 cognitive complexity)
- DefaultWebJarUrlProvider.split: return Optional<String[]> instead of a
null sentinel (S1168; Optional fits the reject semantics, empty-array
would not)
- serving tests: rename local 'loader' -> 'webJarLoader' to stop hiding
the ContentTypeProbe field (S1117)
- WebJarTest: use assertThat(writer).hasToString(...) (S5838)
S110 (WebJarTag inheritance depth) is inherent to the Struts tag base
class hierarchy shared by every tag; left as-is.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5632 docs: add commons-fileupload2 milestone-hardening design spec
Design for hardening the commons-fileupload2 dependency against
milestone binary-incompatibility (manage -core, activate a scoped
enforcer rule, add a runtime API guard in AbstractMultiPartRequest).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5632 docs: add implementation plan for fileupload2 milestone hardening
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5632 build(deps): manage commons-fileupload2-core alongside jakarta-servlet6
Pin both commons-fileupload2 artifacts to a single
commons-fileupload2.version property so the volatile -core API can no
longer skew from -jakarta-servlet6 in the reactor.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5632 build: enforce a single commons-fileupload2 version
Activate maven-enforcer-plugin (previously dormant in pluginManagement)
with a fileupload-scoped bannedDependencies rule so any divergent
commons-fileupload2 version fails the build early.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5632 fix(fileupload): fail fast on incompatible commons-fileupload2 API
Verify once per JVM that the fileupload size-limit setters exist and
throw a clear StrutsException reporting the core/jakarta version skew,
replacing an opaque deep-stack NoSuchMethodError in downstream runtimes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* WW-5632 fix(fileupload): make API-verification guard static
Resolve Sonar java:S2696 (instance method writing a static field) by
making ensureFileUploadApiVerified() static; verification is JVM-global.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* chore(agents): defines a new AGENTS.md focused on reporting vulnerabilities
* chore(security): makes SECURITY.md the source of truth
* Fix typos in SECURITY.md and minor grammar correction
* chore(security): clarify public GitHub repo PoC counts as disclosure
Per @ppkarwasz review on #1680: expand the PoC bullet to make explicit
that pushing a PoC to a public GitHub repo, gist, fork, or branch is
public disclosure, and note that private repos require granting access
to each PMC member individually.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: René Gielen <rgielen@apache.org>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Lukasz Lenart