Lukasz Lenart
7ce27107e2
WW-5668 Make the localized-text provider caches size-bounded and align request-locale resolution (6.x) ( #1823 )
...
* WW-5668 Add remove(key) to the OgnlCache abstraction
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com >
* WW-5668 Bound the localized-text provider caches with configurable size
Converts bundlesMap, messageFormats and missingBundles to the existing
OgnlCache abstraction, configurable via struts.i18n.cacheType and
struts.i18n.cacheMaxSize (wtlfu / 10000 by default). The caches are kept
transient and rebuilt in readObject so the providers stay serializable,
and bundlesMap-related synchronization moves to a dedicated monitor since
the field is now reassignable.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com >
* WW-5668 Add opt-in request-locale resolution consistency to Dispatcher
Adds struts.locale.validateRequestLocale (default false) so request-derived
locales can be restricted to the JVM's available-locale set, matching what
I18nInterceptor already applies to its own locale sources.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com >
* WW-5668 Keep the localized-text providers deserializable across a version upgrade
Pins serialVersionUID to the value implicitly computed for the pre-6.11.0 class
shape instead of 1L, so a session serialized by a 6.10.0 node still loads on a
6.11.0 one during a rolling upgrade rather than failing with InvalidClassException.
Such a stream carries no value for the new cache settings, and field initialisers
do not run during deserialization, so readObject restores their defaults before
rebuilding the caches - without that guard it failed with a NullPointerException.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com >
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com >
2026-08-01 11:55:00 +02:00
Lukasz Lenart
a1c8af5574
WW-5666 Apply input length limits consistently when reading request bodies (6.x) ( #1822 )
...
* WW-5666 fix(json): apply the input length limit while reading
* WW-5666 fix(core): bound the CSP report body read and make the limit configurable
CspReportAction read the submitted report body with a single readLine() and had
no limit of its own. Read it up to a limit instead, defaulting to 8192
characters and configurable through struts.csp.report.maxSize. A body above the
limit is discarded with a warning rather than processed.
The limit is injected when the action is built, before the interceptor stack
runs, because withServletRequest is invoked by the servletConfig interceptor
ahead of staticParams and params. Values that are not usable as a buffer size
are ignored with a warning.
2026-08-01 10:04:57 +02:00
dependabot[bot]
28657e5f29
build(deps): bump jackson.version from 2.22.0 to 2.22.1 ( #1790 )
...
Bumps `jackson.version` from 2.22.0 to 2.22.1.
Updates `com.fasterxml.jackson.core:jackson-core` from 2.22.0 to 2.22.1
- [Commits](https://github.com/FasterXML/jackson-core/compare/jackson-core-2.22.0...jackson-core-2.22.1 )
Updates `com.fasterxml.jackson.core:jackson-databind` from 2.22.0 to 2.22.1
- [Commits](https://github.com/FasterXML/jackson/commits )
Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-xml` from 2.22.0 to 2.22.1
- [Commits](https://github.com/FasterXML/jackson-dataformat-xml/compare/jackson-dataformat-xml-2.22.0...jackson-dataformat-xml-2.22.1 )
---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-core
dependency-version: 2.22.1
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: com.fasterxml.jackson.core:jackson-databind
dependency-version: 2.22.1
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-xml
dependency-version: 2.22.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 20:21:13 +02:00
dependabot[bot]
1b1981e987
build(deps-dev): bump commons-logging:commons-logging ( #1763 )
...
Bumps [commons-logging:commons-logging](https://github.com/apache/commons-logging ) from 1.3.6 to 1.4.0.
- [Changelog](https://github.com/apache/commons-logging/blob/master/RELEASE-NOTES.txt )
- [Commits](https://github.com/apache/commons-logging/compare/rel/commons-logging-1.3.6...rel/commons-logging-1.4.0 )
---
updated-dependencies:
- dependency-name: commons-logging:commons-logging
dependency-version: 1.4.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-12 11:38:07 +02:00
dependabot[bot]
1f16744114
build(deps): bump jackson.version from 2.21.4 to 2.22.0 ( #1746 )
...
Bumps `jackson.version` from 2.21.4 to 2.22.0.
Updates `com.fasterxml.jackson.core:jackson-core` from 2.21.4 to 2.22.0
- [Commits](https://github.com/FasterXML/jackson-core/compare/jackson-core-2.21.4...jackson-core-2.22.0 )
Updates `com.fasterxml.jackson.core:jackson-databind` from 2.21.4 to 2.22.0
- [Commits](https://github.com/FasterXML/jackson/commits )
Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-xml` from 2.21.4 to 2.22.0
- [Commits](https://github.com/FasterXML/jackson-dataformat-xml/compare/jackson-dataformat-xml-2.21.4...jackson-dataformat-xml-2.22.0 )
---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-core
dependency-version: 2.22.0
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: com.fasterxml.jackson.core:jackson-databind
dependency-version: 2.22.0
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-xml
dependency-version: 2.22.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-12 11:35:01 +02:00
dependabot[bot]
efda88b2bb
build(deps): bump log4j2.version from 2.26.0 to 2.26.1 ( #1772 )
...
Bumps `log4j2.version` from 2.26.0 to 2.26.1.
Updates `org.apache.logging.log4j:log4j-api` from 2.26.0 to 2.26.1
Updates `org.apache.logging.log4j:log4j-core` from 2.26.0 to 2.26.1
Updates `org.apache.logging.log4j:log4j-jcl` from 2.26.0 to 2.26.1
Updates `org.apache.logging.log4j:log4j-slf4j-impl` from 2.26.0 to 2.26.1
Updates `org.apache.logging.log4j:log4j-web` from 2.26.0 to 2.26.1
---
updated-dependencies:
- dependency-name: org.apache.logging.log4j:log4j-api
dependency-version: 2.26.1
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.apache.logging.log4j:log4j-core
dependency-version: 2.26.1
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.apache.logging.log4j:log4j-jcl
dependency-version: 2.26.1
dependency-type: direct:development
update-type: version-update:semver-patch
- dependency-name: org.apache.logging.log4j:log4j-slf4j-impl
dependency-version: 2.26.1
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.apache.logging.log4j:log4j-web
dependency-version: 2.26.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-09 09:24:44 +02:00
dependabot[bot]
28db4ac276
build(deps-dev): bump org.apache.maven.plugins:maven-failsafe-plugin ( #1764 )
...
Bumps [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire ) from 3.5.5 to 3.5.6.
- [Release notes](https://github.com/apache/maven-surefire/releases )
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.5...surefire-3.5.6 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin
dependency-version: 3.5.6
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-01 12:56:48 +02:00
dependabot[bot]
d46d581b07
build(deps): bump org.apache.maven.plugins:maven-dependency-plugin ( #1754 )
...
Bumps [org.apache.maven.plugins:maven-dependency-plugin](https://github.com/apache/maven-dependency-plugin ) from 3.10.0 to 3.11.0.
- [Release notes](https://github.com/apache/maven-dependency-plugin/releases )
- [Commits](https://github.com/apache/maven-dependency-plugin/compare/maven-dependency-plugin-3.10.0...maven-dependency-plugin-3.11.0 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-dependency-plugin
dependency-version: 3.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-26 07:17:57 +02:00
dependabot[bot]
bc369df815
build(deps-dev): bump org.jacoco:jacoco-maven-plugin ( #1750 )
...
Bumps [org.jacoco:jacoco-maven-plugin](https://github.com/jacoco/jacoco ) from 0.8.14 to 0.8.15.
- [Release notes](https://github.com/jacoco/jacoco/releases )
- [Commits](https://github.com/jacoco/jacoco/compare/v0.8.14...v0.8.15 )
---
updated-dependencies:
- dependency-name: org.jacoco:jacoco-maven-plugin
dependency-version: 0.8.15
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-26 07:17:14 +02:00
dependabot[bot]
d1b16a7657
build(deps): bump maven-surefire-plugin.version from 3.5.5 to 3.5.6 ( #1748 )
...
Bumps `maven-surefire-plugin.version` from 3.5.5 to 3.5.6.
Updates `org.apache.maven.surefire:surefire-junit47` from 3.5.5 to 3.5.6
Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.5.5 to 3.5.6
- [Release notes](https://github.com/apache/maven-surefire/releases )
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.5...surefire-3.5.6 )
---
updated-dependencies:
- dependency-name: org.apache.maven.surefire:surefire-junit47
dependency-version: 3.5.6
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
dependency-version: 3.5.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-26 07:16:42 +02:00
Lukasz Lenart
e2fa549b12
WW-5630 test(core): streamline ConfigParseUtilTest and convert to JUnit 4 ( #1741 )
...
Port of #1740 to 6.x: 12 overlapping cache tests collapsed to 5 focused
ones, JUnit 3 -> JUnit 4, dropped the ~80-class literal, reflection kept
only in the two size-bound tests. Also reorders the caffeine imports in
ConfigParseUtil to match alphabetical ordering. Production logic unchanged.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-14 18:36:28 +02:00
brianandle
b455d6a8d4
WW-5630 - Performance Issue SecurityMemberAccess ( #1721 ) ( #1736 )
...
* WW-5630 - Performance Issue SecurityMemberAccess
* Add size bound cache, 50, for Class lookup
* Add unit test
Code generated by Copilot
* WW-5630 - Add additional UT
* WW-5630 - Add UT for non-existent class
* WW-5630 - Review feedback changes
* Cache ClassLoader directly
* Use weakKeys and weakValues
* Comment on the ClassLookupException
* Additional Unit Tests
Assistance in coding using co-pilot
* WW-5630 - Additional review
* Limit outer, Classloader, to 25. Ensure memory bounding.
* Limit inner, Classes, to 50. Ensure memory bounding.
* Additional UTs
With co-pilot assitance
(cherry picked from commit 210dc86b88 )
2026-06-14 13:27:11 +02:00
Lukasz Lenart
f8d42eb023
Prepare for a new development cycle of Struts 6.11.0 ( #1739 )
...
* [maven-release-plugin] prepare release STRUTS_6_10_0
* [maven-release-plugin] prepare for next development iteration
2026-06-14 07:39:08 +00:00
dependabot[bot]
f9f69482c7
build(deps): bump asm.version from 9.10 to 9.10.1 ( #1728 )
...
Bumps `asm.version` from 9.10 to 9.10.1.
Updates `org.ow2.asm:asm` from 9.10 to 9.10.1
Updates `org.ow2.asm:asm-commons` from 9.10 to 9.10.1
---
updated-dependencies:
- dependency-name: org.ow2.asm:asm
dependency-version: 9.10.1
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.ow2.asm:asm-commons
dependency-version: 9.10.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-13 08:29:17 +02:00
dependabot[bot]
0b14f39a2f
build(deps): bump jackson.version from 2.21.3 to 2.21.4 ( #1727 )
...
Bumps `jackson.version` from 2.21.3 to 2.21.4.
Updates `com.fasterxml.jackson.core:jackson-core` from 2.21.3 to 2.21.4
- [Commits](https://github.com/FasterXML/jackson-core/compare/jackson-core-2.21.3...jackson-core-2.21.4 )
Updates `com.fasterxml.jackson.core:jackson-databind` from 2.21.3 to 2.21.4
- [Commits](https://github.com/FasterXML/jackson/commits )
Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-xml` from 2.21.3 to 2.21.4
- [Commits](https://github.com/FasterXML/jackson-dataformat-xml/compare/jackson-dataformat-xml-2.21.3...jackson-dataformat-xml-2.21.4 )
---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-core
dependency-version: 2.21.4
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: com.fasterxml.jackson.core:jackson-databind
dependency-version: 2.21.4
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-xml
dependency-version: 2.21.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-10 13:21:25 +02:00
dependabot[bot]
cf9b51669f
build(deps): bump org.owasp:dependency-check-maven from 12.2.0 to 12.2.2 ( #1726 )
...
Bumps [org.owasp:dependency-check-maven](https://github.com/dependency-check/DependencyCheck ) from 12.2.0 to 12.2.2.
- [Release notes](https://github.com/dependency-check/DependencyCheck/releases )
- [Changelog](https://github.com/dependency-check/DependencyCheck/blob/main/CHANGELOG.md )
- [Commits](https://github.com/dependency-check/DependencyCheck/compare/v12.2.0...v12.2.2 )
---
updated-dependencies:
- dependency-name: org.owasp:dependency-check-maven
dependency-version: 12.2.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-10 13:21:00 +02:00
dependabot[bot]
bf0a695dcc
build(deps-dev): bump org.apache.maven.plugins:maven-site-plugin ( #1718 )
...
Bumps [org.apache.maven.plugins:maven-site-plugin](https://github.com/apache/maven-site-plugin ) from 3.21.0 to 3.22.0.
- [Release notes](https://github.com/apache/maven-site-plugin/releases )
- [Commits](https://github.com/apache/maven-site-plugin/compare/maven-site-plugin-3.21.0...maven-site-plugin-3.22.0 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-site-plugin
dependency-version: 3.22.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-28 07:19:41 +02:00
dependabot[bot]
8b8838a55a
build(deps-dev): bump org.apache.maven.plugins:maven-assembly-plugin ( #1717 )
...
Bumps [org.apache.maven.plugins:maven-assembly-plugin](https://github.com/apache/maven-assembly-plugin ) from 3.7.1 to 3.8.0.
- [Release notes](https://github.com/apache/maven-assembly-plugin/releases )
- [Commits](https://github.com/apache/maven-assembly-plugin/compare/maven-assembly-plugin-3.7.1...v3.8.0 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-assembly-plugin
dependency-version: 3.8.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-28 07:19:29 +02:00
dependabot[bot]
bbb111db20
build(deps): bump jackson.version from 2.21.2 to 2.21.3 ( #1716 )
...
Bumps `jackson.version` from 2.21.2 to 2.21.3.
Updates `com.fasterxml.jackson.core:jackson-core` from 2.21.2 to 2.21.3
- [Commits](https://github.com/FasterXML/jackson-core/compare/jackson-core-2.21.2...jackson-core-2.21.3 )
Updates `com.fasterxml.jackson.core:jackson-databind` from 2.21.2 to 2.21.3
- [Commits](https://github.com/FasterXML/jackson/commits )
Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-xml` from 2.21.2 to 2.21.3
- [Commits](https://github.com/FasterXML/jackson-dataformat-xml/compare/jackson-dataformat-xml-2.21.2...jackson-dataformat-xml-2.21.3 )
---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-core
dependency-version: 2.21.3
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: com.fasterxml.jackson.core:jackson-databind
dependency-version: 2.21.3
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-xml
dependency-version: 2.21.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-28 07:19:16 +02:00
dependabot[bot]
ab08c59737
build(deps-dev): bump org.apache.maven.plugins:maven-enforcer-plugin ( #1715 )
...
Bumps [org.apache.maven.plugins:maven-enforcer-plugin](https://github.com/apache/maven-enforcer ) from 3.6.2 to 3.6.3.
- [Release notes](https://github.com/apache/maven-enforcer/releases )
- [Commits](https://github.com/apache/maven-enforcer/compare/enforcer-3.6.2...enforcer-3.6.3 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-enforcer-plugin
dependency-version: 3.6.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-28 07:19:03 +02:00
Lukasz Lenart
0db282a51a
pom(version): sets proper SNAPSHOT version ( #1709 )
2026-05-25 15:04:31 +00:00
Lukasz Lenart
aaf286afa8
WW-5623 fix(core): HTML-encode form action in PostbackResult to prevent XSS ( #1701 )
...
PostbackResult.doExecute() embeds finalLocation into a <form action="">
attribute via raw string concatenation. A double quote in the location
breaks out of the attribute, enabling reflected XSS. The response
Content-Type is text/html.
Form field names and values elsewhere in the same class are properly
URL-encoded via URLEncoder.encode(); the action attribute was not
encoded at all.
Wrap finalLocation with StringEscapeUtils.escapeHtml4() before embedding
it in the form tag, consistent with the encoding approach used in
DefaultActionProxy, Property, and TextProviderHelper.
Adds three regression tests in PostbackResultTest:
- testFormActionHtmlEscaping: XSS payload with attribute breakout
- testFormActionEscapesAllHtmlSpecialChars: covers ", &, <, >
- testFormActionCleanLocationUnchanged: regression for clean URLs
2026-05-25 16:38:20 +02:00
Lukasz Lenart
84ef60eae8
WW-5535 fix(core): enforce class-level HTTP method annotations for wildcard-resolved unannotated methods ( #1693 )
...
The WW-5535 change to DefaultActionProxy.resolveMethod() (which made
wildcard-resolved methods report isMethodSpecified()=true) interacted
with HttpMethodInterceptor's if/else-if so that the class-level
annotation branch became unreachable when the resolved method carried
no method-level annotation:
if (isMethodSpecified()) {
if (method has annotation) return doIntercept(method);
// unannotated method falls through silently
} else if (class has annotation) {
return doIntercept(class); // never reached when methodSpecified=true
}
Convert the else-if to a standalone if so the class-level check is
always evaluated as a fallback. Method-level annotations still take
precedence — they are checked first and return early.
Adds three tests:
- testWildcardResolvedUnannotatedMethodRespectsClassLevelAnnotation:
GET on a wildcard-resolved unannotated method is rejected when the
class is @AllowedHttpMethod(POST).
- testWildcardResolvedUnannotatedMethodAllowsPostWithClassLevelAnnotation:
POST on the same configuration succeeds.
- testWildcardResolvedExecuteRejectsGetThroughRealProxy: end-to-end
via a real DefaultActionProxy with <action name="Wild-*" method="{1}">,
resolving to ActionSupport.execute().
2026-05-25 16:38:04 +02:00
dependabot[bot]
fb35ed410c
build(deps): bump log4j2.version from 2.25.4 to 2.26.0 ( #1706 )
...
Bumps `log4j2.version` from 2.25.4 to 2.26.0.
Updates `org.apache.logging.log4j:log4j-api` from 2.25.4 to 2.26.0
Updates `org.apache.logging.log4j:log4j-core` from 2.25.4 to 2.26.0
Updates `org.apache.logging.log4j:log4j-jcl` from 2.25.4 to 2.26.0
Updates `org.apache.logging.log4j:log4j-slf4j-impl` from 2.25.4 to 2.26.0
Updates `org.apache.logging.log4j:log4j-web` from 2.25.4 to 2.26.0
---
updated-dependencies:
- dependency-name: org.apache.logging.log4j:log4j-api
dependency-version: 2.26.0
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.apache.logging.log4j:log4j-core
dependency-version: 2.26.0
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.apache.logging.log4j:log4j-jcl
dependency-version: 2.26.0
dependency-type: direct:development
update-type: version-update:semver-minor
- dependency-name: org.apache.logging.log4j:log4j-slf4j-impl
dependency-version: 2.26.0
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.apache.logging.log4j:log4j-web
dependency-version: 2.26.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-20 09:58:16 +02:00
dependabot[bot]
9abd02d961
build(deps): bump asm.version from 9.9.1 to 9.10 ( #1703 )
...
Bumps `asm.version` from 9.9.1 to 9.10.
Updates `org.ow2.asm:asm` from 9.9.1 to 9.10
Updates `org.ow2.asm:asm-commons` from 9.9.1 to 9.10
---
updated-dependencies:
- dependency-name: org.ow2.asm:asm
dependency-version: '9.10'
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.ow2.asm:asm-commons
dependency-version: '9.10'
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-20 09:56:17 +02:00
dependabot[bot]
59536d824a
build(deps): bump slf4j.version from 2.0.17 to 2.0.18 ( #1704 )
...
Bumps `slf4j.version` from 2.0.17 to 2.0.18.
Updates `org.slf4j:slf4j-api` from 2.0.17 to 2.0.18
Updates `org.slf4j:slf4j-simple` from 2.0.17 to 2.0.18
---
updated-dependencies:
- dependency-name: org.slf4j:slf4j-api
dependency-version: 2.0.18
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.slf4j:slf4j-simple
dependency-version: 2.0.18
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-20 09:26:54 +02:00
Lukasz Lenart
ca1b22d9be
Struts 6.9.0 ( #1662 )
...
* [maven-release-plugin] prepare release STRUTS_6_9_0
* [maven-release-plugin] prepare for next development iteration
2026-05-01 10:41:26 +02:00
Lukasz Lenart
59b5e47575
ci(scorecards): score cards analysis are only supported for default branch ( #1661 )
2026-04-10 07:13:17 +00:00
Lukasz Lenart
0e22570763
ci(struts6): adjust workflows to use the new branch names ( #1658 )
2026-04-10 08:23:04 +02:00
Lukasz Lenart
94e3ffd1e7
WW-5622 perf(core): cache Hibernate class presence to avoid repeated NoClassDefFoundError ( #1650 )
...
Detect Hibernate availability once at class-load time via Class.forName()
and short-circuit all Hibernate-related methods immediately when absent.
This eliminates repeated NoClassDefFoundError exceptions that cause
significant performance degradation in applications without Hibernate
on the classpath.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
2026-04-05 18:30:57 +02:00
Lukasz Lenart
b936fcbf8b
WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks ( #1643 )
...
Backport of apache/struts#1642 from Struts 7 to Struts 6.
Modern JDKs (7u45+) already protect against this attack with a built-in
64K entity expansion limit. These changes add defense-in-depth hardening
and remove unnecessary attack surface.
- Enable FEATURE_SECURE_PROCESSING in DomHelper SAX parser
- Enable FEATURE_SECURE_PROCESSING in DigesterDefinitionsReader
- Remove unused parseStringAsXML feature from StringAdapter to eliminate
a theoretical XML Entity Expansion vector
- Deprecate setParseStringAsXML() and getParseStringAsXML() for removal
- Add Billion Laughs protection tests for DomHelper and DigesterDefinitionsReader
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
2026-04-04 11:20:47 +02:00
dependabot[bot]
39c1e29958
build(deps): bump log4j2.version from 2.25.3 to 2.25.4 ( #1647 )
...
Bumps `log4j2.version` from 2.25.3 to 2.25.4.
Updates `org.apache.logging.log4j:log4j-api` from 2.25.3 to 2.25.4
Updates `org.apache.logging.log4j:log4j-core` from 2.25.3 to 2.25.4
Updates `org.apache.logging.log4j:log4j-jcl` from 2.25.3 to 2.25.4
Updates `org.apache.logging.log4j:log4j-slf4j-impl` from 2.25.3 to 2.25.4
Updates `org.apache.logging.log4j:log4j-web` from 2.25.3 to 2.25.4
---
updated-dependencies:
- dependency-name: org.apache.logging.log4j:log4j-api
dependency-version: 2.25.4
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.apache.logging.log4j:log4j-core
dependency-version: 2.25.4
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.apache.logging.log4j:log4j-jcl
dependency-version: 2.25.4
dependency-type: direct:development
update-type: version-update:semver-patch
- dependency-name: org.apache.logging.log4j:log4j-slf4j-impl
dependency-version: 2.25.4
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.apache.logging.log4j:log4j-web
dependency-version: 2.25.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-02 16:23:08 +02:00
Lukasz Lenart
6c0189560b
ci: fix nightly publishing on release/struts-6-8-x ( #1644 )
...
* ci: update Jenkinsfile branch guards from struts-6-7-x to struts-6-8-x
The Build Source & JavaDoc, Deploy Snapshot, and Upload nightlies stages
still referenced release/struts-6-7-x in their when conditions, causing
them to be skipped on every release/struts-6-8-x build. This prevented
6.9.0-SNAPSHOT artifacts from being published to nightlies.
Made-with: Cursor
* chore: add .metals, .bloop, and .vscode to .gitignore
Made-with: Cursor
2026-03-30 12:37:45 +02:00
Lukasz Lenart
0a8b111e36
WW-5537 fix(core): resolve classloader/memory leaks during Tomcat hot deployment ( #1631 )
...
* WW-5537 fix(core): resolve classloader/memory leaks during Tomcat hot deployment
Introduce InternalDestroyable interface with container-based discovery to
clean up static caches, daemon threads, and shared references that pin the
webapp classloader after undeploy. This prevents OutOfMemoryError (Metaspace)
on repeated hot deployments.
Changes:
- Add InternalDestroyable/ContextAwareDestroyable interfaces for cleanup hooks
- Clear OGNL, Component, ScopeInterceptor, DefaultFileManager static caches
- Stop FinalizableReferenceQueue daemon thread and null its classloader
- Clear FreeMarker template/introspection caches from ServletContext
- Replace ContainerHolder ThreadLocal with volatile to prevent thread-pool leaks
- Clear static dispatcherListeners list on Dispatcher cleanup
- Add JSONCacheDestroyable for json plugin cache cleanup
- Register all destroyables via struts-beans.xml / struts-plugin.xml
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
* WW-5537 chore(showcase): add log4j-web for proper Log4j2 lifecycle in Servlet container
Without log4j-web, Log4j2 SoftReferences delay classloader GC after undeploy.
The log4j-web module provides Log4jServletContextListener which ensures proper
Log4j2 shutdown during ServletContext destruction.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
* WW-5537 fix(core): use ThreadLocal with generation counter in ContainerHolder
Replace the volatile shared reference with a ThreadLocal backed by a volatile
generation counter. Per-request clear() only affects the current thread (safe
for concurrent requests and tests). On undeploy, invalidateAll() advances the
generation counter so idle pool threads detect staleness on next access and
self-clear, preventing classloader leaks without breaking test isolation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-29 07:17:44 +02:00
dependabot[bot]
696ee73b72
build(deps): bump org.apache.maven.doxia:doxia-module-markdown ( #1638 )
...
Bumps org.apache.maven.doxia:doxia-module-markdown from 2.0.0 to 2.1.0.
---
updated-dependencies:
- dependency-name: org.apache.maven.doxia:doxia-module-markdown
dependency-version: 2.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-27 13:08:32 +01:00
dependabot[bot]
be3db87b7f
build(deps): bump org.apache.maven.doxia:doxia-core from 2.0.0 to 2.1.0 ( #1636 )
...
Bumps [org.apache.maven.doxia:doxia-core](https://github.com/apache/maven-doxia ) from 2.0.0 to 2.1.0.
- [Release notes](https://github.com/apache/maven-doxia/releases )
- [Commits](https://github.com/apache/maven-doxia/compare/doxia-2.0.0...doxia-2.1.0 )
---
updated-dependencies:
- dependency-name: org.apache.maven.doxia:doxia-core
dependency-version: 2.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-27 13:07:54 +01:00
dependabot[bot]
bd93c1bc19
build(deps): bump jackson.version from 2.21.1 to 2.21.2 ( #1635 )
...
Bumps `jackson.version` from 2.21.1 to 2.21.2.
Updates `com.fasterxml.jackson.core:jackson-core` from 2.21.1 to 2.21.2
- [Commits](https://github.com/FasterXML/jackson-core/compare/jackson-core-2.21.1...jackson-core-2.21.2 )
Updates `com.fasterxml.jackson.core:jackson-databind` from 2.21.1 to 2.21.2
- [Commits](https://github.com/FasterXML/jackson/commits )
Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-xml` from 2.21.1 to 2.21.2
- [Commits](https://github.com/FasterXML/jackson-dataformat-xml/compare/jackson-dataformat-xml-2.21.1...jackson-dataformat-xml-2.21.2 )
---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-core
dependency-version: 2.21.2
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: com.fasterxml.jackson.core:jackson-databind
dependency-version: 2.21.2
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-xml
dependency-version: 2.21.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-27 13:07:16 +01:00
Lukasz Lenart
f644ea54e2
WW-5618 feat(json): add configurable limits to JSON plugin for DoS prevention ( #1626 )
...
Add configurable limits to the JSON plugin to prevent denial-of-service
attacks via malicious JSON payloads. Limits are enforced directly in the
existing JSONReader class without breaking backward compatibility (no
interface extraction or class renames).
New configurable constants (struts-plugin.xml defaults):
- struts.json.maxElements (10000) - per-container element count
- struts.json.maxDepth (64) - maximum nesting depth
- struts.json.maxLength (2097152) - maximum input length in chars
- struts.json.maxStringLength (262144) - maximum string value length
- struts.json.maxKeyLength (512) - maximum object key length
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-21 12:11:22 +01:00
Lukasz Lenart
0c47627910
WW-2963 fix(core): resolve default-action-ref via wildcard matching ( #1623 )
...
When a default-action-ref points to an action name that only exists as a
wildcard pattern (e.g. "movie-input" matching "movie-*"), the framework
now falls back to wildcard matching after the exact lookup fails.
Port of PR #1614 from Struts 7 to Struts 6.x.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-16 07:25:30 +01:00
Lukasz Lenart
bfebc3e4a1
WW-4428 feat(json): add java.time serialization and deserialization support ( #1616 )
...
- Add serialization support for LocalDate, LocalDateTime, LocalTime,
ZonedDateTime, OffsetDateTime, and Instant in DefaultJSONWriter
- Add deserialization support for the same types in JSONPopulator
- Support @JSON(format=...) custom formats for all temporal types
- Add Calendar deserialization support (was serialize-only)
- Add comprehensive tests including custom formats, null handling,
malformed input, and round-trip serialization/deserialization
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-12 08:43:08 +01:00
dependabot[bot]
5a90581033
build(deps-dev): bump commons-logging:commons-logging ( #1621 )
...
Bumps [commons-logging:commons-logging](https://github.com/apache/commons-logging ) from 1.3.5 to 1.3.6.
- [Changelog](https://github.com/apache/commons-logging/blob/master/RELEASE-NOTES.txt )
- [Commits](https://github.com/apache/commons-logging/compare/rel/commons-logging-1.3.5...rel/commons-logging-1.3.6 )
---
updated-dependencies:
- dependency-name: commons-logging:commons-logging
dependency-version: 1.3.6
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-11 13:29:50 +01:00
Lukasz Lenart
edd604a9c5
Sets a proper SNAPSHOT version before next release ( #1615 )
2026-03-09 10:24:37 +01:00
Lukasz Lenart
a0d4f21ad4
Simplifies branch namming patter ( #1605 )
2026-03-09 09:57:57 +01:00
Lukasz Lenart
df97ee23dc
fix(i18n): WW-5549 validate locale parameters against supportedLocale ( #1602 )
...
When supportedLocale is configured on I18nInterceptor, request_locale
and request_cookie_locale parameters were ignored because
AcceptLanguageLocaleHandler.find() matched the Accept-Language header
before session/cookie handlers checked their explicit locale parameters.
Additionally, stored locales (session/cookie) were never validated
against supportedLocale.
Changes:
- Add isLocaleSupported() helper to validate locales against config
- RequestLocaleHandler.find() now validates against supportedLocale
- AcceptLanguageLocaleHandler.find() checks request_only_locale first,
then falls back to Accept-Language matching
- SessionLocaleHandler.find() checks request_locale before super.find()
- CookieLocaleHandler.find() checks request_cookie_locale before
super.find()
- SessionLocaleHandler.read() discards stale session locales
- CookieLocaleHandler.read() discards stale cookie locales
Port of PR #1594 (bug fix only, no refactoring)
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-authored-by: Claude <noreply@anthropic.com >
2026-03-06 07:50:38 +01:00
Lukasz Lenart
66ea9eaf24
fix(core): WW-5535 enforce HTTP method annotations for wildcard actions ( #1593 )
...
DefaultActionProxy.resolveMethod() incorrectly set methodSpecified=false
for config-resolved methods (including wildcard-substituted ones), causing
HttpMethodInterceptor to skip method-level @HttpPost/@HttpGet annotation
checks. Move methodSpecified=false inside the inner if block so it only
applies when truly defaulting to "execute".
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-authored-by: Claude <noreply@anthropic.com >
2026-02-27 13:26:06 +01:00
dependabot[bot]
66e02ba621
build(deps-dev): bump org.apache.maven.plugins:maven-failsafe-plugin ( #1601 )
...
Bumps [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire ) from 3.5.4 to 3.5.5.
- [Release notes](https://github.com/apache/maven-surefire/releases )
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.4...surefire-3.5.5 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin
dependency-version: 3.5.5
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-25 09:00:20 +01:00
dependabot[bot]
0e16915b4f
build(deps): bump maven-surefire-plugin.version from 3.5.4 to 3.5.5 ( #1600 )
...
Bumps `maven-surefire-plugin.version` from 3.5.4 to 3.5.5.
Updates `org.apache.maven.surefire:surefire-junit47` from 3.5.4 to 3.5.5
Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.5.4 to 3.5.5
- [Release notes](https://github.com/apache/maven-surefire/releases )
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.4...surefire-3.5.5 )
---
updated-dependencies:
- dependency-name: org.apache.maven.surefire:surefire-junit47
dependency-version: 3.5.5
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
dependency-version: 3.5.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-25 09:00:10 +01:00
dependabot[bot]
7b99d9eacb
build(deps): bump jackson.version from 2.21.0 to 2.21.1 ( #1599 )
...
Bumps `jackson.version` from 2.21.0 to 2.21.1.
Updates `com.fasterxml.jackson.core:jackson-core` from 2.21.0 to 2.21.1
- [Commits](https://github.com/FasterXML/jackson-core/compare/jackson-core-2.21.0...jackson-core-2.21.1 )
Updates `com.fasterxml.jackson.core:jackson-databind` from 2.21.0 to 2.21.1
- [Commits](https://github.com/FasterXML/jackson/commits )
Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-xml` from 2.21.0 to 2.21.1
- [Commits](https://github.com/FasterXML/jackson-dataformat-xml/compare/jackson-dataformat-xml-2.21.0...jackson-dataformat-xml-2.21.1 )
---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-core
dependency-version: 2.21.1
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: com.fasterxml.jackson.core:jackson-databind
dependency-version: 2.21.1
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-xml
dependency-version: 2.21.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-25 09:00:00 +01:00
brianandle
d4a549672f
WW-5616 - JakartaStreamMultiPartRequest warns on file delete if the file doesnt exist ( #1591 )
...
* Pull aspects into alignment with main/7.x+ AbstractMultiPartRequest.java
* Update JakartaMultiPartRequest and JakartaStreamMultiPartRequest to use isFile()
* Update cleanup text to mirror main/7.x+
2026-02-22 08:40:15 +01:00
Lukasz Lenart
4b2915682d
fix(convention): WW-4421 detect duplicate @Action names when execute() is annotated ( #1590 )
...
The duplicate @Action name detection in PackageBasedActionConfigBuilder
was embedded inside a conditional block that only ran when execute() was
NOT annotated with @Action. This meant two methods could map to the same
action name silently when execute() had an @Action annotation, with one
overwriting the other non-deterministically.
Extract the duplicate check to run unconditionally before the conditional
block, so it applies to all annotated methods regardless of whether
execute() is annotated.
Backport of apache/struts#1579 from Struts 7.x to 6.x.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-authored-by: Claude <noreply@anthropic.com >
2026-02-21 18:18:27 +01:00
Lukasz Lenart
18d6e77bf2
WW-5514: Make ProxyUtil cache configurable via struts constants ( #1573 )
...
* fix(ognl): make ProxyUtil cache configurable via struts constants
Makes the ProxyUtil cache type configurable through Struts constants,
allowing applications to use BASIC cache type (default) without
requiring Caffeine as a mandatory dependency.
New configuration properties:
- struts.proxy.cacheType: basic (default), lru, or wtlfu
- struts.proxy.cacheMaxSize: 10000 (default)
Fixes WW-5514
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude <noreply@anthropic.com >
* refactor(ognl): use LazyRef for proxy caches and reset on factory change
Extract lazy initialization into reusable LazyRef<T> utility with
double-checked locking and reset support. ProxyUtil.setProxyCacheFactory()
now resets both caches so they are recreated with the new factory,
fixing the bug where caches were never refreshed after factory changes.
Default proxy cache type changed from 'basic' to 'wtlfu' for consistency
with expression and beanInfo caches. Fix @since version to 6.9.0.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude <noreply@anthropic.com >
---------
Co-authored-by: Claude <noreply@anthropic.com >
2026-02-21 18:17:39 +01:00
dependabot[bot]
2bd1b60802
build(deps): bump org.apache.maven.plugins:maven-dependency-plugin ( #1576 )
...
Bumps [org.apache.maven.plugins:maven-dependency-plugin](https://github.com/apache/maven-dependency-plugin ) from 3.9.0 to 3.10.0.
- [Release notes](https://github.com/apache/maven-dependency-plugin/releases )
- [Commits](https://github.com/apache/maven-dependency-plugin/compare/maven-dependency-plugin-3.9.0...maven-dependency-plugin-3.10.0 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-dependency-plugin
dependency-version: 3.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-12 18:52:58 +02:00
Kusal Kithul-Godage
43b83731b7
Merge pull request #1565 from apache/WW-5610-extend-forwards-compat
...
WW-5610 Extend Struts 7 forwards compat to more interceptors
2026-02-12 21:59:28 +11:00
Lukasz Lenart
122dec4d73
feat(conversion): WW-4291 allow Spring bean names for type converters ( #1564 )
...
Implement two-phase processing for conversion properties to enable
Spring bean name resolution in struts-conversion.properties files.
The issue was a timing problem: type converters were processed during
bootstrap phase before SpringObjectFactory was available. Now:
- Early phase: process struts-default-conversion.properties (class names)
- Late phase: process user properties when SpringObjectFactory is ready
Changes:
- Add UserConversionPropertiesProvider interface for late initialization
- Add UserConversionPropertiesProcessor to trigger late phase processing
- Split StrutsConversionPropertiesProcessor.init() into early/late phases
- Register new beans in DefaultConfiguration and struts-beans.xml
- Add alias in StrutsBeanSelectionProvider for dependency injection
- Improve JavaDocs for BeanSelectionProvider classes
Closes WW-4291
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-authored-by: Claude <noreply@anthropic.com >
2026-02-06 07:44:06 +01:00
dependabot[bot]
2907291ef7
build(deps): bump org.owasp:dependency-check-maven from 12.1.9 to 12.2.0 ( #1527 )
...
Bumps [org.owasp:dependency-check-maven](https://github.com/dependency-check/DependencyCheck ) from 12.1.9 to 12.2.0.
- [Release notes](https://github.com/dependency-check/DependencyCheck/releases )
- [Changelog](https://github.com/dependency-check/DependencyCheck/blob/main/CHANGELOG.md )
- [Commits](https://github.com/dependency-check/DependencyCheck/compare/v12.1.9...v12.2.0 )
---
updated-dependencies:
- dependency-name: org.owasp:dependency-check-maven
dependency-version: 12.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-02 19:56:44 +01:00
dependabot[bot]
7065af8304
build(deps): bump jackson.version from 2.20.1 to 2.21.0 ( #1550 )
...
Bumps `jackson.version` from 2.20.1 to 2.21.0.
Updates `com.fasterxml.jackson.core:jackson-core` from 2.20.1 to 2.21.0
- [Commits](https://github.com/FasterXML/jackson-core/compare/jackson-core-2.20.1...jackson-core-2.21.0 )
Updates `com.fasterxml.jackson.core:jackson-databind` from 2.20.1 to 2.21.0
- [Commits](https://github.com/FasterXML/jackson/commits )
Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-xml` from 2.20.1 to 2.21.0
- [Commits](https://github.com/FasterXML/jackson-dataformat-xml/compare/jackson-dataformat-xml-2.20.1...jackson-dataformat-xml-2.21.0 )
---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-core
dependency-version: 2.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: com.fasterxml.jackson.core:jackson-databind
dependency-version: 2.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-xml
dependency-version: 2.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-02 19:50:51 +01:00
dependabot[bot]
08fe3a2267
build(deps): bump org.apache.commons:commons-text from 1.12.0 to 1.15.0 ( #1549 )
...
Bumps [org.apache.commons:commons-text](https://github.com/apache/commons-text ) from 1.12.0 to 1.15.0.
- [Changelog](https://github.com/apache/commons-text/blob/master/RELEASE-NOTES.txt )
- [Commits](https://github.com/apache/commons-text/compare/rel/commons-text-1.12.0...rel/commons-text-1.15.0 )
---
updated-dependencies:
- dependency-name: org.apache.commons:commons-text
dependency-version: 1.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-02 19:43:30 +01:00
dependabot[bot]
ff496c8850
build(deps): bump org.assertj:assertj-core from 3.27.6 to 3.27.7 ( #1560 )
...
Bumps [org.assertj:assertj-core](https://github.com/assertj/assertj ) from 3.27.6 to 3.27.7.
- [Release notes](https://github.com/assertj/assertj/releases )
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.6...assertj-build-3.27.7 )
---
updated-dependencies:
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-02 18:51:32 +01:00
Kusal Kithul-Godage
87d8feaa8f
WW-5610 Extend Struts 7 forwards compat to more interceptors
2026-02-02 18:27:01 +11:00
Lukasz Lenart
a5b736b488
chore(conf): skips scans if PR created by Dependabot ( #1554 )
2026-01-26 16:21:39 +01:00
dependabot[bot]
55ed8629fe
build(deps): bump org.apache.velocity:velocity-engine-core ( #1546 )
...
Bumps org.apache.velocity:velocity-engine-core from 2.3 to 2.4.1.
---
updated-dependencies:
- dependency-name: org.apache.velocity:velocity-engine-core
dependency-version: 2.4.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-26 12:00:20 +01:00
dependabot[bot]
a3820104d1
build(deps): bump commons-beanutils:commons-beanutils ( #1544 )
...
Bumps commons-beanutils:commons-beanutils from 1.9.4 to 1.11.0.
---
updated-dependencies:
- dependency-name: commons-beanutils:commons-beanutils
dependency-version: 1.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-26 11:57:28 +01:00
dependabot[bot]
984383023b
build(deps-dev): bump org.apache.maven.plugins:maven-wrapper-plugin ( #1542 )
...
Bumps [org.apache.maven.plugins:maven-wrapper-plugin](https://github.com/apache/maven-wrapper ) from 3.3.3 to 3.3.4.
- [Release notes](https://github.com/apache/maven-wrapper/releases )
- [Commits](https://github.com/apache/maven-wrapper/compare/maven-wrapper-3.3.3...maven-wrapper-3.3.4 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-wrapper-plugin
dependency-version: 3.3.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-26 10:24:25 +01:00
dependabot[bot]
ba6572eab1
build(deps-dev): bump org.codehaus.mojo:versions-maven-plugin ( #1535 )
...
Bumps [org.codehaus.mojo:versions-maven-plugin](https://github.com/mojohaus/versions ) from 2.20.1 to 2.21.0.
- [Release notes](https://github.com/mojohaus/versions/releases )
- [Changelog](https://github.com/mojohaus/versions/blob/master/ReleaseNotes.md )
- [Commits](https://github.com/mojohaus/versions/compare/2.20.1...2.21.0 )
---
updated-dependencies:
- dependency-name: org.codehaus.mojo:versions-maven-plugin
dependency-version: 2.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-20 13:11:55 +01:00
dependabot[bot]
921f07f091
build(deps): bump org.apache.maven.plugins:maven-source-plugin ( #1532 )
...
Bumps [org.apache.maven.plugins:maven-source-plugin](https://github.com/apache/maven-source-plugin ) from 3.3.1 to 3.4.0.
- [Release notes](https://github.com/apache/maven-source-plugin/releases )
- [Commits](https://github.com/apache/maven-source-plugin/compare/maven-source-plugin-3.3.1...maven-source-plugin-3.4.0 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-source-plugin
dependency-version: 3.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-20 10:39:13 +01:00
dependabot[bot]
6e15fbde32
build(deps-dev): bump commons-validator:commons-validator ( #1523 )
...
Bumps [commons-validator:commons-validator](https://github.com/apache/commons-validator ) from 1.10.0 to 1.10.1.
- [Changelog](https://github.com/apache/commons-validator/blob/master/RELEASE-NOTES.txt )
- [Commits](https://github.com/apache/commons-validator/compare/rel/commons-validator-1.10.0...rel/commons-validator-1.10.1 )
---
updated-dependencies:
- dependency-name: commons-validator:commons-validator
dependency-version: 1.10.1
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-14 19:19:51 +01:00
Lukasz Lenart
c60670b22b
WW-5602 fix StreamResult contentCharSet handling ( #1511 )
...
Evaluates contentCharSet expression before emptiness check to prevent
malformed content-type headers when expression evaluates to null.
- Parse contentCharSet expression first, then check if result is empty
- Use StringUtils.isNotEmpty() for proper null/empty validation
- Use setCharacterEncoding() instead of appending to content-type string
- Add test for null-evaluating charset expressions
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-authored-by: Claude <noreply@anthropic.com >
2026-01-14 19:18:27 +01:00
dependabot[bot]
6d20e33a37
build(deps): bump io.github.x-stream:mxparser from 1.2.1 to 1.2.3 ( #1517 )
...
Bumps [io.github.x-stream:mxparser](https://github.com/x-stream/mxparser ) from 1.2.1 to 1.2.3.
- [Changelog](https://github.com/x-stream/mxparser/blob/master/changes.xml )
- [Commits](https://github.com/x-stream/mxparser/compare/v-1.2.1...v-1.2.3 )
---
updated-dependencies:
- dependency-name: io.github.x-stream:mxparser
dependency-version: 1.2.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-12 19:26:49 +01:00
dependabot[bot]
43330ec5c5
build(deps): bump org.easymock:easymock from 5.4.0 to 5.6.0 ( #1520 )
...
Bumps [org.easymock:easymock](https://github.com/easymock/easymock ) from 5.4.0 to 5.6.0.
- [Release notes](https://github.com/easymock/easymock/releases )
- [Changelog](https://github.com/easymock/easymock/blob/master/ReleaseNotes.md )
- [Commits](https://github.com/easymock/easymock/compare/easymock-5.4.0...easymock-5.6.0 )
---
updated-dependencies:
- dependency-name: org.easymock:easymock
dependency-version: 5.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-12 19:26:23 +01:00
dependabot[bot]
752c00f1ae
build(deps): bump org.apache.maven.plugins:maven-war-plugin ( #1519 )
...
Bumps [org.apache.maven.plugins:maven-war-plugin](https://github.com/apache/maven-war-plugin ) from 3.4.0 to 3.5.1.
- [Release notes](https://github.com/apache/maven-war-plugin/releases )
- [Commits](https://github.com/apache/maven-war-plugin/compare/maven-war-plugin-3.4.0...maven-war-plugin-3.5.1 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-war-plugin
dependency-version: 3.5.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-12 19:25:59 +01:00
Lukasz Lenart
f3408b756d
Merge pull request #1516 from apache/dependabot/maven/release/struts-6-8-x/commons-logging-commons-logging-1.3.5
...
build(deps-dev): bump commons-logging:commons-logging from 1.3.4 to 1.3.5
2026-01-12 19:25:42 +01:00
dependabot[bot]
1a17211d05
build(deps-dev): bump commons-logging:commons-logging
...
Bumps commons-logging:commons-logging from 1.3.4 to 1.3.5.
---
updated-dependencies:
- dependency-name: commons-logging:commons-logging
dependency-version: 1.3.5
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-01-12 17:52:27 +00:00
dependabot[bot]
d955721e17
build(deps): bump org.codehaus.mojo:exec-maven-plugin ( #1509 )
...
Bumps [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin ) from 3.6.2 to 3.6.3.
- [Release notes](https://github.com/mojohaus/exec-maven-plugin/releases )
- [Commits](https://github.com/mojohaus/exec-maven-plugin/compare/3.6.2...3.6.3 )
---
updated-dependencies:
- dependency-name: org.codehaus.mojo:exec-maven-plugin
dependency-version: 3.6.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-12 18:41:04 +01:00
dependabot[bot]
7f96a4f16e
build(deps): bump org.codehaus.mojo:versions-maven-plugin ( #1501 )
...
Bumps [org.codehaus.mojo:versions-maven-plugin](https://github.com/mojohaus/versions ) from 2.17.1 to 2.20.1.
- [Release notes](https://github.com/mojohaus/versions/releases )
- [Changelog](https://github.com/mojohaus/versions/blob/master/ReleaseNotes.md )
- [Commits](https://github.com/mojohaus/versions/compare/2.17.1...2.20.1 )
---
updated-dependencies:
- dependency-name: org.codehaus.mojo:versions-maven-plugin
dependency-version: 2.20.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-29 13:36:20 +01:00
dependabot[bot]
4982e61f09
build(deps): bump org.owasp:dependency-check-maven from 10.0.4 to 12.1.9 ( #1500 )
...
Bumps [org.owasp:dependency-check-maven](https://github.com/dependency-check/DependencyCheck ) from 10.0.4 to 12.1.9.
- [Release notes](https://github.com/dependency-check/DependencyCheck/releases )
- [Changelog](https://github.com/dependency-check/DependencyCheck/blob/main/CHANGELOG.md )
- [Commits](https://github.com/dependency-check/DependencyCheck/compare/v10.0.4...v12.1.9 )
---
updated-dependencies:
- dependency-name: org.owasp:dependency-check-maven
dependency-version: 12.1.9
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-29 13:36:08 +01:00
dependabot[bot]
71048d41a5
build(deps): bump org.apache.maven.plugins:maven-release-plugin ( #1499 )
...
Bumps [org.apache.maven.plugins:maven-release-plugin](https://github.com/apache/maven-release ) from 3.3.0 to 3.3.1.
- [Release notes](https://github.com/apache/maven-release/releases )
- [Commits](https://github.com/apache/maven-release/compare/maven-release-3.3.0...maven-release-3.3.1 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-release-plugin
dependency-version: 3.3.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-29 13:35:54 +01:00
dependabot[bot]
e8640b21f1
build(deps): bump asm.version from 9.9 to 9.9.1 ( #1495 )
...
Bumps `asm.version` from 9.9 to 9.9.1.
Updates `org.ow2.asm:asm` from 9.9 to 9.9.1
Updates `org.ow2.asm:asm-commons` from 9.9 to 9.9.1
---
updated-dependencies:
- dependency-name: org.ow2.asm:asm
dependency-version: 9.9.1
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.ow2.asm:asm-commons
dependency-version: 9.9.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-29 11:23:43 +01:00
dependabot[bot]
daa9e9c9e1
build(deps): bump org.apache.maven.plugins:maven-site-plugin ( #1494 )
...
Bumps [org.apache.maven.plugins:maven-site-plugin](https://github.com/apache/maven-site-plugin ) from 3.20.0 to 3.21.0.
- [Release notes](https://github.com/apache/maven-site-plugin/releases )
- [Commits](https://github.com/apache/maven-site-plugin/compare/maven-site-plugin-3.20.0...maven-site-plugin-3.21.0 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-site-plugin
dependency-version: 3.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-29 11:23:08 +01:00
dependabot[bot]
07d5533cd6
build(deps): bump log4j2.version from 2.25.2 to 2.25.3 ( #1486 )
...
Bumps `log4j2.version` from 2.25.2 to 2.25.3.
Updates `org.apache.logging.log4j:log4j-api` from 2.25.2 to 2.25.3
Updates `org.apache.logging.log4j:log4j-core` from 2.25.2 to 2.25.3
Updates `org.apache.logging.log4j:log4j-jcl` from 2.25.2 to 2.25.3
Updates `org.apache.logging.log4j:log4j-slf4j-impl` from 2.25.2 to 2.25.3
---
updated-dependencies:
- dependency-name: org.apache.logging.log4j:log4j-api
dependency-version: 2.25.3
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.apache.logging.log4j:log4j-core
dependency-version: 2.25.3
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.apache.logging.log4j:log4j-jcl
dependency-version: 2.25.3
dependency-type: direct:development
update-type: version-update:semver-patch
- dependency-name: org.apache.logging.log4j:log4j-slf4j-impl
dependency-version: 2.25.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-23 09:36:21 +01:00
Ryan J Murphy
b490e2c2fc
Merge pull request #1445 from ryanmurf/multipartCleanup
...
WW-5573 Multipart stream file cleanup
2025-12-11 12:48:13 +01:00
Lukasz Lenart
d5bff6aef8
Merge pull request #1466 from apache/dependabot/maven/release/struts-6-8-x/org.apache.maven.plugins-maven-failsafe-plugin-3.5.4
...
Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.1 to 3.5.4
2025-12-11 12:47:41 +01:00
Lukasz Lenart
69ccd406fe
Merge pull request #1462 from apache/dependabot/maven/release/struts-6-8-x/org.awaitility-awaitility-4.3.0
...
Bump org.awaitility:awaitility from 4.2.2 to 4.3.0
2025-12-11 12:47:21 +01:00
dependabot[bot]
9afee9994d
Bump org.awaitility:awaitility from 4.2.2 to 4.3.0
...
Bumps [org.awaitility:awaitility](https://github.com/awaitility/awaitility ) from 4.2.2 to 4.3.0.
- [Changelog](https://github.com/awaitility/awaitility/blob/master/changelog.txt )
- [Commits](https://github.com/awaitility/awaitility/compare/awaitility-4.2.2...awaitility-4.3.0 )
---
updated-dependencies:
- dependency-name: org.awaitility:awaitility
dependency-version: 4.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-12-11 10:44:01 +00:00
Lukasz Lenart
7d7060896b
Merge pull request #1458 from apache/release/struts-6-7-x
...
Merges changes from older release branch
2025-12-11 11:33:22 +01:00
dependabot[bot]
e37b68570f
Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.1 to 3.5.4
...
Bumps [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire ) from 3.5.1 to 3.5.4.
- [Release notes](https://github.com/apache/maven-surefire/releases )
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.1...surefire-3.5.4 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin
dependency-version: 3.5.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-12-11 10:22:39 +00:00
dependabot[bot]
80739da117
Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.20.0 ( #1455 )
...
Bumps org.apache.commons:commons-lang3 from 3.17.0 to 3.20.0.
---
updated-dependencies:
- dependency-name: org.apache.commons:commons-lang3
dependency-version: 3.20.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-11 10:26:46 +01:00
dependabot[bot]
c8b1d0e2f2
Bump org.apache.maven.plugins:maven-release-plugin from 3.1.1 to 3.3.0 ( #1454 )
...
Bumps [org.apache.maven.plugins:maven-release-plugin](https://github.com/apache/maven-release ) from 3.1.1 to 3.3.0.
- [Release notes](https://github.com/apache/maven-release/releases )
- [Commits](https://github.com/apache/maven-release/compare/maven-release-3.1.1...maven-release-3.3.0 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-release-plugin
dependency-version: 3.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-10 12:25:39 +01:00
dependabot[bot]
e5d835bc19
Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.5.0 to 3.6.2 ( #1453 )
...
Bumps [org.apache.maven.plugins:maven-enforcer-plugin](https://github.com/apache/maven-enforcer ) from 3.5.0 to 3.6.2.
- [Release notes](https://github.com/apache/maven-enforcer/releases )
- [Commits](https://github.com/apache/maven-enforcer/compare/enforcer-3.5.0...enforcer-3.6.2 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-enforcer-plugin
dependency-version: 3.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-10 12:25:21 +01:00
dependabot[bot]
4997040be4
Bump maven-surefire-plugin.version from 3.5.1 to 3.5.4 ( #1452 )
...
Bumps `maven-surefire-plugin.version` from 3.5.1 to 3.5.4.
Updates `org.apache.maven.surefire:surefire-junit47` from 3.5.1 to 3.5.4
Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.5.1 to 3.5.4
- [Release notes](https://github.com/apache/maven-surefire/releases )
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.1...surefire-3.5.4 )
---
updated-dependencies:
- dependency-name: org.apache.maven.surefire:surefire-junit47
dependency-version: 3.5.4
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
dependency-version: 3.5.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-10 12:25:02 +01:00
dependabot[bot]
5d648a62bf
Bump org.apache.rat:apache-rat-plugin from 0.15 to 0.17 ( #1436 )
...
* Bump org.apache.rat:apache-rat-plugin from 0.15 to 0.17
Bumps org.apache.rat:apache-rat-plugin from 0.15 to 0.17.
---
updated-dependencies:
- dependency-name: org.apache.rat:apache-rat-plugin
dependency-version: '0.17'
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
* Updates exclusions
* Cleans up files with missing header
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Lukasz Lenart <lukaszlenart@apache.org >
2025-12-07 09:33:05 +01:00
dependabot[bot]
52dba77dc0
Bump org.jfree:jfreechart from 1.5.5 to 1.5.6 ( #1440 )
...
Bumps [org.jfree:jfreechart](https://github.com/jfree/jfreechart ) from 1.5.5 to 1.5.6.
- [Release notes](https://github.com/jfree/jfreechart/releases )
- [Commits](https://github.com/jfree/jfreechart/compare/v1.5.5...v1.5.6 )
---
updated-dependencies:
- dependency-name: org.jfree:jfreechart
dependency-version: 1.5.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-01 06:55:32 +01:00
dependabot[bot]
1fcfc42ab2
Bump log4j2.version from 2.25.1 to 2.25.2 ( #1437 )
...
Bumps `log4j2.version` from 2.25.1 to 2.25.2.
Updates `org.apache.logging.log4j:log4j-api` from 2.25.1 to 2.25.2
Updates `org.apache.logging.log4j:log4j-core` from 2.25.1 to 2.25.2
Updates `org.apache.logging.log4j:log4j-jcl` from 2.25.1 to 2.25.2
Updates `org.apache.logging.log4j:log4j-slf4j-impl` from 2.25.1 to 2.25.2
---
updated-dependencies:
- dependency-name: org.apache.logging.log4j:log4j-api
dependency-version: 2.25.2
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.apache.logging.log4j:log4j-core
dependency-version: 2.25.2
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.apache.logging.log4j:log4j-jcl
dependency-version: 2.25.2
dependency-type: direct:development
update-type: version-update:semver-patch
- dependency-name: org.apache.logging.log4j:log4j-slf4j-impl
dependency-version: 2.25.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-01 06:54:13 +01:00
Lukasz Lenart
cae08102d5
Removes unused jaxb-core dependency ( #1434 )
2025-11-28 08:44:15 +01:00
dependabot[bot]
a810da1397
Bump com.sun.xml.bind:jaxb-core from 2.3.0.1 to 4.0.6 ( #1429 )
...
Bumps com.sun.xml.bind:jaxb-core from 2.3.0.1 to 4.0.6.
---
updated-dependencies:
- dependency-name: com.sun.xml.bind:jaxb-core
dependency-version: 4.0.6
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-26 19:07:26 +01:00
dependabot[bot]
0489abde40
Bump org.jacoco:jacoco-maven-plugin from 0.8.12 to 0.8.14 ( #1428 )
...
Bumps [org.jacoco:jacoco-maven-plugin](https://github.com/jacoco/jacoco ) from 0.8.12 to 0.8.14.
- [Release notes](https://github.com/jacoco/jacoco/releases )
- [Commits](https://github.com/jacoco/jacoco/compare/v0.8.12...v0.8.14 )
---
updated-dependencies:
- dependency-name: org.jacoco:jacoco-maven-plugin
dependency-version: 0.8.14
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-24 07:18:34 +01:00
dependabot[bot]
96006ab4ff
Bump org.apache.maven.plugins:maven-dependency-plugin ( #1426 )
...
Bumps [org.apache.maven.plugins:maven-dependency-plugin](https://github.com/apache/maven-dependency-plugin ) from 3.8.0 to 3.9.0.
- [Release notes](https://github.com/apache/maven-dependency-plugin/releases )
- [Commits](https://github.com/apache/maven-dependency-plugin/compare/maven-dependency-plugin-3.8.0...maven-dependency-plugin-3.9.0 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-dependency-plugin
dependency-version: 3.9.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-24 07:18:05 +01:00
dependabot[bot]
d9b84bc89e
Bump jackson.version from 2.20.0 to 2.20.1 ( #1412 )
...
Bumps `jackson.version` from 2.20.0 to 2.20.1.
Updates `com.fasterxml.jackson.core:jackson-core` from 2.20.0 to 2.20.1
- [Commits](https://github.com/FasterXML/jackson-core/compare/jackson-core-2.20.0...jackson-core-2.20.1 )
Updates `com.fasterxml.jackson.core:jackson-databind` from 2.20.0 to 2.20.1
- [Commits](https://github.com/FasterXML/jackson/commits )
Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-xml` from 2.20.0 to 2.20.1
- [Commits](https://github.com/FasterXML/jackson-dataformat-xml/compare/jackson-dataformat-xml-2.20.0...jackson-dataformat-xml-2.20.1 )
---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-core
dependency-version: 2.20.1
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: com.fasterxml.jackson.core:jackson-databind
dependency-version: 2.20.1
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-xml
dependency-version: 2.20.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-17 07:57:35 +01:00
dependabot[bot]
7003406d4c
Bump org.codehaus.mojo:exec-maven-plugin from 3.4.1 to 3.6.2 ( #1411 )
...
Bumps [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin ) from 3.4.1 to 3.6.2.
- [Release notes](https://github.com/mojohaus/exec-maven-plugin/releases )
- [Commits](https://github.com/mojohaus/exec-maven-plugin/compare/3.4.1...3.6.2 )
---
updated-dependencies:
- dependency-name: org.codehaus.mojo:exec-maven-plugin
dependency-version: 3.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-17 07:56:47 +01:00
dependabot[bot]
8d935b1394
Bump com.thoughtworks.xstream:xstream from 1.4.20 to 1.4.21 ( #1408 )
...
Bumps [com.thoughtworks.xstream:xstream](https://github.com/x-stream/xstream ) from 1.4.20 to 1.4.21.
- [Release notes](https://github.com/x-stream/xstream/releases )
- [Commits](https://github.com/x-stream/xstream/commits )
---
updated-dependencies:
- dependency-name: com.thoughtworks.xstream:xstream
dependency-version: 1.4.21
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-17 07:54:56 +01:00
dependabot[bot]
f053c78db2
Bump asm.version from 9.7.1 to 9.9 ( #1393 )
...
Bumps `asm.version` from 9.7.1 to 9.9.
Updates `org.ow2.asm:asm` from 9.7.1 to 9.9
Updates `org.ow2.asm:asm-commons` from 9.7.1 to 9.9
---
updated-dependencies:
- dependency-name: org.ow2.asm:asm
dependency-version: '9.9'
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.ow2.asm:asm-commons
dependency-version: '9.9'
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-27 06:51:55 +01:00
dependabot[bot]
e805bb389f
Bump org.freemarker:freemarker from 2.3.33 to 2.3.34 ( #1386 )
...
Bumps org.freemarker:freemarker from 2.3.33 to 2.3.34.
---
updated-dependencies:
- dependency-name: org.freemarker:freemarker
dependency-version: 2.3.34
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-27 06:49:41 +01:00
dependabot[bot]
eb7a0804b8
Bump commons-validator:commons-validator from 1.9.0 to 1.10.0 ( #1385 )
...
Bumps commons-validator:commons-validator from 1.9.0 to 1.10.0.
---
updated-dependencies:
- dependency-name: commons-validator:commons-validator
dependency-version: 1.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-27 06:48:12 +01:00
dependabot[bot]
e07612b762
Bump org.assertj:assertj-core from 3.27.4 to 3.27.6 ( #1387 )
...
Bumps [org.assertj:assertj-core](https://github.com/assertj/assertj ) from 3.27.4 to 3.27.6.
- [Release notes](https://github.com/assertj/assertj/releases )
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.6 )
---
updated-dependencies:
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-19 19:13:17 +02:00
Lukasz Lenart
f92b2372bf
Merge pull request #1369 from apache/dependabot/maven/release/struts-6-7-x/org.apache.maven.doxia-doxia-module-markdown-2.0.0
...
Bump org.apache.maven.doxia:doxia-module-markdown from 1.12.0 to 2.0.0
2025-09-29 08:23:33 +02:00
dependabot[bot]
e5e535b01a
Bump org.apache.maven.doxia:doxia-module-markdown from 1.12.0 to 2.0.0
...
Bumps org.apache.maven.doxia:doxia-module-markdown from 1.12.0 to 2.0.0.
---
updated-dependencies:
- dependency-name: org.apache.maven.doxia:doxia-module-markdown
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-09-29 01:36:07 +00:00
Lukasz Lenart
39c3df3032
Merge pull request #1356 from apache/dependabot/maven/release/struts-6-7-x/org.apache.maven.plugins-maven-failsafe-plugin-3.5.4
...
Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.1 to 3.5.4
2025-09-28 11:51:33 +02:00
dependabot[bot]
730d553664
Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.1 to 3.5.4
...
Bumps [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire ) from 3.5.1 to 3.5.4.
- [Release notes](https://github.com/apache/maven-surefire/releases )
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.1...surefire-3.5.4 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin
dependency-version: 3.5.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-09-22 01:36:06 +00:00
Lukasz Lenart
34e279e6d7
[maven-release-plugin] prepare for next development iteration
2025-09-15 07:46:27 +02:00
Lukasz Lenart
80225c7169
[maven-release-plugin] prepare release STRUTS_6_8_0
2025-09-15 07:46:18 +02:00
Lukasz Lenart
6b2de2df4a
WW-5504 Allows to use request instead of session attribute to store nonce ( #1174 )
2025-09-15 07:13:24 +02:00
Lukasz Lenart
15e257d075
Merge pull request #1345 from apache/dependabot/maven/release/struts-6-7-x/org.assertj-assertj-core-3.27.4
...
Bump org.assertj:assertj-core from 3.26.3 to 3.27.4
2025-09-15 07:12:26 +02:00
Lukasz Lenart
daf2f51721
Merge pull request #1344 from apache/dependabot/maven/release/struts-6-7-x/org.apache.commons-commons-compress-1.28.0
...
WW-5571 Bump org.apache.commons:commons-compress from 1.27.1 to 1.28.0
2025-09-15 07:12:00 +02:00
Lukasz Lenart
440dfe8c6d
Merge pull request #1343 from apache/dependabot/maven/release/struts-6-7-x/org.apache.maven.plugins-maven-project-info-reports-plugin-3.9.0
...
Bump org.apache.maven.plugins:maven-project-info-reports-plugin from 3.7.0 to 3.9.0
2025-09-15 07:10:30 +02:00
Lukasz Lenart
a016d50b53
Merge pull request #1342 from apache/dependabot/maven/release/struts-6-7-x/org.apache.commons-commons-collections4-4.5.0
...
WW-5570 Bump org.apache.commons:commons-collections4 from 4.4 to 4.5.0
2025-09-15 07:09:59 +02:00
dependabot[bot]
d718290ad1
Bump org.assertj:assertj-core from 3.26.3 to 3.27.4
...
Bumps [org.assertj:assertj-core](https://github.com/assertj/assertj ) from 3.26.3 to 3.27.4.
- [Release notes](https://github.com/assertj/assertj/releases )
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.26.3...assertj-build-3.27.4 )
---
updated-dependencies:
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.4
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-09-15 01:37:30 +00:00
dependabot[bot]
2f73fc9ccf
Bump org.apache.commons:commons-compress from 1.27.1 to 1.28.0
...
Bumps [org.apache.commons:commons-compress](https://github.com/apache/commons-compress ) from 1.27.1 to 1.28.0.
- [Changelog](https://github.com/apache/commons-compress/blob/master/RELEASE-NOTES.txt )
- [Commits](https://github.com/apache/commons-compress/compare/rel/commons-compress-1.27.1...rel/commons-compress-1.28.0 )
---
updated-dependencies:
- dependency-name: org.apache.commons:commons-compress
dependency-version: 1.28.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-09-15 01:36:18 +00:00
dependabot[bot]
d054d638b6
Bump org.apache.maven.plugins:maven-project-info-reports-plugin
...
Bumps [org.apache.maven.plugins:maven-project-info-reports-plugin](https://github.com/apache/maven-project-info-reports-plugin ) from 3.7.0 to 3.9.0.
- [Release notes](https://github.com/apache/maven-project-info-reports-plugin/releases )
- [Commits](https://github.com/apache/maven-project-info-reports-plugin/compare/maven-project-info-reports-plugin-3.7.0...maven-project-info-reports-plugin-3.9.0 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-project-info-reports-plugin
dependency-version: 3.9.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-09-15 01:35:59 +00:00
dependabot[bot]
399ec92c4a
Bump org.apache.commons:commons-collections4 from 4.4 to 4.5.0
...
Bumps org.apache.commons:commons-collections4 from 4.4 to 4.5.0.
---
updated-dependencies:
- dependency-name: org.apache.commons:commons-collections4
dependency-version: 4.5.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-09-15 01:34:36 +00:00
Lukasz Lenart
c58fe8bfb9
Merge pull request #1334 from apache/dependabot/maven/release/struts-6-7-x/jackson.version-2.20.0
...
WW-5568 Bump jackson.version from 2.18.0 to 2.20.0
2025-09-10 10:56:56 +02:00
Lukasz Lenart
aa56c07972
Merge pull request #1337 from apache/dependabot/maven/release/struts-6-7-x/org.apache.maven.plugins-maven-wrapper-plugin-3.3.3
...
Bump org.apache.maven.plugins:maven-wrapper-plugin from 3.3.2 to 3.3.3
2025-09-10 10:24:19 +02:00
Lukasz Lenart
5148a9f088
Merge pull request #1335 from apache/dependabot/maven/release/struts-6-7-x/slf4j.version-2.0.17
...
Bump slf4j.version from 2.0.16 to 2.0.17
2025-09-10 10:23:47 +02:00
dependabot[bot]
f743b18e19
Bump jackson.version from 2.18.0 to 2.20.0
...
Bumps `jackson.version` from 2.18.0 to 2.20.0.
Updates `com.fasterxml.jackson.core:jackson-core` from 2.18.0 to 2.20.0
- [Commits](https://github.com/FasterXML/jackson-core/compare/jackson-core-2.18.0...jackson-core-2.20.0 )
Updates `com.fasterxml.jackson.core:jackson-databind` from 2.18.0 to 2.20.0
- [Commits](https://github.com/FasterXML/jackson/commits )
Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-xml` from 2.18.0 to 2.20.0
- [Commits](https://github.com/FasterXML/jackson-dataformat-xml/compare/jackson-dataformat-xml-2.18.0...jackson-dataformat-xml-2.20.0 )
---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-core
dependency-version: 2.20.0
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: com.fasterxml.jackson.core:jackson-databind
dependency-version: 2.20.0
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-xml
dependency-version: 2.20.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-09-10 08:22:31 +00:00
Lukasz Lenart
b674e32cbe
Merge pull request #1330 from apache/dependabot/maven/release/struts-6-7-x/log4j2.version-2.25.1
...
WW-5567 Bump log4j2.version from 2.24.1 to 2.25.1
2025-09-10 10:21:18 +02:00
dependabot[bot]
862013273b
Bump org.apache.maven.plugins:maven-wrapper-plugin from 3.3.2 to 3.3.3
...
Bumps [org.apache.maven.plugins:maven-wrapper-plugin](https://github.com/apache/maven-wrapper ) from 3.3.2 to 3.3.3.
- [Release notes](https://github.com/apache/maven-wrapper/releases )
- [Commits](https://github.com/apache/maven-wrapper/compare/maven-wrapper-3.3.2...maven-wrapper-3.3.3 )
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-wrapper-plugin
dependency-version: 3.3.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-09-10 06:03:37 +00:00
dependabot[bot]
d92509fc29
Bump slf4j.version from 2.0.16 to 2.0.17
...
Bumps `slf4j.version` from 2.0.16 to 2.0.17.
Updates `org.slf4j:slf4j-api` from 2.0.16 to 2.0.17
Updates `org.slf4j:slf4j-simple` from 2.0.16 to 2.0.17
---
updated-dependencies:
- dependency-name: org.slf4j:slf4j-api
dependency-version: 2.0.17
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.slf4j:slf4j-simple
dependency-version: 2.0.17
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-09-10 06:03:31 +00:00
dependabot[bot]
e11ea4778f
Bump log4j2.version from 2.24.1 to 2.25.1
...
Bumps `log4j2.version` from 2.24.1 to 2.25.1.
Updates `org.apache.logging.log4j:log4j-api` from 2.24.1 to 2.25.1
Updates `org.apache.logging.log4j:log4j-core` from 2.24.1 to 2.25.1
Updates `org.apache.logging.log4j:log4j-jcl` from 2.24.1 to 2.25.1
Updates `org.apache.logging.log4j:log4j-slf4j-impl` from 2.24.1 to 2.25.1
---
updated-dependencies:
- dependency-name: org.apache.logging.log4j:log4j-api
dependency-version: 2.25.1
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.apache.logging.log4j:log4j-core
dependency-version: 2.25.1
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.apache.logging.log4j:log4j-jcl
dependency-version: 2.25.1
dependency-type: direct:development
update-type: version-update:semver-minor
- dependency-name: org.apache.logging.log4j:log4j-slf4j-impl
dependency-version: 2.25.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-09-10 06:03:16 +00:00
Lukasz Lenart
0649b5686b
Merge pull request #1328 from apache/WW-5564-fileupload
...
WW-5564 Upgrades commons-fileupload to version 1.6.0
2025-09-10 08:02:32 +02:00
Lukasz Lenart
272797f764
Fixes .ads.yaml to use proper structure for checks
2025-09-10 07:38:43 +02:00
Lukasz Lenart
03cbbdba90
WW-5564 Upgrades commons-fileupload to version 1.6.0
2025-09-10 07:35:21 +02:00
Lukasz Lenart
1460c482c3
Merge pull request #1317 from apache/feature/WW-5511-removes-addCspHeaders
...
WW-5511 Removes deprecated addCspHeaders method
2025-09-02 08:16:56 +02:00
Lukasz Lenart
ea97930474
WW-5511 Removes deprecated addCspHeaders method
2025-08-22 08:35:26 +02:00
Lukasz Lenart
f25321661f
Merge pull request #1316 from apache/fix/WW-5524-converter-factory-s6
...
WW-5524 Fixup StrutsConverterFactory - Struts 6
2025-08-20 07:13:37 +02:00
Martin Ashby
a92568423e
Fixup StrutsConverterFactory
...
It should delegate back to ObjectFactory#buildBean instead of directly
calling Container#inject, otherwise overrides of buildBean in subclasses
of ObjectFactory e.g. SpringObjectFactory are skipped; meaning that
TypeConverters cannot make use of Spring dependency injection
Fixes: https://issues.apache.org/jira/projects/WW/issues/WW-5524
2025-08-20 06:48:31 +02:00
Lukasz Lenart
036c4ddb74
Merge pull request #1306 from apache/fix/clean-uploaded-files
...
Cleans up all uploaded files
2025-08-18 16:55:41 +02:00
Lukasz Lenart
831568929c
Cleans up all uploaded files
2025-08-06 13:46:15 +02:00
Lukasz Lenart
84a51cce0e
WW-5546 Fixes NPE when uploaded file is empty ( #1262 )
2025-05-06 20:48:24 +02:00
Lukasz Lenart
0f61944d64
WW-5544 Marks ReflectionContextFactory as deprecated and uses ActionContext instead ( #1254 )
2025-04-27 15:59:19 +02:00
Lukasz Lenart
ca4e07cead
[maven-release-plugin] prepare for next development iteration
2025-02-20 13:20:56 +01:00
Lukasz Lenart
8fb9aba74b
[maven-release-plugin] prepare release STRUTS_6_7_4
2025-02-20 13:20:46 +01:00
Lukasz Lenart
c45664a330
Merge pull request #1226 from apache/fix/WW-5529-maxlength-s6
...
WW-5529 Adds autogenerated files with updated desc
2025-02-20 13:05:57 +01:00
Lukasz Lenart
91c9314176
WW-5529 Adds autogenerated files with updated desc
2025-02-20 12:21:58 +01:00
Kusal Kithul-Godage
a4e9902d94
Merge pull request #1225 from apache/WW-5531-jre8-compat
...
WW-5531 Enforce JRE8 compatibility (when compiled on JDK9+)
2025-02-20 17:22:42 +11:00
Kusal Kithul-Godage
fe5b197738
WW-5531 Enforce JRE8 compatibility (when compiled on JDK9+)
2025-02-20 16:23:10 +11:00
Lukasz Lenart
87e322dbe2
[maven-release-plugin] prepare for next development iteration
2025-02-17 11:34:19 +01:00
Lukasz Lenart
7909f43237
[maven-release-plugin] prepare release STRUTS_6_7_3
2025-02-17 11:34:11 +01:00
Lukasz Lenart
1fe822cca0
WW-5529 Drops unused misleading setter setMaxLength in favour of setMaxlength ( #1221 ) ( #1222 )
2025-02-17 10:27:04 +01:00
Kusal Kithul-Godage
ef90b3ba3c
Merge pull request #1220 from apache/WW-5525-proxyutil-npe-67
...
6.7: WW-5525 Fix NPE in ProxyUtil for SecurityMemberAccess originating static members
2025-02-17 19:11:21 +11:00
Lukasz Lenart
d35ec15c76
WW-5525 Fixes NPE when checking if expressions is acceptable
...
(cherry picked from commit 9fee06cea0 )
2025-02-17 18:57:27 +11:00
Kusal Kithul-Godage
583b174fe6
WW-5525 Fix NPE in ProxyUtil for SecurityMemberAccess originating static members
2025-02-17 18:57:27 +11:00
Lukasz Lenart
9b044377ac
WW-5501 Reverts all changes related to WW-5501 ( #1218 )
...
* Reverts all changes related to WW-5501
* Fixes CodeQL scan by using proper versions of actions
* WW-5501 Uses FilenameUtils instead of a custom code
2025-02-16 12:05:49 +01:00
Kusal Kithul-Godage
58f37babbf
Merge pull request #1215 from apache/WW-5528-multipart-illegal-char-errors-67
2025-02-09 23:44:10 +11:00
Kusal Kithul-Godage
fe3dd6ba9f
WW-5528 Ensure multipart upload illegal characters reported as error
2025-02-07 12:40:42 +11:00
Lukasz Lenart
7a77c7a82c
[maven-release-plugin] prepare for next development iteration
2025-02-04 07:39:44 +01:00
Lukasz Lenart
5038a9209f
[maven-release-plugin] prepare release STRUTS_6_7_2
2025-02-04 07:39:35 +01:00
Lukasz Lenart
2135ebf651
WW-5501 Ignores DMI related action field ( #1211 )
2025-02-04 06:47:43 +01:00
Kusal Kithul-Godage
c0dd8dd80c
Merge pull request #1210 from apache/WW-5516-attrmap-npe-67
2025-02-04 01:19:16 +11:00
Kusal Kithul-Godage
c36eafa37a
WW-5516 Fix AttributeMap NPE when PageContext has no request
2025-02-04 01:00:36 +11:00
Lukasz Lenart
07603b9591
[maven-release-plugin] prepare for next development iteration
2025-02-02 10:16:30 +01:00
Lukasz Lenart
3227d5929a
[maven-release-plugin] prepare release STRUTS_6_7_1
2025-02-02 10:16:20 +01:00
Lukasz Lenart
4a8ddbb274
Merge pull request #1202 from apache/fix/bom-version
...
Defines proper snapshot version for BOM
2025-02-02 10:10:35 +01:00
Lukasz Lenart
67ba458d03
Defines proper snapshot version for BOM
2025-02-02 10:00:09 +01:00
Lukasz Lenart
959b2182b2
Merge pull request #1195 from apache/fix/proper-version
...
Defines proper snapshot version
2025-01-24 08:28:32 +01:00
Lukasz Lenart
6de93e77db
Defines proper snapshot version
2025-01-24 07:58:39 +01:00
Lukasz Lenart
59dc9301e0
Merge pull request #1194 from apache/fix/jenkinsfile-67x
...
Simplifies Jenkinsfile to build Struts 6.x
2025-01-22 08:18:56 +01:00
Lukasz Lenart
2fc4a822a4
Simplifies Jenkinsfile to build Struts 6.x
2025-01-22 07:52:34 +01:00
Kusal Kithul-Godage
6a6270f62a
Merge pull request #1190 from apache/WW-5516-fix-temp-theme-fallback
...
WW-5516 Fix TemplateDir and Theme fallback to Request/Session/Application attributes
2025-01-22 13:24:09 +11:00
Lukasz Lenart
9153228b6a
Merge pull request #1192 from apache/fix/nightlies-67x
...
Fixes nightlies builds
2025-01-21 20:31:59 +01:00
Lukasz Lenart
5713a74edc
Fixes nightlies builds
2025-01-21 18:06:11 +01:00
Kusal Kithul-Godage
32071c71ad
WW-5516 Fix TemplateDir and Theme fallback to Request/Session/Application attributes
2025-01-21 20:05:24 +11:00
Lukasz Lenart
7e4791985b
Merge pull request #1175 from apache/feature/WW-5512-optional-inject
...
WW-5512 Extends the container to support injecting optional parameters into constructor
2025-01-21 07:25:58 +01:00
Lukasz Lenart
3c1e44ca2d
WW-5512 Supports mixing required and optional parameters in any order
2025-01-19 09:53:01 +01:00
Lukasz Lenart
2ba8d97ad0
WW-5512 Supports mixing required and optional parameters
2025-01-19 09:36:27 +01:00
Lukasz Lenart
cba0db0b07
Merge pull request #1181 from apache/fix/WW-5501-exclude
...
WW-5501 Only exclude malicious file names
2025-01-16 07:28:46 +01:00
Lukasz Lenart
688162cae2
WW-5501 Only exclude malicious file names
2025-01-14 07:47:39 +01:00
Lukasz Lenart
a33c162f53
WW-5512 Extends the container to support injecting optional parameters into constructor
2025-01-05 17:45:11 +01:00
Lukasz Lenart
c7a6daf5ce
Merge pull request #1169 from apache/fix/WW-5500
...
WW-5500 Extends pattern to validate multipart uploads
2025-01-05 09:20:33 +01:00
Lukasz Lenart
370c7ce17a
Merge pull request #1168 from apache/fix/WW-5498
...
WW-5498 Adds devMode errors as action messages to avoid breaking validation logic
2025-01-05 09:16:44 +01:00
Lukasz Lenart
55989befce
Merge pull request #1167 from apache/fix/excluded-packages
...
Excludes new & old packages
2025-01-04 14:37:47 +01:00
Lukasz Lenart
2e4a4b5e36
Excludes new & old packages
2025-01-04 13:56:31 +01:00
Lukasz Lenart
9d07c3b4c3
WW-5498 Adds devMode errors as action messages to avoid breaking validation logic
2025-01-03 17:14:12 +01:00
Lukasz Lenart
575e4e8c9b
WW-5500 Extends pattern to validate multipart uploads
2025-01-03 17:10:59 +01:00
Lukasz Lenart
74388dfba7
Merge pull request #1158 from apache/fix/updates-asf-yaml
...
Updates .asf.yaml to match main
2024-12-23 16:11:55 +01:00
Lukasz Lenart
4ee8b02262
Updates .asf.yaml to match main
2024-12-23 15:24:10 +01:00
Lukasz Lenart
c8febc2050
Merge pull request #1156 from apache/feature/WW-5501-exclude
...
WW-5501 Exclude malicious names
2024-12-23 15:08:58 +01:00
Lukasz Lenart
3ea126388c
WW-5501 Uses StringUtils.normalizeSpace instead of sanitizeNewlines
2024-12-23 14:13:26 +01:00
Lukasz Lenart
09993e3476
WW-5501 Exclude malicious names
2024-12-23 12:05:15 +01:00
Lukasz Lenart
f5688e680b
Merge pull request #1150 from apache/feature/prepare-development
...
Sets version to 6.7.1-SNAPSHOT to prepare for another development cycle
2024-12-18 15:42:21 +01:00
Lukasz Lenart
60a3db0a63
Sets version to 6.7.1-SNAPSHOT to prepare for another development cycle
2024-12-18 14:43:29 +01:00
Lukasz Lenart
4714d27678
Merge pull request #1141 from apache/fix/WW-5493-parameters
...
WW-5493 Restores parameters and uses getAttributes()
2024-12-18 07:42:47 +01:00
Lukasz Lenart
4feceee5f1
WW-5493 Restores parameters and uses getAttributes()
...
Instead of using parameters field directly, this PR uses getAttributes() instead to avoid coupling with internal Component state
2024-12-04 08:19:34 +01:00
Lukasz Lenart
1f5305c249
[maven-release-plugin] prepare release STRUTS_6_7_0
2024-11-17 10:57:09 +01:00
Lukasz Lenart
1903e0ef33
Merge pull request #1126 from apache/feature/WW-5484-dwr
...
WW-5484 Marks the DWR plugin as deprecated
2024-11-14 15:55:01 +01:00
Lukasz Lenart
8a2f494c12
WW-5484 Marks the DWR plugin as deprecated
2024-11-11 17:49:54 +01:00
Lukasz Lenart
6b2e5ecd9b
Merge pull request #1125 from apache/dependabot/github_actions/github/codeql-action-3.27.1
...
Bump github/codeql-action from 3.27.0 to 3.27.1
2024-11-11 07:37:48 +01:00
dependabot[bot]
cb08d18b5a
Bump github/codeql-action from 3.27.0 to 3.27.1
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.27.0 to 3.27.1.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v3.27.0...v3.27.1 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2024-11-11 01:45:38 +00:00