Commit Graph

  • 33627a9e43 WW-5674 docs(ognl): note the naming cleanup deferred to WW-5678 WW-5674-isclassbelongstopackages-allocation Lukasz Lenart 2026-08-03 15:19:21 +02:00
  • 25ac94927a WW-5674 docs(ognl): correct overstated claims and record the trailing-dot direction Lukasz Lenart 2026-08-03 15:03:27 +02:00
  • 2543dd8fc2 WW-5674 docs(ognl): align the design doc with the package-private overload Lukasz Lenart 2026-08-03 13:45:40 +02:00
  • 866722bbb6 WW-5674 test(ognl): assert package-boundary case against the live gate Lukasz Lenart 2026-08-03 13:28:48 +02:00
  • 34e5cf8b2a WW-5674 perf(ognl): match both allowlist package sets in one walk Lukasz Lenart 2026-08-03 13:12:27 +02:00
  • 8237a1fd8b WW-5674 perf(ognl): walk package names in place instead of building prefixes Lukasz Lenart 2026-08-03 13:05:06 +02:00
  • a8f6b4c59d WW-5674 perf(ognl): resolve package names via cached Class.getPackageName Lukasz Lenart 2026-08-03 12:58:54 +02:00
  • 197071def5 WW-5674 test(ognl): characterise SecurityMemberAccess package matching Lukasz Lenart 2026-08-03 12:54:27 +02:00
  • 05a936803d WW-5674 docs(ognl): add implementation plan for allocation-free package matching Lukasz Lenart 2026-08-03 12:44:35 +02:00
  • 7c2002397d WW-5674 docs(ognl): add design for allocation-free isClassBelongsToPackages Lukasz Lenart 2026-08-03 12:39:25 +02:00
  • b1a7c22969 docs: refine creating-version-notes from the 7.3.0 release run (#1828) main Lukasz Lenart 2026-08-01 17:20:17 +02:00
  • 2794832317 [maven-release-plugin] prepare for next development iteration release/7.3.0-RC1 Lukasz Lenart 2026-08-01 15:24:56 +02:00
  • a88fd76364 [maven-release-plugin] prepare release STRUTS_7_3_0 STRUTS_7_3_0 Lukasz Lenart 2026-08-01 14:57:50 +02:00
  • 0fd3d7a2fb docs: add creating-version-notes skill and page template (#1826) Lukasz Lenart 2026-08-01 14:51:10 +02:00
  • 702280f48f WW-5656 docs(conversion): mark ConversionRule.COLLECTION and the Collection_ prefix as deprecated (#1825) Lukasz Lenart 2026-08-01 12:45:25 +02:00
  • 76c0887972 [maven-release-plugin] prepare for next development iteration release/6.11.0-RC1 Lukasz Lenart 2026-08-01 12:28:23 +02:00
  • 52628432a9 [maven-release-plugin] prepare release STRUTS_6_11_0 STRUTS_6_11_0 Lukasz Lenart 2026-08-01 12:28:14 +02:00
  • 687436f9bf WW-5668 Keep the localized-text providers deserializable across a version upgrade (#1824) Lukasz Lenart 2026-08-01 11:55:17 +02:00
  • 7ce27107e2 WW-5668 Make the localized-text provider caches size-bounded and align request-locale resolution (6.x) (#1823) support/struts-6-x-x Lukasz Lenart 2026-08-01 11:55:00 +02:00
  • a1c8af5574 WW-5666 Apply input length limits consistently when reading request bodies (6.x) (#1822) Lukasz Lenart 2026-08-01 10:04:57 +02:00
  • a6570b769b WW-5668 Bound the localized-text provider caches and align request-locale resolution (#1821) Lukasz Lenart 2026-08-01 10:04:40 +02:00
  • 1218c49224 WW-5666 Apply input length limits consistently when reading request bodies (#1819) Lukasz Lenart 2026-07-31 11:05:33 +02:00
  • a07d0e2926 docs: add creating-security-bulletins skill, bulletin template, and triage control-case rule (#1820) Lukasz Lenart 2026-07-30 12:58:12 +02:00
  • 81264063e6 WW-5659 Resolve lazy interceptor params per invocation (#1816) Lukasz Lenart 2026-07-30 09:19:10 +02:00
  • 26141511f8 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#1818) dependabot[bot] 2026-07-29 07:57:45 +02:00
  • d52ffed7ff build(deps): bump github/codeql-action from 4.37.2 to 4.37.3 (#1817) dependabot[bot] 2026-07-29 07:57:35 +02:00
  • 94a8fcb26c WW-3784 Order annotated wildcard actions most-specific-first (#1813) Lukasz Lenart 2026-07-29 07:56:58 +02:00
  • 6f802987f5 WW-3871 Derive ConversionRule prefixes for @TypeConversion keys (#1812) Lukasz Lenart 2026-07-29 07:55:46 +02:00
  • d906f23448 WW-3530 Fix visitor-validator cache-key collision under wildcard actions (#1811) Lukasz Lenart 2026-07-29 07:55:22 +02:00
  • 532ca7f864 WW-2934 Skip field validators when a field has a conversion error (opt-in) (#1810) Lukasz Lenart 2026-07-27 17:40:21 +02:00
  • 0b2bc2be14 WW-3427 Add regression test for conversion errors on aliased properties (#1814) Lukasz Lenart 2026-07-26 10:33:09 +02:00
  • 12015d0bf5 WW-5540 Add caching to AbstractLocalizedTextProvider (#1808) Lukasz Lenart 2026-07-26 09:52:08 +02:00
  • 833220346c WW-5474 Count files only for maxFiles, add maxParameterCount (#1806) Lukasz Lenart 2026-07-26 04:57:19 +02:00
  • c3e9db1b21 WW-5413 Avoid writing small in-memory multipart uploads to disk (#1805) Lukasz Lenart 2026-07-26 04:29:05 +02:00
  • 8a5323fbdf WW-5539 Concurrency performance enhancements (#1799) Lukasz Lenart 2026-07-25 12:30:53 +02:00
  • 73f17c1be7 build(deps-dev): bump org.webjars:jquery from 3.7.1 to 4.0.0 (#1802) dependabot[bot] 2026-07-22 19:22:20 +02:00
  • eb69ad6f3a build(deps): bump org.webjars:bootstrap from 5.3.7 to 5.3.8 (#1803) dependabot[bot] 2026-07-22 18:57:16 +02:00
  • 88d95b2a5f build(deps): bump org.webjars:webjars-locator-lite from 1.1.3 to 1.1.4 (#1801) dependabot[bot] 2026-07-22 18:55:58 +02:00
  • ef8361caa7 build(deps): bump github/codeql-action from 4.37.0 to 4.37.2 (#1800) dependabot[bot] 2026-07-22 18:55:44 +02:00
  • a324538650 build(deps): bump org.htmlunit:htmlunit from 5.2.0 to 5.3.0 (#1804) dependabot[bot] 2026-07-22 18:55:27 +02:00
  • b154b7ca43 ci(owasp): cap job timeout and disable NVD auto-update in check step (#1807) Lukasz Lenart 2026-07-22 18:52:56 +02:00
  • 9f030f62be Library updates for cve's, suppression cleanup and not fail github action job SonarCloud if SONARCLOUD_TOKEN not found (summary report instead). (#1667) William Dutton 2026-07-22 17:46:14 +10:00
  • f32270cdb0 WW-5580 chore(core): use Configuration.VERSION_2_3_34 for FreeMarker config (#1798) Lukasz Lenart 2026-07-21 11:32:34 +02:00
  • f5880be2ef WW-5591 chore(core): mark XWorkObjectPropertyAccessor as deprecated (#1797) Lukasz Lenart 2026-07-21 11:26:22 +02:00
  • 6d27132926 WW-4858 Evaluate JSON name allowlist at leaf keys only (#1784) Lukasz Lenart 2026-07-21 10:59:38 +02:00
  • f2c1f50da2 WW-5604 Recognize CDI/Weld client proxies in SecurityMemberAccess (#1796) Lukasz Lenart 2026-07-21 10:58:28 +02:00
  • 464817e0b0 WW-5653 Upgrade Bootstrap to 5.3.x in sample apps (#1793) Lukasz Lenart 2026-07-20 18:16:03 +02:00
  • b2548542ec WW-5640 refactor(webjars): rename DefaultWebJarUrlProvider to StrutsWebJarUrlProvider (#1795) Lukasz Lenart 2026-07-20 13:58:04 +02:00
  • 11c10ee8f9 WW-5620 Standardize logging on Log4j2 (#1794) Lukasz Lenart 2026-07-20 13:41:45 +02:00
  • 60bc7b8d7a WW-5652 Add support for Java records and Optional serialization in the JSON plugin. (#1792) Sri lakshmi kanthan P 2026-07-20 13:00:52 +05:30
  • 963a81f43d WW-5647 Use ConcurrentHashMap for XSLT template cache (#1781) Arun 2026-07-20 00:10:25 +05:30
  • cc00343f1b WW-5650 Obtain a fresh JSON reader/writer per request in JSONInterceptor (#1782) Lukasz Lenart 2026-07-19 20:25:47 +02:00
  • db64c103d8 build(deps-dev): bump org.webjars:jquery from 3.7.1 to 4.0.0 (#1789) dependabot[bot] 2026-07-17 20:35:40 +02:00
  • 31036a8a49 build(deps): bump github/codeql-action from 4.36.3 to 4.37.0 (#1786) dependabot[bot] 2026-07-17 20:24:32 +02:00
  • 6cb6abf4ba build(deps): bump com.fasterxml.jackson:jackson-bom (#1787) dependabot[bot] 2026-07-17 20:22:29 +02:00
  • 28657e5f29 build(deps): bump jackson.version from 2.22.0 to 2.22.1 (#1790) dependabot[bot] 2026-07-17 20:21:13 +02:00
  • de599c91d3 WW-5646 Modernize path normalization in Include component (#1780) Arun 2026-07-17 15:48:08 +05:30
  • e5eb01abda WW-5642 fix(rest): authorize @StrutsParameter on record/creator-bound REST body properties (#1774) ⳕⲛτⲉⲅⲥⲉⳏτⲟⲅ 🕵🏻 2026-07-17 15:21:47 +05:30
  • cf22320e33 docs(security): treat a fix or PR as disclosure, require private report first (#1785) Lukasz Lenart 2026-07-14 20:25:56 +02:00
  • 40fcae3101 WW-4858 test(json): cover nested-leaf accepted-name and include patterns (#1783) Lukasz Lenart 2026-07-14 13:31:06 +02:00
  • b70ecc8e15 WW-5645 Canonicalise static content paths and remove redundant URL decode (#1777) Arun 2026-07-14 15:07:21 +05:30
  • 18955b98a4 WW-5644 fix(json): confine StrutsJSONWriter write state to the writing thread (#1776) ⳕⲛτⲉⲅⲥⲉⳏτⲟⲅ 🕵🏻 2026-07-14 12:19:07 +05:30
  • 75a285a106 WW-5643 fix(json): confine StrutsJSONReader parse state to the parsing thread (#1775) ⳕⲛτⲉⲅⲥⲉⳏτⲟⲅ 🕵🏻 2026-07-14 12:18:46 +05:30
  • 8fb8bcbcf0 build(deps): bump net.sf.jasperreports:jasperreports (#1779) dependabot[bot] 2026-07-12 11:40:42 +02:00
  • 1b1981e987 build(deps-dev): bump commons-logging:commons-logging (#1763) dependabot[bot] 2026-07-12 11:38:07 +02:00
  • f03198c6f8 build(deps-dev): bump commons-logging:commons-logging (#1760) dependabot[bot] 2026-07-12 11:37:11 +02:00
  • 1f16744114 build(deps): bump jackson.version from 2.21.4 to 2.22.0 (#1746) dependabot[bot] 2026-07-12 11:35:01 +02:00
  • 525c7dae37 WW-4858 Honor parameter filtering during JSON population (#1773) Lukasz Lenart 2026-07-12 11:32:12 +02:00
  • 5c130f9411 WW-5641 Restore struts.json.writer / struts.json.reader override in JSON plugin (#1766) Lukasz Lenart 2026-07-12 11:29:41 +02:00
  • 08fba59807 build(deps): bump org.apache.logging.log4j:log4j-bom (#1767) dependabot[bot] 2026-07-09 09:25:44 +02:00
  • 30cbd1c3c4 build(deps): bump github/codeql-action/upload-sarif (#1768) dependabot[bot] 2026-07-09 09:25:31 +02:00
  • 16aa43137d build(deps): bump github/codeql-action from 4.36.2 to 4.36.3 (#1769) dependabot[bot] 2026-07-09 09:25:18 +02:00
  • 745c08c7ac build(deps-dev): bump byte-buddy.version from 1.18.10 to 1.18.11 (#1771) dependabot[bot] 2026-07-09 09:25:01 +02:00
  • efda88b2bb build(deps): bump log4j2.version from 2.26.0 to 2.26.1 (#1772) dependabot[bot] 2026-07-09 09:24:44 +02:00
  • 789dbf3cd2 WW-5640 Add WebJars support to Struts core (#1765) Lukasz Lenart 2026-07-06 15:03:05 +02:00
  • a09f2a93af build(deps): bump github/codeql-action/upload-sarif (#1758) dependabot[bot] 2026-07-01 12:57:29 +02:00
  • 29f75f2dc0 build(deps): bump org.htmlunit:htmlunit from 5.1.0 to 5.2.0 (#1762) dependabot[bot] 2026-07-01 12:57:04 +02:00
  • 28db4ac276 build(deps-dev): bump org.apache.maven.plugins:maven-failsafe-plugin (#1764) dependabot[bot] 2026-07-01 12:56:48 +02:00
  • dc90e48909 Add draft security threat model (THREAT_MODEL.md) + discoverability pointer (#1756) Jarek Potiuk 2026-06-29 21:10:42 +02:00
  • 50c16e93b1 Release 7.2.1-RC1 (#1744) Lukasz Lenart 2026-06-26 07:18:26 +02:00
  • 07afccbb2f build(deps): bump actions/checkout from 6 to 7 (#1755) dependabot[bot] 2026-06-26 07:18:09 +02:00
  • d46d581b07 build(deps): bump org.apache.maven.plugins:maven-dependency-plugin (#1754) dependabot[bot] 2026-06-26 07:17:57 +02:00
  • 153e42bb9b build(deps): bump org.glassfish.jaxb:jaxb-bom from 4.0.8 to 4.0.9 (#1753) dependabot[bot] 2026-06-26 07:17:43 +02:00
  • 46ba90f797 build(deps-dev): bump org.jacoco:jacoco-maven-plugin (#1751) dependabot[bot] 2026-06-26 07:17:30 +02:00
  • bc369df815 build(deps-dev): bump org.jacoco:jacoco-maven-plugin (#1750) dependabot[bot] 2026-06-26 07:17:14 +02:00
  • 22243e75f5 build(deps): bump org.sitemesh:sitemesh from 3.2.2 to 3.2.3 (#1749) dependabot[bot] 2026-06-26 07:17:04 +02:00
  • d1b16a7657 build(deps): bump maven-surefire-plugin.version from 3.5.5 to 3.5.6 (#1748) dependabot[bot] 2026-06-26 07:16:42 +02:00
  • 1e3fa9a2d7 build(deps-dev): bump byte-buddy.version from 1.18.8 to 1.18.10 (#1745) dependabot[bot] 2026-06-26 07:16:26 +02:00
  • 01a561d9d8 Add CONTRIBUTING.md for new contributors (#1757) Lukasz Lenart 2026-06-25 21:43:45 +02:00
  • 8e31112c0b [maven-release-plugin] prepare release STRUTS_7_2_1 STRUTS_7_2_1 Lukasz Lenart 2026-06-15 12:31:11 +02:00
  • 59e342488d WW-5256 Decouple FreeMarker whitespace stripping from devMode (#1743) Lukasz Lenart 2026-06-15 12:22:51 +02:00
  • 489445c78d Release 7.2.0-RC1 (#1742) Lukasz Lenart 2026-06-15 12:07:02 +02:00
  • 8e908137d0 [maven-release-plugin] prepare release STRUTS_7_2_0 STRUTS_7_2_0 Lukasz Lenart 2026-06-14 19:33:03 +02:00
  • cc3ebc3c1f WW-5635 Avoid logging sensitive token values in TokenHelper (#1738) Arun 2026-06-14 22:38:39 +05:30
  • 8f9b4b8a90 WW-5636 Harden redirect URL escaping in non-302 response body (#1737) Arun 2026-06-14 22:14:43 +05:30
  • e2fa549b12 WW-5630 test(core): streamline ConfigParseUtilTest and convert to JUnit 4 (#1741) Lukasz Lenart 2026-06-14 18:36:28 +02:00
  • b455d6a8d4 WW-5630 - Performance Issue SecurityMemberAccess (#1721) (#1736) brianandle 2026-06-14 04:27:11 -07:00
  • dd830dca80 WW-5630 test: streamline ConfigParseUtilTest and convert to JUnit 4 (#1740) Lukasz Lenart 2026-06-14 11:16:39 +02:00
  • f8d42eb023 Prepare for a new development cycle of Struts 6.11.0 (#1739) Lukasz Lenart 2026-06-14 09:39:08 +02:00
  • 289bcaa922 build(deps): bump org.htmlunit:htmlunit from 4.21.0 to 5.1.0 (#1733) dependabot[bot] 2026-06-13 08:34:36 +02:00