Commit Graph

  • e2fa549b12 WW-5630 test(core): streamline ConfigParseUtilTest and convert to JUnit 4 (#1741) Lukasz Lenart 2026-06-14 18:36:28 +02:00
  • b455d6a8d4 WW-5630 - Performance Issue SecurityMemberAccess (#1721) (#1736) brianandle 2026-06-14 04:27:11 -07:00
  • dd830dca80 WW-5630 test: streamline ConfigParseUtilTest and convert to JUnit 4 (#1740) Lukasz Lenart 2026-06-14 11:16:39 +02:00
  • f8d42eb023 Prepare for a new development cycle of Struts 6.11.0 (#1739) Lukasz Lenart 2026-06-14 09:39:08 +02:00
  • 289bcaa922 build(deps): bump org.htmlunit:htmlunit from 4.21.0 to 5.1.0 (#1733) dependabot[bot] 2026-06-13 08:34:36 +02:00
  • b808dcb845 build(deps): bump com.fasterxml.jackson:jackson-bom (#1729) dependabot[bot] 2026-06-13 08:33:28 +02:00
  • f9f69482c7 build(deps): bump asm.version from 9.10 to 9.10.1 (#1728) dependabot[bot] 2026-06-13 08:29:17 +02:00
  • 4f3fd69aa6 WW-5632 Harden commons-fileupload2 dependency against milestone binary-incompatibility (#1735) Lukasz Lenart 2026-06-13 08:28:47 +02:00
  • 210dc86b88 WW-5630 - Performance Issue SecurityMemberAccess (#1721) brianandle 2026-06-12 10:12:26 -07:00
  • 7c6034c667 build(deps-dev): bump org.apache.maven.plugins:maven-failsafe-plugin (#1732) dependabot[bot] 2026-06-10 13:23:50 +02:00
  • 5e725a72cd build(deps): bump github/codeql-action from 4.36.0 to 4.36.2 (#1734) dependabot[bot] 2026-06-10 13:23:21 +02:00
  • 53ef1ad883 build(deps): bump org.apache.maven.plugins:maven-dependency-plugin (#1730) dependabot[bot] 2026-06-10 13:22:50 +02:00
  • 0972a608a3 build(deps): bump maven-surefire-plugin.version from 3.5.5 to 3.5.6 (#1731) dependabot[bot] 2026-06-10 13:22:32 +02:00
  • 0b14f39a2f build(deps): bump jackson.version from 2.21.3 to 2.21.4 (#1727) dependabot[bot] 2026-06-10 13:21:25 +02:00
  • cf9b51669f build(deps): bump org.owasp:dependency-check-maven from 12.2.0 to 12.2.2 (#1726) dependabot[bot] 2026-06-10 13:21:00 +02:00
  • 9011c32b38 WW-5631 Add opt-in @StrutsParameter enforcement to ChainingInterceptor (#1719) Lukasz Lenart 2026-06-10 13:19:43 +02:00
  • 69cb2964f0 docs(skills): add triaging-security-reports skill (#1722) Lukasz Lenart 2026-06-02 08:44:18 +02:00
  • bf0a695dcc build(deps-dev): bump org.apache.maven.plugins:maven-site-plugin (#1718) dependabot[bot] 2026-05-28 07:19:41 +02:00
  • 8b8838a55a build(deps-dev): bump org.apache.maven.plugins:maven-assembly-plugin (#1717) dependabot[bot] 2026-05-28 07:19:29 +02:00
  • bbb111db20 build(deps): bump jackson.version from 2.21.2 to 2.21.3 (#1716) dependabot[bot] 2026-05-28 07:19:16 +02:00
  • ab08c59737 build(deps-dev): bump org.apache.maven.plugins:maven-enforcer-plugin (#1715) dependabot[bot] 2026-05-28 07:19:03 +02:00
  • e637bb16a3 build(deps): bump asm.version from 9.10 to 9.10.1 (#1713) dependabot[bot] 2026-05-28 07:17:30 +02:00
  • 1555cabff1 build(deps): bump org.apache.maven.plugins:maven-site-plugin (#1711) dependabot[bot] 2026-05-28 07:17:16 +02:00
  • c7b1ca3f0a build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 (#1710) dependabot[bot] 2026-05-28 07:16:52 +02:00
  • 4bfbfeb239 [maven-release-plugin] prepare release STRUTS_6_10_0 STRUTS_6_10_0 Lukasz Lenart 2026-05-25 17:19:48 +02:00
  • 0db282a51a pom(version): sets proper SNAPSHOT version (#1709) Lukasz Lenart 2026-05-25 17:04:31 +02:00
  • aaf286afa8 WW-5623 fix(core): HTML-encode form action in PostbackResult to prevent XSS (#1701) Lukasz Lenart 2026-05-25 16:38:20 +02:00
  • 84ef60eae8 WW-5535 fix(core): enforce class-level HTTP method annotations for wildcard-resolved unannotated methods (#1693) Lukasz Lenart 2026-05-25 16:38:04 +02:00
  • 26756ce85c security(versions): updates list of supported versions (#1708) Lukasz Lenart 2026-05-22 06:47:05 +02:00
  • d628d949a0 build(deps): bump org.apache.logging.log4j:log4j-bom (#1685) dependabot[bot] 2026-05-20 10:06:49 +02:00
  • fb35ed410c build(deps): bump log4j2.version from 2.25.4 to 2.26.0 (#1706) dependabot[bot] 2026-05-20 09:58:16 +02:00
  • 9abd02d961 build(deps): bump asm.version from 9.9.1 to 9.10 (#1703) dependabot[bot] 2026-05-20 09:56:17 +02:00
  • 59536d824a build(deps): bump slf4j.version from 2.0.17 to 2.0.18 (#1704) dependabot[bot] 2026-05-20 09:26:54 +02:00
  • 84712ae152 build(deps): bump asm.version from 9.9.1 to 9.10 (#1699) release/struts-6-8-x dependabot[bot] 2026-05-20 09:18:43 +02:00
  • cc6b4cfd6e build(deps): bump asm.version from 9.9.1 to 9.10 (#1695) dependabot[bot] 2026-05-20 09:18:23 +02:00
  • f26325ff90 ci(dependabot): fix cooldown property name (#1702) Lukasz Lenart 2026-05-20 09:07:05 +02:00
  • ed7d5acd27 build(deps-dev): bump org.apache.maven.plugins:maven-enforcer-plugin (#1697) dependabot[bot] 2026-05-20 08:59:34 +02:00
  • 1bd2951f7e build(deps-dev): bump org.apache.maven.plugins:maven-enforcer-plugin (#1698) dependabot[bot] 2026-05-20 08:59:25 +02:00
  • 16618e0236 build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#1694) dependabot[bot] 2026-05-20 08:58:58 +02:00
  • 419fb1f5c6 WW-5535 test(core): cover wildcard-resolved unannotated methods via real proxy (#1692) Lukasz Lenart 2026-05-19 10:26:49 +02:00
  • 213b83f64f fix(core): enforce class-level HTTP method annotations for wildcard-resolved unannotated methods (#1690) ⳕⲛτⲉⲅⲥⲉⳏτⲟⲅ 🕵🏻 2026-05-19 11:35:21 +05:30
  • 7ea7911cf8 chore(rat): excludes Markdown files in docs/ folder (#1691) Lukasz Lenart 2026-05-18 15:04:58 +02:00
  • e83487f0e1 WW-5627 Gate CookieInterceptor through ParameterAuthorizer (#1681) Lukasz Lenart 2026-05-18 13:52:17 +02:00
  • 3432433e38 chore(agents): defines a new AGENTS.md focused on reporting vulnerabilities (#1680) Lukasz Lenart 2026-05-15 13:27:53 +02:00
  • 09d03286f8 WW-5626 per-property authorization for Jackson REST handlers (#1674) Lukasz Lenart 2026-05-14 15:01:00 +02:00
  • 083faac1c5 build(deps): bump slf4j.version from 2.0.17 to 2.0.18 (#1684) dependabot[bot] 2026-05-14 14:58:37 +02:00
  • a48f57d161 build(deps): bump slf4j.version from 2.0.17 to 2.0.18 (#1683) dependabot[bot] 2026-05-14 14:58:10 +02:00
  • 9c8d3de0e4 build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#1682) dependabot[bot] 2026-05-14 14:57:50 +02:00
  • e5aa3e98a6 build(deps): bump com.github.ben-manes.caffeine:caffeine (#1679) dependabot[bot] 2026-05-09 13:49:55 +02:00
  • 8354ce21a4 build(deps): bump org.owasp:dependency-check-maven from 12.2.1 to 12.2.2 (#1678) dependabot[bot] 2026-05-09 13:49:16 +02:00
  • 56b9b6807e build(deps): bump org.owasp:dependency-check-maven from 12.2.1 to 12.2.2 (#1677) dependabot[bot] 2026-05-09 13:49:01 +02:00
  • fd05da73fa build(deps): bump org.glassfish.jaxb:jaxb-bom from 4.0.7 to 4.0.8 (#1676) dependabot[bot] 2026-05-09 13:48:48 +02:00
  • c9cfa36cb2 build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#1675) dependabot[bot] 2026-05-09 13:48:28 +02:00
  • 690c4c2737 WW-5626 cleanup follow-ups for @StrutsParameter JSON/REST enforcement (#1673) Lukasz Lenart 2026-05-09 12:09:03 +02:00
  • 7799c0fd2a build(deps): bump commons-io:commons-io from 2.21.0 to 2.22.0 (#1672) dependabot[bot] 2026-05-02 16:00:19 +02:00
  • 47ce289e06 build(deps): bump jackson.version from 2.21.2 to 2.21.3 (#1670) dependabot[bot] 2026-05-02 15:56:56 +02:00
  • 11e815f26b build(deps): bump com.fasterxml.jackson:jackson-bom (#1669) dependabot[bot] 2026-05-02 15:56:23 +02:00
  • 664540cc84 build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#1668) dependabot[bot] 2026-05-02 15:56:03 +02:00
  • c3a887085d WW-5624: Enforce @StrutsParameter on JSON/REST body deserialization (#1657) quactv 2026-05-01 15:46:38 +07:00
  • 8d6f13904f fix(core): WW-5623 HTML-encode form action in PostbackResult to prevent XSS (#1653) quactv 2026-05-01 15:42:25 +07:00
  • ca1b22d9be Struts 6.9.0 (#1662) Lukasz Lenart 2026-05-01 10:41:26 +02:00
  • f4c6349283 introduce private method to remove clones (#1666) aaaZayne 2026-04-20 14:57:28 +10:00
  • 716728ce26 build(deps): bump org.owasp:dependency-check-maven from 12.2.0 to 12.2.1 (#1665) dependabot[bot] 2026-04-16 11:06:22 +02:00
  • 71d4e062d3 build(deps): bump org.owasp:dependency-check-maven from 12.2.0 to 12.2.1 (#1664) dependabot[bot] 2026-04-16 11:06:10 +02:00
  • 862019e8f6 build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#1663) dependabot[bot] 2026-04-16 11:06:00 +02:00
  • 1b2f1857d0 [maven-release-plugin] prepare release STRUTS_6_9_0 STRUTS_6_9_0 Lukasz Lenart 2026-04-10 11:58:26 +02:00
  • 59b5e47575 ci(scorecards): score cards analysis are only supported for default branch (#1661) Lukasz Lenart 2026-04-10 09:13:17 +02:00
  • 0e22570763 ci(struts6): adjust workflows to use the new branch names (#1658) Lukasz Lenart 2026-04-10 08:23:04 +02:00
  • 396d7b716d cd(checks): uses proper context names for checks (#1660) Lukasz Lenart 2026-04-10 07:42:32 +02:00
  • 5f7a9129fc ci(struts6): adjusts workflows to use the new branch (#1659) Lukasz Lenart 2026-04-10 07:16:13 +02:00
  • 32c80b22bb build(deps): bump ognl:ognl from 3.4.10 to 3.4.11 (#1655) dependabot[bot] 2026-04-09 18:45:13 +02:00
  • 89ed075b30 ci(dependabot): add cooldown (#1656) Lukasz Lenart 2026-04-08 17:47:58 +02:00
  • b039dc5079 WW-5326 fix(rat): adjust exclude patterns for RAT and adds missing header with license feat/ognl-3.5-upgrade Lukasz Lenart 2026-04-07 07:38:42 +02:00
  • 6374e31384 WW-5326 fix(tiles): use raw OgnlContext in tiles accessors Lukasz Lenart 2026-04-06 19:27:16 +02:00
  • 803b5cbbd0 WW-5326 docs: add Jira reference to spec and plan Lukasz Lenart 2026-04-06 19:18:21 +02:00
  • 1dda92ed23 WW-5326 test(ognl): update tests for StrutsContext migration Lukasz Lenart 2026-04-06 19:17:10 +02:00
  • cda38c79db WW-5326 refactor(tiles): parameterize tiles OGNL accessors with StrutsContext Lukasz Lenart 2026-04-06 19:01:25 +02:00
  • fbb904e9c6 WW-5326 refactor(ognl): replace Ognl.createDefaultContext with direct StrutsContext construction Lukasz Lenart 2026-04-06 18:41:27 +02:00
  • f7923fc704 WW-5326 refactor(ognl): parameterize all accessor implementations with StrutsContext Lukasz Lenart 2026-04-06 18:31:58 +02:00
  • 47718f5a8a WW-5326 refactor(ognl): parameterize core interfaces with StrutsContext Lukasz Lenart 2026-04-06 18:19:55 +02:00
  • e2e8fa1f33 WW-5326 feat(ognl): introduce StrutsContext extending OgnlContext<StrutsContext> Lukasz Lenart 2026-04-06 18:14:29 +02:00
  • 71c204f04b WW-5326 build(deps): bump OGNL from 3.4.10 to 3.5.0-BETA4 Lukasz Lenart 2026-04-06 18:10:50 +02:00
  • 94e3ffd1e7 WW-5622 perf(core): cache Hibernate class presence to avoid repeated NoClassDefFoundError (#1650) Lukasz Lenart 2026-04-05 18:30:57 +02:00
  • d276b2dded WW-5622 perf(core): optimize Hibernate proxy detection when Hibernate is absent (#1649) Lukasz Lenart 2026-04-05 18:30:44 +02:00
  • b936fcbf8b WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks (#1643) Lukasz Lenart 2026-04-04 11:20:47 +02:00
  • 620fcbd152 WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks (#1642) Lukasz Lenart 2026-04-04 11:20:33 +02:00
  • 41abbd1684 build(deps): bump org.apache.logging.log4j:log4j-bom (#1648) dependabot[bot] 2026-04-02 16:23:17 +02:00
  • 39c1e29958 build(deps): bump log4j2.version from 2.25.3 to 2.25.4 (#1647) dependabot[bot] 2026-04-02 16:23:08 +02:00
  • b3ba3d04d5 build(deps-dev): bump byte-buddy.version from 1.18.7 to 1.18.8 (#1646) dependabot[bot] 2026-04-02 16:22:56 +02:00
  • c9918bf8bb build(deps): bump github/codeql-action from 4.34.1 to 4.35.1 (#1645) dependabot[bot] 2026-04-02 16:22:42 +02:00
  • 6c0189560b ci: fix nightly publishing on release/struts-6-8-x (#1644) Lukasz Lenart 2026-03-30 12:37:45 +02:00
  • 2215b6873c WW-5537 Resolve classloader/memory leaks during Tomcat hot deployment (#1632) Lukasz Lenart 2026-03-29 07:17:57 +02:00
  • 0a8b111e36 WW-5537 fix(core): resolve classloader/memory leaks during Tomcat hot deployment (#1631) Lukasz Lenart 2026-03-29 07:17:44 +02:00
  • b0d6d4f2d4 build(deps): bump org.apache.maven.doxia:doxia-core from 2.0.0 to 2.1.0 (#1640) dependabot[bot] 2026-03-27 13:09:17 +01:00
  • da5908d0ea build(deps): bump org.apache.rat:apache-rat-plugin from 0.17 to 0.18 (#1639) dependabot[bot] 2026-03-27 13:09:00 +01:00
  • 696ee73b72 build(deps): bump org.apache.maven.doxia:doxia-module-markdown (#1638) dependabot[bot] 2026-03-27 13:08:32 +01:00
  • be3db87b7f build(deps): bump org.apache.maven.doxia:doxia-core from 2.0.0 to 2.1.0 (#1636) dependabot[bot] 2026-03-27 13:07:54 +01:00
  • bd93c1bc19 build(deps): bump jackson.version from 2.21.1 to 2.21.2 (#1635) dependabot[bot] 2026-03-27 13:07:16 +01:00
  • 20b20e47eb build(deps): bump com.fasterxml.jackson:jackson-bom (#1634) dependabot[bot] 2026-03-27 13:06:42 +01:00
  • f132a2e43b deps(rat): excludes updatding the RAT plugin as it requires Java 17 (#1641) Lukasz Lenart 2026-03-27 11:40:00 +01:00