Struts 6.3.0

What's Changed

• [WW-5327] Stop using JavaBeans notation for setters in SecurityMemberAccess & MemberAccessValueStack by @lukaszlenart in #715
• [WW-5233] Include Apache Tiles code base in the Tiles plugin by @lukaszlenart in #608
• Update StreamResult.java - fix misspell by @ervinpm in #723
• WW-5332 Add validation for package name parsing by @kusalk in #726
• [WW-5327] Removes duplicated exclusion by @lukaszlenart in #729
• Uses Java 17 to perform Code Quality check by @lukaszlenart in #730
• WW-5334 Enable usage of junit-plugin inside velocity-plugin by @kusalk in #732
• [WW-5331] Uses proper signature of get() by @lukaszlenart in #727
• WW-5334 Extract ConventionJUnit4Test into correct module by @kusalk in #733
• Defines a proper CODEOWNERS file by @lukaszlenart in #728
• WW-5334 Misc VelocityManager code cleanup by @kusalk in #731
• WW-5337 Make SecurityMemberAccess exclusion checking more performant by @kusalk in #736
• WW-5336 Deprecate OgnlTool by @kusalk in #735
• WW-5334 Fix empty chained context names in VelocityManager by @kusalk in #744

Dependencies

• [WW-5315] Upgrades ASM to version 9.5 by @lukaszlenart in #695
• [WW-5316] Upgrades commons-io to version 2.13.0 by @lukaszlenart in #697
• [WW-5317] Upgrades log4j to version 2.20.0 by @lukaszlenart in #698
• upgrade Felix Maven Bundle Plugin by @hboutemy in #696
• Feature/update maven dependency plugin by @sepe81 in #699
• [WW-5318] Upgrades slf4j to version 2.0.7 by @lukaszlenart in #700
• Bump actions/upload-artifact from 3.1.0 to 3.1.2 by @dependabot in #702
• Bump actions/cache from 3.0.8 to 3.3.1 by @dependabot in #705
• Bump osgi.core from 7.0.0 to 8.0.0 by @dependabot in #701
• Bump stax2-api from 4.2 to 4.2.1 by @dependabot in #703
• Bump ossf/scorecard-action from 2.0.6 to 2.2.0 by @dependabot in #704
• Bump assertj-core from 3.15.0 to 3.24.2 by @dependabot in #707
• Bump jaxb-impl from 2.3.2 to 4.0.3 by @dependabot in #708
• Bump net.sf.jasperreports:jasperreports from 6.19.1 to 6.20.5 by @dependabot in #709
• Bump jackson.version from 2.14.1 to 2.15.2 by @dependabot in #713
• [WW-5325] Upgrades commons-lang3 to version 2.13.0 by @lukaszlenart in #714
• [WW-5329] Upgrades xstream to version 1.4.20 by @lukaszlenart in #721
• Drops duplicated dependency by @lukaszlenart in #737

New Contributors

• @ervinpm made their first contribution in #723

Full Changelog: STRUTS_6_2_0...STRUTS_6_3_0

Struts 6.2.0

What's Changed

• Updates OWASP suppressions as some reports are false positive by @lukaszlenart in #637
• Defines to autolink PRs to issues in ASF JIRA by @lukaszlenart in #638
• [WW-5263] Uses proper names for CSP, COOP and COEP interceptors by @lukaszlenart in #639
• [WW-5262] Extracts excluded classes and beans into dedicated XML config files by @lukaszlenart in #640
• WW-5199 Allow forwarding from/to actions by @kusalk in #642
• [WW-5264] Moves XSLT result into a dedicated plugin by @lukaszlenart in #641
• Applies permission to GH workflows by @lukaszlenart in #643
• [WW-5264] Removes XSLTResult from struts-default.xml as it was moved in to plugin by @lukaszlenart in #646
• WW-5265 Allow removal of a single/specific container provider by @kusalk in #645
• [WW-5269] Upgrades Jackson to version 2.14.1 by @lukaszlenart in #647
• [WW-5272] Extends <s:date/> to support java.sql.Time by @lukaszlenart in #649
• [WW-5277] Upgrades Freemarker to version 2.3.32 by @lukaszlenart in #651
• [WW-5274] Marks the Pell multipart plugin as deprecated by @lukaszlenart in #653
• [WW-5276] Cleans up also wrapper request to avoid resource leak and potential DoS attack by @lukaszlenart in #654
• [WW-4404] Http interceptor by @lukaszlenart in #655
• WW-5270 Fix forwarding from Struts excluded URL by @kusalk in #648
• WW-5278 Collect duplicated code into AbstractActionValidatorManager by @kusalk in #656
• WW-5279 Improve readability of XmlConfigurationProvider class by @kusalk in #657
• [WW-5275] Allows to provide a custom CspSettings per action by @lukaszlenart in #658
• WW-5284 Refactor ActionValidatorManager implementations by @kusalk in #659
• WW-5268 Ability to exempt classes from package exclusions by @kusalk in #660
• [WW-5285] Limits max number of files to upload at once by @lukaszlenart in #662
• WW-5290 Refactor ConfigurationManager by @kusalk in #666
• WW-5292 Allow overriding of Operations classes in two filter setup and assorted clean up by @kusalk in #667
• WW-5266 Implement struts.multipart.maxFileSize by @kusalk in #665
• WW-5196 use generics for RequestMap and ApplicationMap and correct SessionMap to also be of type <String, Object> by @sdutry in #585
• WW-5243 remove deprecated action prefix cross namespaces by @sdutry in #669
• WW-5253 Remove deprecated methods from DefaultUrlHelper by @sdutry in #671
• WW-5251 remove deprecated interfaces related to ServletConfigInterceptor by @sdutry in #670
• WW-5288 Make excluded package exemption logic more strict by @kusalk in #664
• WW-5293 Allow loading XML configuration from other than filesystem by @kusalk in #668
• Bump spring-core from 5.3.23 to 5.3.26 by @dependabot in #672
• [WW-5289] Fixes creating executor to avoid locking JVM on shutdown by @lukaszlenart in #673
• [WW-5295] Adds support for java.time.LocalTime to <s:date/> tag by @lukaszlenart in #677
• WW-5298 Clean up StrutsVelocityContext by @kusalk in #674
• WW-5299 Clean up ActionChainResult by @kusalk in #675
• WW-5300 Make Dispatcher methods overridable by @kusalk in #676
• WW-5308 Java templates plugin, add minlength and maxlength to textarea. by @gregh3269 in #683
• [WW-5280] Cleans up NoParameters interfaces by @lukaszlenart in #679
• [WW-5304] Drops deprecated methods and fields in ActionContext by @lukaszlenart in #680
• Improve [WW-4434] - add documentation and rename existing ftl to achieve the wanted behaviour by @fischey in #682
• Bump testng from 7.5 to 7.5.1 by @dependabot in #684
• [WW-5302] Evaluates the name attribute before assigning it to the id attribute by @lukaszlenart in #678
• Bump spring-core from 5.3.26 to 5.3.27 by @dependabot in #681
• [WW-5296] Uses proper DTDs by @lukaszlenart in #685
• [WW-5309] Supports patterns starting with variable by @lukaszlenart in #686
• WW-5301 Fix custom VelocityManager bean selection by @kusalk in #687
• [WW-5312] Attempt to fix ExecuteAndWaitInterceptor inconsistent processing by @JCgH4164838Gh792C124B5 in #688
• [WW-5310] Properly parses param value with equal sign by @lukaszlenart in #689
• WW-5288 follow-up test case updates by @JCgH4164838Gh792C124B5 in #690
• [WW-5261] Avoids creating ValueStack if no ActionContext is available by @lukaszlenart in #691
• WW-5314 Do not log warnings for bad user input from JakartaMultiPartRequest by @kusalk in #693
• [WW-5310] Supports fragment in URL by @lukaszlenart in #692

New Contributors

• @kusalk made their first contribution in #642
• @fischey made their first contribution in #682

Full Changelog: STRUTS_6_1_1...STRUTS_6_2_0

Struts 6.1.2.1

What's Changed

• Fixes addressing S2-063 & S2-064 by @yasserzamani

Full Changelog: STRUTS_6_1_2...STRUTS_6_1_2_1

Struts 2.5.31

What's Changed

• Fixes addressing S2-063 & S2-064 by @yasserzamani

Full Changelog: STRUTS_2_5_30...STRUTS_2_5_31

Struts 6.1.2

What's Changed

• [WW-5285] Limits max number of files to upload at once by @lukaszlenart in #662

Full Changelog: STRUTS_6_1_1...STRUTS_6_1_2

Struts 6.1.1

What's Changed

• WW-5219 Moves TestNG related classes into TestNG plugin by @lukaszlenart in #594
• WW-5220 Moves JUnit related test into the JUnit plugin by @lukaszlenart in #595
• WW-5184 - Add optional parameter value check to ParametersInterceptor by @brianandle in #559
• [WW-5213] Upgrades javax.el to 3.0.1-b12 by @lukaszlenart in #596
• [WW-5226] Upgrade weld-core to version 2.4.8.Final by @lukaszlenart in #597
• [WW-5227] Upgrades Log4j to version 2.19.0 by @lukaszlenart in #598
• [WW-5229] Upgrades Spring to version 5.3.23 by @lukaszlenart in #599
• [WW-5228] Upgrades OWASP dependency-check-maven to version 7.2.0 by @lukaszlenart in #600
• [WW-5231] Upgrades apache-rat-plugin to version 0.15 by @lukaszlenart in #601
• [WW-5232] Introduces GH Actions build instead of using Travis by @lukaszlenart in #602
• Replaces Travis badge with GH Actions badge by @lukaszlenart in #603
• [WW-5234] Improves DTD definitions to use proper URL by @lukaszlenart in #604
• [WW-5232] Applies proper coverage settings for Jacoco plugin and Sonar by @lukaszlenart in #605
• [WW-5235] Uses debug log level when setting expression max length to avoid cluttering logs by @lukaszlenart in #606
• [WW-5184] Uses debug log level when parameter value was not accepted by @lukaszlenart in #607
• WW-3691 Converts BackgroundProcess into interface and uses Executor to execute BackgroundProcess by @lukaszlenart in #609
• [WW-5241] Fixes issue with includeParams=all when using exec & wait by @lukaszlenart in #611
• [WW-5242] Marks struts.mapper.action.prefix.crossNamespaces as deprecated by @lukaszlenart in #613
• [WW-5244] Upgrades commons-text to version 1.10.0 by @lukaszlenart in #614
• [WW-5245] Upgrades Jackson Databind to version 2.13.4.2 by @lukaszlenart in #618
• [WW-2815] Refactors XStreamHandler to allow to provide a custom configuration by @lukaszlenart in #615
• [WW-5230] Upgrades OGNL to version 3.3.4 by @lukaszlenart in #619
• [WW-3529] Fixes usage of RegEx related characters in named pattern by @lukaszlenart in #620
• [WW-3737] Allows to define a custom separator used to split patterns by @lukaszlenart in #621
• [WW-5133] Drops labelposition attribute by @lukaszlenart in #622
• [WW-3725] Removes unused template by @lukaszlenart in #623
• [WW-5137] Removes deprecated class attribute by @lukaszlenart in #624
• [WW-4173] Adds support to disable processing a given interceptor by @lukaszlenart in #625
• [WW-4440] Adds basic README.md to all submodules by @lukaszlenart in #627
• [WW-4692] Extracts Url encoder/decoder into dedicated interfaces/classes by @lukaszlenart in #626
• [WW-5252] Disables parsing external entities by @lukaszlenart in #628
• [WW-5255] Fixes <s:script/> and <s:link/> and uses them across tags by @lukaszlenart in #629
• [WW-4514] Fixes building query string with empty parameters by @lukaszlenart in #630
• [WW-5240] Uses doubleOn* attributes in the template by @lukaszlenart in #631
• [WW-5257] Cleans up template by @lukaszlenart in #632
• [WW-5258] Upgrades Struts Annotations to version 1.0.8 by @lukaszlenart in #633
• [WW-5259] Extracts UrlHelper#parseQueryString into a dedicated bean by @lukaszlenart in #634
• [WW-4173] Introduces a dedicated interface to allow conditionally disabling a given interceptor by @lukaszlenart in #635
• [WW-5260] Introduces a constant to set submitUnchecked attribute of checkbox tag globally by @lukaszlenart in #636

New Contributors

• @brianandle made their first contribution in #559

Staging Maven repo

https://repository.apache.org/content/groups/staging/

Standalone artifacts

https://dist.apache.org/repos/dist/dev/struts/6.1.1/

Release notes

https://cwiki.apache.org/confluence/display/WW/Version+Notes+6.1.1

Full Changelog: STRUTS_6_0_3...STRUTS_6_1_1

Struts 6.0.3

What's Changed

• Add async and velocity plugin to bom by @tobiasstadler in #568
• [WW-5191] Fixes placement of maxLength and minLength attributes in <s:textarea/> tag by @lukaszlenart in #572
• [WW-5187] Comments out Velocity based PageFilter by @lukaszlenart in #570
• [WW-5185] Reintroduces proper implementation of Tiles resource to support wildcard matching of Tiles definitions by @lukaszlenart in #566
• [WW-5188] Replaces since 2.6 with 6.0 by @lukaszlenart in #569
• WW-5197 Adds support for java.sql.Date by @tobiasstadler in #574
• [WW-5201] Upgrades log4j2 to version 2.18.0 by @lukaszlenart in #575
• [WW-5193] Uses proper org.hibernate.validator groupId and upgrade to version 6.1.3.Final by @lukaszlenart in #576
• WW-5202 Update jasperreports to 6.19.1 and exclude optional itext from jasperreports by @sepe81 in #578
• [WW-5190] Fixes StackOverflowException when dispatching request by @lukaszlenart in #571
• [WW-5192] Fixes broken radio tag when using with enums by @lukaszlenart in #577
• [WW-5204] Upgrades OGNL to version 3.3.3 by @lukaszlenart in #579
• Update maven wrapper to 3.8.6 by @sepe81 in #582
• WW-5208 Update hibernate-validator to 6.2.4 by @sepe81 in #583
• [WW-5205] - Reverting injection refactor of internal bean by @rproserpio in #580
• Add openjdk17 to build, remove oraclejdk9 (EOL) and switch from oraclejdk to openjdk to fix Travis CI build by @sepe81 in #584
• Update maven-surefire-plugin to 3.0.0-M7 by @sepe81 in #587
• [WW-5207] Uses ASM 9 by default by @lukaszlenart in #586
• [WW-5203] Re-builds policy string on each call by @lukaszlenart in #588
• [WW-5173] - Attempt to fix DI behaviour for custom cache factories by @JCgH4164838Gh792C124B5 in #573
• Update maven-enforcer-plugin to 3.1.0 by @sepe81 in #591
• [WW-5215] Checks if session was already created before applying CSP settings by @lukaszlenart in #590
• [WW-5212] Upgrades to Spring 5.3.22 by @lukaszlenart in #592
• [WW-5218] Allows to disable CSP related interceptors by @lukaszlenart in #593

New Contributors

• @tobiasstadler made their first contribution in #568
• @rproserpio made their first contribution in #580

Staging Maven repo

https://repository.apache.org/content/groups/staging/

Standalone artifacts

https://dist.apache.org/repos/dist/dev/struts/6.0.3/

Release notes

https://cwiki.apache.org/confluence/display/WW/Version+Notes+6.0.3

Full Changelog: STRUTS_6_0_0...STRUTS_6_0_3

Struts 6.0.0

What's Changed

• upgrade Felix m-bundle-p: reproducible builds by @hboutemy in #555
• Bump junit from 4.13 to 4.13.1 by @dependabot in #547
• [WW-5182] Upgrade to Servlet API 3.1 by @lukaszlenart in #550
• [WW-5181] Blocks permanently access to static methods by @lukaszlenart in #549
• Bump xercesImpl from 2.12.0 to 2.12.2 by @dependabot in #551
• Potential expression cache enhancement for 2.6 series by @JCgH4164838Gh792C124B5 in #528
• Basic LocalDateTime support by @gregh3269 in #532
• [WW-5165] Upgrades Spring to version 5.3.20 by @lukaszlenart in #552
• [WW-5179] Set default value of struts.ognl.expressionMaxLength to 256 by @lukaszlenart in #553
• Add basic LocalDateTime support WW-5175 by @gregh3269 in #554
• [WW-5168] Support submit unchecked in Javatemplates and fixes logic for FTL template by @lukaszlenart in #531
• [WW-5016] Adds support for LocalDate and adjusts tests to use the new Java 8 API by @lukaszlenart in #529
• Update mvnw to 3.1.0 and migrate from takari to apache by @sepe81 in #516
• [WW-5161] Update spring to 4.3.30 by @sepe81 in #517
• upgrade Felix maven-bundle-plugin to 5.1.3 by @hboutemy in #518
• upgrade maven-war-plugin to 3.3.1 by @hboutemy in #519
• REST Showcase fix for broken JSPs using S2 link tags by @JCgH4164838Gh792C124B5 in #520
• Update log4j to 2.17.1 to address CVE-2021-44832. by @Chromico in #521
• [WW-4792] Uses proper names for constants by @lukaszlenart in #522
• [WW-5117] Evaluates dynamic attributes - cherrypick by @lukaszlenart in #525
• [WW-5022] Sets escapeHtmlBody to false by default and defines a new flag by @lukaszlenart in #523
• [WW-5112] Reduces logging in logic around missing resource key by @lukaszlenart in #527
• [WW-5115] Reduces logging for ignored DMI related params when DMI is disabled by @lukaszlenart in #526
• WW-4558 contentType override ignored for JSONInterceptor by @victorsosa in #87
• WW-4634 Centre alignment doesn't seem to work in Velocity tags by @victorsosa in #95
• add allowed methods to handleUnknownAction by @justinjmiller in #99
• WW-4650 Json deserialization does not work in 2.5.1 by @victorsosa in #103
• sync up execution ids with top-level Apache pom, otherwise the sources are deployed twice during release by @pbruski in #101
• action parameters should be included when building the URL to action by @pbruski in #102
• WW-4652 fixed a concurrency issue in addDefaultResourceBundle by @pbruski in #106
• WW-4572 Http parameters by @lukaszlenart in #58
• WW-4638 - TestNG 6.9.10 dependency error by @victorsosa in #98
• Change to the documentation by @andrea-ligios in #107
• Fix freemaker error in checkbox.ftl of css_xhtml template by @tiv-source in #109
• [WW-4620] Improve XWorkListPropertyAccessor to against DOS attack by @quaff in #105
• updated javadoc after changing to enum by @sdutry in #110
• replaced String constants for marking status with enum by @sdutry in #111
• WW-4690 added version to jshint-maven-plugin by @sdutry in #112
• ConversionErrorInterceptor to extend MethodFilterIntercept by @gregh3269 in #108
• WW-4636 - File upload error message always in default language by @aleksandr-m in #113
• Virtual file representation by @lukaszlenart in #114
• WW-4737 Properly handle arrays containing nulls by @ThrawnCA in #115
• [WW-4694] annotation processing improved by @yasserzamani in #117
• [WW-4528] handling ChainingInterceptor excludes and includes lists by @yasserzamani in #116
• [WW-4741] Do not force session creation on locale read operation by @yasserzamani in #119
• WW-4753: Injectable context by @lukaszlenart in #120
• WW-4714: Localized bean by @lukaszlenart in #121
• WW-4757: LocaleProvider factory by @lukaszlenart in #122
• WW-4756: Introduce TextFactoryProvider by @lukaszlenart in #123
• WW-4744: AnnotationUtils supports non-public methods by @yasserzamani in #124
• WW-4578: Multidimensional validation by @lukaszlenart in #128
• WW-4780 : upgraded version of log4j2 to 2.8.2 by @sdutry in #132
• WW-4210: Type conversion class by @lukaszlenart in #131
• WW-3952: Credit card validator by @lukaszlenart in #130
• WW-4749: Buffer/Flush behaviour in FreemarkerResult by @lukaszlenart in #134
• WW-4105 Unwraps Spring proxy in actions chain by @yasserzamani in #135
• WW-4762: Default provider by @lukaszlenart in #137
• WW-3171 WW-3650 WW-4581: Locale aware converters by @lukaszlenart in #138
• WW-4800 Executes aspects when chaining AOPed actions by @yasserzamani in #139
• WW-4801 Only one hidden field per checkboxlist. by @gregh3269 in #140
• WW-4805 Blocks ognl access to class members of Spring proxy by @yasserzamani in #142
• WW-4794 Fixes wrapField's where clause by @yasserzamani in #143
• WW-4744 WW-4694 Removes annotation search to commons lang 3.6 by @yasserzamani in #144
• add constant to control proxy member access by @aleksandr-m in #146
• WW-4821 Upgrade Commons IO to 2.5 by @sdutry in #149
• WW-4819 fixed commons-collections groupId in dependency management by @sdutry in #150
• WW-4818 change default Multipart validation regex to comply with RFC1341 by @sdutry in #151
• WW-4826 upgrade to ASM version 5.2 by @sdutry in #152
• WW-4808: Multiple suffixes by @lukaszlenart in #148
• WW-4831 properly convert nulls in arrays by @ThrawnCA in #154
• WW-4834 Improve RegEx used to validate URLs by @sdutry in #156
• WW-4827 Not fully initialized ObjectFactory tries to create beans by @aleksandr-m in #153
• WW-4835: Configurable handlers by @lukaszlenart in #158
• WW-4834 fixed faulty regex by @sdutry in #157
• WW-4840 Build Fails Due to Unused com.sun Import by @swiftelan in #161
• WW-4839 JakartaStreamMultiPartRequest Should Honor "struts.multipart.… by @swiftelan in #160
• return request HTTP method to fix problem for portlets with multipart validation by @pheaber in #162
• WW-4843 DefaultUrlHelper().buildUrl() not outputting port when used as parameter by @aleksandr-m in #163
• WW-4846 Does not traverse/include proxy info in JSONResult by @yasserzamani in #164
• WW-4851 Upgrade to Log4j2 2.9.0 by @sdutry in #166
• Fixes a snippet typo by @yasserzamani in #170
• WW-4849: Initializable interface by @lukaszlenart in #168
• remove an obsolete TODO comment by @pengyunie in #171
• WW-4034 Allows to use custom JSONwriter by @yasserzamani in #167
• Site generation by @lukaszlenart in #174
• WW-4877: adds missing header with license by @lukaszlenart in #175
• WW-4862: Multipart regex by @lukaszlenart in #176
• WW-4884: Allow define just a TextProvider by @lukaszlenart in #178
• WW-4846 Adds unit tests by @yasserzamani in #180
• WW-4869 Fixes JarEntryRevision by @yasserzamani in https://github.com/apache/struts/...

Struts 6.0.0-RC4

What's Changed

• Bump junit from 4.13 to 4.13.1 by @dependabot in #547
• [WW-5182] Upgrade to Servlet API 3.1 by @lukaszlenart in #550
• [WW-5181] Blocks permanently access to static methods by @lukaszlenart in #549
• Bump xercesImpl from 2.12.0 to 2.12.2 by @dependabot in #551
• Potential expression cache enhancement for 2.6 series by @JCgH4164838Gh792C124B5 in #528
• Basic LocalDateTime support by @gregh3269 in #532
• [WW-5165] Upgrades Spring to version 5.3.20 by @lukaszlenart in #552
• [WW-5179] Set default value of struts.ognl.expressionMaxLength to 256 by @lukaszlenart in #553
• Add basic LocalDateTime support WW-5175 by @gregh3269 in #554

New Contributors

• @dependabot made their first contribution in #547

Full Changelog: STRUTS_6_0_0_RC3...STRUTS_6_0_0_RC4

Staging Maven repo
https://repository.apache.org/content/groups/staging/

Standalone artifacts
https://dist.apache.org/repos/dist/dev/struts/6.0.0-RC4/

Version notes
https://cwiki.apache.org/confluence/display/WW/Version+Notes+6.0.0

Migration guide
https://cwiki.apache.org/confluence/display/WW/Struts+2.5+to+6.0.0+migration

Struts 6.0.0-RC3

Description

A test build of a new release

What's Changed

• [WW-5168] Support submit unchecked in Javatemplates and fixes logic for FTL template by @lukaszlenart in #531
• [WW-5016] Adds support for LocalDate and adjusts tests to use the new Java 8 API by @lukaszlenart in #529

Full Changelog: STRUTS_6_0_0_RC2...STRUTS_6_0_0_RC3

Staging Maven repo
https://repository.apache.org/content/groups/staging/

Standalone artifacts
https://dist.apache.org/repos/dist/dev/struts/6.0.0-RC3/

Version notes
https://cwiki.apache.org/confluence/display/WW/Version+Notes+6.0.0

Migration guide
https://cwiki.apache.org/confluence/display/WW/Struts+2.5+to+6.0.0+migration