struts STRUTS_6_13_0

What’s Changed

• Release 6.12.0 RC-1 by @lukaszlenart in https://github.com/apache/struts/pull/1969
• WW-5753 Reject cross-site non-GET navigations and cross-site GET subresource requests in the Fetch Metadata policy (6.x) by @lukaszlenart in https://github.com/apache/struts/pull/1984
• build(deps): WW-5755 bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1979
• WW-5757 fix(bean-validation): resolve the constraint message template as the text key (6.x) by @lukaszlenart in https://github.com/apache/struts/pull/1990
• build(deps): WW-5779 bump asm.version from 9.10.1 to 9.11 by @dependabot[bot] in https://github.com/apache/struts/pull/2013
• WW-5765 Re-store only the token validated in the request in execAndWait by @lukaszlenart in https://github.com/apache/struts/pull/2023
• build: use relativizeSiteLinks for maven-site-plugin 3.22.0 by @lukaszlenart in https://github.com/apache/struts/pull/2075
• WW-5823 fix(javatemplates): escape dynamic attributes and evaluate them only for lazy components (6.x) by @lukaszlenart in https://github.com/apache/struts/pull/2077
• WW-5824 fix(core): escape the radio name attribute like every other tag (6.x) by @lukaszlenart in https://github.com/apache/struts/pull/2080
• WW-5828 Bound integer digits when formatting BigDecimal (6.x) by @lukaszlenart in https://github.com/apache/struts/pull/2086
• WW-5838 Exclude java.beans, java.lang.reflect and java.lang.invoke from OGNL member access by default by @lukaszlenart in https://github.com/apache/struts/pull/2112
• WW-5836 Bound integer digits in number tag and message arguments (6.x) by @lukaszlenart in https://github.com/apache/struts/pull/2096
• WW-5842 Map actions from the servlet path and path info the container reports (6.x) by @lukaszlenart in https://github.com/apache/struts/pull/2119
• WW-5754 Accept cross-site HEAD navigations in the Fetch Metadata policy (6.x) by @lukaszlenart in https://github.com/apache/struts/pull/2123
• WW-5846 Match exemptedPaths against the request path in FetchMetadata, COOP and COEP interceptors (6.x) by @lukaszlenart in https://github.com/apache/struts/pull/2125
• WW-5847 fix(core): preselect multiple values in the doubleselect second list by @lukaszlenart in https://github.com/apache/struts/pull/2127

Dependencies

• build(deps-dev): bump org.codehaus.mojo:versions-maven-plugin from 2.21.0 to 2.22.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1955
• build(deps-dev): bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1951
• build(deps): bump slf4j.version from 2.0.19 to 2.0.20 by @dependabot[bot] in https://github.com/apache/struts/pull/1981
• build(deps): bump jackson.version from 2.22.2 to 2.22.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1980
• build(deps): bump org.apache.maven:apache-maven from 3.9.16 to 3.10.0 by @dependabot[bot] in https://github.com/apache/struts/pull/2000
• build(deps): bump org.apache.maven.doxia:doxia-module-markdown from 2.1.0 to 2.2.0 by @dependabot[bot] in https://github.com/apache/struts/pull/2045
• build(deps-dev): bump org.codehaus.mojo:versions-maven-plugin from 2.22.0 to 2.23.0 by @dependabot[bot] in https://github.com/apache/struts/pull/2032
• build(deps-dev): bump org.apache.maven.plugins:maven-failsafe-plugin from 3.6.0 to 3.6.1 by @dependabot[bot] in https://github.com/apache/struts/pull/2072
• build(deps): bump asm.version from 9.11 to 9.11.1 by @dependabot[bot] in https://github.com/apache/struts/pull/2070
• build(deps): bump jackson.version from 2.22.3 to 2.22.4 by @dependabot[bot] in https://github.com/apache/struts/pull/2069
• build(deps-dev): bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.3 to 3.7.0 by @dependabot[bot] in https://github.com/apache/struts/pull/2106
• build(deps-dev): bump org.jacoco:jacoco-maven-plugin from 0.8.15 to 0.8.16 by @dependabot[bot] in https://github.com/apache/struts/pull/2100

Full Changelog: https://github.com/apache/struts/compare/STRUTS_6_12_0…STRUTS_6_13_0

---

Source apache/struts · STRUTS_6_13_0 · 2026-11-08 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.