struts STRUTS_7_2_1

What’s Changed

WW-5529 Adds autogenerated files with updated desc by @lukaszlenart in https://github.com/apache/struts/pull/1224
WW-5532 Upgrade and align various dependencies by @kusalk in https://github.com/apache/struts/pull/1232
WW-5376 Fix BOM leaking unrelated dependencies by @kusalk in https://github.com/apache/struts/pull/1234
WW-5533 Add compilation support for Jakarta EE 11 by @kusalk in https://github.com/apache/struts/pull/1233
WW-5530 make DateConverter work for LocalDate and LocalTime by @bill-humblcloud in https://github.com/apache/struts/pull/1223
WW-5527 Sync tag with main ftl template. by @gregh3269 in https://github.com/apache/struts/pull/1212
WW-5534 Simplify ProxyUtil, add OgnlCache#computeIfAbsent by @kusalk in https://github.com/apache/struts/pull/1236
WW-5534 Allow @StrutsParameter recognition and OGNL allowlist for Spring proxies by @kusalk in https://github.com/apache/struts/pull/1237
WW-5538 Add conversion handling for java.time.OffsetDateTime by @bill-humblcloud in https://github.com/apache/struts/pull/1241
WW-5455 Defines a new plugin to support Jasper Reports 7 by @lukaszlenart in https://github.com/apache/struts/pull/1124
WW-5534 Proper fix ModelDriven parameter injection and allowlisting by @kusalk in https://github.com/apache/struts/pull/1243
WW-5544 Marks ReflectionContextFactory as deprecated and uses ActionContext instead by @lukaszlenart in https://github.com/apache/struts/pull/1255
WW-5547 Bump com.github.ben-manes.caffeine:caffeine from 3.1.8 to 3.2.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1257
WW-5546 Fixes NPE when uploaded file is empty by @lukaszlenart in https://github.com/apache/struts/pull/1263
WW-5550 Bump asm.version from 9.7.1 to 9.8 by @dependabot[bot] in https://github.com/apache/struts/pull/1274
WW-5551 Bump commons-beanutils:commons-beanutils from 1.9.4 to 1.11.0 in /parent by @dependabot[bot] in https://github.com/apache/struts/pull/1277
WW-5552 Bump weld.version from 5.1.2.Final to 6.0.2.Final by @dependabot[bot] in https://github.com/apache/struts/pull/1270
WW-5553 Bump com.fasterxml.jackson:jackson-bom from 2.18.3 to 2.19.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1281
WW-5557 Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.18.0 in /parent by @dependabot[bot] in https://github.com/apache/struts/pull/1289
WW-5554 Bump org.apache.struts:struts-annotations from 1.0.8 to 2.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1311
WW-5561 Bump org.apache.commons:commons-text from 1.13.1 to 1.14.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1312
WW-5366 Rejects empty files during upload by @lukaszlenart in https://github.com/apache/struts/pull/1307
WW-5524 Fixup StrutsConverterFactory by @MFAshby in https://github.com/apache/struts/pull/1309
WW-5502 Removes deprecated sanitizeNewlines method by @lukaszlenart in https://github.com/apache/struts/pull/1319
WW-5511 Adds missing JavaDocs to addCspHeaders method by @lukaszlenart in https://github.com/apache/struts/pull/1318
WW-5565 Bump org.apache.commons:commons-collections4 from 4.4 to 4.5.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1323
WW-5566 Bump commons-validator:commons-validator from 1.9.0 to 1.10.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1325
WW-5567 Bump org.apache.logging.log4j:log4j-bom from 2.24.3 to 2.25.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1336
WW-5569 Bump org.apache.commons:commons-compress from 1.27.1 to 1.28.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1338
WW-5504 Allows to use request instead of session attribute to store nonce by @lukaszlenart in https://github.com/apache/struts/pull/1352
Improves CLAUDE.md and defines specific subagents by @lukaszlenart in https://github.com/apache/struts/pull/1363
WW-5572 Bump org.mockito:mockito-core from 5.15.2 to 5.20.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1362
WW-5575 Upgrades commons-io to version 2.20.0 by @lukaszlenart in https://github.com/apache/struts/pull/1367
WW-5574 Upgrades commons-logging to version 1.3.5 by @lukaszlenart in https://github.com/apache/struts/pull/1366
Improve Claude Code agents configuration for Apache Struts by @lukaszlenart in https://github.com/apache/struts/pull/1376
WW-5573 Avoids false positive warning if file doesn’t exist already by @lukaszlenart in https://github.com/apache/struts/pull/1365
WW-5577 Bump org.apache.commons:commons-lang3 from 3.18.0 to 3.19.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1373
Fix Claude Code settings by @lukaszlenart in https://github.com/apache/struts/pull/1388
Add tests for conversion error repopulation with indexed properties by @lukaszlenart in https://github.com/apache/struts/pull/1391
WW-5579 Add missing DoubleRangeFieldValidator and ShortRangeFieldValidator to @Validations container by @lukaszlenart in https://github.com/apache/struts/pull/1390
Reverse merge changes related to releasing Struts 7.1.1 by @lukaszlenart in https://github.com/apache/struts/pull/1378
WW-5578 Don’t catch and swallow ConfigurationException in InterceptorBuilder. by @MFAshby in https://github.com/apache/struts/pull/1377
WW-5576 Java 25 build by @lukaszlenart in https://github.com/apache/struts/pull/1415
WW-5586 fix(core): enable WithLazyParams interceptor configuration in stacks by @lukaszlenart in https://github.com/apache/struts/pull/1414
WW-5587 fix(core): preserve parameters in InterceptorMapping for WithLazyParams interceptors by @lukaszlenart in https://github.com/apache/struts/pull/1416
WW-5588 Allow Preparable interface to work with only per-method prepare*() implementations by @lukaszlenart in https://github.com/apache/struts/pull/1417
WW-5585: Implement dynamic parameter evaluation for file upload validation by @lukaszlenart in https://github.com/apache/struts/pull/1413
Fixes site and JavaDocs generation by @lukaszlenart in https://github.com/apache/struts/pull/1419
WW-5582 Bump asm.version from 9.8 to 9.9 by @dependabot[bot] in https://github.com/apache/struts/pull/1381
Clean up obsolete Claude Code configurations by @lukaszlenart in https://github.com/apache/struts/pull/1433
WW-5256 Add configurable FreeMarker whitespace stripping and compress tag by @lukaszlenart in https://github.com/apache/struts/pull/1418
WW-5256 Move compress constants to struts.tag.compress namespace by @lukaszlenart in https://github.com/apache/struts/pull/1446
WW-5595 Bump org.apache.commons:commons-text from 1.14.0 to 1.15.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1448
WW-5596 Bump byte-buddy.version from 1.17.7 to 1.18.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1450
WW-5598 Bump com.fasterxml.jackson:jackson-bom from 2.19.1 to 2.20.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1456
feat(release): uses release/struts-6-8-x as based branch for next Struts 6.x release by @lukaszlenart in https://github.com/apache/struts/pull/1457
WW-5444 Add HTML5 theme with comprehensive unit tests by @lukaszlenart in https://github.com/apache/struts/pull/1422
WW-5594 Fix convention plugin wildcard exclusion pattern for root packages by @lukaszlenart in https://github.com/apache/struts/pull/1468
WW-5593 Handle NoClassDefFoundError in convention plugin action class scanning by @lukaszlenart in https://github.com/apache/struts/pull/1469
Fix Textfield tag not allowing white space. WW-5592. by @gregh3269 in https://github.com/apache/struts/pull/1489
WW-5601 build(deps): bump commons-io:commons-io from 2.20.0 to 2.21.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1474
WW-5602 Fix StreamResult contentCharSet handling and refactor for extensibility by @lukaszlenart in https://github.com/apache/struts/pull/1510
WW-5603 Move xwork-default.xml to test resources by @lukaszlenart in https://github.com/apache/struts/pull/1513
chore(deps): excludes org.apache.tomcat:tomcat-api for Struts 6.x by @lukaszlenart in https://github.com/apache/struts/pull/1548
WW-5607 build(deps): bump com.fasterxml.jackson:jackson-bom from 2.20.1 to 2.21.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1545
WW-5536 Bump ognl:ognl from 3.3.5 to 3.4.8 by @dependabot[bot] in https://github.com/apache/struts/pull/1405
chore: updates SNAPSHOT version to reflect current scope of changes by @lukaszlenart in https://github.com/apache/struts/pull/1563
docs: streamline CLAUDE.md for clarity and conciseness by @lukaszlenart in https://github.com/apache/struts/pull/1568
WW-4291 Allow Spring bean names for type converters by @lukaszlenart in https://github.com/apache/struts/pull/1562
WW-3647 Change autowire alwaysRespect default to true by @lukaszlenart in https://github.com/apache/struts/pull/1571
WW-5614 Remove cache for ProxyUtil#ultimateTargetClass by @kusalk in https://github.com/apache/struts/pull/1578
WW-5294 Add warning when JSP tags accessed directly by @lukaszlenart in https://github.com/apache/struts/pull/1569
WW-3429 Add configurable checkbox hidden field prefix by @lukaszlenart in https://github.com/apache/struts/pull/1570
ci: use wildcard to exclude all Spring dependencies from 6.x updates by @lukaszlenart in https://github.com/apache/struts/pull/1587
WW-4421 Fix duplicate @Action annotation check being skipped by @lukaszlenart in https://github.com/apache/struts/pull/1579
WW-5514 Add StrutsProxyService for proxy detection and resolution by @lukaszlenart in https://github.com/apache/struts/pull/1586
WW-5535 Fix HttpMethodInterceptor with wildcard action names by @lukaszlenart in https://github.com/apache/struts/pull/1592
docs: streamline CLAUDE.md based on benchmark findings by @lukaszlenart in https://github.com/apache/struts/pull/1604
WW-5549 Fix I18nInterceptor supportedLocale breaking request_locale by @lukaszlenart in https://github.com/apache/struts/pull/1594
chore: remove project-specific test-runner agent by @lukaszlenart in https://github.com/apache/struts/pull/1613
WW-4428 Add java.time support to JSON plugin by @lukaszlenart in https://github.com/apache/struts/pull/1603
WW-2963 default-action-ref fails to find wildcard named actions by @lukaszlenart in https://github.com/apache/struts/pull/1614
WW-5617 Replace printStackTrace() with System.err in CompileReport by @Senrian in https://github.com/apache/struts/pull/1606
Harden showcase apps and convert READMEs to Markdown by @lukaszlenart in https://github.com/apache/struts/pull/1624
WW-5618 Add configurable limits to JSON plugin by @lukaszlenart in https://github.com/apache/struts/pull/1625
WW-5537 Resolve classloader/memory leaks during Tomcat hot deployment by @lukaszlenart in https://github.com/apache/struts/pull/1632
WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks by @lukaszlenart in https://github.com/apache/struts/pull/1642
WW-5622 Optimize Hibernate proxy detection when Hibernate is absent by @lukaszlenart in https://github.com/apache/struts/pull/1649
fix(core): WW-5623 HTML-encode form action in PostbackResult to prevent XSS by @tranquac in https://github.com/apache/struts/pull/1653
WW-5624: Enforce @StrutsParameter on JSON/REST body deserialization by @tranquac in https://github.com/apache/struts/pull/1657
WW-5626 cleanup follow-ups for @StrutsParameter JSON/REST enforcement by @lukaszlenart in https://github.com/apache/struts/pull/1673
WW-5626 per-property authorization for Jackson REST handlers by @lukaszlenart in https://github.com/apache/struts/pull/1674
chore(agents): defines a new AGENTS.md focused on reporting vulnerabilities by @lukaszlenart in https://github.com/apache/struts/pull/1680
WW-5627 Gate CookieInterceptor through ParameterAuthorizer by @lukaszlenart in https://github.com/apache/struts/pull/1681
chore(rat): excludes Markdown files in docs/ folder by @lukaszlenart in https://github.com/apache/struts/pull/1691
fix(core): enforce class-level HTTP method annotations for wildcard-resolved unannotated methods by @g0w6y in https://github.com/apache/struts/pull/1690
WW-5535 test(core): cover wildcard-resolved unannotated methods via real proxy by @lukaszlenart in https://github.com/apache/struts/pull/1692
WW-5631 Add opt-in @StrutsParameter enforcement to ChainingInterceptor by @lukaszlenart in https://github.com/apache/struts/pull/1719
WW-5630 - Performance Issue SecurityMemberAccess by @brianandle in https://github.com/apache/struts/pull/1721
WW-5632 Harden commons-fileupload2 dependency against milestone binary-incompatibility by @lukaszlenart in https://github.com/apache/struts/pull/1735
WW-5630 Streamline ConfigParseUtilTest and convert to JUnit 4 by @lukaszlenart in https://github.com/apache/struts/pull/1740
WW-5636 Harden redirect URL escaping in non-302 response body by @arunmanni-ai in https://github.com/apache/struts/pull/1737
WW-5635 Avoid logging sensitive token values in TokenHelper by @arunmanni-ai in https://github.com/apache/struts/pull/1738
WW-5548 Defines proper request attributes when forwarding or including final path by @lukaszlenart in https://github.com/apache/struts/pull/1265

Dependencies

Bump actions/upload-artifact from 4.6.0 to 4.6.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1227
Bump github/codeql-action from 3.28.9 to 3.28.10 by @dependabot[bot] in https://github.com/apache/struts/pull/1228
Bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1229
Bump com.fasterxml.jackson:jackson-bom from 2.18.2 to 2.18.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1238
Bump org.eclipse.transformer:transformer-maven-plugin from 0.5.0 to 1.0.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1216
Bump github/codeql-action from 3.28.10 to 3.28.15 by @dependabot[bot] in https://github.com/apache/struts/pull/1253
Bump actions/upload-artifact from 4.6.1 to 4.6.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1247
Bump org.apache.maven.doxia:doxia-module-markdown from 1.12.0 to 2.0.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1245
Bump byte-buddy.version from 1.17.1 to 1.17.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1244
Bump org.apache.maven.plugins:maven-site-plugin from 3.20.0 to 3.21.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1256
Bump org.owasp:dependency-check-maven from 10.0.4 to 12.1.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1259
Bump github/codeql-action from 3.28.15 to 3.28.17 by @dependabot[bot] in https://github.com/apache/struts/pull/1261
Bump org.htmlunit:htmlunit from 4.9.0 to 4.11.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1258
Bump org.apache.felix:maven-bundle-plugin from 5.1.9 to 6.0.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1271
Bump org.apache.maven.plugins:maven-project-info-reports-plugin from 3.8.0 to 3.9.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1269
Bump byte-buddy.version from 1.17.2 to 1.17.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1268
Bump org.awaitility:awaitility from 4.2.2 to 4.3.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1276
Bump github/codeql-action from 3.28.17 to 3.29.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1280
Bump jasperreports7.version from 7.0.1 to 7.0.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1275
Bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1278
Bump com.github.ben-manes.caffeine:caffeine from 3.2.0 to 3.2.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1282
Bump github/codeql-action from 3.29.0 to 3.29.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1288
Bump weld.version from 6.0.2.Final to 6.0.3.Final by @dependabot[bot] in https://github.com/apache/struts/pull/1284
Bump org.easymock:easymock from 5.4.0 to 5.6.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1287
Bump org.owasp:dependency-check-maven from 12.1.1 to 12.1.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1290
Bump maven-surefire-plugin.version from 3.5.2 to 3.5.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1291
Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.2 to 3.5.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1292
Bump org.apache.commons:commons-text from 1.13.0 to 1.13.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1293
Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.5.0 to 3.6.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1296
Bump com.github.ben-manes.caffeine:caffeine from 3.2.1 to 3.2.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1297
Bump org.htmlunit:htmlunit from 4.11.1 to 4.13.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1298
Bump org.jfree:jfreechart from 1.5.5 to 1.5.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1299
Bump org.codehaus.mojo:exec-maven-plugin from 3.5.0 to 3.5.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1301
Bump org.springframework:spring-framework-bom from 6.2.3 to 6.2.9 by @dependabot[bot] in https://github.com/apache/struts/pull/1304
Bump github/codeql-action from 3.29.2 to 3.29.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1305
Bump org.apache.commons:commons-fileupload2-jakarta-servlet6 from 2.0.0-M2 to 2.0.0-M4 by @dependabot[bot] in https://github.com/apache/struts/pull/1283
Bump slf4j.version from 2.0.16 to 2.0.17 by @dependabot[bot] in https://github.com/apache/struts/pull/1313
Bump github/codeql-action from 3.29.5 to 3.29.9 by @dependabot[bot] in https://github.com/apache/struts/pull/1314
Bump actions/checkout from 4 to 5 by @dependabot[bot] in https://github.com/apache/struts/pull/1315
Bump byte-buddy.version from 1.17.5 to 1.17.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1302
Bump github/codeql-action from 3.29.9 to 3.29.11 by @dependabot[bot] in https://github.com/apache/struts/pull/1320
Bump actions/setup-java from 4 to 5 by @dependabot[bot] in https://github.com/apache/struts/pull/1321
Bump github/codeql-action from 3.29.11 to 3.30.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1326
Bump byte-buddy.version from 1.17.6 to 1.17.7 by @dependabot[bot] in https://github.com/apache/struts/pull/1331
Bump org.htmlunit:htmlunit from 4.13.0 to 4.16.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1332
Bump github/codeql-action from 3.30.1 to 3.30.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1333
Bump org.apache.rat:apache-rat-plugin from 0.15 to 0.16.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1339
Bump github/codeql-action from 3.30.2 to 3.30.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1341
Bump org.eclipse.jetty:jetty-maven-plugin from 11.0.18 to 11.0.26 by @dependabot[bot] in https://github.com/apache/struts/pull/1347
Bump org.springframework:spring-framework-bom from 6.2.9 to 6.2.11 by @dependabot[bot] in https://github.com/apache/struts/pull/1348
Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.11.2 to 3.11.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1349
Bump org.assertj:assertj-core from 3.27.3 to 3.27.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1350
Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.3 to 3.5.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1358
Bump org.codehaus.mojo:versions-maven-plugin from 2.18.0 to 2.19.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1360
Bump github/codeql-action from 3.30.3 to 3.30.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1368
Bump org.jacoco:jacoco-maven-plugin from 0.8.12 to 0.8.13 by @dependabot[bot] in https://github.com/apache/struts/pull/1372
Bump org.apache.logging.log4j:log4j-bom from 2.25.1 to 2.25.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1374
Bump org.assertj:assertj-core from 3.27.4 to 3.27.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1375
build(deps): bump github/codeql-action from 4.32.1 to 4.32.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1574
build(deps): bump org.apache.maven.plugins:maven-dependency-plugin from 3.9.0 to 3.10.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1575
build(deps): WW-5613 bump ognl:ognl from 3.4.8 to 3.4.10 by @dependabot[bot] in https://github.com/apache/struts/pull/1567
build(deps-dev): bump byte-buddy.version from 1.18.4 to 1.18.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1583
build(deps): bump github/codeql-action from 4.32.2 to 4.32.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1580
build(deps): WW-5615 bump org.apache.commons:commons-fileupload2-jakarta-servlet6 from 2.0.0-M4 to 2.0.0-M5 by @dependabot[bot] in https://github.com/apache/struts/pull/1584
conf(git): Ignores Cursor related paths by @lukaszlenart in https://github.com/apache/struts/pull/1585
build(deps): bump org.springframework:spring-framework-bom from 6.2.12 to 7.0.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1581
build(deps): bump github/codeql-action from 4.32.3 to 4.32.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1589
build(deps): bump org.springframework:spring-framework-bom from 6.2.12 to 7.0.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1588
build(deps-dev): bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.4 to 3.5.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1595
build(deps): bump maven-surefire-plugin.version from 3.5.4 to 3.5.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1596
build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.0 to 2.21.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1597
build(deps-dev): bump byte-buddy.version from 1.18.5 to 1.18.7 by @dependabot[bot] in https://github.com/apache/struts/pull/1607
build(deps): bump org.mockito:mockito-core from 5.21.0 to 5.22.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1609
build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1612
build(deps): bump github/codeql-action from 4.32.4 to 4.32.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1611
build(deps): bump org.apache.felix:maven-bundle-plugin from 6.0.0 to 6.0.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1610
Bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1379
Bump org.apache.maven.plugins:maven-wrapper-plugin from 3.3.2 to 3.3.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1382
Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.1 to 3.6.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1383
Bump maven-surefire-plugin.version from 3.5.3 to 3.5.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1384
Bump github/codeql-action from 3.30.5 to 4.30.8 by @dependabot[bot] in https://github.com/apache/struts/pull/1389
Bump org.htmlunit:htmlunit from 4.16.0 to 4.17.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1396
Bump org.codehaus.groovy:groovy-jsr223 from 3.0.22 to 3.0.25 by @dependabot[bot] in https://github.com/apache/struts/pull/1398
Bump org.owasp:dependency-check-maven from 12.1.3 to 12.1.8 by @dependabot[bot] in https://github.com/apache/struts/pull/1399
Bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1400
Bump github/codeql-action from 4.30.8 to 4.31.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1401
Bump github/codeql-action from 4.31.0 to 4.31.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1402
Bump com.github.ben-manes.caffeine:caffeine from 3.2.2 to 3.2.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1403
Bump org.springframework:spring-framework-bom from 6.2.11 to 6.2.12 by @dependabot[bot] in https://github.com/apache/struts/pull/1404
Bump actions/checkout from 5 to 6 by @dependabot[bot] in https://github.com/apache/struts/pull/1423
Bump github/codeql-action from 4.31.2 to 4.31.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1424
Bump org.owasp:dependency-check-maven from 12.1.8 to 12.1.9 by @dependabot[bot] in https://github.com/apache/struts/pull/1430
Bump org.glassfish.jaxb:jaxb-bom from 4.0.5 to 4.0.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1432
Bump org.apache.rat:apache-rat-plugin from 0.16.1 to 0.17 by @dependabot[bot] in https://github.com/apache/struts/pull/1406
Bump github/codeql-action from 4.31.4 to 4.31.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1435
Bump org.codehaus.mojo:exec-maven-plugin from 3.5.1 to 3.6.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1441
Bump org.apache.maven.plugins:maven-release-plugin from 3.1.1 to 3.2.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1442
Bump org.apache.maven.plugins:maven-dependency-plugin from 3.8.1 to 3.9.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1443
Bump org.apache.maven.plugins:maven-assembly-plugin from 3.7.1 to 3.8.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1444
Bump github/codeql-action from 4.31.5 to 4.31.7 by @dependabot[bot] in https://github.com/apache/struts/pull/1447
Bump org.apache.maven.plugins:maven-war-plugin from 3.4.0 to 3.5.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1449
Bump org.jacoco:jacoco-maven-plugin from 0.8.13 to 0.8.14 by @dependabot[bot] in https://github.com/apache/struts/pull/1459
Bump org.codehaus.mojo:versions-maven-plugin from 2.19.0 to 2.20.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1463
Bump org.apache.maven.plugins:maven-release-plugin from 3.2.0 to 3.3.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1460
Bump org.springframework:spring-framework-bom from 6.2.12 to 7.0.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1467
build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1470
build(deps): bump github/codeql-action from 4.31.7 to 4.31.8 by @dependabot[bot] in https://github.com/apache/struts/pull/1471
build(deps): bump org.mockito:mockito-core from 5.20.0 to 5.21.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1472
build(deps): bump org.apache.maven.plugins:maven-release-plugin from 3.3.0 to 3.3.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1473
build(deps): bump github/codeql-action from 4.31.8 to 4.31.9 by @dependabot[bot] in https://github.com/apache/struts/pull/1481
build(deps): bump org.apache.logging.log4j:log4j-bom from 2.25.2 to 2.25.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1482
build(deps): bump asm.version from 9.9 to 9.9.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1483
build(deps-dev): bump commons-validator:commons-validator from 1.10.0 to 1.10.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1490
build(deps-dev): bump byte-buddy.version from 1.18.2 to 1.18.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1491
chore(deps): ignore incompatible updates for release/struts-6-8-x by @lukaszlenart in https://github.com/apache/struts/pull/1497
build(deps): bump org.springframework:spring-framework-bom from 6.2.12 to 7.0.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1475
build(deps): bump org.apache.maven.plugins:maven-source-plugin from 3.3.1 to 3.4.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1502
build(deps): bump org.codehaus.mojo:exec-maven-plugin from 3.6.2 to 3.6.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1503
build(deps): bump org.htmlunit:htmlunit from 4.17.0 to 4.21.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1504
Excludes some deps in 6.x by @lukaszlenart in https://github.com/apache/struts/pull/1514
build(deps): bump org.owasp:dependency-check-maven from 12.1.9 to 12.2.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1518
build(deps): bump github/codeql-action from 4.31.9 to 4.31.10 by @dependabot[bot] in https://github.com/apache/struts/pull/1521
Ignores incompatible dependencies with Struts 6.x by @lukaszlenart in https://github.com/apache/struts/pull/1526
build(deps-dev): bump weld.version from 6.0.3.Final to 6.0.4.Final by @dependabot[bot] in https://github.com/apache/struts/pull/1530
Ignores some dependencies for update in 6.x by @lukaszlenart in https://github.com/apache/struts/pull/1533
build(deps): WW-5605 bump org.apache.juneau:juneau-marshall from 8.1.3 to 9.2.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1512
build(deps-dev): bump byte-buddy.version from 1.18.3 to 1.18.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1537
build(deps-dev): bump org.codehaus.mojo:versions-maven-plugin from 2.20.1 to 2.21.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1538
build(deps): bump org.springframework:spring-framework-bom from 6.2.12 to 7.0.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1540
Excludes some dependencies from upgrade in 6.x by @lukaszlenart in https://github.com/apache/struts/pull/1541
build(deps): bump org.assertj:assertj-core from 3.27.6 to 3.27.7 by @dependabot[bot] in https://github.com/apache/struts/pull/1552
build(deps): bump org.testng:testng from 7.11.0 to 7.12.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1553
build(deps): bump github/codeql-action from 4.31.10 to 4.31.11 by @dependabot[bot] in https://github.com/apache/struts/pull/1551
fix(conf): drops deprecated del_branch_on_merge by @lukaszlenart in https://github.com/apache/struts/pull/1555
build(deps): bump github/codeql-action from 4.31.11 to 4.32.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1556
build(deps): excludes upgrading Tomcat 11 libraries by @lukaszlenart in https://github.com/apache/struts/pull/1559
build(deps): bump github/codeql-action from 4.32.0 to 4.32.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1566
build(deps): bump github/codeql-action from 4.32.5 to 4.32.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1619
build(deps-dev): bump commons-logging:commons-logging from 1.3.5 to 1.3.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1620
build(deps): bump net.sf.jasperreports:jasperreports from 7.0.3 to 7.0.4 in /plugins/jasperreports7 by @dependabot[bot] in https://github.com/apache/struts/pull/1618
build(deps): bump github/codeql-action from 4.32.6 to 4.33.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1627
build(deps): bump org.glassfish.jaxb:jaxb-bom from 4.0.6 to 4.0.7 by @dependabot[bot] in https://github.com/apache/struts/pull/1628
build(deps): bump org.mockito:mockito-core from 5.22.0 to 5.23.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1629
build(deps): bump github/codeql-action from 4.33.0 to 4.34.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1633
deps(rat): excludes updatding the RAT plugin as it requires Java 17 by @lukaszlenart in https://github.com/apache/struts/pull/1641
build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.1 to 2.21.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1634
build(deps): bump org.apache.rat:apache-rat-plugin from 0.17 to 0.18 by @dependabot[bot] in https://github.com/apache/struts/pull/1639
build(deps): bump org.apache.maven.doxia:doxia-core from 2.0.0 to 2.1.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1640
build(deps): bump github/codeql-action from 4.34.1 to 4.35.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1645
build(deps-dev): bump byte-buddy.version from 1.18.7 to 1.18.8 by @dependabot[bot] in https://github.com/apache/struts/pull/1646
build(deps): bump org.apache.logging.log4j:log4j-bom from 2.25.3 to 2.25.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1648
ci(dependabot): add cooldown by @lukaszlenart in https://github.com/apache/struts/pull/1656
build(deps): bump ognl:ognl from 3.4.10 to 3.4.11 by @dependabot[bot] in https://github.com/apache/struts/pull/1655
ci(struts6): adjusts workflows to use the new branch by @lukaszlenart in https://github.com/apache/struts/pull/1659
cd(checks): uses proper context names for checks by @lukaszlenart in https://github.com/apache/struts/pull/1660
build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1663
build(deps): bump org.owasp:dependency-check-maven from 12.2.0 to 12.2.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1664
introduce private method to remove clones by @aaaZayne in https://github.com/apache/struts/pull/1666
build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1668
build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.2 to 2.21.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1669
build(deps): WW-5625 bump commons-io:commons-io from 2.21.0 to 2.22.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1672
Uses proper config to avoid failing a build when generating JavaDocs by @lukaszlenart in https://github.com/apache/struts/pull/1240
Uses new url for Maven Badges app by @lukaszlenart in https://github.com/apache/struts/pull/1252
Adjusts required checks to the new structure by @lukaszlenart in https://github.com/apache/struts/pull/1264
Uses proper name of check to pass by @lukaszlenart in https://github.com/apache/struts/pull/1266
Fixes build check for Struts 6.x by @lukaszlenart in https://github.com/apache/struts/pull/1308
Defines basic set of files to work with Claude Code by @lukaszlenart in https://github.com/apache/struts/pull/1295
Enables Dependabot to support all the main branches by @lukaszlenart in https://github.com/apache/struts/pull/1327
Reverse merge changes from release/7.1.0 by @lukaszlenart in https://github.com/apache/struts/pull/1364
build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1675
build(deps): bump org.glassfish.jaxb:jaxb-bom from 4.0.7 to 4.0.8 by @dependabot[bot] in https://github.com/apache/struts/pull/1676
build(deps): bump org.owasp:dependency-check-maven from 12.2.1 to 12.2.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1677
build(deps): bump com.github.ben-manes.caffeine:caffeine from 3.2.3 to 3.2.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1679
build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1682
build(deps): bump slf4j.version from 2.0.17 to 2.0.18 by @dependabot[bot] in https://github.com/apache/struts/pull/1683
build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1694
build(deps-dev): bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1698
ci(dependabot): fix cooldown property name by @lukaszlenart in https://github.com/apache/struts/pull/1702
build(deps): WW-5628 bump asm.version from 9.9.1 to 9.10 by @dependabot[bot] in https://github.com/apache/struts/pull/1695
build(deps): WW-5629 bump org.apache.logging.log4j:log4j-bom from 2.25.4 to 2.26.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1685
security(versions): updates list of supported versions by @lukaszlenart in https://github.com/apache/struts/pull/1708
build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1710
build(deps): bump org.apache.maven.plugins:maven-site-plugin from 3.21.0 to 3.22.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1711
build(deps): bump asm.version from 9.10 to 9.10.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1713
docs(skills): add triaging-security-reports skill by @lukaszlenart in https://github.com/apache/struts/pull/1722
build(deps): bump maven-surefire-plugin.version from 3.5.5 to 3.5.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1731
build(deps): bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1730
build(deps): bump github/codeql-action from 4.36.0 to 4.36.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1734
build(deps-dev): bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.5.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1732
build(deps): WW-5633 bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1729
build(deps): WW-5634 bump org.htmlunit:htmlunit from 4.21.0 to 5.1.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1733

New Contributors

@bill-humblcloud made their first contribution in https://github.com/apache/struts/pull/1223
@MFAshby made their first contribution in https://github.com/apache/struts/pull/1309
@Senrian made their first contribution in https://github.com/apache/struts/pull/1606
@aaaZayne made their first contribution in https://github.com/apache/struts/pull/1666
@tranquac made their first contribution in https://github.com/apache/struts/pull/1653
@g0w6y made their first contribution in https://github.com/apache/struts/pull/1690
@arunmanni-ai made their first contribution in https://github.com/apache/struts/pull/1737

Full Changelog: https://github.com/apache/struts/compare/STRUTS_7_0_3…STRUTS_7_2_0

Source apache/struts · STRUTS_7_2_1 · 2026-06-14 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.

Release notes are published by the upstream project and mirrored here for indexing. All rights belong to their authors.