The Apache Struts web framework Files

What's Changed

• WW-5529 Adds autogenerated files with updated desc by @lukaszlenart in https://github.com/apache/struts/pull/1224
• WW-5532 Upgrade and align various dependencies by @kusalk in https://github.com/apache/struts/pull/1232
• WW-5376 Fix BOM leaking unrelated dependencies by @kusalk in https://github.com/apache/struts/pull/1234
• WW-5533 Add compilation support for Jakarta EE 11 by @kusalk in https://github.com/apache/struts/pull/1233
• WW-5530 make DateConverter work for LocalDate and LocalTime by @bill-humblcloud in https://github.com/apache/struts/pull/1223
• WW-5527 Sync tag with main ftl template. by @gregh3269 in https://github.com/apache/struts/pull/1212
• WW-5534 Simplify ProxyUtil, add OgnlCache#computeIfAbsent by @kusalk in https://github.com/apache/struts/pull/1236
• WW-5534 Allow @StrutsParameter recognition and OGNL allowlist for Spring proxies by @kusalk in https://github.com/apache/struts/pull/1237
• WW-5538 Add conversion handling for java.time.OffsetDateTime by @bill-humblcloud in https://github.com/apache/struts/pull/1241
• WW-5455 Defines a new plugin to support Jasper Reports 7 by @lukaszlenart in https://github.com/apache/struts/pull/1124
• WW-5534 Proper fix ModelDriven parameter injection and allowlisting by @kusalk in https://github.com/apache/struts/pull/1243
• WW-5544 Marks ReflectionContextFactory as deprecated and uses ActionContext instead by @lukaszlenart in https://github.com/apache/struts/pull/1255
• WW-5547 Bump com.github.ben-manes.caffeine:caffeine from 3.1.8 to 3.2.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1257
• WW-5546 Fixes NPE when uploaded file is empty by @lukaszlenart in https://github.com/apache/struts/pull/1263
• WW-5550 Bump asm.version from 9.7.1 to 9.8 by @dependabot[bot] in https://github.com/apache/struts/pull/1274
• WW-5551 Bump commons-beanutils:commons-beanutils from 1.9.4 to 1.11.0 in /parent by @dependabot[bot] in https://github.com/apache/struts/pull/1277
• WW-5552 Bump weld.version from 5.1.2.Final to 6.0.2.Final by @dependabot[bot] in https://github.com/apache/struts/pull/1270
• WW-5553 Bump com.fasterxml.jackson:jackson-bom from 2.18.3 to 2.19.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1281
• WW-5557 Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.18.0 in /parent by @dependabot[bot] in https://github.com/apache/struts/pull/1289
• WW-5554 Bump org.apache.struts:struts-annotations from 1.0.8 to 2.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1311
• WW-5561 Bump org.apache.commons:commons-text from 1.13.1 to 1.14.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1312
• WW-5366 Rejects empty files during upload by @lukaszlenart in https://github.com/apache/struts/pull/1307
• WW-5524 Fixup StrutsConverterFactory by @MFAshby in https://github.com/apache/struts/pull/1309
• WW-5502 Removes deprecated sanitizeNewlines method by @lukaszlenart in https://github.com/apache/struts/pull/1319
• WW-5511 Adds missing JavaDocs to addCspHeaders method by @lukaszlenart in https://github.com/apache/struts/pull/1318
• WW-5565 Bump org.apache.commons:commons-collections4 from 4.4 to 4.5.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1323
• WW-5566 Bump commons-validator:commons-validator from 1.9.0 to 1.10.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1325
• WW-5567 Bump org.apache.logging.log4j:log4j-bom from 2.24.3 to 2.25.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1336
• WW-5569 Bump org.apache.commons:commons-compress from 1.27.1 to 1.28.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1338
• WW-5504 Allows to use request instead of session attribute to store nonce by @lukaszlenart in https://github.com/apache/struts/pull/1352
• Improves CLAUDE.md and defines specific subagents by @lukaszlenart in https://github.com/apache/struts/pull/1363
• WW-5572 Bump org.mockito:mockito-core from 5.15.2 to 5.20.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1362
• WW-5575 Upgrades commons-io to version 2.20.0 by @lukaszlenart in https://github.com/apache/struts/pull/1367
• WW-5574 Upgrades commons-logging to version 1.3.5 by @lukaszlenart in https://github.com/apache/struts/pull/1366
• Improve Claude Code agents configuration for Apache Struts by @lukaszlenart in https://github.com/apache/struts/pull/1376
• WW-5573 Avoids false positive warning if file doesn't exist already by @lukaszlenart in https://github.com/apache/struts/pull/1365
• WW-5577 Bump org.apache.commons:commons-lang3 from 3.18.0 to 3.19.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1373
• Fix Claude Code settings by @lukaszlenart in https://github.com/apache/struts/pull/1388
• Add tests for conversion error repopulation with indexed properties by @lukaszlenart in https://github.com/apache/struts/pull/1391
• WW-5579 Add missing DoubleRangeFieldValidator and ShortRangeFieldValidator to @Validations container by @lukaszlenart in https://github.com/apache/struts/pull/1390
• Reverse merge changes related to releasing Struts 7.1.1 by @lukaszlenart in https://github.com/apache/struts/pull/1378
• WW-5578 Don't catch and swallow ConfigurationException in InterceptorBuilder. by @MFAshby in https://github.com/apache/struts/pull/1377
• WW-5576 Java 25 build by @lukaszlenart in https://github.com/apache/struts/pull/1415
• WW-5586 fix(core): enable WithLazyParams interceptor configuration in stacks by @lukaszlenart in https://github.com/apache/struts/pull/1414
• WW-5587 fix(core): preserve parameters in InterceptorMapping for WithLazyParams interceptors by @lukaszlenart in https://github.com/apache/struts/pull/1416
• WW-5588 Allow Preparable interface to work with only per-method prepare*() implementations by @lukaszlenart in https://github.com/apache/struts/pull/1417
• WW-5585: Implement dynamic parameter evaluation for file upload validation by @lukaszlenart in https://github.com/apache/struts/pull/1413
• Fixes site and JavaDocs generation by @lukaszlenart in https://github.com/apache/struts/pull/1419
• WW-5582 Bump asm.version from 9.8 to 9.9 by @dependabot[bot] in https://github.com/apache/struts/pull/1381
• Clean up obsolete Claude Code configurations by @lukaszlenart in https://github.com/apache/struts/pull/1433
• WW-5256 Add configurable FreeMarker whitespace stripping and compress tag by @lukaszlenart in https://github.com/apache/struts/pull/1418
• WW-5256 Move compress constants to struts.tag.compress namespace by @lukaszlenart in https://github.com/apache/struts/pull/1446
• WW-5595 Bump org.apache.commons:commons-text from 1.14.0 to 1.15.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1448
• WW-5596 Bump byte-buddy.version from 1.17.7 to 1.18.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1450
• WW-5598 Bump com.fasterxml.jackson:jackson-bom from 2.19.1 to 2.20.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1456
• feat(release): uses release/struts-6-8-x as based branch for next Struts 6.x release by @lukaszlenart in https://github.com/apache/struts/pull/1457
• WW-5444 Add HTML5 theme with comprehensive unit tests by @lukaszlenart in https://github.com/apache/struts/pull/1422
• WW-5594 Fix convention plugin wildcard exclusion pattern for root packages by @lukaszlenart in https://github.com/apache/struts/pull/1468
• WW-5593 Handle NoClassDefFoundError in convention plugin action class scanning by @lukaszlenart in https://github.com/apache/struts/pull/1469
• Fix Textfield tag not allowing white space. WW-5592. by @gregh3269 in https://github.com/apache/struts/pull/1489
• WW-5601 build(deps): bump commons-io:commons-io from 2.20.0 to 2.21.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1474
• WW-5602 Fix StreamResult contentCharSet handling and refactor for extensibility by @lukaszlenart in https://github.com/apache/struts/pull/1510
• WW-5603 Move xwork-default.xml to test resources by @lukaszlenart in https://github.com/apache/struts/pull/1513
• chore(deps): excludes org.apache.tomcat:tomcat-api for Struts 6.x by @lukaszlenart in https://github.com/apache/struts/pull/1548
• WW-5607 build(deps): bump com.fasterxml.jackson:jackson-bom from 2.20.1 to 2.21.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1545
• WW-5536 Bump ognl:ognl from 3.3.5 to 3.4.8 by @dependabot[bot] in https://github.com/apache/struts/pull/1405
• chore: updates SNAPSHOT version to reflect current scope of changes by @lukaszlenart in https://github.com/apache/struts/pull/1563
• docs: streamline CLAUDE.md for clarity and conciseness by @lukaszlenart in https://github.com/apache/struts/pull/1568
• WW-4291 Allow Spring bean names for type converters by @lukaszlenart in https://github.com/apache/struts/pull/1562
• WW-3647 Change autowire alwaysRespect default to true by @lukaszlenart in https://github.com/apache/struts/pull/1571
• WW-5614 Remove cache for ProxyUtil#ultimateTargetClass by @kusalk in https://github.com/apache/struts/pull/1578
• WW-5294 Add warning when JSP tags accessed directly by @lukaszlenart in https://github.com/apache/struts/pull/1569
• WW-3429 Add configurable checkbox hidden field prefix by @lukaszlenart in https://github.com/apache/struts/pull/1570
• ci: use wildcard to exclude all Spring dependencies from 6.x updates by @lukaszlenart in https://github.com/apache/struts/pull/1587
• WW-4421 Fix duplicate @Action annotation check being skipped by @lukaszlenart in https://github.com/apache/struts/pull/1579
• WW-5514 Add StrutsProxyService for proxy detection and resolution by @lukaszlenart in https://github.com/apache/struts/pull/1586
• WW-5535 Fix HttpMethodInterceptor with wildcard action names by @lukaszlenart in https://github.com/apache/struts/pull/1592
• docs: streamline CLAUDE.md based on benchmark findings by @lukaszlenart in https://github.com/apache/struts/pull/1604
• WW-5549 Fix I18nInterceptor supportedLocale breaking request_locale by @lukaszlenart in https://github.com/apache/struts/pull/1594
• chore: remove project-specific test-runner agent by @lukaszlenart in https://github.com/apache/struts/pull/1613
• WW-4428 Add java.time support to JSON plugin by @lukaszlenart in https://github.com/apache/struts/pull/1603
• WW-2963 default-action-ref fails to find wildcard named actions by @lukaszlenart in https://github.com/apache/struts/pull/1614
• WW-5617 Replace printStackTrace() with System.err in CompileReport by @Senrian in https://github.com/apache/struts/pull/1606
• Harden showcase apps and convert READMEs to Markdown by @lukaszlenart in https://github.com/apache/struts/pull/1624
• WW-5618 Add configurable limits to JSON plugin by @lukaszlenart in https://github.com/apache/struts/pull/1625
• WW-5537 Resolve classloader/memory leaks during Tomcat hot deployment by @lukaszlenart in https://github.com/apache/struts/pull/1632
• WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks by @lukaszlenart in https://github.com/apache/struts/pull/1642
• WW-5622 Optimize Hibernate proxy detection when Hibernate is absent by @lukaszlenart in https://github.com/apache/struts/pull/1649
• fix(core): WW-5623 HTML-encode form action in PostbackResult to prevent XSS by @tranquac in https://github.com/apache/struts/pull/1653
• WW-5624: Enforce @StrutsParameter on JSON/REST body deserialization by @tranquac in https://github.com/apache/struts/pull/1657
• WW-5626 cleanup follow-ups for @StrutsParameter JSON/REST enforcement by @lukaszlenart in https://github.com/apache/struts/pull/1673
• WW-5626 per-property authorization for Jackson REST handlers by @lukaszlenart in https://github.com/apache/struts/pull/1674
• chore(agents): defines a new AGENTS.md focused on reporting vulnerabilities by @lukaszlenart in https://github.com/apache/struts/pull/1680
• WW-5627 Gate CookieInterceptor through ParameterAuthorizer by @lukaszlenart in https://github.com/apache/struts/pull/1681
• chore(rat): excludes Markdown files in docs/ folder by @lukaszlenart in https://github.com/apache/struts/pull/1691
• fix(core): enforce class-level HTTP method annotations for wildcard-resolved unannotated methods by @g0w6y in https://github.com/apache/struts/pull/1690
• WW-5535 test(core): cover wildcard-resolved unannotated methods via real proxy by @lukaszlenart in https://github.com/apache/struts/pull/1692
• WW-5631 Add opt-in @StrutsParameter enforcement to ChainingInterceptor by @lukaszlenart in https://github.com/apache/struts/pull/1719
• WW-5630 - Performance Issue SecurityMemberAccess by @brianandle in https://github.com/apache/struts/pull/1721
• WW-5632 Harden commons-fileupload2 dependency against milestone binary-incompatibility by @lukaszlenart in https://github.com/apache/struts/pull/1735
• WW-5630 Streamline ConfigParseUtilTest and convert to JUnit 4 by @lukaszlenart in https://github.com/apache/struts/pull/1740
• WW-5636 Harden redirect URL escaping in non-302 response body by @arunmanni-ai in https://github.com/apache/struts/pull/1737
• WW-5635 Avoid logging sensitive token values in TokenHelper by @arunmanni-ai in https://github.com/apache/struts/pull/1738
• WW-5548 Defines proper request attributes when forwarding or including final path by @lukaszlenart in https://github.com/apache/struts/pull/1265

Dependencies

• Bump actions/upload-artifact from 4.6.0 to 4.6.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1227
• Bump github/codeql-action from 3.28.9 to 3.28.10 by @dependabot[bot] in https://github.com/apache/struts/pull/1228
• Bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1229
• Bump com.fasterxml.jackson:jackson-bom from 2.18.2 to 2.18.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1238
• Bump org.eclipse.transformer:transformer-maven-plugin from 0.5.0 to 1.0.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1216
• Bump github/codeql-action from 3.28.10 to 3.28.15 by @dependabot[bot] in https://github.com/apache/struts/pull/1253
• Bump actions/upload-artifact from 4.6.1 to 4.6.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1247
• Bump org.apache.maven.doxia:doxia-module-markdown from 1.12.0 to 2.0.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1245
• Bump byte-buddy.version from 1.17.1 to 1.17.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1244
• Bump org.apache.maven.plugins:maven-site-plugin from 3.20.0 to 3.21.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1256
• Bump org.owasp:dependency-check-maven from 10.0.4 to 12.1.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1259
• Bump github/codeql-action from 3.28.15 to 3.28.17 by @dependabot[bot] in https://github.com/apache/struts/pull/1261
• Bump org.htmlunit:htmlunit from 4.9.0 to 4.11.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1258
• Bump org.apache.felix:maven-bundle-plugin from 5.1.9 to 6.0.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1271
• Bump org.apache.maven.plugins:maven-project-info-reports-plugin from 3.8.0 to 3.9.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1269
• Bump byte-buddy.version from 1.17.2 to 1.17.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1268
• Bump org.awaitility:awaitility from 4.2.2 to 4.3.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1276
• Bump github/codeql-action from 3.28.17 to 3.29.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1280
• Bump jasperreports7.version from 7.0.1 to 7.0.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1275
• Bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1278
• Bump com.github.ben-manes.caffeine:caffeine from 3.2.0 to 3.2.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1282
• Bump github/codeql-action from 3.29.0 to 3.29.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1288
• Bump weld.version from 6.0.2.Final to 6.0.3.Final by @dependabot[bot] in https://github.com/apache/struts/pull/1284
• Bump org.easymock:easymock from 5.4.0 to 5.6.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1287
• Bump org.owasp:dependency-check-maven from 12.1.1 to 12.1.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1290
• Bump maven-surefire-plugin.version from 3.5.2 to 3.5.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1291
• Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.2 to 3.5.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1292
• Bump org.apache.commons:commons-text from 1.13.0 to 1.13.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1293
• Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.5.0 to 3.6.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1296
• Bump com.github.ben-manes.caffeine:caffeine from 3.2.1 to 3.2.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1297
• Bump org.htmlunit:htmlunit from 4.11.1 to 4.13.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1298
• Bump org.jfree:jfreechart from 1.5.5 to 1.5.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1299
• Bump org.codehaus.mojo:exec-maven-plugin from 3.5.0 to 3.5.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1301
• Bump org.springframework:spring-framework-bom from 6.2.3 to 6.2.9 by @dependabot[bot] in https://github.com/apache/struts/pull/1304
• Bump github/codeql-action from 3.29.2 to 3.29.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1305
• Bump org.apache.commons:commons-fileupload2-jakarta-servlet6 from 2.0.0-M2 to 2.0.0-M4 by @dependabot[bot] in https://github.com/apache/struts/pull/1283
• Bump slf4j.version from 2.0.16 to 2.0.17 by @dependabot[bot] in https://github.com/apache/struts/pull/1313
• Bump github/codeql-action from 3.29.5 to 3.29.9 by @dependabot[bot] in https://github.com/apache/struts/pull/1314
• Bump actions/checkout from 4 to 5 by @dependabot[bot] in https://github.com/apache/struts/pull/1315
• Bump byte-buddy.version from 1.17.5 to 1.17.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1302
• Bump github/codeql-action from 3.29.9 to 3.29.11 by @dependabot[bot] in https://github.com/apache/struts/pull/1320
• Bump actions/setup-java from 4 to 5 by @dependabot[bot] in https://github.com/apache/struts/pull/1321
• Bump github/codeql-action from 3.29.11 to 3.30.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1326
• Bump byte-buddy.version from 1.17.6 to 1.17.7 by @dependabot[bot] in https://github.com/apache/struts/pull/1331
• Bump org.htmlunit:htmlunit from 4.13.0 to 4.16.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1332
• Bump github/codeql-action from 3.30.1 to 3.30.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1333
• Bump org.apache.rat:apache-rat-plugin from 0.15 to 0.16.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1339
• Bump github/codeql-action from 3.30.2 to 3.30.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1341
• Bump org.eclipse.jetty:jetty-maven-plugin from 11.0.18 to 11.0.26 by @dependabot[bot] in https://github.com/apache/struts/pull/1347
• Bump org.springframework:spring-framework-bom from 6.2.9 to 6.2.11 by @dependabot[bot] in https://github.com/apache/struts/pull/1348
• Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.11.2 to 3.11.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1349
• Bump org.assertj:assertj-core from 3.27.3 to 3.27.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1350
• Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.3 to 3.5.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1358
• Bump org.codehaus.mojo:versions-maven-plugin from 2.18.0 to 2.19.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1360
• Bump github/codeql-action from 3.30.3 to 3.30.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1368
• Bump org.jacoco:jacoco-maven-plugin from 0.8.12 to 0.8.13 by @dependabot[bot] in https://github.com/apache/struts/pull/1372
• Bump org.apache.logging.log4j:log4j-bom from 2.25.1 to 2.25.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1374
• Bump org.assertj:assertj-core from 3.27.4 to 3.27.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1375
• build(deps): bump github/codeql-action from 4.32.1 to 4.32.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1574
• build(deps): bump org.apache.maven.plugins:maven-dependency-plugin from 3.9.0 to 3.10.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1575
• build(deps): WW-5613 bump ognl:ognl from 3.4.8 to 3.4.10 by @dependabot[bot] in https://github.com/apache/struts/pull/1567
• build(deps-dev): bump byte-buddy.version from 1.18.4 to 1.18.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1583
• build(deps): bump github/codeql-action from 4.32.2 to 4.32.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1580
• build(deps): WW-5615 bump org.apache.commons:commons-fileupload2-jakarta-servlet6 from 2.0.0-M4 to 2.0.0-M5 by @dependabot[bot] in https://github.com/apache/struts/pull/1584
• conf(git): Ignores Cursor related paths by @lukaszlenart in https://github.com/apache/struts/pull/1585
• build(deps): bump org.springframework:spring-framework-bom from 6.2.12 to 7.0.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1581
• build(deps): bump github/codeql-action from 4.32.3 to 4.32.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1589
• build(deps): bump org.springframework:spring-framework-bom from 6.2.12 to 7.0.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1588
• build(deps-dev): bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.4 to 3.5.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1595
• build(deps): bump maven-surefire-plugin.version from 3.5.4 to 3.5.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1596
• build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.0 to 2.21.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1597
• build(deps-dev): bump byte-buddy.version from 1.18.5 to 1.18.7 by @dependabot[bot] in https://github.com/apache/struts/pull/1607
• build(deps): bump org.mockito:mockito-core from 5.21.0 to 5.22.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1609
• build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1612
• build(deps): bump github/codeql-action from 4.32.4 to 4.32.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1611
• build(deps): bump org.apache.felix:maven-bundle-plugin from 6.0.0 to 6.0.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1610
• Bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1379
• Bump org.apache.maven.plugins:maven-wrapper-plugin from 3.3.2 to 3.3.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1382
• Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.1 to 3.6.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1383
• Bump maven-surefire-plugin.version from 3.5.3 to 3.5.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1384
• Bump github/codeql-action from 3.30.5 to 4.30.8 by @dependabot[bot] in https://github.com/apache/struts/pull/1389
• Bump org.htmlunit:htmlunit from 4.16.0 to 4.17.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1396
• Bump org.codehaus.groovy:groovy-jsr223 from 3.0.22 to 3.0.25 by @dependabot[bot] in https://github.com/apache/struts/pull/1398
• Bump org.owasp:dependency-check-maven from 12.1.3 to 12.1.8 by @dependabot[bot] in https://github.com/apache/struts/pull/1399
• Bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1400
• Bump github/codeql-action from 4.30.8 to 4.31.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1401
• Bump github/codeql-action from 4.31.0 to 4.31.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1402
• Bump com.github.ben-manes.caffeine:caffeine from 3.2.2 to 3.2.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1403
• Bump org.springframework:spring-framework-bom from 6.2.11 to 6.2.12 by @dependabot[bot] in https://github.com/apache/struts/pull/1404
• Bump actions/checkout from 5 to 6 by @dependabot[bot] in https://github.com/apache/struts/pull/1423
• Bump github/codeql-action from 4.31.2 to 4.31.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1424
• Bump org.owasp:dependency-check-maven from 12.1.8 to 12.1.9 by @dependabot[bot] in https://github.com/apache/struts/pull/1430
• Bump org.glassfish.jaxb:jaxb-bom from 4.0.5 to 4.0.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1432
• Bump org.apache.rat:apache-rat-plugin from 0.16.1 to 0.17 by @dependabot[bot] in https://github.com/apache/struts/pull/1406
• Bump github/codeql-action from 4.31.4 to 4.31.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1435
• Bump org.codehaus.mojo:exec-maven-plugin from 3.5.1 to 3.6.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1441
• Bump org.apache.maven.plugins:maven-release-plugin from 3.1.1 to 3.2.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1442
• Bump org.apache.maven.plugins:maven-dependency-plugin from 3.8.1 to 3.9.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1443
• Bump org.apache.maven.plugins:maven-assembly-plugin from 3.7.1 to 3.8.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1444
• Bump github/codeql-action from 4.31.5 to 4.31.7 by @dependabot[bot] in https://github.com/apache/struts/pull/1447
• Bump org.apache.maven.plugins:maven-war-plugin from 3.4.0 to 3.5.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1449
• Bump org.jacoco:jacoco-maven-plugin from 0.8.13 to 0.8.14 by @dependabot[bot] in https://github.com/apache/struts/pull/1459
• Bump org.codehaus.mojo:versions-maven-plugin from 2.19.0 to 2.20.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1463
• Bump org.apache.maven.plugins:maven-release-plugin from 3.2.0 to 3.3.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1460
• Bump org.springframework:spring-framework-bom from 6.2.12 to 7.0.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1467
• build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1470
• build(deps): bump github/codeql-action from 4.31.7 to 4.31.8 by @dependabot[bot] in https://github.com/apache/struts/pull/1471
• build(deps): bump org.mockito:mockito-core from 5.20.0 to 5.21.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1472
• build(deps): bump org.apache.maven.plugins:maven-release-plugin from 3.3.0 to 3.3.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1473
• build(deps): bump github/codeql-action from 4.31.8 to 4.31.9 by @dependabot[bot] in https://github.com/apache/struts/pull/1481
• build(deps): bump org.apache.logging.log4j:log4j-bom from 2.25.2 to 2.25.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1482
• build(deps): bump asm.version from 9.9 to 9.9.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1483
• build(deps-dev): bump commons-validator:commons-validator from 1.10.0 to 1.10.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1490
• build(deps-dev): bump byte-buddy.version from 1.18.2 to 1.18.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1491
• chore(deps): ignore incompatible updates for release/struts-6-8-x by @lukaszlenart in https://github.com/apache/struts/pull/1497
• build(deps): bump org.springframework:spring-framework-bom from 6.2.12 to 7.0.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1475
• build(deps): bump org.apache.maven.plugins:maven-source-plugin from 3.3.1 to 3.4.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1502
• build(deps): bump org.codehaus.mojo:exec-maven-plugin from 3.6.2 to 3.6.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1503
• build(deps): bump org.htmlunit:htmlunit from 4.17.0 to 4.21.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1504
• Excludes some deps in 6.x by @lukaszlenart in https://github.com/apache/struts/pull/1514
• build(deps): bump org.owasp:dependency-check-maven from 12.1.9 to 12.2.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1518
• build(deps): bump github/codeql-action from 4.31.9 to 4.31.10 by @dependabot[bot] in https://github.com/apache/struts/pull/1521
• Ignores incompatible dependencies with Struts 6.x by @lukaszlenart in https://github.com/apache/struts/pull/1526
• build(deps-dev): bump weld.version from 6.0.3.Final to 6.0.4.Final by @dependabot[bot] in https://github.com/apache/struts/pull/1530
• Ignores some dependencies for update in 6.x by @lukaszlenart in https://github.com/apache/struts/pull/1533
• build(deps): WW-5605 bump org.apache.juneau:juneau-marshall from 8.1.3 to 9.2.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1512
• build(deps-dev): bump byte-buddy.version from 1.18.3 to 1.18.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1537
• build(deps-dev): bump org.codehaus.mojo:versions-maven-plugin from 2.20.1 to 2.21.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1538
• build(deps): bump org.springframework:spring-framework-bom from 6.2.12 to 7.0.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1540
• Excludes some dependencies from upgrade in 6.x by @lukaszlenart in https://github.com/apache/struts/pull/1541
• build(deps): bump org.assertj:assertj-core from 3.27.6 to 3.27.7 by @dependabot[bot] in https://github.com/apache/struts/pull/1552
• build(deps): bump org.testng:testng from 7.11.0 to 7.12.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1553
• build(deps): bump github/codeql-action from 4.31.10 to 4.31.11 by @dependabot[bot] in https://github.com/apache/struts/pull/1551
• fix(conf): drops deprecated del_branch_on_merge by @lukaszlenart in https://github.com/apache/struts/pull/1555
• build(deps): bump github/codeql-action from 4.31.11 to 4.32.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1556
• build(deps): excludes upgrading Tomcat 11 libraries by @lukaszlenart in https://github.com/apache/struts/pull/1559
• build(deps): bump github/codeql-action from 4.32.0 to 4.32.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1566
• build(deps): bump github/codeql-action from 4.32.5 to 4.32.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1619
• build(deps-dev): bump commons-logging:commons-logging from 1.3.5 to 1.3.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1620
• build(deps): bump net.sf.jasperreports:jasperreports from 7.0.3 to 7.0.4 in /plugins/jasperreports7 by @dependabot[bot] in https://github.com/apache/struts/pull/1618
• build(deps): bump github/codeql-action from 4.32.6 to 4.33.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1627
• build(deps): bump org.glassfish.jaxb:jaxb-bom from 4.0.6 to 4.0.7 by @dependabot[bot] in https://github.com/apache/struts/pull/1628
• build(deps): bump org.mockito:mockito-core from 5.22.0 to 5.23.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1629
• build(deps): bump github/codeql-action from 4.33.0 to 4.34.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1633
• deps(rat): excludes updatding the RAT plugin as it requires Java 17 by @lukaszlenart in https://github.com/apache/struts/pull/1641
• build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.1 to 2.21.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1634
• build(deps): bump org.apache.rat:apache-rat-plugin from 0.17 to 0.18 by @dependabot[bot] in https://github.com/apache/struts/pull/1639
• build(deps): bump org.apache.maven.doxia:doxia-core from 2.0.0 to 2.1.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1640
• build(deps): bump github/codeql-action from 4.34.1 to 4.35.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1645
• build(deps-dev): bump byte-buddy.version from 1.18.7 to 1.18.8 by @dependabot[bot] in https://github.com/apache/struts/pull/1646
• build(deps): bump org.apache.logging.log4j:log4j-bom from 2.25.3 to 2.25.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1648
• ci(dependabot): add cooldown by @lukaszlenart in https://github.com/apache/struts/pull/1656
• build(deps): bump ognl:ognl from 3.4.10 to 3.4.11 by @dependabot[bot] in https://github.com/apache/struts/pull/1655
• ci(struts6): adjusts workflows to use the new branch by @lukaszlenart in https://github.com/apache/struts/pull/1659
• cd(checks): uses proper context names for checks by @lukaszlenart in https://github.com/apache/struts/pull/1660
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1663
• build(deps): bump org.owasp:dependency-check-maven from 12.2.0 to 12.2.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1664
• introduce private method to remove clones by @aaaZayne in https://github.com/apache/struts/pull/1666
• build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1668
• build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.2 to 2.21.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1669
• build(deps): WW-5625 bump commons-io:commons-io from 2.21.0 to 2.22.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1672
• Uses proper config to avoid failing a build when generating JavaDocs by @lukaszlenart in https://github.com/apache/struts/pull/1240
• Uses new url for Maven Badges app by @lukaszlenart in https://github.com/apache/struts/pull/1252
• Adjusts required checks to the new structure by @lukaszlenart in https://github.com/apache/struts/pull/1264
• Uses proper name of check to pass by @lukaszlenart in https://github.com/apache/struts/pull/1266
• Fixes build check for Struts 6.x by @lukaszlenart in https://github.com/apache/struts/pull/1308
• Defines basic set of files to work with Claude Code by @lukaszlenart in https://github.com/apache/struts/pull/1295
• Enables Dependabot to support all the main branches by @lukaszlenart in https://github.com/apache/struts/pull/1327
• Reverse merge changes from release/7.1.0 by @lukaszlenart in https://github.com/apache/struts/pull/1364
• build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1675
• build(deps): bump org.glassfish.jaxb:jaxb-bom from 4.0.7 to 4.0.8 by @dependabot[bot] in https://github.com/apache/struts/pull/1676
• build(deps): bump org.owasp:dependency-check-maven from 12.2.1 to 12.2.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1677
• build(deps): bump com.github.ben-manes.caffeine:caffeine from 3.2.3 to 3.2.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1679
• build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by @dependabot[bot] in https://github.com/apache/struts/pull/1682
• build(deps): bump slf4j.version from 2.0.17 to 2.0.18 by @dependabot[bot] in https://github.com/apache/struts/pull/1683
• build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 by @dependabot[bot] in https://github.com/apache/struts/pull/1694
• build(deps-dev): bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 by @dependabot[bot] in https://github.com/apache/struts/pull/1698
• ci(dependabot): fix cooldown property name by @lukaszlenart in https://github.com/apache/struts/pull/1702
• build(deps): WW-5628 bump asm.version from 9.9.1 to 9.10 by @dependabot[bot] in https://github.com/apache/struts/pull/1695
• build(deps): WW-5629 bump org.apache.logging.log4j:log4j-bom from 2.25.4 to 2.26.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1685
• security(versions): updates list of supported versions by @lukaszlenart in https://github.com/apache/struts/pull/1708
• build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1710
• build(deps): bump org.apache.maven.plugins:maven-site-plugin from 3.21.0 to 3.22.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1711
• build(deps): bump asm.version from 9.10 to 9.10.1 by @dependabot[bot] in https://github.com/apache/struts/pull/1713
• docs(skills): add triaging-security-reports skill by @lukaszlenart in https://github.com/apache/struts/pull/1722
• build(deps): bump maven-surefire-plugin.version from 3.5.5 to 3.5.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1731
• build(deps): bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1730
• build(deps): bump github/codeql-action from 4.36.0 to 4.36.2 by @dependabot[bot] in https://github.com/apache/struts/pull/1734
• build(deps-dev): bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.5.6 by @dependabot[bot] in https://github.com/apache/struts/pull/1732
• build(deps): WW-5633 bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1729
• build(deps): WW-5634 bump org.htmlunit:htmlunit from 4.21.0 to 5.1.0 by @dependabot[bot] in https://github.com/apache/struts/pull/1733

New Contributors

• @bill-humblcloud made their first contribution in https://github.com/apache/struts/pull/1223
• @MFAshby made their first contribution in https://github.com/apache/struts/pull/1309
• @Senrian made their first contribution in https://github.com/apache/struts/pull/1606
• @aaaZayne made their first contribution in https://github.com/apache/struts/pull/1666
• @tranquac made their first contribution in https://github.com/apache/struts/pull/1653
• @g0w6y made their first contribution in https://github.com/apache/struts/pull/1690
• @arunmanni-ai made their first contribution in https://github.com/apache/struts/pull/1737

Full Changelog: https://github.com/apache/struts/compare/STRUTS_7_0_3...STRUTS_7_2_0