Struts 7.0.0-M9

What's Changed

• WW-5441 Bump net.sf.jasperreports:jasperreports to 6.21.3 by @kusalk in #985
• WW-5428 Stop further excessive logging in DevMode by @kusalk in #987
• WW-5443 Bump Spring dependencies to 5.3.37 by @kusalk in #990
• WW-5442 Enforce allowlist for OgnlReflectionProvider by @kusalk in #988
• WW-5440 Fix OGNL allowlist compat with Convention plugin by @kusalk in #986

Dependencies

• Bump jackson.version from 2.17.1 to 2.17.2 by @dependabot in #993
• Bump maven-surefire-plugin.version from 3.2.5 to 3.3.1 by @dependabot in #994

Full Changelog: STRUTS_7_0_0_M8...STRUTS_7_0_0_M9

Struts 6.6.0

What's Changed

• WW-5406 Ensure Action excluded patterns are reinjected by @kusalk in #910
• WW-5407 Extend SecurityMemberAccess proxy detection to other proxies by @jefferyxhy in #911
• WW-5408 add option to not fallback to empty namespace when unresolved by @jefferyxhy in #912
• WW-5406 Fix injection order issue for excluded patterns by @kusalk in #917
• WW-5409 introduce final attribute to package element which make them unextendable by @jefferyxhy in #914
• WW-5417 bump ognl version to fix security issue by @jefferyxhy in #915
• WW-5418 Forbid Enums and Jasper classes by @kusalk in #916
• WW-5421 Bump asm.version from 9.6 to 9.7 by @dependabot in #907
• WW-5420 Upgrades commons-text to ver. 1.12.0 by @lukaszlenart in #924
• WW-5419 Fixes support for loading Tiles definitions by @lukaszlenart in #920
• WW-5400 Extend default configuration options for the CSP interceptor. by @eschulma in #913
• WW-5422 Fixes support for trimable locale string in request by @lukaszlenart in #931
• WW-5414 Always call afterInvocation even in case of exception by @lukaszlenart in #932
• WW-5415 Fixes accessing public constructors via expression by @lukaszlenart in #933
• INFRA-25666 Disables review by code owners by @lukaszlenart in #945
• WW-5425 Bump jackson.version from 2.16.1 to 2.17.1 by @dependabot in #944
• WW-5426 Bump org.freemarker:freemarker from 2.3.32 to 2.3.33 by @dependabot in #953
• WW-5424 Fixes ClassCastException when using short var name in s:set tag by @lukaszlenart in #946
• Disables required reviewers option by @lukaszlenart in #947
• WW-5412 Upgrades struts-master to ver 15 by @lukaszlenart in #948
• WW-5400 Simplifies how CspSettings is created by @lukaszlenart in #956
• WW-5250 Addresses TODO in test and stops using Mock Objects by @lukaszlenart in #957
• WW-5310 Fixes broken support for Fragments in <s:url/> tag by @lukaszlenart in #968
• WW-5429 Log parameter annotation issues at ERROR level when in DevMode by @kusalk in #969
• WW-5431 Marks unused constants as deprecated by @lukaszlenart in #971
• WW-5437 Swap order of sysStrSubstitutor and envStrSubstitutor in substitute method by @stefansielaff in #977
• WW-5428 Allowlist capability should resolve Hibernate proxies when disableProxyObjects is not set by @kusalk in #967
• WW-5439 Move DevMode security configuration to SecurityMemberAccess by @kusalk in #979
• WW-5428 Stop excessive logging in DevMode by @kusalk in #982
• WW-5441 Bump net.sf.jasperreports:jasperreports to 6.21.3 by @kusalk in #985
• WW-5428 Stop further excessive logging in DevMode by @kusalk in #987
• WW-5443 Bump Spring dependencies to 5.3.37 by @kusalk in #990
• WW-5442 Enforce allowlist for OgnlReflectionProvider by @kusalk in #988
• WW-5440 Fix OGNL allowlist compat with Convention plugin by @kusalk in #986

Dependencies

• Bump org.assertj:assertj-core from 3.25.2 to 3.25.3 by @dependabot in #909
• Bump actions/upload-artifact from 4.3.1 to 4.3.2 by @dependabot in #923
• Bump org.codehaus.mojo:versions-maven-plugin from 2.16.1 to 2.16.2 by @dependabot in #922
• Bump org.codehaus.mojo:exec-maven-plugin from 3.1.0 to 3.2.0 by @dependabot in #925
• Bump actions/upload-artifact from 4.3.2 to 4.3.3 by @dependabot in #926
• Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.0.0-M6 to 3.2.5 by @dependabot in #905
• Bump org.apache.maven.plugins:maven-source-plugin from 3.3.0 to 3.3.1 by @dependabot in #934
• Bump slf4j.version from 2.0.12 to 2.0.13 by @dependabot in #936
• Bump org.apache.maven.plugins:maven-project-info-reports-plugin from 3.0.0 to 3.5.0 by @dependabot in #938
• Bump ossf/scorecard-action from 2.3.1 to 2.3.3 by @dependabot in #939
• Bump org.jacoco:jacoco-maven-plugin from 0.8.11 to 0.8.12 by @dependabot in #940
• Bump org.apache.maven.plugins:maven-assembly-plugin from 3.6.0 to 3.7.1 by @dependabot in #950
• Bump org.apache.commons:commons-compress from 1.26.0 to 1.26.2 by @dependabot in #961
• Bump org.owasp:dependency-check-maven from 8.4.2 to 9.2.0 by @dependabot in #962
• Bump commons-validator:commons-validator from 1.8.0 to 1.9.0 by @dependabot in #958
• Bump org.apache.felix:org.apache.felix.main from 6.0.3 to 7.0.5 by @dependabot in #960
• Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.4.1 to 3.5.0 by @dependabot in #965
• Bump org.codehaus.mojo:exec-maven-plugin from 3.2.0 to 3.3.0 by @dependabot in #966
• Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.2.5 to 3.3.0 by @dependabot in #976
• Bump actions/upload-artifact from 4.3.3 to 4.3.4 by @dependabot in #978
• Bump jackson.version from 2.17.1 to 2.17.2 by @dependabot in #993
• Bump maven-surefire-plugin.version from 3.2.5 to 3.3.1 by @dependabot in #994

New Contributors

• @jefferyxhy made their first contribution in #911
• @eschulma made their first contribution in #913
• @stefansielaff made their first contribution in #977

Full Changelog: STRUTS_6_4_0...STRUTS_6_6_0

Struts 7.0.0-M8

What's Changed

• WW-5310 Fixes broken support for Fragments in <s:url/> tag by @lukaszlenart in #968
• WW-5429 Log parameter annotation issues at ERROR level when in DevMode by @kusalk in #969
• WW-5430 Uses Freemarker native support for JakartaEE instead of manually transforming the artifacts by @lukaszlenart in #970
• WW-5431 Marks unused constants as deprecated by @lukaszlenart in #971
• Bump commons-validator:commons-validator from 1.8.0 to 1.9.0 by @dependabot in #958
• Bump org.apache.felix:org.apache.felix.main from 6.0.3 to 7.0.5 by @dependabot in #960
• Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.4.1 to 3.5.0 by @dependabot in #965
• Bump org.codehaus.mojo:exec-maven-plugin from 3.2.0 to 3.3.0 by @dependabot in #966
• WW-5437 Swap order of sysStrSubstitutor and envStrSubstitutor in substitute method by @stefansielaff in #977
• WW-5428 Allowlist capability should resolve Hibernate proxies when disableProxyObjects is not set by @kusalk in #967
• WW-5439 Move DevMode security configuration to SecurityMemberAccess by @kusalk in #979
• Merge master to 7.0.x, 2024-07-08 by @kusalk in #980
• Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.2.5 to 3.3.0 by @dependabot in #976
• Bump actions/upload-artifact from 4.3.3 to 4.3.4 by @dependabot in #978
• WW-5411 Delete deprecated method/classes by @kusalk in #981
• WW-5428 Stop excessive logging in DevMode by @kusalk in #982
• Merge master to 7.0.x, 2024-07-09 by @kusalk in #983
• WW-5438 Fixes scope of Weld dependencies by @lukaszlenart in #984

New Contributors

• @stefansielaff made their first contribution in #977

Full Changelog: STRUTS_7_0_0_M7...STRUTS_7_0_0_M8

Struts 7.0.0-M7

What's Changed

• WW-5406 Ensure Action excluded patterns are reinjected by @kusalk in #910
• WW-5407 Extend SecurityMemberAccess proxy detection to other proxies by @jefferyxhy in #911
• WW-5408 add option to not fallback to empty namespace when unresolved by @jefferyxhy in #912
• WW-5406 Fix injection order issue for excluded patterns by @kusalk in #917
• WW-5409 introduce final attribute to package element which make them unextendable by @jefferyxhy in #914
• WW-5417 bump ognl version to fix security issue by @jefferyxhy in #915
• WW-5418 Forbid Enums and Jasper classes by @kusalk in #916
• Bump org.assertj:assertj-core from 3.25.2 to 3.25.3 by @dependabot in #909
• Forward merge master to 7.0.0 by @kusalk in #918
• Bump actions/upload-artifact from 4.3.1 to 4.3.2 by @dependabot in #923
• Bump org.codehaus.mojo:versions-maven-plugin from 2.16.1 to 2.16.2 by @dependabot in #922
• WW-5353 Stronger security defaults for 7.0 by @kusalk in #919
• Bump org.codehaus.mojo:exec-maven-plugin from 3.1.0 to 3.2.0 by @dependabot in #925
• Bump actions/upload-artifact from 4.3.2 to 4.3.3 by @dependabot in #926
• WW-5421 Bump asm.version from 9.6 to 9.7 by @dependabot in #907
• Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.0.0-M6 to 3.2.5 by @dependabot in #905
• WW-5420 Upgrades commons-text to ver. 1.12.0 by @lukaszlenart in #924
• [WW-5419] Fixes support for loading Tiles definitions by @lukaszlenart in #920
• WW-5400 Extend default configuration options for the CSP interceptor. by @eschulma in #913
• Bump org.apache.maven.plugins:maven-source-plugin from 3.3.0 to 3.3.1 by @dependabot in #934
• Bump slf4j.version from 2.0.12 to 2.0.13 by @dependabot in #936
• Bump org.apache.maven.plugins:maven-project-info-reports-plugin from 3.0.0 to 3.5.0 by @dependabot in #938
• Bump ossf/scorecard-action from 2.3.1 to 2.3.3 by @dependabot in #939
• WW-5422 Fixes support for trimable locale string in request by @lukaszlenart in #931
• WW-5414 Always call afterInvocation even in case of exception by @lukaszlenart in #932
• WW-5415 Fixes accessing public constructors via expression by @lukaszlenart in #933
• INFRA-25666 Disables review by code owners by @lukaszlenart in #945
• Bump org.jacoco:jacoco-maven-plugin from 0.8.11 to 0.8.12 by @dependabot in #940
• WW-5425 Bump jackson.version from 2.16.1 to 2.17.1 by @dependabot in #944
• Bump org.apache.maven.plugins:maven-assembly-plugin from 3.6.0 to 3.7.1 by @dependabot in #950
• WW-5426 Bump org.freemarker:freemarker from 2.3.32 to 2.3.33 by @dependabot in #953
• [WW-5424] Fixes ClassCastException when using short var name in s:set tag by @lukaszlenart in #946
• Disables required reviewers option by @lukaszlenart in #947
• [WW-5412] Upgrades struts-master to ver 15 by @lukaszlenart in #948
• Bump org.apache.commons:commons-compress from 1.26.0 to 1.26.2 by @dependabot in #961
• Bump org.owasp:dependency-check-maven from 8.4.2 to 9.2.0 by @dependabot in #962
• [WW-5423] Fixes returning null instead of empty array in case of non-existing param by @lukaszlenart in #954
• WW-5400 Simplifies how CspSettings is created by @lukaszlenart in #956
• WW-5250 Addresses TODO in test and stops using Mock Objects by @lukaszlenart in #957
• Merge master 2024-06-10 by @lukaszlenart in #963

New Contributors

• @jefferyxhy made their first contribution in #911
• @eschulma made their first contribution in #913

Full Changelog: STRUTS_7_0_0_M6...STRUTS_7_0_0_M7

Struts 7.0.0-M6

What's Changed

• WW-5397 Bump net.sf.jasperreports:jasperreports from 6.20.6 to 6.21.0 by @dependabot in #843
• Updates link to build status on Jenkins by @lukaszlenart in #878
• Bump org.apache.maven.doxia:doxia-core from 1.9.1 to 1.12.0 by @dependabot in #879
• Bump slf4j.version from 2.0.11 to 2.0.12 by @dependabot in #880
• Bump org.apache.maven.doxia:doxia-module-markdown from 1.9.1 to 1.12.0 by @dependabot in #883
• WW-5398 Bump commons-validator:commons-validator from 1.6 to 1.8.0 by @dependabot in #882
• [WW-5399] Bump org.apache.commons:commons-compress from 1.25.0 to 1.26.0 by @dependabot in #884
• Bump maven-surefire-plugin.version from 3.0.0-M7 to 3.2.5 by @dependabot in #886
• Fix original file upload to use actual file name rather than uploadxxx.tmp by @gregh3269 in #893
• [WW-5401] Improves logging around wrapping request and detecting multipart request by @lukaszlenart in #892
• WW-5364 Fix potential NPE in XmlDocConfigurationProvider by @kusalk in #894
• Converts multiple file uploads example to use Action based upload by @lukaszlenart in #895
• WW-5251 Reinstate deleted interfaces with transparent compat by @kusalk in #898
• Enables required review by codeowners by @lukaszlenart in #899
• WW-5251 Fix deprecated interface method signature by @kusalk in #900
• WW-5402 Auto loads Tiles definitions from classpath by @lukaszlenart in #896
• Uses proper context name in branch protection rule by @lukaszlenart in #901
• WW-5404 Bump log4j2.version from 2.21.1 to 2.23.1 by @dependabot in #902
• WW-5390 Fixes creating assembly and attaching sources when preparing a new release by @lukaszlenart in #903

Full Changelog: STRUTS_7_0_0_M3...STRUTS_7_0_0_M6

Struts 6.4.0

What's Changed

• WW-5341 Ensure exclusion list applies to objects from all ClassLoaders by @kusalk in #741
• WW-5342 Add option to block use of default package by @kusalk in #742
• WW-5339 Misc clean up in CompoundRootAccessor and OgnlValueStackTest by @kusalk in #745
• WW-5340 Preliminary refactor of OgnlUtil by @kusalk in #746
• [WW-5346] replace BeanManager::createInjectionTarget by @hepptho in #754
• WW-5340 Introducing OGNL Guard by @kusalk in #747
• WW-5348 Allow overriding of logging behaviour in DefaultAcceptedPatternsChecker by @kusalk in #757
• [WW-5338] Removes deprecated OgnlTool by @lukaszlenart in #758
• [WW-5344] Un-deprecates Sitemesh plugin and upgrades Sitmesh to ver 2.5.0 by @lukaszlenart in #759
• WW-5340 Mild refactor StrutsOgnlGuard for easier subclassing by @kusalk in #760
• WW-5349 Remove Struts core dependency on OGNL VarRefs by @kusalk in #763
• WW-5354 Ensure ActionSupport fields are not parameter injectable by @kusalk in #765
• WW-5355 Integrate W-TinyLfu cache and use by default by @kusalk in #766
• Improved the StrutsUrlDecoder so that charset retrieval is performed only once. by @mygreen in #773
• WW-5358 Expand exclusion lists by @kusalk in #774
• WW-5350 Refactor SecurityMemberAccess by @kusalk in #780
• [WW-5333] Refactors AttributeMap by @lukaszlenart in #779
• WW-5363 Velocity: read chained contexts before ValueStack by @kusalk in #789
• WW-5350 Implement OGNL Allowlist capability by @kusalk in #781
• WW-5363 Remove redundant method from VelocityManager by @kusalk in #793
• WW-5343 Make SecurityMemberAccess an extensible bean by @kusalk in #791
• WW-5364 Automatically populate OGNL allowlist by @kusalk in #800
• WW-5339 Add option to block custom OGNL maps by @kusalk in #806
• [WW-5370] Makes HttpParameters case-insensitive by @lukaszlenart in #807
• [WW-5371] Modern upload by @lukaszlenart in #808
• WW-5364 Add missing system allowlist classes by @kusalk in #815
• [WW-5373] Update JavaDoc CspReportAction.java by @assachs in #814
• [WW-5328] Removes deprecated setters by @lukaszlenart in #811
• [WW-5362] Removes type attribute out of <s:script/> tag by @lukaszlenart in #812
• WW-5378 Add option to NOT fallback to context lookup when finding value on OgnlValueStack by @kusalk in #821
• WW-5364 Add String.class to system allowlist by @kusalk in #828
• WW-5381 Introduce RootAccessor interface for extension point by @kusalk in #823
• WW-5379 Implement alternative mechanism for Velocity directives to obtain ValueStack by @kusalk in #822
• WW-5352 Repackage ParametersInterceptor and related classes by @kusalk in #829
• WW-5381 Introduce extension point for CompoundRootAccessor by @kusalk in #824
• [WW-5383] Updates RegEx to excludes JARs by default by @lukaszlenart in #830
• WW-5382 Fix stale injections in Dispatcher by @kusalk in #826
• WW-5381 Introduce extension point for MethodAccessor by @kusalk in #825
• WW-5352 Refactor ParametersInterceptor by @kusalk in #831
• [WW-5365] Reverts changes introduced in WW-5192 to allow evaluate the value attribute of Radio tag by @lukaszlenart in #835
• WW-5352 Clean up OgnlValueStackTest by @kusalk in #841
• [WW-5387] Fixes remove() signature by @lukaszlenart in #844
• [WW-5369] Re-define minimal library set by @lukaszlenart in #847
• [WW-5374] Allows to prepend reportUri with Servlet context by @lukaszlenart in #845
• [WW-5357] Adds support for disabled attribute to anchor tag by @lukaszlenart in #848
• WW-5352 Introducing the StrutsParameter annotation by @kusalk in #832
• [WW-5360] Introduces additional countStr & indexStr to allow to ignore conversion by @lukaszlenart in #852
• WW-5391 Add interface for VelocityManager extension point by @kusalk in #867
• WW-5394 Use request encoding by @aleksandr-m in #872
• s:file shows server/file location WW-5396 by @gregh3269 in #876
• [WW-5401] Improves logging around wrapping request and detecting multipart request by @lukaszlenart in #892
• WW-5364 Fix potential NPE in XmlDocConfigurationProvider by @kusalk in #894
• WW-5251 Reinstate deleted interfaces with transparent compat by @kusalk in #898
• WW-5251 Fix deprecated interface method signature by @kusalk in #900
• WW-5402 Auto loads Tiles definitions from classpath by @lukaszlenart in #896
• WW-5390 Fixes creating assembly and attaching sources when preparing a new release by @lukaszlenart in #903

Dependencies

• Moves all CI notifications to commits@ list by @lukaszlenart in #748
• Bump actions/checkout from 3 to 4 by @dependabot in #751
• Bump actions/upload-artifact from 3.1.2 to 3.1.3 by @dependabot in #752
• Bump actions/cache from 3.3.1 to 3.3.2 by @dependabot in #753
• Split SonarCloud into separate action by @kusalk in #755
• [WW-5347] Upgrades to commons-digester3 ver 3.2 by @lukaszlenart in #756
• Bump ossf/scorecard-action from 2.2.0 to 2.3.0 by @dependabot in #762
• Bump org.jfree:jfreechart from 1.5.1 to 1.5.4 by @dependabot in #740
• Add JDK 21 build by @kusalk in #764
• Fix conflicting dependencies by @kusalk in #767
• Bump org.codehaus.mojo:versions-maven-plugin from 2.7 to 2.16.1 by @dependabot in #768
• Bump org.owasp:dependency-check-maven from 7.2.0 to 8.4.2 by @dependabot in #771
• Bump ossf/scorecard-action from 2.3.0 to 2.3.1 by @dependabot in #775
• Bump junit:junit from 4.13.1 to 4.13.2 by @dependabot in #776
• Bump org.jacoco:jacoco-maven-plugin from 0.8.8 to 0.8.11 by @dependabot in #777
• Bump slf4j.version from 2.0.7 to 2.0.9 by @dependabot in #783
• Bump net.sf.jasperreports:jasperreports from 6.20.5 to 6.20.6 by @dependabot in #784
• Uses the new notifications@ list for all the messages form Github by @lukaszlenart in #788
• Send Jenkins notifications to the notifications@ list by @lukaszlenart in #790
• Bump jackson.version from 2.15.3 to 2.16.0 by @dependabot in #796
• Bump actions/setup-java from 3 to 4 by @dependabot in #804
• Builds Struts 7 as part of the main pipeline by @lukaszlenart in #813
• Bump github/codeql-action from 2 to 3 by @dependabot in #817
• Bump actions/upload-artifact from 3.1.3 to 4.0.0 by @dependabot in #816
• Bump org.apache.commons:commons-compress from 1.23.0 to 1.24.0 by @dependabot in #818
• Stops cleaning nightlies to allow to coexist different versions by @lukaszlenart in #834
• Bump org.apache.maven.plugins:maven-release-plugin from 3.0.0-M1 to 3.0.1 by @dependabot in #837
• Reduces log level to debug to reduce noise in the logs by @lukaszlenart in #838
• Bump actions/upload-artifact from 4.0.0 to 4.1.0 by @dependabot in #842
• Bump org.apache.commons:commons-compress from 1.23.0 to 1.25.0 by @dependabot in #820
• Extends sleep period to avoid breaking a build by @lukaszlenart in #849
• Upgrade maven to 3.9.6 and wrappe...

v7.0.0-M3

What's Changed

• various dependency updates for master by @sepe81 in #863
• WW-5391 Add interface for VelocityManager extension point by @kusalk in #867
• [WW-5390] Fixes generating assemblies during release process by @lukaszlenart in #868
• Fixes problem with failing file upload tests by @lukaszlenart in #869
• [WW-5384] Update log4j2 to 2.22.1 and [WW-5393] caffeine to 3.1.8 including error_prone_annotations > 2.10.0 which depends on Java 11 by @sepe81 in #870
• Bump actions/upload-artifact from 4.3.0 to 4.3.1 by @dependabot in #875
• WW-5395 Bump commons-logging:commons-logging from 1.2 to 1.3.0 by @dependabot in #874
• WW-5394 Use request encoding by @aleksandr-m in #872
• [WW-5388] Fixes a few issues in Servlet 6 file upload usage by @lukaszlenart in #873
• s:file shows server/file location WW-5396 by @gregh3269 in #876
• Merge master to 7-x-x 2024-02-16 by @lukaszlenart in #877

Full Changelog: STRUTS_7_0_0_M2...STRUTS_7_0_0_M3

v7.0.0-M2

What's Changed

• Fixes excluding Plexus container in OWASP scan by @lukaszlenart in #858
• Drops JDK11 build and fixes duplicated steps by @lukaszlenart in #859
• Small spelling and MD fixes (IntelliJ assisted) by @sepe81 in #854
• Stops running sonar.yml on forks by @lukaszlenart in #862
• WW-5352 Introducing the StrutsParameter annotation by @kusalk in #832
• [WW-5360] Introduces additional countStr & indexStr to allow to ignore conversion by @lukaszlenart in #852
• [WW-5388] Uses the latest JakartaEE FileUpload Servlet 6 package by @lukaszlenart in #861
• Merge master into 7-0-x branch - 2024-02-01 by @lukaszlenart in #866

Dependencies

• Upgrade maven to 3.9.6 and wrapper to 3.2.0 by @sepe81 in #851
• Upgrade maven to 3.9.6 and wrapper to 3.2.0 (cherry-pick from 7.x) by @sepe81 in #853
• Bump actions/upload-artifact from 4.1.0 to 4.2.0 by @dependabot in #855
• Bump actions/upload-artifact from 4.2.0 to 4.3.0 by @dependabot in #864

Full Changelog: STRUTS_7_0_0_M1...STRUTS_7_0_0_M2

v7.0.0-M1

What's Changed

• Moves all CI notifications to commits@ list by @lukaszlenart in #748
• WW-5341 Ensure exclusion list applies to objects from all ClassLoaders by @kusalk in #741
• WW-5342 Add option to block use of default package by @kusalk in #742
• WW-5339 Misc clean up in CompoundRootAccessor and OgnlValueStackTest by @kusalk in #745
• WW-5340 Preliminary refactor of OgnlUtil by @kusalk in #746
• [WW-5346] replace BeanManager::createInjectionTarget by @hepptho in #754
• Split SonarCloud into separate action by @kusalk in #755
• WW-5340 Introducing OGNL Guard by @kusalk in #747
• WW-5348 Allow overriding of logging behaviour in DefaultAcceptedPatternsChecker by @kusalk in #757
• [WW-5347] Upgrades to commons-digester3 ver 3.2 by @lukaszlenart in #756
• [WW-5338] Removes deprecated OgnlTool by @lukaszlenart in #758
• [WW-5344] Un-deprecates Sitemesh plugin and upgrades Sitmesh to ver 2.5.0 by @lukaszlenart in #759
• WW-5340 Mild refactor StrutsOgnlGuard for easier subclassing by @kusalk in #760
• WW-5349 Remove Struts core dependency on OGNL VarRefs by @kusalk in #763
• Add JDK 21 build by @kusalk in #764
• WW-5354 Ensure ActionSupport fields are not parameter injectable by @kusalk in #765
• WW-5355 Integrate W-TinyLfu cache and use by default by @kusalk in #766
• Improved the StrutsUrlDecoder so that charset retrieval is performed only once. by @mygreen in #773
• WW-5358 Expand exclusion lists by @kusalk in #774
• WW-5350 Refactor SecurityMemberAccess by @kusalk in #780
• [WW-5333] Refactors AttributeMap by @lukaszlenart in #779
• Uses the new notifications@ list for all the messages form Github by @lukaszlenart in #788
• Send Jenkins notifications to the notifications@ list by @lukaszlenart in #790
• WW-5363 Velocity: read chained contexts before ValueStack by @kusalk in #789
• WW-5350 Implement OGNL Allowlist capability by @kusalk in #781
• WW-5363 Remove redundant method from VelocityManager by @kusalk in #793
• WW-5343 Make SecurityMemberAccess an extensible bean by @kusalk in #791
• WW-5364 Automatically populate OGNL allowlist by @kusalk in #800
• WW-5339 Add option to block custom OGNL maps by @kusalk in #806
• [WW-5370] Makes HttpParameters case-insensitive by @lukaszlenart in #807
• [WW-5371] Modern upload by @lukaszlenart in #808
• Rebase struts-7-0-x branch by @lukaszlenart in #809
• Builds Struts 7 as part of the main pipeline by @lukaszlenart in #813
• WW-5364 Add missing system allowlist classes by @kusalk in #815
• [WW-5373] Update JavaDoc CspReportAction.java by @assachs in #814
• [WW-5328] Removes deprecated setters by @lukaszlenart in #811
• JakartaEE modules by @lukaszlenart in #810
• [WW-5362] Removes type attribute out of <s:script/> tag by @lukaszlenart in #812
• WW-5378 Add option to NOT fallback to context lookup when finding value on OgnlValueStack by @kusalk in #821
• WW-5364 Add String.class to system allowlist by @kusalk in #828
• Upgrades Mockito to ver 5.8.0 by @lukaszlenart in #827
• WW-5381 Introduce RootAccessor interface for extension point by @kusalk in #823
• WW-5379 Implement alternative mechanism for Velocity directives to obtain ValueStack by @kusalk in #822
• WW-5352 Repackage ParametersInterceptor and related classes by @kusalk in #829
• WW-5381 Introduce extension point for CompoundRootAccessor by @kusalk in #824
• [WW-5383] Updates RegEx to excludes JARs by default by @lukaszlenart in #830
• [Struts 7] Merge master to 7xx by @lukaszlenart in #833
• Stops cleaning nightlies to allow to coexist different versions by @lukaszlenart in #834
• WW-5382 Fix stale injections in Dispatcher by @kusalk in #826
• WW-5381 Introduce extension point for MethodAccessor by @kusalk in #825
• WW-5352 Refactor ParametersInterceptor by @kusalk in #831
• Reduces log level to debug to reduce noise in the logs by @lukaszlenart in #838
• [WW-5365] Reverts changes introduced in WW-5192 to allow evaluate the value attribute of Radio tag by @lukaszlenart in #835
• WW-5352 Clean up OgnlValueStackTest by @kusalk in #841
• [WW-5387] Fixes remove() signature by @lukaszlenart in #844
• [WW-5369] Re-define minimal library set by @lukaszlenart in #847
• [WW-5374] Allows to prepend reportUri with Servlet context by @lukaszlenart in #845
• Extends sleep period to avoid breaking a build by @lukaszlenart in #849
• [WW-5357] Adds support for disabled attribute to anchor tag by @lukaszlenart in #848
• [Struts-7] Merge master to 7xx 2024-01-20 by @lukaszlenart in #850

Dependencies

• Bump actions/checkout from 3 to 4 by @dependabot in #751
• Bump actions/upload-artifact from 3.1.2 to 3.1.3 by @dependabot in #752
• Bump actions/cache from 3.3.1 to 3.3.2 by @dependabot in #753
• Bump ossf/scorecard-action from 2.2.0 to 2.3.0 by @dependabot in #762
• Bump org.jfree:jfreechart from 1.5.1 to 1.5.4 by @dependabot in #740
• Fix conflicting dependencies by @kusalk in #767
• Bump org.codehaus.mojo:versions-maven-plugin from 2.7 to 2.16.1 by @dependabot in #768
• Bump org.owasp:dependency-check-maven from 7.2.0 to 8.4.2 by @dependabot in #771
• Bump ossf/scorecard-action from 2.3.0 to 2.3.1 by @dependabot in #775
• Bump junit:junit from 4.13.1 to 4.13.2 by @dependabot in #776
• Bump org.jacoco:jacoco-maven-plugin from 0.8.8 to 0.8.11 by @dependabot in #777
• Bump slf4j.version from 2.0.7 to 2.0.9 by @dependabot in #783
• Bump net.sf.jasperreports:jasperreports from 6.20.5 to 6.20.6 by @dependabot in #784
• Bump jackson.version from 2.15.3 to 2.16.0 by @dependabot in #796
• Bump actions/setup-java from 3 to 4 by @dependabot in #804
• Bump github/codeql-action from 2 to 3 by @dependabot in #817
• Bump actions/upload-artifact from 3.1.3 to 4.0.0 by @dependabot in #816
• Bump org.apache.commons:commons-compress from 1.23.0 to 1.24.0 by @dependabot in #818
• Bump org.apache.maven.plugins:maven-release-plugin from 3.0.0-M1 to 3.0.1 by @dependabot in #837
• Bump actions/upload-artifact from 4.0.0 to 4.1.0 by @dependabot in #842
• Bump org.apache.commons:commons-compress from 1.23.0 to 1.25.0 by @dependabot in #820

New Contributors

• @hepptho made their first contribution in #754
• @mygreen made their first contribution in #773
• @assachs made their first contribution in #814

Full Changelog: STRUTS_6_3_0...STRUTS_7_0_0_M1

Struts 2.5.33

What's changed

Version notes

Full Changelog: STRUTS_2_5_32...STRUTS_2_5_33