What's Changed
- docs: state the control test that separates hardening from a vulnerability by @lukaszlenart in #1964
- docs(skills): send the [TEST] mail from the @apache.org identity by @lukaszlenart in #1963
- build(ci): decide "does this need a build" in one reusable workflow by @lukaszlenart in #1965
- ci: pin Scorecards checkout action by commit by @mcc0nnell in #1966
- build(ci): test once on JDK 17 in Jenkins, reserve Jetty ports for the showcase ITs by @lukaszlenart in #1967
- docs: drop derivable layout and architecture sections from CLAUDE.md by @lukaszlenart in #1977
- WW-5753 Reject cross-site non-GET navigations and cross-site GET subresource requests in the Fetch Metadata policy by @g0w6y in #1983
- WW-5751 Treat a negative maximumSize as no upload size limit by @lukaszlenart in #1976
- Release 7.4.0 RC-1 by @lukaszlenart in #1968
- WW-5752 Normalize request-derived values in log messages by @g0w6y in #1982
- docs(skills): resolve Dependabot tickets via Jira transition id by @lukaszlenart in #1985
- docs(skills): carry the 7.4.0 / 6.12.0 advisory lessons into the release skills by @lukaszlenart in #1987
- docs: re-baseline THREAT_MODEL.md against S2-075 to S2-078 by @lukaszlenart in #1988
- WW-5757 fix(bean-validation): resolve the constraint message template as the text key by @lukaszlenart in #1989
- WW-5759 Resolve @StrutsParameter accessors the way OGNL does by @lukaszlenart in #1992
- WW-5760 Upgrade OGNL to version 3.4.15 by @lukaszlenart in #1993
- WW-5758 Enforce @StrutsParameter authorization in AliasInterceptor's raw-parameter fallback by @g0w6y in #1991
- docs: drop the hard-coded version from CLAUDE.md by @lukaszlenart in #1994
- build(deps): WW-5763 bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 by @dependabot[bot] in #1997
- build(deps): WW-5764 bump com.github.ben-manes.caffeine:caffeine from 3.2.4 to 3.3.0 by @dependabot[bot] in #1995
- chore: hand Dependabot tickets back open and read fix versions from Jira by @lukaszlenart in #2001
- WW-3364 Use registered type converters in JSON serialization (opt-in) by @lukaszlenart in #2002
- WW-3447 test(convention): cover action-mapping flags with no tests by @lukaszlenart in #2003
- WW-3464 test(config): pin first-match-wins wildcard order by @lukaszlenart in #2004
- WW-3476 Add package-scoped constants by @lukaszlenart in #2005
- WW-5766 Support struts.scopedConstantProvider in Java-based configuration by @lukaszlenart in #2006
- WW-5767 Apply value substitution to scoped-constant values by @lukaszlenart in #2007
- WW-5768 Make struts.ui.theme and struts.ui.templateDir scopable per package by @lukaszlenart in #2008
- WW-5770 Make struts.convention.result.path scopable per package by @lukaszlenart in #2009
- build(ci): detect changes in-job and cancel superseded PR runs by @lukaszlenart in #2010
- build(ci): build a reduced matrix on pull requests by @lukaszlenart in #2011
- WW-5772 Remove inline event handlers from optiontransferselect, inputtransferselect, updownselect and combobox by @aeonframework in #2012
- build(ci): align GitHub Actions with the ASF Actions policy by @lukaszlenart in #2024
- WW-5765 Re-store only the token validated in the request in execAndWait by @lukaszlenart in #2022
- WW-5780 fix(html5): close the checkbox input in the html5 checkboxlist template by @lukaszlenart in #2025
- WW-5781 fix(tags): render a single class and style on checkboxlist and radio inputs by @lukaszlenart in #2026
- WW-5782 fix(tags): document and warn that s:a href ignores nested params by @lukaszlenart in #2034
- WW-3624 feat(tags): allow regex matching of field names on fielderror tag by @lukaszlenart in #2036
- WW-3655 test(freemarker): guard against resolving the result location from the request URI by @lukaszlenart in #2037
- WW-3717 feat(core): restrict an action to HTTP methods with an http-method attribute by @lukaszlenart in #2038
- WW-3666 Trim surrounding whitespace before converting to non-String types by @lukaszlenart in #2039
- WW-3720 test(core): cover comma-delimited interceptor params split across lines by @lukaszlenart in #2040
- WW-3792 test(core): pin css_xhtml checkbox left-label wrappers to match other controls by @lukaszlenart in #2041
- build(deps): WW-5779 bump asm.version from 9.10.1 to 9.11 by @dependabot[bot] in #2030
- WW-3576 Keep SessionMap in step with the HttpSession by @lukaszlenart in #2042
- WW-4323 Pin that ParameterNameAware cannot accept an excluded name by @lukaszlenart in #2049
- WW-5789 fix(rest): keep params-bound values when the body handler binds nothing by @lukaszlenart in #2050
- WW-5790 fix(rest): copy only what the body handler changed in the two-phase copy by @lukaszlenart in #2051
- WW-5786 Pin HTTP method enforcement on Convention plugin actions by @lukaszlenart in #2052
- WW-5791 Struts Boot: run Struts from main() on embedded Tomcat with a fluent action registry by @lukaszlenart in #2053
- WW-5792 Warn instead of silently skipping non-public action classes by @lukaszlenart in #2054
- WW-5778 Support datetextfield tag in the html5 theme by @lukaszlenart in #2055
- WW-5810 Support java.time types in the datetextfield tag by @lukaszlenart in #2056
- WW-5812 DateConverter rejects valid ISO dates when a lenient-only format matches first by @lukaszlenart in #2057
- WW-5813 DateConverter rejects date input with text after the parsed value by @lukaszlenart in #2058
- WW-5814 Opt-in offset-aware ISO date-times for java.util.Date by @lukaszlenart in #2059
- WW-5816 Add a range validator for java.time.LocalDate by @lukaszlenart in #2060
- WW-5811 Derive date min/max and temporal required HTML5 constraints by @lukaszlenart in #2061
- WW-5819 Log a validator param that fails type conversion by @lukaszlenart in #2062
- WW-5823 Escape javatemplates dynamic attributes and evaluate them only for lazy components by @lukaszlenart in #2076
- docs: state output encoding by the framework's own tags as a §8 property by @lukaszlenart in #2078
- WW-5824 fix(core): escape the radio name attribute like every other tag by @lukaszlenart in #2079
- WW-5825 Normalize request-derived values in DateTextFieldInterceptor log message by @g0w6y in #2081
- WW-5828 Bound integer digits when formatting BigDecimal by @lukaszlenart in #2085
- docs: tie the control test to the THREAT_MODEL §8 properties by @lukaszlenart in #2083
- Fix typo 'occured' to 'occurred' in MultiPartRequestWrapper and ValidationInterceptor by @siddiqueirshad in #2094
- WW-5837 Upgrade OGNL to version 3.4.17 by @lukaszlenart in #2107
- build: drop redundant doxia-core override from maven-site-plugin by @lukaszlenart in #2108
- WW-5820 Hold the declared-on-neither fallback to objects further down the value stack by @emilhuseyn in #2073
- WW-5774 Move combobox change handling into a static script with a delegated listener by @emilhuseyn in #2074
- WW-5826 fix(core): make ScopeInterceptor lock table thread-safe by @g0w6y in #2082
- WW-5834 fix(conversion): reject over-long numeric strings before parsing them by @g0w6y in #2092
- docs(skills): require the request-to-sink path in every security triage by @lukaszlenart in #2110
- WW-5838 Exclude java.beans, java.lang.reflect and java.lang.invoke from OGNL member access by default by @lukaszlenart in #2111
- docs(skills): owe a [NOT-VULNERABILITY] user-list notice for public reports closed as non-vulnerabilities by @lukaszlenart in #2113
- WW-5831 fix(xslt): make BeanAdapter property descriptor cache thread-safe by @g0w6y in #2089
- WW-5832 Bound the FreeMarker template cache by @g0w6y in #2090
- WW-5833 fix(rest): authorize nested container members at the depth ParametersInterceptor counts by @g0w6y in #2091
- WW-4164 Support per-package and per-action action extensions by @lukaszlenart in #2093
- WW-5836 Bound integer digits in number tag and message arguments by @lukaszlenart in #2095
- WW-5842 fix(core)!: map actions from the servlet path and path info the container reports by @lukaszlenart in #2118
- WW-5754 Accept cross-site HEAD navigations in the Fetch Metadata policy by @lukaszlenart in #2122
- WW-5846 Match exemptedPaths against the request path in FetchMetadata, COOP and COEP interceptors by @lukaszlenart in #2124
- WW-5847 fix(core): preselect multiple values in the doubleselect second list by @lukaszlenart in #2126
- chore: allow gh pr review in project Claude settings by @lukaszlenart in #2128
- WW-5829 fix(interceptor): apply parameter value filters to every value of a multi-valued parameter by @g0w6y in #2087
- WW-5841 fix(boot): restrict session tracking to cookies and set SameSite=Lax by @g0w6y in #2117
- WW-5844 fix(core)!: enforce HTTP method annotations across action hierarchies and plugin stacks by @g0w6y in #2120
- WW-5845 Validate JSONP callback names by @g0w6y in #2121
- WW-5791 chore(boot): mark Struts Boot as experimental by @lukaszlenart in #2131
Dependencies
- build(deps-dev): bump org.codehaus.mojo:versions-maven-plugin from 2.21.0 to 2.22.0 by @dependabot[bot] in #1950
- build(deps-dev): bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4 by @dependabot[bot] in #1954
- build(deps): bump github/codeql-action from 4.37.9 to 4.38.0 by @dependabot[bot] in #1952
- build(deps-dev): bump org.apache.tomcat.embed:tomcat-embed-core from 10.1.59 to 11.0.26 by @dependabot[bot] in #1949
- build(deps): bump github/codeql-action from 4.38.0 to 4.38.2 by @dependabot[bot] in #1978
- build(deps): bump org.webjars:webjars-locator-lite from 1.1.4 to 1.1.5 by @dependabot[bot] in #1975
- build(deps-dev): bump byte-buddy.version from 1.18.13 to 1.18.14 by @dependabot[bot] in #1974
- build(deps): bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 by @dependabot[bot] in #1972
- build(deps): bump ognl:ognl from 3.4.12 to 3.4.13 by @dependabot[bot] in #1971
- build(deps-dev): bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 by @dependabot[bot] in #1999
- build(deps): bump org.apache.maven:apache-maven from 3.9.16 to 3.10.0 by @dependabot[bot] in #1996
- build(deps): bump ognl:ognl from 3.4.15 to 3.4.16 by @dependabot[bot] in #2014
- build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 by @dependabot[bot] in #2015
- build(deps-dev): bump org.codehaus.mojo:versions-maven-plugin from 2.22.0 to 2.23.0 by @dependabot[bot] in #2016
- build(deps): bump mikepenz/action-junit-report from 6.5.0 to 6.6.1 by @dependabot[bot] in #2017
- build(deps): bump github/codeql-action from 4.38.2 to 4.38.3 by @dependabot[bot] in #2018
- build(deps): bump com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.3 by @dependabot[bot] in #2019
- build(deps-dev): bump org.apache.tomcat.embed:tomcat-embed-core from 11.0.26 to 11.0.27 by @dependabot[bot] in #2020
- build(deps): bump github/codeql-action/upload-sarif from 4.38.2 to 4.39.0 by @dependabot[bot] in #2047
- build(deps): bump github/codeql-action from 4.38.3 to 4.39.0 by @dependabot[bot] in #2046
- build(deps): bump org.mockito:mockito-core from 5.23.0 to 5.24.0 by @dependabot[bot] in #2031
- build(deps): bump org.webjars.npm:bootstrap-icons from 1.13.1 to 1.13.2 by @dependabot[bot] in #2029
- build(deps): bump org.sitemesh:sitemesh from 3.2.3 to 3.3.0 by @dependabot[bot] in #2028
- build(deps): bump com.github.ben-manes.caffeine:caffeine from 3.3.0 to 3.3.1 by @dependabot[bot] in #2027
- build(deps): bump github/codeql-action from 4.39.0 to 4.39.1 by @dependabot[bot] in #2071
- build(deps): bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 by @dependabot[bot] in #2066
- build(deps): bump com.fasterxml.jackson:jackson-bom from 2.22.3 to 2.22.4 by @dependabot[bot] in #2065
- build(deps): bump asm.version from 9.11 to 9.11.1 by @dependabot[bot] in #2064
- build(deps-dev): bump byte-buddy.version from 1.18.14 to 1.18.16 by @dependabot[bot] in #2063
- build(deps-dev): bump org.jacoco:jacoco-maven-plugin from 0.8.15 to 0.8.16 by @dependabot[bot] in #2105
- build(deps): bump mikepenz/action-junit-report from 6.6.1 to 6.6.2 by @dependabot[bot] in #2102
- build(deps): bump org.htmlunit:htmlunit from 5.5.0 to 5.6.0 by @dependabot[bot] in #2098
- build(deps-dev): bump org.apache.maven.plugins:maven-failsafe-plugin from 3.6.0 to 3.6.1 by @dependabot[bot] in #2097
New Contributors
- @mcc0nnell made their first contribution in #1966
- @aeonframework made their first contribution in #2012
- @siddiqueirshad made their first contribution in #2094
- @emilhuseyn made their first contribution in #2073
Full Changelog: STRUTS_7_4_0...STRUTS_7_5_0