(tick) These are the notes for the Struts version 7.2.1 distribution.

(tick) For prior notes in this release series, see Version Notes 7.1.1

Maven users

If you are a Maven user, you might want to get started using the Maven Archetype.

Maven Dependency
<dependency>
  <groupId>org.apache.struts</groupId>
  <artifactId>struts2-core</artifactId>
  <version>7.2.1</version>
</dependency>

You can also use Struts Archetype Catalog like below

Struts Archetype Catalog
mvn archetype:generate -DarchetypeCatalog=http://struts.apache.org/
Staging Repository
<repositories>
  <repository>
    <id>apache.nexus</id>
    <name>ASF Nexus Staging</name>
    <url>https://repository.apache.org/content/groups/staging/</url>
  </repository>
</repositories>

Breaking changes

  • JSON and REST request bodies are now authorized per property during deserialization, so action/model properties without @StrutsParameter  are no longer populated when struts.parameters.requireAnnotations is enabled (the default) [WW-5626], [WW-5624].
  • CookieInterceptor  now applies @StrutsParameter  authorization to cookie values and deprecates the 4-arg populateCookieValueIntoStack(...)  in favor of a new 5-arg overload taking the action, so un-annotated setters stop receiving cookies and subclass overrides must migrate [WW-5627].
  • Apache Commons FileUpload was upgraded to 2.0.0-M5, whose renamed methods break custom upload code or FileUploadInterceptor  subclasses calling its API directly [WW-5615], [WW-5632].
  • OGNL was upgraded from 3.3.5 to 3.4.11, which may affect code or configuration relying on OGNL expression, method-access, or security semantics [WW-5536], [WW-5613].
  • StreamResult  now honors an explicitly empty contentCharSet  by clearing the response character encoding, changing the emitted Content-Type for that configuration [WW-5602].
  • ChainingInterceptor  adds the opt-in struts.chaining.requireAnnotations  constant (default false) that, when enabled, skips properties without @StrutsParameter  during action chaining [WW-5631].

Bug

  • [WW-2963] - default-action-ref fails to find wildcard named actions
  • [WW-3429] - <input> tag generated by <s:checkbox> produce HTML warning in validators
  • [WW-3647] - Adding a jndi-lookup Spring bean breaks ServletActionRedirectResult
  • [WW-4421] - Duplicate @Action value annotation check skipped
  • [WW-4428] - Add support for new Java 8 LocalDate and LocalDateTime to the JSON plugin
  • [WW-5294] - Tag <s:textfield/> is not showing the warning when exposed directly via JSP
  • [WW-5368] - Access warning when get resource bundle which its name starts with "label"
  • [WW-5514] - Allow configuration of ProxyUtil for cache types
  • [WW-5519] - Plugin not compatible with latest version of IDEA
  • [WW-5535] - HttpMethodInterceptor does not work with action names using wildcards
  • [WW-5537] - Memory Leak
  • [WW-5549] - i18n interceptor param supportedLocale (when set) disables request_locale param functionality
  • [WW-5578] - Bad interceptor configuration is masked
  • [WW-5586] - WithLazyParams interceptors cannot be configured within interceptor stacks
  • [WW-5587] - WithLazyParams interceptors lose parameters in stack configurations
  • [WW-5592] - Textfield tag not allowing white space
  • [WW-5593] - Convention plugin fails with NoClassDefFoundError when scanning classes with missing dependencies
  • [WW-5594] - Convention plugin exclusion pattern org.apache.struts2.* doesn't match root package classes
  • [WW-5602] - Can't specify empty charset on StreamResult
  • [WW-5614] - Excessive memory usage in apps with large short-lived objects
  • [WW-5623] - Harden output encoding of the form action attribute in PostbackResult
  • [WW-5624] - Request body population bypasses @StrutsParameter contract outside ParametersInterceptor
  • [WW-5630] - Performance Issue SecurityMemberAccess
  • [WW-5636] - ServletRedirectResult writes unescaped URL to response body for non-302 status codes

New Feature

  • [WW-5444] - Implement a new html5 theme
  • [WW-5631] - Add opt-in @StrutsParameter enforcement to ChainingInterceptor
  • [WW-5632] - Harden commons-fileupload2 dependency against milestone binary-incompatibility

Improvement

  • [WW-4291] - Can't use Spring bean name for type convertor
  • [WW-5256] - Reduce size of generate html out of freemarker tag templates
  • [WW-5560] - Support IntelliJ Platform 2024.2
  • [WW-5563] - Support IntelliJ Platform 2025.3
  • [WW-5576] - In Java 25: the use of the three-letter time zone IDs is deprecated
  • [WW-5585] - Allow dynamically set "allowedTypes" and "allowedExtensions" for file upload validation
  • [WW-5588] - Allow Preparable interface to work with only per-method prepare*() implementations
  • [WW-5589] - Convert remaining UIBean protected fields to private to prevent OGNL warnings
  • [WW-5603] - xwork-default.xml is shown as framework config file
  • [WW-5613] - Add proper support for OGNL 3.4.10
  • [WW-5617] - Use System.err.println() instead of printStackTrace()
  • [WW-5618] - Make JSON plugin more configurable
  • [WW-5621] - Harden XML parsers against Entity Expansion (Billion Laughs) attacks
  • [WW-5622] - Optimize Hibernate proxy detection to avoid repeated exception overhead when Hibernate is absent
  • [WW-5626] - Refactor JSON/REST @StrutsParameter enforcement to per-property authorization
  • [WW-5627] - CookieInterceptor bypasses @StrutsParameter authorization
  • [WW-5635] - TokenHelper.validToken() includes session token in WARN log output

Task

  • [WW-5615] - Adapt to renamed methods in Apache Commons FileUpload 2.0.0-M5

Dependency

  • [WW-5536] - Bump ognl:ognl from 3.3.5 to 3.4.8
  • [WW-5579] - @DoubleRangeFieldValidator and @ShortRangeFieldValidator missing from @Validations container annotation
  • [WW-5582] - Bump asm.version from 9.8 to 9.9
  • [WW-5583] - Bump commons-validator:commons-validator from 1.9.0 to 1.10.0
  • [WW-5595] - Bump org.apache.commons:commons-text from 1.14.0 to 1.15.0
  • [WW-5596] - Bump byte-buddy.version from 1.17.7 to 1.18.2
  • [WW-5598] - Bump com.fasterxml.jackson:jackson-bom from 2.19.1 to 2.20.1
  • [WW-5601] - Bump commons-io:commons-io from 2.20.0 to 2.21.0
  • [WW-5605] - Bump org.apache.juneau:juneau-marshall from 8.1.3 to 9.2.0
  • [WW-5607] - Bump com.fasterxml.jackson:jackson-bom from 2.20.1 to 2.21.0
  • [WW-5625] - Bump commons-io:commons-io from 2.21.0 to 2.22.0
  • [WW-5628] - bump asm.version from 9.9.1 to 9.10
  • [WW-5629] - bump log4j2.version from 2.25.4 to 2.26.0
  • [WW-5633] - Bumps com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.0.
  • [WW-5634] - Bumps org.htmlunit:htmlunit from 4.21.0 to 5.1.0.

Issue Detail

Issue List

Other resources