(tick) These are the notes for the Struts version 7.3.0 distribution.

(tick) For prior notes in this release series, see Version Notes 7.2.1

Maven users

If you are a Maven user, you might want to get started using the Maven Archetype.

Maven Dependency
<dependency>
  <groupId>org.apache.struts</groupId>
  <artifactId>struts2-core</artifactId>
  <version>7.3.0</version>
</dependency>

You can also use Struts Archetype Catalog like below

Struts Archetype Catalog
mvn archetype:generate -DarchetypeCatalog=http://struts.apache.org/
Staging Repository
<repositories>
  <repository>
    <id>apache.nexus</id>
    <name>ASF Nexus Staging</name>
    <url>https://repository.apache.org/content/groups/staging/</url>
  </repository>
</repositories>

Breaking changes

  • Struts no longer uses SLF4J or java.util.logging internally, and the container no longer injects a Logger [WW-5620].
  • JSON body population now honours the excluded and accepted parameter-name patterns [WW-4858].
  • Annotated wildcard actions are matched most-specific-first, so action selection can differ [WW-3784].
  • JSONInterceptor uses a fresh reader and writer per request, so custom ones must not hold state between requests [WW-5650].
  • @TypeConversion derives the ConversionRule key prefix automatically and can now be placed on fields [WW-3871].
  • Static content paths are canonicalised and a redundant URL decode was removed [WW-5645].
  • The <s:include> component normalises its path the same way [WW-5646].

Deprecations

  • XWorkObjectPropertyAccessor is deprecated [WW-5591].
  • ConversionRule.COLLECTION and the Collection_ key prefix are deprecated; use ConversionRule.ELEMENT and Element_ instead [WW-5656].

Rejected requests

Three tickets were closed against this release without a change to shipped code. They are listed here so the decision is visible rather than silent.

  • [WW-1522] - Automatic Alias ActionConfigs - will not be implemented.
  • [WW-2635] - Flash scope - will not be implemented; the proposed mechanism could introduce a security risk.
  • [WW-3427] - If you alias a property that uses a custom TypeConverter and it throws TypeConversionException the error is never caught - closed as Not A Problem; the behaviour was already correct, and a regression test was added to keep it so.

Bug

  • [WW-3530] - Invalid cache key in AnnotationActionValidationManager.buildValidatorKey when using visitor field validators
  • [WW-3784] - Greedy and non-greedy matching behaviour should work in action methods using annotated wildcards
  • [WW-5413] - Multipart misbehavior with commons-io 2.16.0 and 2.16.1
  • [WW-5416] - Hello World example does not match documentation and returns a 404
  • [WW-5474] - struts.multipart.maxFiles does not work as described/expected
  • [WW-5562] - Support for version 2025.2 (252)
  • [WW-5604] - CDI proxies won't be recognized as proxy in SecurityMemberAccess
  • [WW-5641] - JSON plugin ignores struts.json.writer / struts.json.reader override (regression since 7.2.x)
  • [WW-5642] - @StrutsParameter authorization bypassed for record/creator-bound REST body properties
  • [WW-5643] - StrutsJSONReader parse state shared across concurrent requests
  • [WW-5644] - StrutsJSONWriter write state shared across concurrent requests
  • [WW-5659] - WithLazyParams resolves dynamic interceptor params onto the shared interceptor instance

New Feature

  • [WW-5640] - Add WebJars support to Struts core

Improvement

  • [WW-2934] - conversion error should short-circuit all validators
  • [WW-3871] - TypeConversion annotation support improvement
  • [WW-4858] - JSONInterceptor must not populate value stack directly
  • [WW-5539] - Concurrency performance enhancements
  • [WW-5540] - Add caching to AbstractLocalizedTextProvider
  • [WW-5580] - Use Configuration.VERSION_2_3_34 for Freemaker config
  • [WW-5591] - Mark XWorkObjectPropertyAccessor as deprecated
  • [WW-5620] - Replace java.util.logging and SLF4J with Log4j2
  • [WW-5645] - Canonicalise static content paths and remove redundant URL decode
  • [WW-5646] - Modernize path normalization in Include component
  • [WW-5647] - Use ConcurrentHashMap for XSLT template cache
  • [WW-5650] - Refactor JSON plugin reader/writer to per-request instances instead of shared mutable state
  • [WW-5652] - Support Java record serialization and Optional handling in Struts JSON plugin
  • [WW-5653] - Upgrade bundled Bootstrap in sample apps from 3.3.4 to 5.3.x
  • [WW-5656] - Mark ConversionRule.COLLECTION and the Collection_ prefix as @Deprecated
  • [WW-5666] - Apply input length limits consistently when reading request bodies
  • [WW-5668] - Make the localized-text provider caches size-bounded and align request-locale resolution across entry points

Dependency

  • [WW-5649] - Bump commons-logging:commons-logging from 1.3.6 to 1.4.0

Issue Detail

Issue List

Other resources

  • No labels