Prepared announcement: https://github.com/apache/struts-site/pull/306
--- Subject: [ANN] Apache Struts 7.2.1 The Apache Struts group is pleased to announce that Apache Struts version 7.2.1 is available as a "General Availability" release. The GA designation is our highest quality grade. The Apache Struts is an elegant, extensible framework for creating enterprise-ready Java web applications. The framework has been designed to streamline the full development cycle, from building, to deploying, to maintaining applications over time. Please read the Migration Guide to find more details about how to adopt a new version. https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration Please read the Version Notes to find more details about performed bug fixes and improvements. https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.2.1 All developers are strongly advised to perform this upgrade. The 7.x series of the Apache Struts framework has a minimum requirement of the following specification versions: Java 17 and JakartaEE. Should any issues arise with your use of any version of the Struts framework, please post your comments to the user list, and, if appropriate, file a tracking ticket. https://issues.apache.org/jira/projects/WW/ You can download this version from our download page. https://struts.apache.org/download.cgi#struts-ga --- pon., 29 cze 2026 o 14:46 Lukasz Lenart <[email protected]> napisał(a): > > Vote passed with result: > > GA +1 (binding) x4 > > Thanks a lot! > Łukasz > > śr., 24 cze 2026 o 09:02 Lukasz Lenart <[email protected]> napisał(a): > > > > The Apache Struts 7.2.1 test build is available. This release contains > > a few minor breaking changes plus some bug fixes. Also a lot of > > dependencies have been updated: > > > > Breaking changes > > > > - JSON and REST request bodies are now authorized per property during > > deserialization, so action/model properties without @StrutsParameter > > are no longer populated when struts.parameters.requireAnnotations is > > enabled (the default) [WW-5626], [WW-5624]. > > - CookieInterceptor now applies @StrutsParameter authorization to > > cookie values and deprecates the 4-arg > > populateCookieValueIntoStack(...) in favor of a new 5-arg overload > > taking the action, so un-annotated setters stop receiving cookies and > > subclass overrides must migrate [WW-5627]. > > - Apache Commons FileUpload was upgraded to 2.0.0-M5, whose renamed > > methods break custom upload code or FileUploadInterceptor subclasses > > calling its API directly [WW-5615], [WW-5632]. > > - OGNL was upgraded from 3.3.5 to 3.4.11, which may affect code or > > configuration relying on OGNL expression, method-access, or security > > semantics [WW-5536], [WW-5613]. > > - StreamResult now honors an explicitly empty contentCharSet by > > clearing the response character encoding, changing the emitted > > Content-Type for that configuration [WW-5602]. > > - ChainingInterceptor adds the opt-in > > struts.chaining.requireAnnotations constant (default false) that, > > when enabled, skips properties without @StrutsParameter during action > > chaining [WW-5631]. > > > > Bug > > [WW-2963] - default-action-ref fails to find wildcard named actions > > [WW-3429] - <input> tag generated by <s:checkbox> produce HTML warning > > in validators > > [WW-3647] - Adding a jndi-lookup Spring bean breaks > > ServletActionRedirectResult > > [WW-4421] - Duplicate @Action value annotation check skipped > > [WW-4428] - Add support for new Java 8 LocalDate and LocalDateTime to > > the JSON plugin > > [WW-5294] - Tag <s:textfield/> is not showing the warning when exposed > > directly via JSP > > [WW-5368] - Access warning when get resource bundle which its name > > starts with "label" > > [WW-5514] - Allow configuration of ProxyUtil for cache types > > [WW-5519] - Plugin not compatible with latest version of IDEA > > [WW-5535] - HttpMethodInterceptor does not work with action names > > using wildcards > > [WW-5537] - Memory Leak > > [WW-5549] - i18n interceptor param supportedLocale (when set) disables > > request_locale param functionality > > [WW-5578] - Bad interceptor configuration is masked > > [WW-5586] - WithLazyParams interceptors cannot be configured within > > interceptor stacks > > [WW-5587] - WithLazyParams interceptors lose parameters in stack > > configurations > > [WW-5592] - Textfield tag not allowing white space > > [WW-5593] - Convention plugin fails with NoClassDefFoundError when > > scanning classes with missing dependencies > > [WW-5594] - Convention plugin exclusion pattern org.apache.struts2.* > > doesn't match root package classes > > [WW-5602] - Can't specify empty charset on StreamResult > > [WW-5614] - Excessive memory usage in apps with large short-lived objects > > [WW-5623] - Harden output encoding of the form action attribute in > > PostbackResult > > [WW-5624] - Request body population bypasses @StrutsParameter contract > > outside ParametersInterceptor > > [WW-5630] - Performance Issue SecurityMemberAccess > > [WW-5636] - ServletRedirectResult writes unescaped URL to response > > body for non-302 status codes > > > > New Feature > > [WW-5444] - Implement a new html5 theme > > [WW-5631] - Add opt-in @StrutsParameter enforcement to ChainingInterceptor > > [WW-5632] - Harden commons-fileupload2 dependency against milestone > > binary-incompatibility > > > > Improvement > > [WW-4291] - Can't use Spring bean name for type convertor > > [WW-5256] - Reduce size of generate html out of freemarker tag templates > > [WW-5560] - Support IntelliJ Platform 2024.2 > > [WW-5563] - Support IntelliJ Platform 2025.3 > > [WW-5576] - In Java 25: the use of the three-letter time zone IDs is > > deprecated > > [WW-5585] - Allow dynamically set "allowedTypes" and > > "allowedExtensions" for file upload validation > > [WW-5588] - Allow Preparable interface to work with only per-method > > prepare*() implementations > > [WW-5589] - Convert remaining UIBean protected fields to private to > > prevent OGNL warnings > > [WW-5603] - xwork-default.xml is shown as framework config file > > [WW-5613] - Add proper support for OGNL 3.4.10 > > [WW-5617] - Use System.err.println() instead of printStackTrace() > > [WW-5618] - Make JSON plugin more configurable > > [WW-5621] - Harden XML parsers against Entity Expansion (Billion Laughs) > > attacks > > [WW-5622] - Optimize Hibernate proxy detection to avoid repeated > > exception overhead when Hibernate is absent > > [WW-5626] - Refactor JSON/REST @StrutsParameter enforcement to > > per-property authorization > > [WW-5627] - CookieInterceptor bypasses @StrutsParameter authorization > > [WW-5635] - TokenHelper.validToken() includes session token in WARN log > > output > > > > Task > > [WW-5615] - Adapt to renamed methods in Apache Commons FileUpload 2.0.0-M5 > > > > Dependency > > [WW-5536] - Bump ognl:ognl from 3.3.5 to 3.4.8 > > [WW-5579] - @DoubleRangeFieldValidator and @ShortRangeFieldValidator > > missing from @Validations container annotation > > [WW-5582] - Bump asm.version from 9.8 to 9.9 > > [WW-5583] - Bump commons-validator:commons-validator from 1.9.0 to 1.10.0 > > [WW-5595] - Bump org.apache.commons:commons-text from 1.14.0 to 1.15.0 > > [WW-5596] - Bump byte-buddy.version from 1.17.7 to 1.18.2 > > [WW-5598] - Bump com.fasterxml.jackson:jackson-bom from 2.19.1 to 2.20.1 > > [WW-5601] - Bump commons-io:commons-io from 2.20.0 to 2.21.0 > > [WW-5605] - Bump org.apache.juneau:juneau-marshall from 8.1.3 to 9.2.0 > > [WW-5607] - Bump com.fasterxml.jackson:jackson-bom from 2.20.1 to 2.21.0 > > [WW-5625] - Bump commons-io:commons-io from 2.21.0 to 2.22.0 > > [WW-5628] - bump asm.version from 9.9.1 to 9.10 > > [WW-5629] - bump log4j2.version from 2.25.4 to 2.26.0 > > [WW-5633] - Bumps com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.0. > > [WW-5634] - Bumps org.htmlunit:htmlunit from 4.21.0 to 5.1.0. > > > > Release notes: > > * https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.2.1 > > > > Github release > > * https://github.com/apache/struts/releases/tag/STRUTS_7_2_1 > > > > Distribution: > > * https://dist.apache.org/repos/dist/dev/struts/7.2.1/ > > > > Maven 2 staging repository: > > * https://repository.apache.org/content/repositories/staging/ > > > > Once you have had a chance to review the test build, please respond > > with a vote on its quality: > > > > [ ] Leave at test build > > [ ] Alpha > > [ ] Beta > > [ ] General Availability (GA) > > > > Everyone who has tested the build is invited to vote. Votes by PMC > > members are considered binding. A vote passes if there are at least > > three binding +1s and more +1s than -1s. > > > > The vote will remain open for at least 72 hours, longer upon request. > > A vote can be amended at any time to upgrade or downgrade the quality > > of the release based on future experience. If an initial vote > > designates the build as "Beta", the release will be submitted for > > mirroring and announced to the user list. Once released as a public > > beta, subsequent quality votes on a build may be held on the user > > list. > > > > As always, the act of voting carries certain obligations. A binding > > vote not only states an opinion, but means that the voter is agreeing > > to help do the work. > > > > On behalf of the Apache Struts project > > Łukasz --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
