Lukasz Lenart created WW-5684:
---------------------------------
Summary: Document the SecurityMemberAccess dev-mode setter removal
in the Migration Guide
Key: WW-5684
URL: https://issues.apache.org/jira/browse/WW-5684
Project: Struts 2
Issue Type: Task
Reporter: Lukasz Lenart
WW-5675 removes five dev-mode configuration setters from
{{org.apache.struts2.ognl.SecurityMemberAccess}}. This is a source-breaking
change and needs a Version Notes entry and a Migration Guide entry on the cwiki
before the release ships. Those pages are not in the repository, so the change
could not be documented in the WW-5675 pull request itself.
h2. What was removed
|| Method || Visibility || Bound to ||
| {{useDevModeExcludedClasses}} | public | struts.devMode.excludedClasses |
| {{useDevModeExcludedPackageNamePatterns}} | public |
struts.devMode.excludedPackageNamePatterns |
| {{useDevModeExcludedPackageNames}} | public |
struts.devMode.excludedPackageNames |
| {{useDevModeExcludedPackageExemptClasses}} | public |
struts.devMode.excludedPackageExemptClasses |
| {{useDevMode}} | protected | struts.devMode |
The private {{useDevModeConfiguration()}} and six dev-mode fields went with
them, but those were never API.
h2. What upgraders need to know
_No configuration change is required._ None of the {{struts.devMode.*}}
constants changed, and dev-mode behaves exactly as before — the configuration
is now read once per container by the new {{SecurityMemberAccessConfig}} bean
instead of once per {{SecurityMemberAccess}} instance. Anyone configuring
Struts through properties is unaffected.
The break reaches only code calling these setters directly. There is no such
caller anywhere in Struts itself, and the failure mode for a third party is a
compile error with an obvious fix.
h2. Also worth a migration note: a silent change for subclasses
The other eleven configuration setters on {{SecurityMemberAccess}} were kept
and deprecated, but they lost their {{@Inject}} annotations. This has a
consequence that produces _no_ compile error and _no_ log message:
A subclass registered via {{struts.ognl.memberAccess}} that overrides one of
those setters — for example overriding {{useExcludedClasses}} to append its own
exclusions — previously had that override invoked by the container, because the
injector was created for the superclass method and dispatched virtually into
the override. The container no longer injects those methods, so such an
override silently never runs.
The subclass still receives the full container-parsed configuration through the
new {{useConfig}} setter, so it loses only its own additions, not the baseline
exclusions. But it loses them silently, which makes this arguably more
important to document than the five removals above.
h2. Related
* WW-5675 — the change itself
* WW-5682 — removes the eleven deprecated setters in 8.0.0
* WW-5683 — migrates the tests off the deprecated setters
Note the release version is still open: removing public methods forces a major
by semver, so whether this ships as 7.4.0 or 8.0.0 should be settled before the
notes are written.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
