[
https://issues.apache.org/jira/browse/WW-5684?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5684:
------------------------------
Fix Version/s: 7.4.0
Description:
WW-5675 removes five dev-mode configuration setters from
{{org.apache.struts2.ognl.SecurityMemberAccess}}. This is a source-breaking
change and needs a Version Notes entry and a Migration Guide entry on the cwiki
before the release ships. Those pages are not in the repository, so the change
could not be documented in the WW-5675 pull request itself.
h2. What was removed
|| Method || Visibility || Bound to ||
| {{useDevModeExcludedClasses}} | public | struts.devMode.excludedClasses |
| {{useDevModeExcludedPackageNamePatterns}} | public |
struts.devMode.excludedPackageNamePatterns |
| {{useDevModeExcludedPackageNames}} | public |
struts.devMode.excludedPackageNames |
| {{useDevModeExcludedPackageExemptClasses}} | public |
struts.devMode.excludedPackageExemptClasses |
| {{useDevMode}} | protected | struts.devMode |
The private {{useDevModeConfiguration()}} and six dev-mode fields went with
them, but those were never API.
h2. What upgraders need to know
_No configuration change is required._ None of the {{struts.devMode.*}}
constants changed, and dev-mode behaves exactly as before — the configuration
is now read once per container by the new {{SecurityMemberAccessConfig}} bean
instead of once per {{SecurityMemberAccess}} instance. Anyone configuring
Struts through properties is unaffected.
The break reaches only code calling these setters directly. There is no such
caller anywhere in Struts itself, and the failure mode for a third party is a
compile error with an obvious fix.
One line is also worth adding for completeness: the eleven configuration
setters that were kept and deprecated no longer carry {{@Inject}}, so the
container does not invoke them and overriding one in a subclass no longer
affects configuration.
h2. Target version
Decided 2026-08-14: this ships as _7.4.0_, matching the {{@Deprecated(since =
"7.4.0", forRemoval = true)}} annotations already in the code. Revisit only if
the release is retargeted — the removal of public methods would justify a major
under strict semver, but the affected methods are container-injected with no
known external caller, so the practical impact does not warrant forcing 8.0.0.
h2. Related
* WW-5675 — the change itself
* WW-5682 — removes the eleven deprecated setters in 8.0.0
* WW-5683 — migrates the tests off the deprecated setters
was:
WW-5675 removes five dev-mode configuration setters from
{{org.apache.struts2.ognl.SecurityMemberAccess}}. This is a source-breaking
change and needs a Version Notes entry and a Migration Guide entry on the cwiki
before the release ships. Those pages are not in the repository, so the change
could not be documented in the WW-5675 pull request itself.
h2. What was removed
|| Method || Visibility || Bound to ||
| {{useDevModeExcludedClasses}} | public | struts.devMode.excludedClasses |
| {{useDevModeExcludedPackageNamePatterns}} | public |
struts.devMode.excludedPackageNamePatterns |
| {{useDevModeExcludedPackageNames}} | public |
struts.devMode.excludedPackageNames |
| {{useDevModeExcludedPackageExemptClasses}} | public |
struts.devMode.excludedPackageExemptClasses |
| {{useDevMode}} | protected | struts.devMode |
The private {{useDevModeConfiguration()}} and six dev-mode fields went with
them, but those were never API.
h2. What upgraders need to know
_No configuration change is required._ None of the {{struts.devMode.*}}
constants changed, and dev-mode behaves exactly as before — the configuration
is now read once per container by the new {{SecurityMemberAccessConfig}} bean
instead of once per {{SecurityMemberAccess}} instance. Anyone configuring
Struts through properties is unaffected.
The break reaches only code calling these setters directly. There is no such
caller anywhere in Struts itself, and the failure mode for a third party is a
compile error with an obvious fix.
One line is also worth adding for completeness: the eleven configuration
setters that were kept and deprecated no longer carry {{@Inject}}, so the
container does not invoke them and overriding one in a subclass no longer
affects configuration.
h2. Related
* WW-5675 — the change itself
* WW-5682 — removes the eleven deprecated setters in 8.0.0
* WW-5683 — migrates the tests off the deprecated setters
Note the release version is still open: removing public methods forces a major
by semver, so whether this ships as 7.4.0 or 8.0.0 should be settled before the
notes are written.
> Document the SecurityMemberAccess dev-mode setter removal in the Migration
> Guide
> --------------------------------------------------------------------------------
>
> Key: WW-5684
> URL: https://issues.apache.org/jira/browse/WW-5684
> Project: Struts 2
> Issue Type: Task
> Reporter: Lukasz Lenart
> Priority: Major
> Fix For: 7.4.0
>
>
> WW-5675 removes five dev-mode configuration setters from
> {{org.apache.struts2.ognl.SecurityMemberAccess}}. This is a source-breaking
> change and needs a Version Notes entry and a Migration Guide entry on the
> cwiki before the release ships. Those pages are not in the repository, so the
> change could not be documented in the WW-5675 pull request itself.
> h2. What was removed
> || Method || Visibility || Bound to ||
> | {{useDevModeExcludedClasses}} | public | struts.devMode.excludedClasses |
> | {{useDevModeExcludedPackageNamePatterns}} | public |
> struts.devMode.excludedPackageNamePatterns |
> | {{useDevModeExcludedPackageNames}} | public |
> struts.devMode.excludedPackageNames |
> | {{useDevModeExcludedPackageExemptClasses}} | public |
> struts.devMode.excludedPackageExemptClasses |
> | {{useDevMode}} | protected | struts.devMode |
> The private {{useDevModeConfiguration()}} and six dev-mode fields went with
> them, but those were never API.
> h2. What upgraders need to know
> _No configuration change is required._ None of the {{struts.devMode.*}}
> constants changed, and dev-mode behaves exactly as before — the configuration
> is now read once per container by the new {{SecurityMemberAccessConfig}} bean
> instead of once per {{SecurityMemberAccess}} instance. Anyone configuring
> Struts through properties is unaffected.
> The break reaches only code calling these setters directly. There is no such
> caller anywhere in Struts itself, and the failure mode for a third party is a
> compile error with an obvious fix.
> One line is also worth adding for completeness: the eleven configuration
> setters that were kept and deprecated no longer carry {{@Inject}}, so the
> container does not invoke them and overriding one in a subclass no longer
> affects configuration.
> h2. Target version
> Decided 2026-08-14: this ships as _7.4.0_, matching the {{@Deprecated(since =
> "7.4.0", forRemoval = true)}} annotations already in the code. Revisit only
> if the release is retargeted — the removal of public methods would justify a
> major under strict semver, but the affected methods are container-injected
> with no known external caller, so the practical impact does not warrant
> forcing 8.0.0.
> h2. Related
> * WW-5675 — the change itself
> * WW-5682 — removes the eleven deprecated setters in 8.0.0
> * WW-5683 — migrates the tests off the deprecated setters
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
