[
https://issues.apache.org/jira/browse/WW-5735?focusedWorklogId=1041124&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041124
]
ASF GitHub Bot logged work on WW-5735:
--------------------------------------
Author: ASF GitHub Bot
Created on: 12/Sep/26 13:39
Start Date: 12/Sep/26 13:39
Worklog Time Spent: 10m
Work Description: lukaszlenart opened a new pull request, #1926:
URL: https://github.com/apache/struts/pull/1926
Fixes [WW-5735](https://issues.apache.org/jira/browse/WW-5735)
## What
`struts2-jasperreports7-plugin` declared
`net.sf.jasperreports:jasperreports` at compile scope, so the assembly's
runtime dependency set has shipped `jasperreports-7.0.7.jar` in
`struts-*-lib.zip` and `struts-*-all.zip` since 7.1.0 (verified in
`struts-7.3.0-lib.zip`: `struts-7.3.0/lib/jasperreports-7.0.7.jar`), and every
Maven consumer of the plugin pulled it transitively. JasperReports is LGPL,
which may not be included in an Apache product. The 6.x plugin has always
declared the same dependency as `provided` for exactly this reason.
The dependency is now `provided`, matching the 6.x plugin.
`jasperreports-pdf` was already `optional` and never propagated.
Before / after, from `mvn -pl assembly dependency:list
-DincludeScope=runtime`:
```
- net.sf.jasperreports:jasperreports:jar:7.0.7:compile
```
The plugin's own build and tests are unaffected (`provided` stays on the
compile and test classpaths; the embedded-Tomcat test from WW-5734 still
passes).
The second commit drops the OWASP suppression for `jasperreports-*.jar` /
CVE-2025-10492: the `dependency-check` profile skips provided scope, so the
entry no longer matches anything.
## Migration note (for the Version Notes / Migration Guide)
Applications using the jasperreports7 plugin must declare
`net.sf.jasperreports:jasperreports` (and `jasperreports-pdf` for PDF output)
themselves, as they already do with the 6.x plugin. The plugin page being added
in WW-5728 should state this.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Issue Time Tracking
-------------------
Worklog Id: (was: 1041124)
Remaining Estimate: 0h
Time Spent: 10m
> JasperReports 7 plugin bundles the LGPL jasperreports jar into the release
> distribution
> ---------------------------------------------------------------------------------------
>
> Key: WW-5735
> URL: https://issues.apache.org/jira/browse/WW-5735
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - JasperReports
> Reporter: Lukasz Lenart
> Priority: Major
> Fix For: 7.4.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> {{plugins/jasperreports7/pom.xml}} declares
> {{net.sf.jasperreports:jasperreports}} as a plain compile-scope, non-optional
> dependency. The 6.x {{struts2-jasperreports-plugin}} has always declared it
> {{provided}}, precisely so that the LGPL library is never part of an Apache
> Struts distribution — users add it to their own application.
> Because the assembly collects the runtime dependency set of every plugin, the
> jar is now shipped: {{struts-7.3.0-lib.zip}} on {{archive.apache.org}}
> contains {{struts-7.3.0/lib/jasperreports-7.0.7.jar}} (3.8 MB), and
> {{LICENSE.txt}} / {{NOTICE.txt}} do not mention it. The same applies to
> {{struts-7.3.0-all.zip}} and to every release since the plugin was introduced
> in 7.1.0. Users depending on {{struts2-jasperreports7-plugin}} from Maven
> also pull the LGPL jar transitively by default.
> JasperReports is LGPL, which is ASF Category X and may not be included in an
> Apache product.
> Fix: declare {{jasperreports}} with {{<scope>provided</scope>}}, matching the
> 6.x plugin. Applications using the plugin must then add
> {{net.sf.jasperreports:jasperreports}} (and {{jasperreports-pdf}} for PDF
> output, which is already optional) themselves; the plugin documentation page
> should say so. Verify afterwards that the assembly's {{lib/}} no longer
> contains any {{net.sf.jasperreports}} artifact.
> This is a licensing and distribution issue, not a security vulnerability.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
