Re: Which Struts Version To Use?

[David Greene]

Just from my personal experience, migrating from 2.3.x to 2.5.x was a very
small development task.  I was actually surprised at how few changes were
required.  As someone else mentioned, a little bit of regex to weed out the
now-unused tag arguments was probably the 'hardest' part.  I would
recommend just biting the (small) bullet and going with 2.5.x if Java 1.6
isn't required in your environment.

-David


On Tue, Sep 19, 2017 at 1:11 AM, Lukasz Lenart 
wrote:

> Bruce
>
> Struts 2.5.x is not only due to build on JDK7, also there were few
> important architectural changes which may be backward incompatible in
> some cases. Also 2.5.x brings more new features and improvements that
> also at some point can break backward comaptibility. 2.5.x is a good
> choice when you start a new development project or you need a ned
> feature which is available in 2.5.x only.
>
> That's why I keep 2.3.x branch just to port security fixes and allow
> easier transition to 2.5.x (or 2.6.x soon). There is no exact plans
> how long 2.3.x will be around, I do plan switch to JDK7 (lack of tools
> to support build on JDK6) and then 2.3.x will be branded as 2.4.x but
> still with the same scope - only security fixes. So 2.3.x/2.4.x will
> stay with us for longer :)
>
>
> Regards
> --
> Łukasz
> + 48 606 323 122 http://www.lenart.org.pl/
>
> PS. Please remember that Struts doesn't follow strict semantic
> versioning, "2" means "Struts 2" so Struts 2.5.x is "Struts 2 version
> 5.x" where Struts 2.3.x means "Struts 2 version 3.x" :)
>
> 2017-09-18 21:29 GMT+02:00 bruceaphill...@gmail.com <
> bruceaphill...@gmail.com>:
> > Thank you for the reply.
> >
> > I still don't understand why there are two active branches, especially
> since JDK7 was EOL some time ago.
> >
> > If the 2.3.X line is going to be ended soon and the 2.5.X line is the
> future then I'd like to get our Struts apps on 2.5.X
> >
> > But if 2.3.X is going to be maintained for the next 1-2 years then I'd
> feel comfortable updating to 2.3.X
> >
> > Another consideration is that all our newer web apps use Spring MVC and
> do not use Struts 2.  We only have some legacy web apps that still use
> Struts 2.  If the time commitment in converting from Struts 2.3.X to 2.5.X
> is high then we might as well just convert those apps to Spring MVC.
> >
> > It would be great if the Struts 2 PMC would publicly state what the
> future plan is for Struts 2 or if there is already a published plan please
> let know.
> >
> > Bruce
> >
> > On 2017-09-18 10:15, "Jason D. Burkert" 
> wrote:
> >> On 2017-09-18 11:05 AM, Phillips, Bruce A wrote:
> >> > We still have a couple of web apps that are using Struts version
> 2.3.32
> >> >
> >> > We want to update those web apps to the latest version of Struts but
> I’m not sure what version to update to.
> >> >
> >> > I see a 2.5.13 and a 2.3.34 – both tags seem to be recently created.
> >> >
> >> > Should I update to 2.5.13 or should I stay on the 2.3.X line?
> >> >
> >> > Why are there different production tags (2.5.X and 2.3.X) ?
> >> >
> >> > Thank You,
> >> >
> >> > Bruce Phillips
> >> >
> >>
> >> Hello Bruce,
> >>
> >> If you have existing web apps using 2.3.32 it would be easiest to update
> >> to 2.3.34 for the latest security updates.
> >>
> >> In the future, to use the 2.5.x series, you'll need to perform some
> >> migration steps.  Review the Version Notes for 2.5 to get started,
> >> especially "Internal Changes" and "Package names have changed".
> >> https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.5
> >>
> >> As to why there are both 2.3.x series and 2.5.x series releases, my
> >> understanding is that one significant reason is "Struts2 is now build
> >> with JDK7" as of the first 2.5 release.
> >>
> >> -Jason
> >>
> >>
> >
> > -
> > To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
> > For additional commands, e-mail: user-h...@struts.apache.org
> >
>
> -
> To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
> For additional commands, e-mail: user-h...@struts.apache.org
>
>

Re: Which Struts Version To Use?

[Yasser Zamani]

I'm sorry for duplicate mails. Microsoft's outlook services was down 
yesterday! while I thought there is a problem with me :)

Bruce, I had experience with migrating from 2.3 to 2.5. Its time 
commitment is not high. I did a few small steps manually but for rest, I 
could do them by a regular expression enabled replace. Then I tested 
converted one against our JMeter functional tests and all of them passed.

The only thing that I saw a few users complain, is when they want to 
access something which is excluded in new version due to security fixes. 
If any, then we can help you here.

Sincerely Yours,
Yasser.

On 9/18/2017 8:21 PM, Yasser Zamani wrote:
> 
> 
> On 9/18/2017 7:35 PM, Phillips, Bruce A wrote:
>> We still have a couple of web apps that are using Struts version 2.3.32
>>
>> We want to update those web apps to the latest version of Struts but 
>> I’m not sure what version to update to.
>>
>> I see a 2.5.13 and a 2.3.34 – both tags seem to be recently created.
>>
>> Should I update to 2.5.13 or should I stay on the 2.3.X line?
>>
>> Why are there different production tags (2.5.X and 2.3.X) ?
>>
> 
> Because The 2.5.x series introduced some breaking changes, so the 
> development is now branching, as 2.3.x is still supported. Basically we 
> backport some security fixes to 2.3.x without breaking things.
> 
> So you can update to 2.3.34 without any needed change but you will not 
> get any further bug fixes but only security fixes. But if you update to 
> 2.5.13, then you need to do a few migration steps at [1], and then you 
> will get future both security and bug fixes.
> 
> I recommend updating to 2.5.13 as I already test [1] on our app and all 
> of our JMeter functional tests pass in it also.
> 
> Hope this helps.
> 
> [1] https://struts.apache.org/docs/struts-23-to-25-migration.html
> 
>> Thank You,
>>
>> Bruce Phillips
>>

Re: Which Struts Version To Use?

[Lukasz Lenart]

Bruce

Struts 2.5.x is not only due to build on JDK7, also there were few
important architectural changes which may be backward incompatible in
some cases. Also 2.5.x brings more new features and improvements that
also at some point can break backward comaptibility. 2.5.x is a good
choice when you start a new development project or you need a ned
feature which is available in 2.5.x only.

That's why I keep 2.3.x branch just to port security fixes and allow
easier transition to 2.5.x (or 2.6.x soon). There is no exact plans
how long 2.3.x will be around, I do plan switch to JDK7 (lack of tools
to support build on JDK6) and then 2.3.x will be branded as 2.4.x but
still with the same scope - only security fixes. So 2.3.x/2.4.x will
stay with us for longer :)


Regards
-- 
Łukasz
+ 48 606 323 122 http://www.lenart.org.pl/

PS. Please remember that Struts doesn't follow strict semantic
versioning, "2" means "Struts 2" so Struts 2.5.x is "Struts 2 version
5.x" where Struts 2.3.x means "Struts 2 version 3.x" :)

2017-09-18 21:29 GMT+02:00 bruceaphill...@gmail.com :
> Thank you for the reply.
>
> I still don't understand why there are two active branches, especially since 
> JDK7 was EOL some time ago.
>
> If the 2.3.X line is going to be ended soon and the 2.5.X line is the future 
> then I'd like to get our Struts apps on 2.5.X
>
> But if 2.3.X is going to be maintained for the next 1-2 years then I'd feel 
> comfortable updating to 2.3.X
>
> Another consideration is that all our newer web apps use Spring MVC and do 
> not use Struts 2.  We only have some legacy web apps that still use Struts 2. 
>  If the time commitment in converting from Struts 2.3.X to 2.5.X is high then 
> we might as well just convert those apps to Spring MVC.
>
> It would be great if the Struts 2 PMC would publicly state what the future 
> plan is for Struts 2 or if there is already a published plan please let know.
>
> Bruce
>
> On 2017-09-18 10:15, "Jason D. Burkert"  wrote:
>> On 2017-09-18 11:05 AM, Phillips, Bruce A wrote:
>> > We still have a couple of web apps that are using Struts version 2.3.32
>> >
>> > We want to update those web apps to the latest version of Struts but I’m 
>> > not sure what version to update to.
>> >
>> > I see a 2.5.13 and a 2.3.34 – both tags seem to be recently created.
>> >
>> > Should I update to 2.5.13 or should I stay on the 2.3.X line?
>> >
>> > Why are there different production tags (2.5.X and 2.3.X) ?
>> >
>> > Thank You,
>> >
>> > Bruce Phillips
>> >
>>
>> Hello Bruce,
>>
>> If you have existing web apps using 2.3.32 it would be easiest to update
>> to 2.3.34 for the latest security updates.
>>
>> In the future, to use the 2.5.x series, you'll need to perform some
>> migration steps.  Review the Version Notes for 2.5 to get started,
>> especially "Internal Changes" and "Package names have changed".
>> https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.5
>>
>> As to why there are both 2.3.x series and 2.5.x series releases, my
>> understanding is that one significant reason is "Struts2 is now build
>> with JDK7" as of the first 2.5 release.
>>
>> -Jason
>>
>>
>
> -
> To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
> For additional commands, e-mail: user-h...@struts.apache.org
>

-
To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
For additional commands, e-mail: user-h...@struts.apache.org

Re: Which Struts Version To Use?

[bruceaphill...@gmail.com]

Thank you for the reply.

I still don't understand why there are two active branches, especially since 
JDK7 was EOL some time ago.

If the 2.3.X line is going to be ended soon and the 2.5.X line is the future 
then I'd like to get our Struts apps on 2.5.X

But if 2.3.X is going to be maintained for the next 1-2 years then I'd feel 
comfortable updating to 2.3.X

Another consideration is that all our newer web apps use Spring MVC and do not 
use Struts 2.  We only have some legacy web apps that still use Struts 2.  If 
the time commitment in converting from Struts 2.3.X to 2.5.X is high then we 
might as well just convert those apps to Spring MVC.

It would be great if the Struts 2 PMC would publicly state what the future plan 
is for Struts 2 or if there is already a published plan please let know.

Bruce

On 2017-09-18 10:15, "Jason D. Burkert"  wrote: 
> On 2017-09-18 11:05 AM, Phillips, Bruce A wrote:
> > We still have a couple of web apps that are using Struts version 2.3.32
> >
> > We want to update those web apps to the latest version of Struts but I’m 
> > not sure what version to update to.
> >
> > I see a 2.5.13 and a 2.3.34 – both tags seem to be recently created.
> >
> > Should I update to 2.5.13 or should I stay on the 2.3.X line?
> >
> > Why are there different production tags (2.5.X and 2.3.X) ?
> >
> > Thank You,
> >
> > Bruce Phillips
> >
> 
> Hello Bruce,
> 
> If you have existing web apps using 2.3.32 it would be easiest to update 
> to 2.3.34 for the latest security updates.
> 
> In the future, to use the 2.5.x series, you'll need to perform some 
> migration steps.  Review the Version Notes for 2.5 to get started, 
> especially "Internal Changes" and "Package names have changed".
> https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.5
> 
> As to why there are both 2.3.x series and 2.5.x series releases, my 
> understanding is that one significant reason is "Struts2 is now build 
> with JDK7" as of the first 2.5 release.
> 
> -Jason
> 
> 

-
To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
For additional commands, e-mail: user-h...@struts.apache.org

Re: Which Struts Version To Use?

[Yasser Zamani]

On 9/18/2017 7:35 PM, Phillips, Bruce A wrote:
> We still have a couple of web apps that are using Struts version 2.3.32
> 
> We want to update those web apps to the latest version of Struts but I’m not 
> sure what version to update to.
> 
> I see a 2.5.13 and a 2.3.34 – both tags seem to be recently created.
> 
> Should I update to 2.5.13 or should I stay on the 2.3.X line?
> 
> Why are there different production tags (2.5.X and 2.3.X) ?

Because The 2.5.x series introduced some breaking changes, so the 
development is now branching, as 2.3.x is still supported. Basically we 
backport some security fixes to 2.3.x without breaking things.

So you can update to 2.3.34 without any needed change but you will not 
get any further bug fixes but only security fixes. But if you update to 
2.5.13, then you need to do a few migration steps at [1], and then you 
will get future both security and bug fixes.

I recommend updating to 2.5.13 as I already test [1] on our app and all 
of our JMeter functional tests pass in it also.

Hope this helps.

[1] https://struts.apache.org/docs/struts-23-to-25-migration.html


> 
> Thank You,
> 
> Bruce Phillips
> 

-
To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
For additional commands, e-mail: user-h...@struts.apache.org

Re: Which Struts Version To Use?

[Yasser Zamani]

On 9/18/2017 7:35 PM, Phillips, Bruce A wrote:
> We still have a couple of web apps that are using Struts version 2.3.32
> 
> We want to update those web apps to the latest version of Struts but I’m not 
> sure what version to update to.
> 
> I see a 2.5.13 and a 2.3.34 – both tags seem to be recently created.
> 
> Should I update to 2.5.13 or should I stay on the 2.3.X line?
> 
> Why are there different production tags (2.5.X and 2.3.X) ?
> 

Because The 2.5.x series introduced some breaking changes, so the 
development is now branching, as 2.3.x is still supported. Basically we 
backport some security fixes to 2.3.x without breaking things.

So you can update to 2.3.34 without any needed change but you will not 
get any further bug fixes but only security fixes. But if you update to 
2.5.13, then you need to do a few migration steps at [1], and then you 
will get future both security and bug fixes.

I recommend updating to 2.5.13 as I already test [1] on our app and all 
of our JMeter functional tests pass in it also.

Hope this helps.

[1] https://struts.apache.org/docs/struts-23-to-25-migration.html

> Thank You,
> 
> Bruce Phillips
> 

Re: Which Struts Version To Use?

[Yasser Zamani]

On 9/18/2017 7:35 PM, Phillips, Bruce A wrote:
> We still have a couple of web apps that are using Struts version 2.3.32
> 
> We want to update those web apps to the latest version of Struts but I’m not 
> sure what version to update to.
> 
> I see a 2.5.13 and a 2.3.34 – both tags seem to be recently created.
> 
> Should I update to 2.5.13 or should I stay on the 2.3.X line?
> 
> Why are there different production tags (2.5.X and 2.3.X) ?
> 

Because The 2.5.x series introduced some breaking changes, so the 
development is now branching, as 2.3.x is still supported. Basically we 
backport some security fixes to 2.3.x without breaking things.

So you can update to 2.3.34 without any needed change but you will not 
get any further bug fixes but only security fixes. But if you update to 
2.5.13, then you need to do a few migration steps at [1], and then you 
will get future both security and bug fixes.

I recommend updating to 2.5.13 as I already test [1] on our app and all 
of our JMeter functional tests pass in it also.

Hope this helps.

[1] https://struts.apache.org/docs/struts-23-to-25-migration.html

> Thank You,
> 
> Bruce Phillips
> 

Re: Which Struts Version To Use?

[Jason D. Burkert]

On 2017-09-18 11:05 AM, Phillips, Bruce A wrote:

We still have a couple of web apps that are using Struts version 2.3.32

We want to update those web apps to the latest version of Struts but I’m not 
sure what version to update to.

I see a 2.5.13 and a 2.3.34 – both tags seem to be recently created.

Should I update to 2.5.13 or should I stay on the 2.3.X line?

Why are there different production tags (2.5.X and 2.3.X) ?

Thank You,

Bruce Phillips



Hello Bruce,

If you have existing web apps using 2.3.32 it would be easiest to update 
to 2.3.34 for the latest security updates.


In the future, to use the 2.5.x series, you'll need to perform some 
migration steps.  Review the Version Notes for 2.5 to get started, 
especially "Internal Changes" and "Package names have changed".

https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.5

As to why there are both 2.3.x series and 2.5.x series releases, my 
understanding is that one significant reason is "Struts2 is now build 
with JDK7" as of the first 2.5 release.


-Jason



smime.p7s
Description: S/MIME Cryptographic Signature