Re: [VOTE] Apache Struts 7.3.0

+1 (binding)

[ ] Leave at test build
[ ] Alpha
[ ] Beta
[X] General Availability (GA)

Thank you!

Johannes


Am Sa., 8. Aug. 2026 um 09:16 Uhr schrieb Łukasz Lenart <
[email protected]>:

> The Apache Struts 7.3.0 test build is available. This release contains
> seven breaking changes and two deprecations, together with a broad set
> of improvements and bug fixes:
>
> Breaking changes
>
> - Struts no longer uses SLF4J or java.util.logging internally, and the
> container no longer injects a Logger [WW-5620].
> - JSON body population now honours the excluded and accepted
> parameter-name patterns [WW-4858].
> - Annotated wildcard actions are matched most-specific-first, so action
> selection can differ [WW-3784].
> - JSONInterceptor uses a fresh reader and writer per request, so custom
> ones must not hold state between requests [WW-5650].
> - @TypeConversion derives the ConversionRule key prefix automatically
> and can now be placed on fields [WW-3871].
> - Static content paths are canonicalised and a redundant URL decode was
> removed [WW-5645].
> - The <s:include> component normalises its path the same way [WW-5646].
>
> Deprecations
>
> - XWorkObjectPropertyAccessor is deprecated [WW-5591].
> - ConversionRule.COLLECTION and the Collection_ key prefix are
> deprecated; use ConversionRule.ELEMENT and Element_ instead [WW-5656].
>
> Rejected requests
>
> Three tickets were closed against this release without a change to
> shipped code. They are listed here so the decision is visible rather
> than silent.
>
> [WW-1522] - Automatic Alias ActionConfigs - will not be implemented.
> [WW-2635] - Flash scope - will not be implemented; the proposed
> mechanism could introduce a security risk.
> [WW-3427] - If you alias a property that uses a custom TypeConverter and
> it throws TypeConversionException the error is never caught - closed as
> Not A Problem; the behaviour was already correct, and a regression test
> was added to keep it so.
>
> Bug
> [WW-3530] - Invalid cache key in
> AnnotationActionValidationManager.buildValidatorKey when using visitor
> field validators
> [WW-3784] - Greedy and non-greedy matching behaviour should work in
> action methods using annotated wildcards
> [WW-5413] - Multipart misbehavior with commons-io 2.16.0 and 2.16.1
> [WW-5416] - Hello World example does not match documentation and returns
> a 404
> [WW-5474] - struts.multipart.maxFiles does not work as
> described/expected
> [WW-5562] - Support for version 2025.2 (252)
> [WW-5604] - CDI proxies won't be recognized as proxy in
> SecurityMemberAccess
> [WW-5641] - JSON plugin ignores struts.json.writer / struts.json.reader
> override (regression since 7.2.x)
> [WW-5642] - @StrutsParameter authorization bypassed for
> record/creator-bound REST body properties
> [WW-5643] - StrutsJSONReader parse state shared across concurrent
> requests
> [WW-5644] - StrutsJSONWriter write state shared across concurrent
> requests
> [WW-5659] - WithLazyParams resolves dynamic interceptor params onto the
> shared interceptor instance
>
> New Feature
> [WW-5640] - Add WebJars support to Struts core
>
> Improvement
> [WW-2934] - conversion error should short-circuit all validators
> [WW-3871] - TypeConversion annotation support improvement
> [WW-4858] - JSONInterceptor must not populate value stack directly
> [WW-5539] - Concurrency performance enhancements
> [WW-5540] - Add caching to AbstractLocalizedTextProvider
> [WW-5580] - Use Configuration.VERSION_2_3_34 for Freemaker config
> [WW-5591] - Mark XWorkObjectPropertyAccessor as deprecated
> [WW-5620] - Replace java.util.logging and SLF4J with Log4j2
> [WW-5645] - Canonicalise static content paths and remove redundant URL
> decode
> [WW-5646] - Modernize path normalization in Include component
> [WW-5647] - Use ConcurrentHashMap for XSLT template cache
> [WW-5650] - Refactor JSON plugin reader/writer to per-request instances
> instead of shared mutable state
> [WW-5652] - Support Java record serialization and Optional handling in
> Struts JSON plugin
> [WW-5653] - Upgrade bundled Bootstrap in sample apps from 3.3.4 to 5.3.x
> [WW-5656] - Mark ConversionRule.COLLECTION and the Collection_ prefix as
> @Deprecated
> [WW-5666] - Apply input length limits consistently when reading request
> bodies
> [WW-5668] - Make the localized-text provider caches size-bounded and
> align request-locale resolution across entry points
>
> Dependency
> [WW-5649] - Bump commons-logging:commons-logging from 1.3.6 to 1.4.0
>
> Release notes:
> * https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.3.0
>
> Github release
> * https://github.com/apache/struts/releases/tag/STRUTS_7_3_0
>
> Distribution:
> * https://dist.apache.org/repos/dist/dev/struts/7.3.0/
>
> Maven 2 staging repository:
> * https://repository.apache.org/content/groups/staging/
>
> Once you have had a chance to review the test build, please respond
> with a vote on its quality:
>
> [ ] Leave at test build
> [ ] Alpha
> [ ] Beta
> [ ] General Availability (GA)
>
> Everyone who has tested the build is invited to vote. Votes by PMC
> members are considered binding. A vote passes if there are at least
> three binding +1s and more +1s than -1s.
>
> The vote will remain open for at least 72 hours, longer upon request.
> A vote can be amended at any time to upgrade or downgrade the quality
> of the release based on future experience. If an initial vote
> designates the build as "Beta", the release will be submitted for
> mirroring and announced to the user list. Once released as a public
> beta, subsequent quality votes on a build may be held on the user
> list.
>
> As always, the act of voting carries certain obligations. A binding
> vote not only states an opinion, but means that the voter is agreeing
> to help do the work.
>
> On behalf of the Apache Struts project
> Łukasz
>