This is an automated email from the ASF dual-hosted git repository.
lukaszlenart pushed a change to branch feat/ognl-3.5-upgrade
in repository https://gitbox.apache.org/repos/asf/struts.git
omit b039dc507 WW-5326 fix(rat): adjust exclude patterns for RAT and adds
missing header with license
omit 6374e3138 WW-5326 fix(tiles): use raw OgnlContext in tiles accessors
omit 803b5cbbd WW-5326 docs: add Jira reference to spec and plan
omit 1dda92ed2 WW-5326 test(ognl): update tests for StrutsContext migration
omit cda38c79d WW-5326 refactor(tiles): parameterize tiles OGNL accessors
with StrutsContext
omit fbb904e9c WW-5326 refactor(ognl): replace Ognl.createDefaultContext
with direct StrutsContext construction
omit f7923fc70 WW-5326 refactor(ognl): parameterize all accessor
implementations with StrutsContext
omit 47718f5a8 WW-5326 refactor(ognl): parameterize core interfaces with
StrutsContext
omit e2e8fa1f3 WW-5326 feat(ognl): introduce StrutsContext extending
OgnlContext<StrutsContext>
omit 71c204f04 WW-5326 build(deps): bump OGNL from 3.4.10 to 3.5.0-BETA4
add 89ed075b3 ci(dependabot): add cooldown (#1656)
add 32c80b22b build(deps): bump ognl:ognl from 3.4.10 to 3.4.11 (#1655)
add 5f7a9129f ci(struts6): adjusts workflows to use the new branch (#1659)
add 396d7b716 cd(checks): uses proper context names for checks (#1660)
add 862019e8f build(deps): bump actions/upload-artifact from 7.0.0 to
7.0.1 (#1663)
add 71d4e062d build(deps): bump org.owasp:dependency-check-maven from
12.2.0 to 12.2.1 (#1664)
add f4c634928 introduce private method to remove clones (#1666)
add 8d6f13904 fix(core): WW-5623 HTML-encode form action in PostbackResult
to prevent XSS (#1653)
add c3a887085 WW-5624: Enforce @StrutsParameter on JSON/REST body
deserialization (#1657)
add 664540cc8 build(deps): bump github/codeql-action from 4.35.1 to 4.35.2
(#1668)
add 11e815f26 build(deps): bump com.fasterxml.jackson:jackson-bom (#1669)
add 7799c0fd2 build(deps): bump commons-io:commons-io from 2.21.0 to
2.22.0 (#1672)
add 690c4c273 WW-5626 cleanup follow-ups for @StrutsParameter JSON/REST
enforcement (#1673)
add c9cfa36cb build(deps): bump github/codeql-action from 4.35.2 to 4.35.3
(#1675)
add fd05da73f build(deps): bump org.glassfish.jaxb:jaxb-bom from 4.0.7 to
4.0.8 (#1676)
add 56b9b6807 build(deps): bump org.owasp:dependency-check-maven from
12.2.1 to 12.2.2 (#1677)
add e5aa3e98a build(deps): bump com.github.ben-manes.caffeine:caffeine
(#1679)
add 9c8d3de0e build(deps): bump github/codeql-action from 4.35.3 to 4.35.4
(#1682)
add a48f57d16 build(deps): bump slf4j.version from 2.0.17 to 2.0.18 (#1683)
add 09d03286f WW-5626 per-property authorization for Jackson REST handlers
(#1674)
add 3432433e3 chore(agents): defines a new AGENTS.md focused on reporting
vulnerabilities (#1680)
add e83487f0e WW-5627 Gate CookieInterceptor through ParameterAuthorizer
(#1681)
add 7ea7911cf chore(rat): excludes Markdown files in docs/ folder (#1691)
add 213b83f64 fix(core): enforce class-level HTTP method annotations for
wildcard-resolved unannotated methods (#1690)
add 419fb1f5c WW-5535 test(core): cover wildcard-resolved unannotated
methods via real proxy (#1692)
add 16618e023 build(deps): bump github/codeql-action from 4.35.4 to 4.35.5
(#1694)
add 1bd2951f7 build(deps-dev): bump
org.apache.maven.plugins:maven-enforcer-plugin (#1698)
add f26325ff9 ci(dependabot): fix cooldown property name (#1702)
add cc6b4cfd6 build(deps): bump asm.version from 9.9.1 to 9.10 (#1695)
add d628d949a build(deps): bump org.apache.logging.log4j:log4j-bom (#1685)
add 26756ce85 security(versions): updates list of supported versions
(#1708)
add c7b1ca3f0 build(deps): bump github/codeql-action from 4.35.5 to 4.36.0
(#1710)
add 1555cabff build(deps): bump org.apache.maven.plugins:maven-site-plugin
(#1711)
add e637bb16a build(deps): bump asm.version from 9.10 to 9.10.1 (#1713)
add 69cb2964f docs(skills): add triaging-security-reports skill (#1722)
add 9011c32b3 WW-5631 Add opt-in @StrutsParameter enforcement to
ChainingInterceptor (#1719)
add 0972a608a build(deps): bump maven-surefire-plugin.version from 3.5.5
to 3.5.6 (#1731)
add 53ef1ad88 build(deps): bump
org.apache.maven.plugins:maven-dependency-plugin (#1730)
add 5e725a72c build(deps): bump github/codeql-action from 4.36.0 to 4.36.2
(#1734)
add 7c6034c66 build(deps-dev): bump
org.apache.maven.plugins:maven-failsafe-plugin (#1732)
add 210dc86b8 WW-5630 - Performance Issue SecurityMemberAccess (#1721)
add 4f3fd69aa WW-5632 Harden commons-fileupload2 dependency against
milestone binary-incompatibility (#1735)
add b808dcb84 build(deps): bump com.fasterxml.jackson:jackson-bom (#1729)
add 289bcaa92 build(deps): bump org.htmlunit:htmlunit from 4.21.0 to 5.1.0
(#1733)
add dd830dca8 WW-5630 test: streamline ConfigParseUtilTest and convert to
JUnit 4 (#1740)
add 8f9b4b8a9 WW-5636 Harden redirect URL escaping in non-302 response
body (#1737)
add cc3ebc3c1 WW-5635 Avoid logging sensitive token values in TokenHelper
(#1738)
add 489445c78 Release 7.2.0-RC1 (#1742)
add 59e342488 WW-5256 Decouple FreeMarker whitespace stripping from
devMode (#1743)
add 01a561d9d Add CONTRIBUTING.md for new contributors (#1757)
add 1e3fa9a2d build(deps-dev): bump byte-buddy.version from 1.18.8 to
1.18.10 (#1745)
add 22243e75f build(deps): bump org.sitemesh:sitemesh from 3.2.2 to 3.2.3
(#1749)
add 46ba90f79 build(deps-dev): bump org.jacoco:jacoco-maven-plugin (#1751)
add 153e42bb9 build(deps): bump org.glassfish.jaxb:jaxb-bom from 4.0.8 to
4.0.9 (#1753)
add 07afccbb2 build(deps): bump actions/checkout from 6 to 7 (#1755)
add 50c16e93b Release 7.2.1-RC1 (#1744)
add dc90e4890 Add draft security threat model (THREAT_MODEL.md) +
discoverability pointer (#1756)
add 29f75f2dc build(deps): bump org.htmlunit:htmlunit from 5.1.0 to 5.2.0
(#1762)
add a09f2a93a build(deps): bump github/codeql-action/upload-sarif (#1758)
add 789dbf3cd WW-5640 Add WebJars support to Struts core (#1765)
add 745c08c7a build(deps-dev): bump byte-buddy.version from 1.18.10 to
1.18.11 (#1771)
add 16aa43137 build(deps): bump github/codeql-action from 4.36.2 to 4.36.3
(#1769)
add 30cbd1c3c build(deps): bump github/codeql-action/upload-sarif (#1768)
add 08fba5980 build(deps): bump org.apache.logging.log4j:log4j-bom (#1767)
add 5c130f941 WW-5641 Restore struts.json.writer / struts.json.reader
override in JSON plugin (#1766)
add 525c7dae3 WW-4858 Honor parameter filtering during JSON population
(#1773)
add f03198c6f build(deps-dev): bump commons-logging:commons-logging (#1760)
add 8fb8bcbcf build(deps): bump net.sf.jasperreports:jasperreports (#1779)
add 75a285a10 WW-5643 fix(json): confine StrutsJSONReader parse state to
the parsing thread (#1775)
add 18955b98a WW-5644 fix(json): confine StrutsJSONWriter write state to
the writing thread (#1776)
add b70ecc8e1 WW-5645 Canonicalise static content paths and remove
redundant URL decode (#1777)
add 40fcae310 WW-4858 test(json): cover nested-leaf accepted-name and
include patterns (#1783)
add cf22320e3 docs(security): treat a fix or PR as disclosure, require
private report first (#1785)
add e5eb01abd WW-5642 fix(rest): authorize @StrutsParameter on
record/creator-bound REST body properties (#1774)
add de599c91d WW-5646 Modernize path normalization in Include component
(#1780)
add 6cb6abf4b build(deps): bump com.fasterxml.jackson:jackson-bom (#1787)
add 31036a8a4 build(deps): bump github/codeql-action from 4.36.3 to 4.37.0
(#1786)
add db64c103d build(deps-dev): bump org.webjars:jquery from 3.7.1 to 4.0.0
(#1789)
add cc00343f1 WW-5650 Obtain a fresh JSON reader/writer per request in
JSONInterceptor (#1782)
add 963a81f43 WW-5647 Use ConcurrentHashMap for XSLT template cache (#1781)
add 60bc7b8d7 WW-5652 Add support for Java records and Optional
serialization in the JSON plugin. (#1792)
add 11c10ee8f WW-5620 Standardize logging on Log4j2 (#1794)
add b2548542e WW-5640 refactor(webjars): rename DefaultWebJarUrlProvider
to StrutsWebJarUrlProvider (#1795)
add 464817e0b WW-5653 Upgrade Bootstrap to 5.3.x in sample apps (#1793)
add f2c1f50da WW-5604 Recognize CDI/Weld client proxies in
SecurityMemberAccess (#1796)
add 6d2713292 WW-4858 Evaluate JSON name allowlist at leaf keys only
(#1784)
add f5880be2e WW-5591 chore(core): mark XWorkObjectPropertyAccessor as
deprecated (#1797)
add f32270cdb WW-5580 chore(core): use Configuration.VERSION_2_3_34 for
FreeMarker config (#1798)
add 9f030f62b Library updates for cve's, suppression cleanup and not fail
github action job SonarCloud if SONARCLOUD_TOKEN not found (summary report
instead). (#1667)
add b154b7ca4 ci(owasp): cap job timeout and disable NVD auto-update in
check step (#1807)
add a32453865 build(deps): bump org.htmlunit:htmlunit from 5.2.0 to 5.3.0
(#1804)
add ef8361caa build(deps): bump github/codeql-action from 4.37.0 to 4.37.2
(#1800)
add 88d95b2a5 build(deps): bump org.webjars:webjars-locator-lite from
1.1.3 to 1.1.4 (#1801)
add eb69ad6f3 build(deps): bump org.webjars:bootstrap from 5.3.7 to 5.3.8
(#1803)
add 73f17c1be build(deps-dev): bump org.webjars:jquery from 3.7.1 to 4.0.0
(#1802)
add 8a5323fbd WW-5539 Concurrency performance enhancements (#1799)
add c3e9db1b2 WW-5413 Avoid writing small in-memory multipart uploads to
disk (#1805)
add 833220346 WW-5474 Count files only for maxFiles, add maxParameterCount
(#1806)
add 12015d0bf WW-5540 Add caching to AbstractLocalizedTextProvider (#1808)
add 0b2bc2be1 WW-3427 Add regression test for conversion errors on aliased
properties (#1814)
add 532ca7f86 WW-2934 Skip field validators when a field has a conversion
error (opt-in) (#1810)
add d906f2344 WW-3530 Fix visitor-validator cache-key collision under
wildcard actions (#1811)
add 6f802987f WW-3871 Derive ConversionRule prefixes for @TypeConversion
keys (#1812)
add 94a8fcb26 WW-3784 Order annotated wildcard actions most-specific-first
(#1813)
add d52ffed7f build(deps): bump github/codeql-action from 4.37.2 to 4.37.3
(#1817)
add 26141511f build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4
(#1818)
add 81264063e WW-5659 Resolve lazy interceptor params per invocation
(#1816)
add a07d0e292 docs: add creating-security-bulletins skill, bulletin
template, and triage control-case rule (#1820)
add 1218c4922 WW-5666 Apply input length limits consistently when reading
request bodies (#1819)
add a6570b769 WW-5668 Bound the localized-text provider caches and align
request-locale resolution (#1821)
add 687436f9b WW-5668 Keep the localized-text providers deserializable
across a version upgrade (#1824)
add 702280f48 WW-5656 docs(conversion): mark ConversionRule.COLLECTION and
the Collection_ prefix as deprecated (#1825)
add 0fd3d7a2f docs: add creating-version-notes skill and page template
(#1826)
add b1a7c2296 docs: refine creating-version-notes from the 7.3.0 release
run (#1828)
add f2f3a9d3b docs: add creating-release-vote-mail skill (#1836)
add 2e417d3b6 docs: hand over a paste-ready body in
creating-release-vote-mail (#1837)
add 830d46a32 docs(skills): require plain-text list mail in the two
mail-producing skills (#1843)
add f6fef7396 docs(skills): add releasing-struts, and configure the
release plugin in the pom (#1844)
add d2e965515 Prepare for a new development cycle of Struts 7.4.0 (#1829)
add 5dfff82fd build(deps): bump github/codeql-action from 4.37.3 to 4.37.6
(#1839)
add a314739f3 build(deps): bump org.owasp:dependency-check-maven from
12.2.2 to 13.0.0 (#1840)
add 0ef20170c build(ci): stop .claude-only changes from triggering full
builds (#1846)
add 81b34c295 WW-5674 Cut the per-call allocations in SecurityMemberAccess
package matching (#1830)
add 7411024c9 build(ci): report the required check when only .claude/
changed (#1849)
add 791d1e3db build(ci): baseline the Jenkins .claude/ filter on the PR
target branch (#1850)
add b82f21244 docs: point the releasing-struts skill at the published
Release Guidelines (#1848)
add 9a0ea540b docs(skills): send CVE advisory mails from the ASF CVE tool
(#1851)
add 80278c16f docs(security): re-baseline the threat model on
S2-070..S2-074 (#1852)
add 4e84c9a42 docs: correct stale facts in CLAUDE.md (#1857)
add d637e4541 WW-5675 Share parsed OGNL security configuration across
SecurityMemberAccess instances (#1847)
add 015c9c833 WW-5676 test(ognl): pin the array package-resolution
decision (#1858)
add 74d7ec0d7 WW-5677 perf(ognl): drop the residual getPackage() lookups
on the access path (#1859)
add b921f416c build(deps): bump github/codeql-action from 4.37.6 to 4.37.7
(#1856)
add 8fd42d461 build(deps): bump org.htmlunit:htmlunit from 5.3.0 to 5.4.0
(#1853)
add c6b41b6d1 build(deps): bump org.apache.felix:maven-bundle-plugin
(#1831)
add b8aa6cb43 WW-5685 fix(conversion): skip the mapped key instead of
abandoning the file (#1860)
add 482b4d2ce WW-1742 docs(execAndWait): document token-scoped background
process naming (#1861)
add cf85c2320 WW-5688 fix(rest): resolve id-bearing URIs into the root
namespace when declared (#1862)
add 05ad78a06 WW-5690 perf(dispatcher): load the dev-mode error template
on first use (#1864)
add c15fa305b Update Maven Central badge link in README (#1875)
add a1193445b chore(copilot): add code-review agent skill (#1876)
add a87f86b94 docs: add merging-dependabot-prs skill (#1877)
add c752860e3 WW-5695 Derive HTML5 constraint attributes from validators,
deprecate the JS validator (#1865)
add 819263664 build(deps): bump org.apache.maven.wrapper:maven-wrapper
from 3.3.2 to 3.3.4 (#1870)
add dc7755036 build(deps): bump github/codeql-action from 4.37.7 to 4.37.8
(#1867)
add 84da8fe43 build(deps-dev): bump byte-buddy.version from 1.18.11 to
1.18.12 (#1866)
add e7e1f311c build(deps-dev): bump
org.apache.commons:commons-collections4 from 4.5.0 to 4.6.0 (#1838)
add d51fbd6a9 build(deps-dev): bump commons-validator:commons-validator
from 1.10.1 to 1.11.0 (#1833)
add ebd730951 chore: remove stale Claude Code agents and commands (#1884)
add 16415adec docs: point CLAUDE.md at THREAT_MODEL.md for security scope
(#1885)
add 2e78416f9 docs: drop hardcoded test-class counts from the review
guides (#1886)
add 66af2365e WW-5697 Restrict the indexed-access fast path in
XWorkMethodAccessor to real indexed properties (#1871)
add f179011d8 WW-5698 Scope the ModelDriven exemption in
StrutsParameterAuthorizer to the model object (#1872)
add ee7f11d3c WW-5700 fix(ognl): skip the store when a map or list element
cannot be converted (#1873)
add 655310bd1 WW-5701 fix(conversion): compare the conversion marker by
identity, not equals (#1874)
add 2620abedd WW-5706 fix(core): align RestfulActionMapper action name
handling with DefaultActionMapper (#1880)
add 98fb891aa WW-5707 chore(core): deprecate legacy restful and restful2
action mappers (#1882)
add 1411fe307 WW-5711 fix(conversion): bound fraction digits when
formatting BigDecimal (#1887)
add 7d53aef4d build(deps): bump mikepenz/action-junit-report from 6.4.2 to
6.5.0 (#1900)
add 84604be8a build(deps): bump actions/setup-java from 5 to 6 (#1899)
add 97acbce5c build(deps): bump org.easymock:easymock from 5.6.0 to 5.7.0
(#1898)
add 4d969761a build(deps): bump com.fasterxml.jackson:jackson-bom from
2.22.1 to 2.22.2 (#1897)
add 5f15fb09a build(deps): bump ognl:ognl from 3.4.11 to 3.4.12 (#1895)
add f483a8a3e build(deps): bump github/codeql-action from 4.37.8 to 4.37.9
(#1894)
add 772ee841d build(deps): bump org.apache.maven:apache-maven from 3.9.9
to 3.9.16 (#1892)
add 06cb7113a build(deps): bump org.freemarker:freemarker from 2.3.34 to
2.3.35 (#1891)
add 7b6794fd8 chore: gate reply drafting in triaging-security-reports
skill (#1901)
add b96a99e08 WW-5712 Cover Jackson any-setters in REST parameter
authorization (#1889)
add c373c5312 WW-5717 build: bump Spring Framework to 7.0.9 in the
jakartaee11 profile
add 3a05ecff5 Merge pull request #1911 from apache/WW-5717-spring-7.0.9
add cb0c9e9ef build(deps): bump org.apache.felix:maven-bundle-plugin from
6.1.0 to 6.1.2 (#1910)
add 9b7187a30 build(deps-dev): bump
org.apache.maven.plugins:maven-failsafe-plugin from 3.5.6 to 3.6.0 (#1909)
add a5e76c5cb build(deps): bump org.htmlunit:htmlunit from 5.4.0 to 5.5.0
(#1906)
add f2f36a873 build(deps-dev): bump byte-buddy.version from 1.18.12 to
1.18.13 (#1904)
add f903e55da WW-5716 fix(tiles): bound the per-locale definition caches
(#1902)
add 2d36231cd docs: frame CVE-at-release-time as PMC practice, not a rule
(#1917)
add 402a28d8d WW-3226 test: pin which value wins for each alias/params
ordering (#1918)
add 8f8be8f4b WW-3245 feat(jasperreports): fill from report parameters
when no dataSource or connection is set (#1919)
add 8c66d8d64 WW-5729 fix(jasperreports): override HashMap.get/containsKey
in ValueStackShadowMap (#1920)
add 2cc6fa632 WW-5731 fix(jasperreports7): stop using the field delimiter
as the CSV record delimiter (#1921)
add a2ed3bc9f WW-5732 fix(jasperreports7): match the report format
case-insensitively (#1922)
add 9b8b0face WW-5733 fix(jasperreports7): stop closing the response
stream before the report is written (#1923)
add f7a23c962 WW-5734 test(jasperreports7): run the plugin end-to-end on
an embedded Tomcat (#1924)
add a99a06bc6 WW-5735 build(jasperreports7): declare jasperreports as
provided (#1926)
add c9183d67b WW-5723 Bound the request body read in the REST plugin
(#1912)
add 6829de72c WW-5724 fix(core): hand out a clone of the cached
MessageFormat (#1914)
add c506bbd3a build(deps-dev): bump
org.apache.tomcat.embed:tomcat-embed-core (#1925)
add 024aa661b WW-5725 Authorize the buffered creator path in
AuthorizingSettableBeanProperty (#1916)
add 4af86aea1 WW-5669 Honour struts.csp.nonceSource alongside
struts.csp.nonce.source (#1927)
add c379e1f56 WW-5670 fix(core): parse struts.locale once and stop
mislabelling the fallback locale (#1928)
add 0956cd3cc WW-5686 test(core): stop DateTest.testJavaSqlDate racing the
clock (#1929)
add a8626db3a WW-5687 feat(core): clear the conversion and validator
caches on Dispatcher.cleanup() (#1930)
add 20979d0ba WW-5709 fix(core): recognise fluent setters in
@StrutsParameter enforcement (#1931)
add 2f712f110 WW-5710 fix(core): prime the OGNL allowlist against the
action as well as the model (#1932)
add 8e37691f3 WW-5663 fix(core): hand a WithLazyParams interceptor its own
mapping's params (#1933)
add e8c81e9f2 WW-5702 fix(core): close the scope gaps in HTML5 constraint
derivation (#1934)
add bb5761dff WW-5702 fix(core): tighten the HTML5 constraint provider's
attribute hygiene (#1935)
add 71a3c6548 WW-5702 test(core): render pattern, required-on-radio and
required-on-file end to end (#1936)
add 839bfc9df WW-5740 fix(core): resolve visitor-nested constraint
messages like validation does (#1937)
add a2837aabc WW-5703 fix(core): keep the HTML5 pattern from rejecting
blank input the regex validator skips (#1938)
add 192d33c29 WW-5704 fix(core): emit required on radio/file only when the
bound value would fail the validator (#1939)
add 60269a5b1 WW-5715 fix(rest): authorize REST body properties by Java
member name, not wire name (#1940)
add 08b6fbdde WW-5726 fix(rest): decline the in-place merge of a
polymorphic REST body property (#1941)
add 6b246aee4 WW-5727 fix(rest): authorize the @JsonIdentityInfo id
property (#1943)
add ec6f41b93 WW-5745 fix(rest): keep the read-time verdict for a
forward-referenced property (#1944)
add 6581dd404 WW-5746 fix(rest): authorize a bean-typed @JsonIdentityInfo
id's members under the id path (#1945)
add 0be1f3f30 WW-5747 fix(rest): leave the parser at the end of an object
the redaction wrapper drops (#1946)
add 349314a3a WW-5748 fix(rest): let Jackson XML's deserializer modifier
see the bean deserializer (#1947)
add a9ef39ea7 WW-5720 fix(rest): log any-setter dynamic-key rejections
once per request (#1948)
add 9831e0f6b WW-3353 fix(junit): make StrutsRestTestCase work against a
REST/Convention app (#1956)
add 5c991141b WW-5718 fix(rest,bean-validation): add the
resource-isolation interceptors to the plugin default stacks (#1957)
add 2e01eaa82 WW-5749 fix(rest): write nothing from the XML handlers when
there is no target (#1959)
add d083a3a4c WW-5713 fix(tiles): fail closed for legacy Tiles OGNL
evaluation (#1890)
add e213ef6c8 WW-5713 refactor(tiles): resolve the legacy OGNL flag from
the container's own ServletContext (#1961)
add 39620ca2a WW-5719 Pin Maven distribution checksum (#1942)
add cd6fbb315 WW-5743 fix(convention): rank path-spanning ** patterns
after single-segment ones (#1962)
add 02116f72a docs: state the control test that separates hardening from a
vulnerability (#1964)
add 22b24ef15 docs(skills): send the [TEST] mail from the @apache.org
identity (#1963)
add 16fd32295 build(ci): decide "does this need a build" in one reusable
workflow (#1965)
add 9a0c4572f build(deps-dev): bump
org.codehaus.mojo:versions-maven-plugin from 2.21.0 to 2.22.0 (#1950)
add 3d51632a3 build(deps-dev): bump org.codehaus.mojo:exec-maven-plugin
from 3.6.3 to 3.6.4 (#1954)
add 9f392c96b build(deps): bump github/codeql-action from 4.37.9 to 4.38.0
(#1952)
add 85f30e35c build(deps-dev): bump
org.apache.tomcat.embed:tomcat-embed-core from 10.1.59 to 11.0.26 (#1949)
add c407f7f55 ci: pin Scorecards checkout action by commit (#1966)
add e5fb8e91d build(ci): test once on JDK 17 in Jenkins, reserve Jetty
ports for the showcase ITs (#1967)
add 3e428e438 docs: drop derivable layout and architecture sections from
CLAUDE.md (#1977)
add 1d92b07b0 WW-5753 Reject cross-site non-GET navigations and cross-site
GET subresource requests in the Fetch Metadata policy (#1983)
add 972fd8a02 WW-5751 Treat a negative maximumSize as no upload size limit
(#1976)
add 7ba6ef01a [maven-release-plugin] prepare release STRUTS_7_4_0
add 9d2a40186 [maven-release-plugin] prepare for next development iteration
add 707108b93 Release 7.4.0 RC-1 (#1968)
add 54a1ca3ff WW-5752 Normalize request-derived values in log messages
(#1982)
add edf2982da build(deps): bump github/codeql-action from 4.38.0 to 4.38.2
(#1978)
add f06fc305e build(deps): bump org.webjars:webjars-locator-lite from
1.1.4 to 1.1.5 (#1975)
add 3ae18dfb9 build(deps-dev): bump byte-buddy.version from 1.18.13 to
1.18.14 (#1974)
add 608662d55 build(deps): bump org.apache.felix:maven-bundle-plugin from
6.1.2 to 6.2.0 (#1972)
add c0628dd18 build(deps): bump ognl:ognl from 3.4.12 to 3.4.13 (#1971)
add c8c7b4e0f docs(skills): resolve Dependabot tickets via Jira transition
id (#1985)
add 153a78997 docs(skills): carry the 7.4.0 / 6.12.0 advisory lessons into
the release skills
add e3613f96d docs(skills): carry the 7.4.0 / 6.12.0 advisory lessons into
the release skills (#1987)
add 765f8af3a docs: re-baseline THREAT_MODEL.md against S2-075 to S2-078
add a2352599e Merge pull request #1988 from
apache/docs/threat-model-s2-075-to-s2-078
add 95f205802 WW-5757 fix(bean-validation): resolve the constraint message
template as the text key
add 17a26bf34 WW-5757 test(bean-validation): cover message encoding and
lookup failure in resolveMessage
add dcfdec948 Merge pull request #1989 from
apache/WW-5757-bean-validation-message-template
add 9aa77f721 WW-5759 Resolve @StrutsParameter accessors the way OGNL does
(#1992)
add 056a6f308 WW-5760 build(deps): bump OGNL from 3.4.14 to 3.4.15
add 877836860 WW-5760 build(deps): bump OGNL from 3.4.14 to 3.4.15 (#1993)
add bc8cad43c WW-5326 build(deps): bump OGNL from 3.4.15 to 3.5.0-BETA8
add 82cac06a9 WW-5326 feat(ognl): introduce StrutsContext extending
OgnlContext<StrutsContext>
add 59d3007cf WW-5326 refactor(ognl): parameterize core interfaces with
StrutsContext
add f7e22d08e WW-5326 refactor(ognl): parameterize all accessor
implementations with StrutsContext
add 3621c1191 WW-5326 refactor(ognl): replace Ognl.createDefaultContext
with direct StrutsContext construction
add db8d30b59 WW-5326 refactor(tiles): parameterize tiles OGNL accessors
with StrutsContext
add 1579fb67a WW-5326 test(ognl): update tests for StrutsContext migration
add 0c8c28d3f WW-5326 docs: add Jira reference to spec and plan
add 267155585 WW-5326 fix(tiles): use raw OgnlContext in tiles accessors
add 263c82f5c WW-5326 fix(rat): adjust exclude patterns for RAT and adds
missing header with license
add 1ba0996ac WW-5326 chore: drop the unrelated Hibernate proxy plan from
this branch
add 1b2c66d6a WW-5326 test(ognl): migrate tests added on main since April
to StrutsContext
add a7a99f6c1 WW-5326 fix(tiles): evaluate legacy OGNL attributes with a
StrutsContext
add a6c9f2706 WW-5326 docs(ognl): mark StrutsContext @since 8.0.0
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (b039dc507)
\
N -- N -- N refs/heads/feat/ognl-3.5-upgrade (a6c9f2706)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
No new revisions were added by this update.
Summary of changes:
.asf.yaml | 13 +-
.claude/agents/code-quality-checker.md | 387 --
.claude/agents/codebase-analyzer.md | 248 -
.claude/agents/codebase-locator.md | 248 -
.claude/agents/codebase-pattern-finder.md | 189 -
.claude/agents/config-validator.md | 484 --
.claude/agents/security-analyzer.md | 238 -
.claude/agents/thoughts-analyzer.md | 179 -
.claude/agents/thoughts-locator.md | 127 -
.claude/agents/web-search-researcher.md | 108 -
.claude/commands/config_analyze.md | 531 --
.claude/commands/create_plan.md | 348 --
.claude/commands/quality_check.md | 438 --
.claude/commands/research_codebase.md | 179 -
.claude/commands/security_scan.md | 288 -
.claude/commands/validate_plan.md | 325 -
.claude/skills/creating-release-vote-mail/SKILL.md | 190 +
.../vote-mail-template.md | 152 +
.../skills/creating-security-bulletins/SKILL.md | 385 ++
.../bulletin-template.md | 154 +
.claude/skills/creating-version-notes/SKILL.md | 353 ++
.../version-notes-template.md | 153 +
.claude/skills/merging-dependabot-prs/SKILL.md | 205 +
.claude/skills/releasing-struts/SKILL.md | 157 +
.claude/skills/releasing-struts/release-runbook.md | 113 +
.../releasing-struts/scripts/promote-dist.sh | 36 +
.../releasing-struts/scripts/stage-assemblies.sh | 103 +
.claude/skills/triaging-security-reports/SKILL.md | 128 +
.github/dependabot.yml | 6 +-
.github/skills/code-review/SKILL.md | 136 +
.github/workflows/changes.yml | 93 +
.github/workflows/codeql.yml | 27 +-
.github/workflows/maven.yml | 44 +-
.github/workflows/owasp.yml | 103 +
.github/workflows/scorecards-analysis.yaml | 8 +-
.github/workflows/sonar.yml | 20 +-
.gitignore | 2 +
.mvn/wrapper/maven-wrapper.properties | 21 +-
AGENTS.md | 31 +
CLAUDE.md | 66 +-
CONTRIBUTING.md | 118 +
Jenkinsfile | 138 +-
README.md | 2 +-
SECURITY.md | 160 +-
THREAT_MODEL.md | 634 ++
apps/pom.xml | 2 +-
apps/rest-showcase/pom.xml | 27 +-
apps/rest-showcase/src/main/resources/struts.xml | 1 +
.../WEB-INF/content/orders-deleteConfirm.jsp | 7 +-
.../main/webapp/WEB-INF/content/orders-edit.jsp | 26 +-
.../main/webapp/WEB-INF/content/orders-editNew.jsp | 21 +-
.../main/webapp/WEB-INF/content/orders-index.jsp | 13 +-
.../main/webapp/WEB-INF/content/orders-show.jsp | 19 +-
.../src/main/webapp/css/bootstrap-theme.css | 476 --
.../src/main/webapp/css/bootstrap-theme.css.map | 1 -
.../src/main/webapp/css/bootstrap-theme.min.css | 5 -
.../src/main/webapp/css/bootstrap.css | 6584 --------------------
.../src/main/webapp/css/bootstrap.css.map | 1 -
.../src/main/webapp/css/bootstrap.min.css | 5 -
.../example/OrdersControllerRestTestCaseTest.java | 41 +-
apps/showcase/pom.xml | 52 +-
apps/showcase/src/main/resources/log4j2.xml | 2 +
apps/showcase/src/main/resources/struts.xml | 3 +-
.../actionchaining/actionChainingResult.jsp | 2 +-
.../WEB-INF/bean-validation/bean-validation.jsp | 2 +-
.../webapp/WEB-INF/conversion/enterAddressInfo.jsp | 2 +-
.../webapp/WEB-INF/conversion/enterOperations.jsp | 2 +-
.../webapp/WEB-INF/conversion/enterPersonInfo.jsp | 6 +-
.../src/main/webapp/WEB-INF/conversion/index.jsp | 2 +-
.../webapp/WEB-INF/conversion/showAddressInfo.jsp | 2 +-
.../webapp/WEB-INF/conversion/showOperations.jsp | 2 +-
.../webapp/WEB-INF/conversion/showPersonInfo.jsp | 2 +-
.../src/main/webapp/WEB-INF/decorators/main.jsp | 199 +-
.../webapp/WEB-INF/dispatcher/dispatch-result.jsp | 2 +-
.../webapp/WEB-INF/empmanager/editEmployee.jsp | 2 +-
.../main/webapp/WEB-INF/empmanager/editSkill.jsp | 2 +-
.../webapp/WEB-INF/empmanager/listEmployees.jsp | 4 +-
.../main/webapp/WEB-INF/empmanager/listSkills.jsp | 4 +-
.../src/main/webapp/WEB-INF/filedownload/index.jsp | 6 +-
.../WEB-INF/fileupload/dynamic-upload-success.jsp | 64 +-
.../webapp/WEB-INF/fileupload/dynamic-upload.jsp | 6 +-
.../webapp/WEB-INF/fileupload/multiple-success.jsp | 2 +-
.../fileupload/multipleUploadUsingArray.jsp | 2 +-
.../WEB-INF/fileupload/multipleUploadUsingList.jsp | 2 +-
.../webapp/WEB-INF/fileupload/upload-success.jsp | 2 +-
.../src/main/webapp/WEB-INF/fileupload/upload.jsp | 6 +-
.../freemarker/customFreemarkerManagerUsage.ftl | 2 +-
.../webapp/WEB-INF/freemarker/standardTags.ftl | 2 +-
.../main/webapp/WEB-INF/hangman/hangmanNonAjax.ftl | 2 +-
apps/showcase/src/main/webapp/WEB-INF/help.jsp | 6 +-
.../src/main/webapp/WEB-INF/html5/index.jsp | 15 +-
.../webapp/WEB-INF/modelDriven/modelDriven.jsp | 2 +-
.../WEB-INF/modelDriven/modelDrivenResult.jsp | 2 +-
.../src/main/webapp/WEB-INF/person/edit-person.jsp | 4 +-
.../src/main/webapp/WEB-INF/person/list-people.ftl | 4 +-
.../src/main/webapp/WEB-INF/person/new-person.ftl | 26 +-
apps/showcase/src/main/webapp/WEB-INF/showcase.jsp | 4 +-
.../tags/non-ui/actionPrefix/actionPrefix.ftl | 4 +-
.../non-ui/actionPrefix/actionPrefixExample.ftl | 2 +-
.../tags/non-ui/actionPrefix/methodPrefix.ftl | 4 +-
.../tags/non-ui/actionPrefix/normalSubmit.ftl | 4 +-
.../non-ui/actionPrefix/redirectActionPrefix.ftl | 4 +-
.../tags/non-ui/actionTag/showActionTagDemo.jsp | 10 +-
.../src/main/webapp/WEB-INF/tags/non-ui/date.jsp | 4 +-
.../src/main/webapp/WEB-INF/tags/non-ui/debug.jsp | 2 +-
.../webapp/WEB-INF/tags/non-ui/ifTag/testIf.ftl | 2 +-
.../webapp/WEB-INF/tags/non-ui/ifTag/testIf.jsp | 2 +-
.../iteratorTag/appendIteratorTagDemoResult.jsp | 4 +-
.../iteratorTag/iteratorGeneratorTagDemoResult.jsp | 4 +-
.../iteratorTag/mergeIteratorTagDemoResult.jsp | 4 +-
.../iteratorTag/showAppendIteratorTagDemo.jsp | 6 +-
.../iteratorTag/showIteratorGeneratorTagDemo.jsp | 6 +-
.../iteratorTag/showMergeIteratorTagDemo.jsp | 6 +-
.../non-ui/iteratorTag/subsetIteratorTagDemo.jsp | 6 +-
.../iteratorTag/subsetIteratorTagDemoResult.jsp | 4 +-
.../WEB-INF/tags/ui/actionTagExampleCalling.jsp | 4 +-
.../webapp/WEB-INF/tags/ui/componentTagExample.jsp | 2 +-
.../src/main/webapp/WEB-INF/tags/ui/example.jsp | 6 +-
.../src/main/webapp/WEB-INF/tags/ui/example.vm | 2 +-
.../webapp/WEB-INF/tags/ui/exampleSubmited.jsp | 4 +-
.../main/webapp/WEB-INF/tags/ui/exampleSubmited.vm | 2 +-
.../WEB-INF/tags/ui/lotsOfOptiontransferselect.jsp | 2 +-
.../tags/ui/lotsOfOptiontransferselectSubmit.jsp | 2 +-
.../main/webapp/WEB-INF/tags/ui/moreSelects.jsp | 2 +-
.../webapp/WEB-INF/tags/ui/moreSelectsSubmit.jsp | 2 +-
.../src/main/webapp/WEB-INF/tiles/header.jsp | 2 +-
.../src/main/webapp/WEB-INF/token/doublePost.jsp | 2 +-
.../src/main/webapp/WEB-INF/token/example1.jsp | 2 +-
.../src/main/webapp/WEB-INF/token/example2.jsp | 2 +-
.../src/main/webapp/WEB-INF/token/example3.jsp | 2 +-
.../src/main/webapp/WEB-INF/token/example4.ftl | 2 +-
.../src/main/webapp/WEB-INF/token/transferDone.jsp | 2 +-
.../webapp/WEB-INF/validation/ajaxFormSubmit.jsp | 2 +-
.../WEB-INF/validation/ajaxFormSubmitSuccess.jsp | 2 +-
.../validation/clientSideValidationExample.jsp | 2 +-
.../WEB-INF/validation/fieldValidatorsExample.jsp | 2 +-
.../validation/nonFieldValidatorsExample.jsp | 2 +-
.../main/webapp/WEB-INF/validation/quiz-basic.jsp | 2 +-
.../webapp/WEB-INF/validation/quiz-client-css.jsp | 2 +-
.../main/webapp/WEB-INF/validation/quiz-client.jsp | 2 +-
.../webapp/WEB-INF/validation/quiz-success.jsp | 2 +-
.../validation/storeErrorsAcrossRequestCancel.jsp | 6 +-
.../validation/storeErrorsAcrossRequestExample.jsp | 2 +-
.../validation/storeErrorsAcrossRequestOk.jsp | 6 +-
.../successClientSideValidationExample.jsp | 4 +-
.../validation/successFieldValidatorsExample.jsp | 4 +-
.../successNonFieldValidatorsExample.jsp | 4 +-
.../validation/successVisitorValidatorsExample.jsp | 4 +-
.../validation/visitorValidatorsExample.jsp | 4 +-
.../src/main/webapp/WEB-INF/wait/complete.jsp | 4 +-
.../src/main/webapp/WEB-INF/wait/example1.jsp | 2 +-
.../src/main/webapp/WEB-INF/wait/example2.jsp | 2 +-
.../src/main/webapp/WEB-INF/wait/example3.jsp | 2 +-
.../src/main/webapp/WEB-INF/wait/index.jsp | 2 +-
.../showcase/src/main/webapp/WEB-INF/wait/wait.jsp | 10 +-
apps/showcase/src/main/webapp/async/index.html | 2 +-
apps/showcase/src/main/webapp/js/bootstrap.min.js | 7 -
.../src/main/webapp/js/jquery-2.1.4.min.js | 4 -
.../src/main/webapp/styles/bootstrap-theme.css | 476 --
.../src/main/webapp/styles/bootstrap-theme.css.map | 1 -
.../src/main/webapp/styles/bootstrap-theme.min.css | 5 -
apps/showcase/src/main/webapp/styles/bootstrap.css | 6584 --------------------
.../src/main/webapp/styles/bootstrap.css.map | 1 -
.../src/main/webapp/styles/bootstrap.min.css | 5 -
apps/showcase/src/main/webapp/token/index.html | 2 +-
.../struts2/showcase/ActionChainingTest.java | 2 +-
.../struts2/showcase/ActionTagExampleTest.java | 2 +-
.../it/org/apache/struts2/showcase/AsyncTest.java | 56 +-
.../it/org/apache/struts2/showcase/CRUDTest.java | 2 +-
.../struts2/showcase/ComponentTagExampleTest.java | 2 +-
.../apache/struts2/showcase/ConventionTest.java | 2 +-
.../apache/struts2/showcase/ConversionTest.java | 6 +-
.../struts2/showcase/DispatcherResultTest.java | 4 +-
.../struts2/showcase/DynamicFileUploadTest.java | 14 +-
.../apache/struts2/showcase/ExecAndWaitTest.java | 2 +-
.../apache/struts2/showcase/FileDownloadTest.java | 4 +-
.../apache/struts2/showcase/FileUploadTest.java | 4 +-
.../org/apache/struts2/showcase/ForwardTest.java | 2 +-
.../struts2/showcase/FreeMarkerManagerTest.java | 4 +-
.../struts2/showcase/Html5TagExampleTest.java | 10 +-
.../apache/struts2/showcase/ModelDrivenTest.java | 2 +-
.../apache/struts2/showcase/ParameterUtils.java | 14 +
.../showcase/SpringProxyActionChainingTest.java | 2 +-
.../apache/struts2/showcase/StaticContentTest.java | 4 +-
.../struts2/showcase/StrutsParametersTest.java | 2 +-
.../apache/struts2/showcase/UITagExampleTest.java | 2 +-
.../apache/struts2/showcase/ValidationTest.java | 2 +-
assembly/pom.xml | 2 +-
bom/pom.xml | 2 +-
core/pom.xml | 25 +-
.../apache/struts2/DefaultActionInvocation.java | 60 +-
.../main/java/org/apache/struts2/RequestUtils.java | 5 +
.../java/org/apache/struts2/StrutsConstants.java | 99 +-
.../org/apache/struts2/action/CspReportAction.java | 84 +-
.../struts2/action/DefaultCspReportAction.java | 4 +-
.../org/apache/struts2/components/Checkbox.java | 5 +
.../struts2/components/EcmaScriptSafeRegex.java | 268 +
.../java/org/apache/struts2/components/File.java | 34 +
.../java/org/apache/struts2/components/Form.java | 328 +-
.../java/org/apache/struts2/components/Hidden.java | 5 +
.../struts2/components/HtmlConstraintProvider.java | 54 +
.../apache/struts2/components/HtmlControlType.java | 83 +
.../org/apache/struts2/components/Include.java | 19 +-
.../org/apache/struts2/components/Password.java | 5 +
.../java/org/apache/struts2/components/Radio.java | 5 +
.../java/org/apache/struts2/components/Select.java | 5 +
.../components/StrutsHtmlConstraintProvider.java | 282 +
.../org/apache/struts2/components/TextArea.java | 5 +
.../org/apache/struts2/components/TextField.java | 6 +
.../java/org/apache/struts2/components/UIBean.java | 181 +
.../java/org/apache/struts2/components/WebJar.java | 95 +
.../config/StrutsBeanSelectionProvider.java | 8 +
.../struts2/config/entities/PackageConfig.java | 21 +
.../struts2/config/impl/DefaultConfiguration.java | 8 +
.../conversion/StrutsTypeConverterHolder.java | 111 +-
.../struts2/conversion/TypeConverterHolder.java | 68 +-
.../conversion/annotations/ConversionRule.java | 41 +-
.../conversion/annotations/TypeConversion.java | 48 +-
.../conversion/impl/CollectionConverter.java | 6 +-
.../impl/DefaultConversionAnnotationProcessor.java | 3 +
.../impl/DefaultConversionFileProcessor.java | 11 +-
.../impl/DefaultObjectTypeDeterminer.java | 7 +
.../struts2/conversion/impl/StringConverter.java | 14 +-
.../struts2/conversion/impl/XWorkConverter.java | 284 +-
...java => ActionValidatorManagerDestroyable.java} | 24 +-
.../dispatcher/DefaultDispatcherErrorHandler.java | 30 +-
.../dispatcher/DefaultStaticContentLoader.java | 129 +-
.../org/apache/struts2/dispatcher/Dispatcher.java | 69 +-
.../struts2/dispatcher/StaticContentLoader.java | 31 +-
...le.java => TypeConverterHolderDestroyable.java} | 24 +-
.../dispatcher/mapper/DefaultActionMapper.java | 8 +-
.../dispatcher/mapper/Restful2ActionMapper.java | 4 +
.../dispatcher/mapper/RestfulActionMapper.java | 46 +-
.../multipart/AbstractMultiPartRequest.java | 157 +-
.../FileUploadParameterCountLimitException.java | 25 +-
.../multipart/JakartaMultiPartRequest.java | 150 +-
.../multipart/JakartaStreamMultiPartRequest.java | 34 +-
.../multipart/StrutsInMemoryUploadedFile.java | 213 +
.../dispatcher/multipart/StrutsUploadedFile.java | 8 +
.../struts2/dispatcher/multipart/UploadedFile.java | 38 +
.../struts2/factory/DefaultInterceptorFactory.java | 155 +-
.../apache/struts2/inject/ContainerBuilder.java | 20 -
.../inject/util/FinalizableReferenceQueue.java | 9 +-
.../interceptor/AbstractFileUploadInterceptor.java | 82 +-
.../interceptor/ActionFileUploadInterceptor.java | 29 +-
.../struts2/interceptor/ChainingInterceptor.java | 89 +-
.../struts2/interceptor/CookieInterceptor.java | 63 +-
...AbstractInterceptor.java => DisableParams.java} | 50 +-
.../interceptor/ExecuteAndWaitInterceptor.java | 28 +
.../struts2/interceptor/InterceptorParams.java | 55 +
.../interceptor/StrutsResourceIsolationPolicy.java | 2 +-
.../apache/struts2/interceptor/UploadPolicy.java | 132 +
.../apache/struts2/interceptor/WithLazyParams.java | 101 +-
.../struts2/interceptor/csp/CspNonceSource.java | 33 +-
.../interceptor/csp/DefaultCspSettings.java | 26 +-
.../interceptor/csp/StrutsCspNonceReader.java | 16 +-
.../httpmethod/HttpMethodInterceptor.java | 3 +-
.../parameter/OgnlParameterAllowlister.java | 191 +
.../parameter/ParameterAllowlister.java | 62 +
.../parameter/ParameterAuthorizationContext.java | 192 +
.../interceptor/parameter/ParameterAuthorizer.java | 68 +
.../parameter/ParametersInterceptor.java | 59 +-
.../interceptor/parameter/StrutsParameter.java | 11 +
.../parameter/StrutsParameterAuthorizer.java | 391 ++
.../struts2/locale/DefaultLocaleProvider.java | 5 +-
.../java/org/apache/struts2/ognl/OgnlCache.java | 9 +
.../org/apache/struts2/ognl/OgnlCaffeineCache.java | 5 +
.../org/apache/struts2/ognl/OgnlDefaultCache.java | 5 +
.../java/org/apache/struts2/ognl/OgnlLRUCache.java | 5 +
.../apache/struts2/ognl/SecurityMemberAccess.java | 250 +-
.../struts2/ognl/SecurityMemberAccessConfig.java | 270 +
.../org/apache/struts2/ognl/StrutsContext.java | 2 +-
.../ognl/accessor/XWorkListPropertyAccessor.java | 9 +
.../ognl/accessor/XWorkMapPropertyAccessor.java | 12 +-
.../struts2/ognl/accessor/XWorkMethodAccessor.java | 98 +-
.../ognl/accessor/XWorkObjectPropertyAccessor.java | 2 +
.../org/apache/struts2/result/PostbackResult.java | 3 +-
.../struts2/result/ServletRedirectResult.java | 3 +-
.../text/AbstractLocalizedTextProvider.java | 372 +-
.../struts2/text/GlobalLocalizedTextProvider.java | 3 +
.../struts2/text/StrutsLocalizedTextProvider.java | 64 +-
.../org/apache/struts2/util/ConfigParseUtil.java | 48 +-
.../java/org/apache/struts2/util/TokenHelper.java | 15 +-
.../util/reflection/ReflectionContextState.java | 8 +
.../struts2/validator/ActionValidatorManager.java | 9 +
.../AnnotationActionValidatorManager.java | 24 +-
.../validator/DefaultActionValidatorManager.java | 92 +-
.../struts2/validator/DefaultValidatorFactory.java | 4 +-
.../validators/RequiredFieldValidator.java | 20 +-
.../views/freemarker/FreemarkerManager.java | 13 +-
.../views/freemarker/tags/StrutsModels.java | 8 +
.../tags/{ElseIfModel.java => WebJarModel.java} | 14 +-
.../views/jsp/{CompressTag.java => WebJarTag.java} | 26 +-
.../org/apache/struts2/views/jsp/ui/FormTag.java | 7 +
.../struts2/webjars/StrutsWebJarUrlProvider.java | 148 +
.../apache/struts2/webjars/WebJarUrlProvider.java | 51 +
.../org/apache/struts2/default.properties | 45 +-
.../org/apache/struts2/struts-messages.properties | 10 +-
.../apache/struts2/struts-messages_da.properties | 2 +-
.../apache/struts2/struts-messages_de.properties | 2 +-
.../apache/struts2/struts-messages_en.properties | 2 +-
.../apache/struts2/struts-messages_pl.properties | 2 +-
.../apache/struts2/struts-messages_pt.properties | 2 +-
core/src/main/resources/struts-beans.xml | 17 +
.../resources/template/html5/common-attributes.ftl | 1 +
.../{common-attributes.ftl => constraints.ftl} | 6 +-
.../template/xhtml/form-close-validate.ftl | 7 +
...bean-attributes.html => webjar-attributes.html} | 4 +-
.../site/resources/tags/webjar-description.html | 1 +
.../struts2/DefaultActionInvocationTest.java | 107 +
.../apache/struts2/TestConfigurationProvider.java | 19 +
.../action/CspReportActionReportSizeTest.java | 185 +
.../apache/struts2/action/CspReportActionTest.java | 12 +
.../AdminConstraintUser.java} | 4 +-
.../struts2/components/ConstraintAction.java | 125 +
.../struts2/components/ConstraintAddress.java} | 59 +-
.../components/ConstraintAttributesTest.java | 472 ++
.../apache/struts2/components/ConstraintUser.java | 50 +-
.../apache/struts2/components/ControlTypeTest.java | 80 +
.../org/apache/struts2/components/DateTest.java | 8 +-
.../components/EcmaScriptSafeRegexTest.java | 172 +
.../components/FormFieldValidatorsTest.java | 215 +
.../struts2/components/HtmlControlTypeTest.java | 78 +
.../components/ModelDrivenConstraintAction.java} | 62 +-
.../StrutsHtmlConstraintProviderTest.java | 461 ++
.../org/apache/struts2/components/WebJarTest.java | 81 +
.../entities/PackageConfigBuilderReorderTest.java | 44 +
.../struts2/conversion/ConversionTestAction.java | 4 +-
.../conversion/StrutsTypeConverterHolderTest.java | 442 ++
.../conversion/TypeConverterHolderTest.java | 151 +
.../annotations/ConversionRuleTest.java} | 26 +-
.../conversion/impl/CollectionConverterTest.java | 127 +
.../impl/DefaultConversionFileProcessorTest.java | 89 +
.../conversion/impl/StringConverterTest.java | 13 +
.../conversion/impl/XWorkConverterTest.java | 474 ++
.../DefaultDispatcherErrorHandlerTest.java | 59 +
.../dispatcher/DefaultStaticContentLoaderTest.java | 19 +-
.../DefaultStaticContentLoaderWebJarTest.java | 129 +
.../struts2/dispatcher/DispatcherCleanupTest.java | 47 +-
.../apache/struts2/dispatcher/DispatcherTest.java | 94 +
.../dispatcher/StaticContentLoaderTest.java | 2 -
.../dispatcher/WebJarTestServletOutputStream.java | 33 +-
.../dispatcher/mapper/DefaultActionMapperTest.java | 17 +
.../dispatcher/mapper/RestfulActionMapperTest.java | 28 +
.../AbstractMultiPartRequestApiCheckTest.java | 47 +
.../multipart/AbstractMultiPartRequestTest.java | 26 +-
.../multipart/JakartaMultiPartRequestTest.java | 353 +-
.../JakartaStreamMultiPartRequestTest.java | 63 +-
.../multipart/StrutsInMemoryUploadedFileTest.java | 217 +
.../multipart/StrutsUploadedFileTest.java} | 42 +-
.../dispatcher/multipart/UploadedFileTest.java | 91 +
.../factory/DefaultInterceptorFactoryTest.java | 188 +
.../ActionFileUploadInterceptorTest.java | 503 +-
.../AliasConversionAction.java} | 39 +-
.../struts2/interceptor/AliasInterceptorTest.java | 55 +
.../AnnotatedChainingAction.java} | 32 +-
.../interceptor/ChainingInterceptorTest.java | 151 +
.../CookieInterceptorAnnotationTest.java | 219 +
.../struts2/interceptor/CookieInterceptorTest.java | 75 +
.../struts2/interceptor/DisableParamsTest.java | 60 +
.../ExecuteAndWaitInterceptorTokenScopeTest.java | 163 +
.../interceptor/FetchMetadataInterceptorTest.java | 43 +
.../struts2/interceptor/LazyParamInjectorTest.java | 160 +
.../interceptor/LazyParamsAllowlistTest.java | 123 +
.../interceptor/ThrowingTypeConverter.java} | 20 +-
...yAction.java => UnannotatedChainingAction.java} | 21 +-
.../interceptor/csp/CspNonceSourceConfigTest.java | 93 +
.../interceptor/csp/CspNonceSourceTest.java | 54 +
.../interceptor/csp/StrutsCspNonceReaderTest.java | 90 +
.../httpmethod/HttpMethodInterceptorTest.java | 81 +
.../parameter/OgnlParameterAllowlisterTest.java | 154 +
.../ParameterAuthorizationContextTest.java | 172 +
.../parameter/ParameterAuthorizerTest.java | 627 ++
.../parameter/ParametersInterceptorTest.java | 337 +
.../parameter/StrutsParameterAnnotationTest.java | 47 +
.../struts2/locale/DefaultLocaleProviderTest.java | 16 +
.../apache/struts2/mock/MockLazyInterceptor.java | 63 +-
.../OgnlCacheRemoveTest.java} | 46 +-
.../ognl/SecurityMemberAccessArrayTargetTest.java | 150 +
...mberAccessConfigProductionRegistrationTest.java | 43 +
.../SecurityMemberAccessConfigSharingTest.java | 192 +
.../ognl/SecurityMemberAccessConfigTest.java | 164 +
.../SecurityMemberAccessPackageMatchingTest.java | 260 +
.../struts2/ognl/SecurityMemberAccessTest.java | 29 +-
.../accessor/XWorkListPropertyAccessorTest.java | 16 +
.../accessor/XWorkMapPropertyAccessorTest.java | 45 +
.../ognl/accessor/XWorkMethodAccessorTest.java | 382 ++
.../apache/struts2/result/PostbackResultTest.java | 103 +
.../struts2/result/ServletRedirectResultTest.java | 28 +
.../org/apache/struts2/test/AnnotationUser.java | 2 +
.../java/org/apache/struts2/test/LogCapture.java | 62 +
.../org/apache/struts2/text/CacheFixture.java} | 19 +-
.../text/StrutsLocalizedTextProviderTest.java | 381 ++
...pplicationScopedWithoutKeyConversionAction.java | 54 +
...eanAction.java => BareKeyConversionAction.java} | 43 +-
...dCat.java => CollidingKeyConversionAction.java} | 50 +-
.../apache/struts2/util/ConfigParseUtilTest.java | 288 +
.../struts2/util/EmptyKeyConversionAction.java} | 38 +-
.../{Cat.java => ExplicitKeyConversionAction.java} | 44 +-
.../apache/struts2/util/FieldConversionAction.java | 58 +
.../util/InheritedMethodConversionAction.java | 48 +
.../util/InheritedMethodConversionSubAction.java | 41 +
.../org/apache/struts2/util/MyBeanActionTest.java | 28 +
...{MyBeanAction.java => MyBeanBareKeyAction.java} | 36 +-
.../util/PropertiesCollisionBaseAction.java} | 11 +-
.../util/PropertiesCollisionSubAction.java} | 11 +-
.../org/apache/struts2/util/TokenHelperTest.java | 39 +
.../AnnotationActionValidatorManagerTest.java | 41 +
.../validator/ConversionErrorSkipAction.java | 34 +-
...delAction.java => ConversionErrorSkipBean.java} | 28 +-
.../DefaultActionValidatorManagerTest.java | 302 +
.../struts2/validator/RegexFieldValidatorTest.java | 17 +
.../validators/RequiredFieldValidatorTest.java | 17 +
.../views/freemarker/FreemarkerManagerTest.java | 31 +-
.../apache/struts2/views/jsp/IncludeTagTest.java | 12 +
.../views/jsp/ui/Html5ConstraintRenderingTest.java | 277 +
.../webjars/StrutsWebJarUrlProviderTest.java | 110 +
.../components/AdminConstraintUser.properties | 2 +-
...nstraintAction-constraintAction-validation.xml} | 4 +-
.../ConstraintAction-validation.xml} | 76 +-
.../ConstraintAddress-validation.xml} | 4 +-
.../components/ConstraintUser-validation.xml | 11 +-
.../struts2/components/ConstraintUser.properties | 4 +-
.../AliasConversionAction-conversion.properties | 2 +-
.../apache/struts2/text/CacheFixture.properties | 6 +-
.../apache/struts2/text/CacheFixture_de.properties | 2 +-
...idingKeyConversionAction-conversion.properties} | 2 +-
...ertiesCollisionBaseAction-conversion.properties | 7 +-
...pertiesCollisionSubAction-conversion.properties | 2 +-
.../ConversionErrorSkipAction-validation.xml} | 24 +-
.../ConversionErrorSkipBean-validation.xml} | 14 +-
...est-allowlist.xml => struts-alias-ordering.xml} | 33 +-
...body.xml => struts-csp-nonce-source-legacy.xml} | 2 +-
...escape-body.xml => struts-csp-nonce-source.xml} | 2 +-
.../template/html5child}/theme.properties | 2 +-
...st-allowlist.xml => xwork-alias-conversion.xml} | 26 +-
core/src/test/resources/xwork-sample.xml | 37 +
core/src/test/resources/xwork-test-default.xml | 5 +
...04-04-hibernate-proxy-detection-optimization.md | 272 -
...6-10-WW-5632-fileupload2-milestone-hardening.md | 392 ++
...256-freemarker-whitespace-devmode-decoupling.md | 253 +
.../plans/2026-07-01-WW-5640-webjars-support.md | 1396 +++++
...26-07-06-WW-5641-json-writer-reader-override.md | 447 ++
.../2026-07-08-WW-4858-json-parameter-filtering.md | 838 +++
.../2026-07-17-WW-5653-bootstrap5-migration.md | 490 ++
...07-20-WW-5620-log4j2-logging-standardization.md | 345 +
.../2026-07-21-WW-5539-concurrency-performance.md | 1215 ++++
...6-07-22-WW-5413-inmemory-upload-optimization.md | 827 +++
...6-07-22-WW-5474-multipart-maxfiles-semantics.md | 594 ++
...-WW-2934-skip-validators-on-conversion-error.md | 293 +
...7-23-WW-5540-localized-text-provider-caching.md | 871 +++
...26-07-25-WW-3530-visitor-validator-cache-key.md | 224 +
...-07-25-WW-3871-typeconversion-key-derivation.md | 1026 +++
...3784-annotated-wildcard-specificity-ordering.md | 484 ++
...26-07-27-WW-5659-lazy-params-request-scoping.md | 1323 ++++
...-WW-5668-i18n-cache-bounds-locale-resolution.md | 617 ++
...-WW-5674-isclassbelongstopackages-allocation.md | 625 ++
.../2026-08-08-creating-release-vote-mail-skill.md | 105 +
...14-WW-5675-share-parsed-ognl-security-config.md | 1118 ++++
.../2026-08-24-html5-constraint-validation.md | 1828 ++++++
...06-10-fileupload2-milestone-hardening-design.md | 206 +
...emarker-whitespace-devmode-decoupling-design.md | 125 +
.../specs/2026-07-01-webjars-support-design.md | 146 +
...son-writer-reader-override-regression-design.md | 161 +
...7-08-WW-4858-json-parameter-filtering-design.md | 145 +
...26-07-17-WW-5653-bootstrap5-migration-design.md | 140 +
...W-5620-log4j2-logging-standardization-design.md | 135 +
...07-21-WW-5539-concurrency-performance-design.md | 332 +
...-WW-5413-inmemory-upload-optimization-design.md | 136 +
...-WW-5474-multipart-maxfiles-semantics-design.md | 100 +
...4-skip-validators-on-conversion-error-design.md | 133 +
...-5540-localized-text-provider-caching-design.md | 263 +
...5-WW-3530-visitor-validator-cache-key-design.md | 164 +
...WW-3871-typeconversion-key-derivation-design.md | 229 +
...notated-wildcard-specificity-ordering-design.md | 197 +
...7-WW-5659-lazy-params-request-scoping-design.md | 368 ++
...8-i18n-cache-bounds-locale-resolution-design.md | 215 +
...4-isclassbelongstopackages-allocation-design.md | 381 ++
.../2026-08-08-release-vote-mail-skill-design.md | 187 +
...security-member-access-config-sharing-design.md | 362 ++
...026-08-24-html5-constraint-validation-design.md | 422 ++
jakarta/pom.xml | 2 +-
jakarta/velocity-tools-jsp-jakarta/pom.xml | 2 +-
jakarta/velocity-tools-view-jakarta/pom.xml | 2 +-
mvnw | 50 +-
mvnw.cmd | 338 +-
parent/pom.xml | 58 +-
plugins/async/pom.xml | 2 +-
plugins/bean-validation/pom.xml | 2 +-
.../interceptor/BeanValidationInterceptor.java | 41 +-
.../src/main/resources/struts-plugin.xml | 13 +
.../BeanValidationDefaultStackTest.java | 60 +
.../BeanValidationInterceptorTest.java | 16 +-
.../{FieldAction.java => CheckDigitAction.java} | 16 +-
.../BeanValidationInterceptorMessageTest.java | 130 +
.../src/test/resources/bean-validation-test.xml | 4 +
.../beanvalidation/actions/FieldAction.properties | 2 +-
plugins/cdi/pom.xml | 11 +-
.../org/apache/struts2/cdi/CdiProxyService.java | 122 +
plugins/cdi/src/main/resources/struts-plugin.xml | 3 +
.../apache/struts2/cdi/CdiProxyServiceTest.java | 160 +
.../{FooService.java => ProxiedFooService.java} | 9 +-
.../ognl/CdiSecurityMemberAccessProxyTest.java | 102 +
plugins/config-browser/pom.xml | 2 +-
plugins/convention/pom.xml | 2 +-
.../ActionNameSpecificityComparator.java | 99 +
.../PackageBasedActionConfigBuilder.java | 19 +
.../ActionNameSpecificityComparatorTest.java | 89 +
...PackageBasedActionConfigBuilderReorderTest.java | 53 +
.../convention/WildcardSpecificityRoutingTest.java | 91 +
plugins/jasperreports/pom.xml | 4 +-
.../views/jasperreports/JasperReportsResult.java | 24 +-
.../views/jasperreports/ValueStackShadowMap.java | 33 +-
.../jasperreports/JasperReportsResultTest.java | 61 +-
.../jasperreports/ValueStackShadowMapTest.java | 71 +
.../jasperreports/{simple.jrxml => csv.jrxml} | 15 +-
plugins/jasperreports7/pom.xml | 12 +-
.../views/jasperreports7/JasperReport7Result.java | 35 +-
.../views/jasperreports7/ValueStackShadowMap.java | 11 +-
.../export/JasperReport7CsvExporterProvider.java | 4 +-
.../export/JasperReport7HtmlExporterProvider.java | 3 +-
.../export/JasperReport7PdfExporterProvider.java | 3 +-
.../export/JasperReport7RtfExporterProvider.java | 3 +-
.../export/JasperReport7XlsxExporterProvider.java | 3 +-
.../export/JasperReport7XmlExporterProvider.java | 3 +-
.../jasperreports7/JasperReport7ResultTest.java | 163 +-
.../tomcat/JasperReport7TomcatTest.java | 148 +
.../views/jasperreports7/tomcat/ReportAction.java} | 28 +-
.../jasperreports7/{simple.jrxml => csv.jrxml} | 17 +-
.../src/test/resources/struts-tomcat.xml | 13 +-
plugins/javatemplates/pom.xml | 2 +-
plugins/jfreechart/pom.xml | 2 +-
plugins/json/pom.xml | 2 +-
.../org/apache/struts2/json/JSONInterceptor.java | 281 +-
.../java/org/apache/struts2/json/JSONUtil.java | 13 +-
.../org/apache/struts2/json/StrutsJSONReader.java | 4 +
.../org/apache/struts2/json/StrutsJSONWriter.java | 78 +-
.../org/apache/struts2/json/annotations/JSON.java | 2 +-
.../struts2/json/annotations/JSONFieldBridge.java | 2 +-
.../src/main/resources/struts-deferred.xml | 2 +-
plugins/json/src/main/resources/struts-plugin.xml | 2 -
.../apache/struts2/json/CustomTestJSONReader.java | 32 +-
.../apache/struts2/json/CustomTestJSONWriter.java | 51 +
.../apache/struts2/json/JSONInterceptorTest.java | 529 +-
.../struts2/json/JSONUtilInputLimitTest.java | 114 +
.../struts2/json/JSONWriterOverrideTest.java | 78 +
.../struts2/json/ParameterAwareTestAction.java | 59 +-
.../apache/struts2/json/StrutsJSONReaderTest.java | 1 +
.../apache/struts2/json/StrutsJSONWriterTest.java | 159 +
.../src/test/resources/struts-json-override.xml | 17 +-
plugins/junit/pom.xml | 6 +-
.../apache/struts2/junit/StrutsRestTestCase.java | 2 +-
plugins/pom.xml | 2 +-
plugins/rest/pom.xml | 2 +-
.../struts2/rest/ContentTypeInterceptor.java | 433 +-
.../rest/RequestBodyTooLargeException.java} | 20 +-
.../apache/struts2/rest/RestActionInvocation.java | 9 +
.../org/apache/struts2/rest/RestActionMapper.java | 11 +
.../org/apache/struts2/rest/RestConstants.java | 2 +
.../rest/config/entities/RestConstantConfig.java | 11 +
.../AuthorizationAwareContentTypeHandler.java | 46 +
.../struts2/rest/handler/JacksonJsonHandler.java | 20 +-
.../struts2/rest/handler/JacksonXmlHandler.java | 33 +-
.../struts2/rest/handler/JuneauXmlHandler.java | 207 +-
.../struts2/rest/handler/XStreamHandler.java | 11 +-
.../jackson/AuthorizedForwardReferences.java | 82 +
.../jackson/AuthorizingSettableAnyProperty.java | 270 +
.../jackson/AuthorizingSettableBeanProperty.java | 183 +
.../jackson/AuthorizingValueDeserializer.java | 181 +
.../jackson/DynamicKeyAuthorizationContext.java | 115 +
.../rest/handler/jackson/DynamicKeyRejections.java | 86 +
.../handler/jackson/ObjectIdPathDeserializer.java | 81 +
.../jackson/ParameterAuthorizingModule.java | 194 +
.../jackson/RedactionAwareDeserializer.java | 212 +
.../rest/handler/jackson/XmlWrapperSupport.java | 78 +
plugins/rest/src/main/resources/struts-plugin.xml | 15 +
.../ContentTypeInterceptorIntegrationTest.java | 376 ++
.../struts2/rest/ContentTypeInterceptorTest.java | 448 +-
.../rest/JuneauXmlHandlerIntegrationTest.java | 178 +
.../struts2/rest/RestActionInvocationTest.java | 23 +
.../rest/RestActionMapperRootNamespaceTest.java | 85 +
.../apache/struts2/rest/RestActionMapperTest.java | 17 +
.../apache/struts2/rest/RestDefaultStackTest.java | 60 +
.../org/apache/struts2/rest/SecureRestAction.java | 101 +
.../rest/handler/JacksonXmlHandlerTest.java | 127 +
.../struts2/rest/handler/JuneauXmlHandlerTest.java | 17 +
.../jackson/ForwardReferenceStateProbe.java | 34 +-
.../jackson/ParameterAuthorizingModuleTest.java | 1800 ++++++
.../src/test/resources/ww-5688.xml} | 9 +-
plugins/spring/README.md | 8 +
plugins/spring/pom.xml | 2 +-
plugins/testng/pom.xml | 2 +-
plugins/tiles/README.md | 16 +
plugins/tiles/pom.xml | 4 +-
.../tiles/DisabledOgnlAttributeEvaluator.java} | 26 +-
.../struts2/tiles/StrutsTilesContainerFactory.java | 90 +-
.../struts2/tiles/StrutsTilesInitializer.java | 15 +-
.../org/apache/struts2/tiles/TilesConstants.java | 23 +-
.../dao/CachingLocaleUrlDefinitionDAO.java | 38 +-
.../pattern/AbstractPatternDefinitionResolver.java | 10 +-
.../pattern/PatternDefinitionResolver.java | 8 +
.../apache/tiles/ognl/OGNLAttributeEvaluator.java | 21 +-
.../AbstractDefaultToStringRenderable.java | 6 +-
plugins/tiles/src/main/resources/struts-plugin.xml | 2 +
.../tiles/DisabledOgnlAttributeEvaluatorTest.java} | 40 +-
.../tiles/StrutsTilesContainerFactoryTest.java | 313 +-
...notations.java => StrutsTilesListenerTest.java} | 61 +-
.../tiles/TilesOgnlEvaluatorIntegrationTest.java | 286 +
.../dao/CachingLocaleUrlDefinitionDAOTest.java | 37 +
.../AbstractPatternDefinitionResolverTest.java | 29 +
.../apache/struts2/tiles/struts-tiles-legacy.xml | 7 +-
plugins/velocity/pom.xml | 2 +-
plugins/xslt/pom.xml | 2 +-
.../org/apache/struts2/result/xslt/XSLTResult.java | 38 +-
.../apache/struts2/result/xslt/XSLTResultTest.java | 148 +
...{XSLTResultTest.xsl => XSLTResultTestDedup.xsl} | 4 +-
...Test.xsl => XSLTResultTestNoCachePollution.xsl} | 4 +-
pom.xml | 166 +-
src/etc/project-suppression.xml | 192 +-
619 files changed, 51491 insertions(+), 21696 deletions(-)
delete mode 100644 .claude/agents/code-quality-checker.md
delete mode 100644 .claude/agents/codebase-analyzer.md
delete mode 100644 .claude/agents/codebase-locator.md
delete mode 100644 .claude/agents/codebase-pattern-finder.md
delete mode 100644 .claude/agents/config-validator.md
delete mode 100644 .claude/agents/security-analyzer.md
delete mode 100644 .claude/agents/thoughts-analyzer.md
delete mode 100644 .claude/agents/thoughts-locator.md
delete mode 100644 .claude/agents/web-search-researcher.md
delete mode 100644 .claude/commands/config_analyze.md
delete mode 100644 .claude/commands/create_plan.md
delete mode 100644 .claude/commands/quality_check.md
delete mode 100644 .claude/commands/research_codebase.md
delete mode 100644 .claude/commands/security_scan.md
delete mode 100644 .claude/commands/validate_plan.md
create mode 100644 .claude/skills/creating-release-vote-mail/SKILL.md
create mode 100644
.claude/skills/creating-release-vote-mail/vote-mail-template.md
create mode 100644 .claude/skills/creating-security-bulletins/SKILL.md
create mode 100644
.claude/skills/creating-security-bulletins/bulletin-template.md
create mode 100644 .claude/skills/creating-version-notes/SKILL.md
create mode 100644
.claude/skills/creating-version-notes/version-notes-template.md
create mode 100644 .claude/skills/merging-dependabot-prs/SKILL.md
create mode 100644 .claude/skills/releasing-struts/SKILL.md
create mode 100644 .claude/skills/releasing-struts/release-runbook.md
create mode 100755 .claude/skills/releasing-struts/scripts/promote-dist.sh
create mode 100755 .claude/skills/releasing-struts/scripts/stage-assemblies.sh
create mode 100644 .claude/skills/triaging-security-reports/SKILL.md
create mode 100644 .github/skills/code-review/SKILL.md
create mode 100644 .github/workflows/changes.yml
create mode 100644 .github/workflows/owasp.yml
create mode 100644 AGENTS.md
create mode 100644 CONTRIBUTING.md
create mode 100644 THREAT_MODEL.md
delete mode 100644 apps/rest-showcase/src/main/webapp/css/bootstrap-theme.css
delete mode 100644
apps/rest-showcase/src/main/webapp/css/bootstrap-theme.css.map
delete mode 100644
apps/rest-showcase/src/main/webapp/css/bootstrap-theme.min.css
delete mode 100644 apps/rest-showcase/src/main/webapp/css/bootstrap.css
delete mode 100644 apps/rest-showcase/src/main/webapp/css/bootstrap.css.map
delete mode 100644 apps/rest-showcase/src/main/webapp/css/bootstrap.min.css
copy
core/src/test/java/org/apache/struts2/interceptor/httpmethod/HttpMethodTest.java
=>
apps/rest-showcase/src/test/java/org/demo/rest/example/OrdersControllerRestTestCaseTest.java
(52%)
delete mode 100644 apps/showcase/src/main/webapp/js/bootstrap.min.js
delete mode 100644 apps/showcase/src/main/webapp/js/jquery-2.1.4.min.js
delete mode 100644 apps/showcase/src/main/webapp/styles/bootstrap-theme.css
delete mode 100644 apps/showcase/src/main/webapp/styles/bootstrap-theme.css.map
delete mode 100644 apps/showcase/src/main/webapp/styles/bootstrap-theme.min.css
delete mode 100644 apps/showcase/src/main/webapp/styles/bootstrap.css
delete mode 100644 apps/showcase/src/main/webapp/styles/bootstrap.css.map
delete mode 100644 apps/showcase/src/main/webapp/styles/bootstrap.min.css
create mode 100644
core/src/main/java/org/apache/struts2/components/EcmaScriptSafeRegex.java
create mode 100644
core/src/main/java/org/apache/struts2/components/HtmlConstraintProvider.java
create mode 100644
core/src/main/java/org/apache/struts2/components/HtmlControlType.java
create mode 100644
core/src/main/java/org/apache/struts2/components/StrutsHtmlConstraintProvider.java
create mode 100644 core/src/main/java/org/apache/struts2/components/WebJar.java
copy
core/src/main/java/org/apache/struts2/dispatcher/{OgnlCacheDestroyable.java =>
ActionValidatorManagerDestroyable.java} (54%)
copy
core/src/main/java/org/apache/struts2/dispatcher/{OgnlCacheDestroyable.java =>
TypeConverterHolderDestroyable.java} (55%)
copy plugins/json/src/main/java/org/apache/struts2/json/JSONException.java =>
core/src/main/java/org/apache/struts2/dispatcher/multipart/FileUploadParameterCountLimitException.java
(55%)
create mode 100644
core/src/main/java/org/apache/struts2/dispatcher/multipart/StrutsInMemoryUploadedFile.java
copy
core/src/main/java/org/apache/struts2/interceptor/{AbstractInterceptor.java =>
DisableParams.java} (52%)
create mode 100644
core/src/main/java/org/apache/struts2/interceptor/InterceptorParams.java
create mode 100644
core/src/main/java/org/apache/struts2/interceptor/UploadPolicy.java
create mode 100644
core/src/main/java/org/apache/struts2/interceptor/parameter/OgnlParameterAllowlister.java
create mode 100644
core/src/main/java/org/apache/struts2/interceptor/parameter/ParameterAllowlister.java
create mode 100644
core/src/main/java/org/apache/struts2/interceptor/parameter/ParameterAuthorizationContext.java
create mode 100644
core/src/main/java/org/apache/struts2/interceptor/parameter/ParameterAuthorizer.java
create mode 100644
core/src/main/java/org/apache/struts2/interceptor/parameter/StrutsParameterAuthorizer.java
create mode 100644
core/src/main/java/org/apache/struts2/ognl/SecurityMemberAccessConfig.java
copy
core/src/main/java/org/apache/struts2/views/freemarker/tags/{ElseIfModel.java
=> WebJarModel.java} (84%)
copy core/src/main/java/org/apache/struts2/views/jsp/{CompressTag.java =>
WebJarTag.java} (71%)
create mode 100644
core/src/main/java/org/apache/struts2/webjars/StrutsWebJarUrlProvider.java
create mode 100644
core/src/main/java/org/apache/struts2/webjars/WebJarUrlProvider.java
copy core/src/main/resources/template/html5/{common-attributes.ftl =>
constraints.ftl} (84%)
copy core/src/site/resources/tags/{bean-attributes.html =>
webjar-attributes.html} (89%)
create mode 100644 core/src/site/resources/tags/webjar-description.html
create mode 100644
core/src/test/java/org/apache/struts2/action/CspReportActionReportSizeTest.java
copy core/src/test/java/org/apache/struts2/{factory/MyResultFactory.java =>
components/AdminConstraintUser.java} (89%)
create mode 100644
core/src/test/java/org/apache/struts2/components/ConstraintAction.java
copy
core/src/{main/java/org/apache/struts2/components/ExtraParameterProvider.java
=> test/java/org/apache/struts2/components/ConstraintAddress.java} (80%)
create mode 100644
core/src/test/java/org/apache/struts2/components/ConstraintAttributesTest.java
copy plugins/spring/src/test/java/org/apache/struts2/TestChildBean.java =>
core/src/test/java/org/apache/struts2/components/ConstraintUser.java (63%)
create mode 100644
core/src/test/java/org/apache/struts2/components/ControlTypeTest.java
create mode 100644
core/src/test/java/org/apache/struts2/components/EcmaScriptSafeRegexTest.java
create mode 100644
core/src/test/java/org/apache/struts2/components/FormFieldValidatorsTest.java
create mode 100644
core/src/test/java/org/apache/struts2/components/HtmlControlTypeTest.java
copy
core/src/{main/java/org/apache/struts2/components/ExtraParameterProvider.java
=> test/java/org/apache/struts2/components/ModelDrivenConstraintAction.java}
(70%)
create mode 100644
core/src/test/java/org/apache/struts2/components/StrutsHtmlConstraintProviderTest.java
create mode 100644
core/src/test/java/org/apache/struts2/components/WebJarTest.java
create mode 100644
core/src/test/java/org/apache/struts2/config/entities/PackageConfigBuilderReorderTest.java
create mode 100644
core/src/test/java/org/apache/struts2/conversion/StrutsTypeConverterHolderTest.java
create mode 100644
core/src/test/java/org/apache/struts2/conversion/TypeConverterHolderTest.java
copy core/src/test/java/org/apache/struts2/{ActionChainResultTest.java =>
conversion/annotations/ConversionRuleTest.java} (55%)
create mode 100644
core/src/test/java/org/apache/struts2/conversion/impl/CollectionConverterTest.java
create mode 100644
core/src/test/java/org/apache/struts2/conversion/impl/DefaultConversionFileProcessorTest.java
create mode 100644
core/src/test/java/org/apache/struts2/dispatcher/DefaultStaticContentLoaderWebJarTest.java
copy
plugins/rest/src/main/java/org/apache/struts2/rest/handler/HtmlHandler.java =>
core/src/test/java/org/apache/struts2/dispatcher/WebJarTestServletOutputStream.java
(58%)
create mode 100644
core/src/test/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequestApiCheckTest.java
create mode 100644
core/src/test/java/org/apache/struts2/dispatcher/multipart/StrutsInMemoryUploadedFileTest.java
copy
core/src/{main/java/org/apache/struts2/util/classloader/AbstractResourceStore.java
=>
test/java/org/apache/struts2/dispatcher/multipart/StrutsUploadedFileTest.java}
(52%)
create mode 100644
core/src/test/java/org/apache/struts2/dispatcher/multipart/UploadedFileTest.java
create mode 100644
core/src/test/java/org/apache/struts2/factory/DefaultInterceptorFactoryTest.java
copy core/src/test/java/org/apache/struts2/{views/freemarker/TestAction.java
=> interceptor/AliasConversionAction.java} (53%)
copy core/src/test/java/org/apache/struts2/{ModelDrivenAction.java =>
interceptor/AnnotatedChainingAction.java} (61%)
create mode 100644
core/src/test/java/org/apache/struts2/interceptor/CookieInterceptorAnnotationTest.java
create mode 100644
core/src/test/java/org/apache/struts2/interceptor/DisableParamsTest.java
create mode 100644
core/src/test/java/org/apache/struts2/interceptor/ExecuteAndWaitInterceptorTokenScopeTest.java
create mode 100644
core/src/test/java/org/apache/struts2/interceptor/LazyParamInjectorTest.java
create mode 100644
core/src/test/java/org/apache/struts2/interceptor/LazyParamsAllowlistTest.java
copy core/src/{main/java/org/apache/struts2/interceptor/NoOpInterceptor.java
=> test/java/org/apache/struts2/interceptor/ThrowingTypeConverter.java} (61%)
copy
core/src/test/java/org/apache/struts2/interceptor/{ExecuteAndWaitDelayAction.java
=> UnannotatedChainingAction.java} (65%)
create mode 100644
core/src/test/java/org/apache/struts2/interceptor/csp/CspNonceSourceConfigTest.java
create mode 100644
core/src/test/java/org/apache/struts2/interceptor/csp/CspNonceSourceTest.java
create mode 100644
core/src/test/java/org/apache/struts2/interceptor/csp/StrutsCspNonceReaderTest.java
create mode 100644
core/src/test/java/org/apache/struts2/interceptor/parameter/OgnlParameterAllowlisterTest.java
create mode 100644
core/src/test/java/org/apache/struts2/interceptor/parameter/ParameterAuthorizationContextTest.java
create mode 100644
core/src/test/java/org/apache/struts2/interceptor/parameter/ParameterAuthorizerTest.java
copy
core/src/test/java/org/apache/struts2/{interceptor/httpmethod/HttpMethodTest.java
=> ognl/OgnlCacheRemoveTest.java} (52%)
create mode 100644
core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessArrayTargetTest.java
create mode 100644
core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessConfigProductionRegistrationTest.java
create mode 100644
core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessConfigSharingTest.java
create mode 100644
core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessConfigTest.java
create mode 100644
core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessPackageMatchingTest.java
create mode 100644
core/src/test/java/org/apache/struts2/ognl/accessor/XWorkMethodAccessorTest.java
create mode 100644 core/src/test/java/org/apache/struts2/test/LogCapture.java
copy core/src/{main/java/org/apache/struts2/result/plain/DateHttpHeader.java
=> test/java/org/apache/struts2/text/CacheFixture.java} (72%)
create mode 100644
core/src/test/java/org/apache/struts2/util/ApplicationScopedWithoutKeyConversionAction.java
copy core/src/test/java/org/apache/struts2/util/{MyBeanAction.java =>
BareKeyConversionAction.java} (56%)
copy core/src/test/java/org/apache/struts2/util/{AnnotatedCat.java =>
CollidingKeyConversionAction.java} (55%)
create mode 100644
core/src/test/java/org/apache/struts2/util/ConfigParseUtilTest.java
copy core/src/{main/java/org/apache/struts2/util/ListEntry.java =>
test/java/org/apache/struts2/util/EmptyKeyConversionAction.java} (61%)
copy core/src/test/java/org/apache/struts2/util/{Cat.java =>
ExplicitKeyConversionAction.java} (58%)
create mode 100644
core/src/test/java/org/apache/struts2/util/FieldConversionAction.java
create mode 100644
core/src/test/java/org/apache/struts2/util/InheritedMethodConversionAction.java
create mode 100644
core/src/test/java/org/apache/struts2/util/InheritedMethodConversionSubAction.java
copy core/src/test/java/org/apache/struts2/util/{MyBeanAction.java =>
MyBeanBareKeyAction.java} (65%)
copy core/src/{main/java/org/apache/struts2/util/ClearableValueStack.java =>
test/java/org/apache/struts2/util/PropertiesCollisionBaseAction.java} (75%)
copy core/src/{main/java/org/apache/struts2/util/ClearableValueStack.java =>
test/java/org/apache/struts2/util/PropertiesCollisionSubAction.java} (74%)
copy
plugins/rest/src/test/java/org/apache/struts2/rest/handler/SimpleBean.java =>
core/src/test/java/org/apache/struts2/validator/ConversionErrorSkipAction.java
(68%)
copy
core/src/test/java/org/apache/struts2/validator/{VisitorValidatorModelAction.java
=> ConversionErrorSkipBean.java} (65%)
create mode 100644
core/src/test/java/org/apache/struts2/views/jsp/ui/Html5ConstraintRenderingTest.java
create mode 100644
core/src/test/java/org/apache/struts2/webjars/StrutsWebJarUrlProviderTest.java
copy
apps/showcase/src/main/resources/org/apache/struts2/showcase/UITagExample-conversion.properties
=>
core/src/test/resources/org/apache/struts2/components/AdminConstraintUser.properties
(94%)
copy core/src/test/resources/org/apache/struts2/{TestBean-validation.xml =>
components/ConstraintAction-constraintAction-validation.xml} (93%)
copy core/src/test/resources/org/apache/struts2/{test/Equidae-validation.xml
=> components/ConstraintAction-validation.xml} (51%)
copy core/src/test/resources/org/apache/struts2/{TestBean-validation.xml =>
components/ConstraintAddress-validation.xml} (93%)
copy
apps/showcase/src/main/resources/org/apache/struts2/showcase/person/Person-validation.xml
=>
core/src/test/resources/org/apache/struts2/components/ConstraintUser-validation.xml
(83%)
copy
apps/showcase/src/main/resources/org/apache/struts2/showcase/UITagExample-conversion.properties
=>
core/src/test/resources/org/apache/struts2/components/ConstraintUser.properties
(86%)
copy
apps/showcase/src/main/resources/org/apache/struts2/showcase/UITagExample-conversion.properties
=>
core/src/test/resources/org/apache/struts2/interceptor/AliasConversionAction-conversion.properties
(92%)
copy apps/rest-showcase/src/main/resources/velocity.properties =>
core/src/test/resources/org/apache/struts2/text/CacheFixture.properties (83%)
copy
apps/showcase/src/main/resources/template/ajaxErrorContainers/theme.properties
=> core/src/test/resources/org/apache/struts2/text/CacheFixture_de.properties
(96%)
copy core/src/{main/resources/template/html5/theme.properties =>
test/resources/org/apache/struts2/util/CollidingKeyConversionAction-conversion.properties}
(95%)
copy apps/rest-showcase/src/main/resources/velocity.properties =>
core/src/test/resources/org/apache/struts2/util/PropertiesCollisionBaseAction-conversion.properties
(73%)
copy
apps/showcase/src/main/resources/template/ajaxErrorContainers/theme.properties
=>
core/src/test/resources/org/apache/struts2/util/PropertiesCollisionSubAction-conversion.properties
(96%)
copy
core/src/test/resources/org/apache/struts2/{SimpleAction-subproperty-validation.xml
=> validator/ConversionErrorSkipAction-validation.xml} (70%)
copy core/src/test/resources/org/apache/struts2/{TestAction-validation.xml =>
validator/ConversionErrorSkipBean-validation.xml} (81%)
copy
core/src/test/resources/{org/apache/struts2/config/providers/xwork-test-allowlist.xml
=> struts-alias-ordering.xml} (55%)
copy core/src/test/resources/{struts-escape-body.xml =>
struts-csp-nonce-source-legacy.xml} (94%)
copy core/src/test/resources/{struts-escape-body.xml =>
struts-csp-nonce-source.xml} (94%)
copy {apps/showcase/src/main/resources/template/ajaxErrorContainers =>
core/src/test/resources/template/html5child}/theme.properties (98%)
copy
core/src/test/resources/{org/apache/struts2/config/providers/xwork-test-allowlist.xml
=> xwork-alias-conversion.xml} (62%)
delete mode 100644
docs/superpowers/plans/2026-04-04-hibernate-proxy-detection-optimization.md
create mode 100644
docs/superpowers/plans/2026-06-10-WW-5632-fileupload2-milestone-hardening.md
create mode 100644
docs/superpowers/plans/2026-06-15-WW-5256-freemarker-whitespace-devmode-decoupling.md
create mode 100644 docs/superpowers/plans/2026-07-01-WW-5640-webjars-support.md
create mode 100644
docs/superpowers/plans/2026-07-06-WW-5641-json-writer-reader-override.md
create mode 100644
docs/superpowers/plans/2026-07-08-WW-4858-json-parameter-filtering.md
create mode 100644
docs/superpowers/plans/2026-07-17-WW-5653-bootstrap5-migration.md
create mode 100644
docs/superpowers/plans/2026-07-20-WW-5620-log4j2-logging-standardization.md
create mode 100644
docs/superpowers/plans/2026-07-21-WW-5539-concurrency-performance.md
create mode 100644
docs/superpowers/plans/2026-07-22-WW-5413-inmemory-upload-optimization.md
create mode 100644
docs/superpowers/plans/2026-07-22-WW-5474-multipart-maxfiles-semantics.md
create mode 100644
docs/superpowers/plans/2026-07-23-WW-2934-skip-validators-on-conversion-error.md
create mode 100644
docs/superpowers/plans/2026-07-23-WW-5540-localized-text-provider-caching.md
create mode 100644
docs/superpowers/plans/2026-07-25-WW-3530-visitor-validator-cache-key.md
create mode 100644
docs/superpowers/plans/2026-07-25-WW-3871-typeconversion-key-derivation.md
create mode 100644
docs/superpowers/plans/2026-07-26-WW-3784-annotated-wildcard-specificity-ordering.md
create mode 100644
docs/superpowers/plans/2026-07-27-WW-5659-lazy-params-request-scoping.md
create mode 100644
docs/superpowers/plans/2026-07-30-WW-5668-i18n-cache-bounds-locale-resolution.md
create mode 100644
docs/superpowers/plans/2026-08-03-WW-5674-isclassbelongstopackages-allocation.md
create mode 100644
docs/superpowers/plans/2026-08-08-creating-release-vote-mail-skill.md
create mode 100644
docs/superpowers/plans/2026-08-14-WW-5675-share-parsed-ognl-security-config.md
create mode 100644
docs/superpowers/plans/2026-08-24-html5-constraint-validation.md
create mode 100644
docs/superpowers/specs/2026-06-10-fileupload2-milestone-hardening-design.md
create mode 100644
docs/superpowers/specs/2026-06-15-WW-5256-freemarker-whitespace-devmode-decoupling-design.md
create mode 100644 docs/superpowers/specs/2026-07-01-webjars-support-design.md
create mode 100644
docs/superpowers/specs/2026-07-06-WW-5641-json-writer-reader-override-regression-design.md
create mode 100644
docs/superpowers/specs/2026-07-08-WW-4858-json-parameter-filtering-design.md
create mode 100644
docs/superpowers/specs/2026-07-17-WW-5653-bootstrap5-migration-design.md
create mode 100644
docs/superpowers/specs/2026-07-20-WW-5620-log4j2-logging-standardization-design.md
create mode 100644
docs/superpowers/specs/2026-07-21-WW-5539-concurrency-performance-design.md
create mode 100644
docs/superpowers/specs/2026-07-22-WW-5413-inmemory-upload-optimization-design.md
create mode 100644
docs/superpowers/specs/2026-07-22-WW-5474-multipart-maxfiles-semantics-design.md
create mode 100644
docs/superpowers/specs/2026-07-23-WW-2934-skip-validators-on-conversion-error-design.md
create mode 100644
docs/superpowers/specs/2026-07-23-WW-5540-localized-text-provider-caching-design.md
create mode 100644
docs/superpowers/specs/2026-07-25-WW-3530-visitor-validator-cache-key-design.md
create mode 100644
docs/superpowers/specs/2026-07-25-WW-3871-typeconversion-key-derivation-design.md
create mode 100644
docs/superpowers/specs/2026-07-26-WW-3784-annotated-wildcard-specificity-ordering-design.md
create mode 100644
docs/superpowers/specs/2026-07-27-WW-5659-lazy-params-request-scoping-design.md
create mode 100644
docs/superpowers/specs/2026-07-30-WW-5668-i18n-cache-bounds-locale-resolution-design.md
create mode 100644
docs/superpowers/specs/2026-08-03-WW-5674-isclassbelongstopackages-allocation-design.md
create mode 100644
docs/superpowers/specs/2026-08-08-release-vote-mail-skill-design.md
create mode 100644
docs/superpowers/specs/2026-08-14-WW-5675-security-member-access-config-sharing-design.md
create mode 100644
docs/superpowers/specs/2026-08-24-html5-constraint-validation-design.md
create mode 100644
plugins/bean-validation/src/test/java/org/apache/struts/beanvalidation/BeanValidationDefaultStackTest.java
copy
plugins/bean-validation/src/test/java/org/apache/struts/beanvalidation/actions/{FieldAction.java
=> CheckDigitAction.java} (76%)
create mode 100644
plugins/bean-validation/src/test/java/org/apache/struts/beanvalidation/validation/interceptor/BeanValidationInterceptorMessageTest.java
copy
apps/showcase/src/main/resources/org/apache/struts2/showcase/UITagExample-conversion.properties
=>
plugins/bean-validation/src/test/resources/org/apache/struts/beanvalidation/actions/FieldAction.properties
(94%)
create mode 100644
plugins/cdi/src/main/java/org/apache/struts2/cdi/CdiProxyService.java
create mode 100644
plugins/cdi/src/test/java/org/apache/struts2/cdi/CdiProxyServiceTest.java
copy plugins/cdi/src/test/java/org/apache/struts2/cdi/{FooService.java =>
ProxiedFooService.java} (79%)
create mode 100644
plugins/cdi/src/test/java/org/apache/struts2/ognl/CdiSecurityMemberAccessProxyTest.java
create mode 100644
plugins/convention/src/main/java/org/apache/struts2/convention/ActionNameSpecificityComparator.java
create mode 100644
plugins/convention/src/test/java/org/apache/struts2/convention/ActionNameSpecificityComparatorTest.java
create mode 100644
plugins/convention/src/test/java/org/apache/struts2/convention/PackageBasedActionConfigBuilderReorderTest.java
create mode 100644
plugins/convention/src/test/java/org/apache/struts2/convention/WildcardSpecificityRoutingTest.java
create mode 100644
plugins/jasperreports/src/test/java/org/apache/struts2/views/jasperreports/ValueStackShadowMapTest.java
copy
plugins/jasperreports/src/test/resources/org/apache/struts2/views/jasperreports/{simple.jrxml
=> csv.jrxml} (78%)
create mode 100644
plugins/jasperreports7/src/test/java/org/apache/struts2/views/jasperreports7/tomcat/JasperReport7TomcatTest.java
copy
plugins/{junit/src/test/java/org/apache/struts2/junit/JUnitTestAction.java =>
jasperreports7/src/test/java/org/apache/struts2/views/jasperreports7/tomcat/ReportAction.java}
(63%)
copy
plugins/jasperreports7/src/test/resources/org/apache/struts2/views/jasperreports7/{simple.jrxml
=> csv.jrxml} (67%)
copy
core/src/test/resources/org/apache/struts2/config/providers/xwork-include-after-package-2.xml
=> plugins/jasperreports7/src/test/resources/struts-tomcat.xml (68%)
copy plugins/{velocity => json}/src/main/resources/struts-deferred.xml (89%)
copy core/src/main/java/org/apache/struts2/ognl/accessor/ObjectAccessor.java
=> plugins/json/src/test/java/org/apache/struts2/json/CustomTestJSONReader.java
(54%)
create mode 100644
plugins/json/src/test/java/org/apache/struts2/json/CustomTestJSONWriter.java
create mode 100644
plugins/json/src/test/java/org/apache/struts2/json/JSONUtilInputLimitTest.java
create mode 100644
plugins/json/src/test/java/org/apache/struts2/json/JSONWriterOverrideTest.java
copy core/src/test/java/org/apache/struts2/mock/MockLazyInterceptor.java =>
plugins/json/src/test/java/org/apache/struts2/json/ParameterAwareTestAction.java
(50%)
copy apps/showcase/src/main/resources/struts-person.xml =>
plugins/json/src/test/resources/struts-json-override.xml (60%)
copy plugins/{json/src/main/java/org/apache/struts2/json/JSONException.java =>
rest/src/main/java/org/apache/struts2/rest/RequestBodyTooLargeException.java}
(71%)
create mode 100644
plugins/rest/src/main/java/org/apache/struts2/rest/handler/AuthorizationAwareContentTypeHandler.java
create mode 100644
plugins/rest/src/main/java/org/apache/struts2/rest/handler/jackson/AuthorizedForwardReferences.java
create mode 100644
plugins/rest/src/main/java/org/apache/struts2/rest/handler/jackson/AuthorizingSettableAnyProperty.java
create mode 100644
plugins/rest/src/main/java/org/apache/struts2/rest/handler/jackson/AuthorizingSettableBeanProperty.java
create mode 100644
plugins/rest/src/main/java/org/apache/struts2/rest/handler/jackson/AuthorizingValueDeserializer.java
create mode 100644
plugins/rest/src/main/java/org/apache/struts2/rest/handler/jackson/DynamicKeyAuthorizationContext.java
create mode 100644
plugins/rest/src/main/java/org/apache/struts2/rest/handler/jackson/DynamicKeyRejections.java
create mode 100644
plugins/rest/src/main/java/org/apache/struts2/rest/handler/jackson/ObjectIdPathDeserializer.java
create mode 100644
plugins/rest/src/main/java/org/apache/struts2/rest/handler/jackson/ParameterAuthorizingModule.java
create mode 100644
plugins/rest/src/main/java/org/apache/struts2/rest/handler/jackson/RedactionAwareDeserializer.java
create mode 100644
plugins/rest/src/main/java/org/apache/struts2/rest/handler/jackson/XmlWrapperSupport.java
create mode 100644
plugins/rest/src/test/java/org/apache/struts2/rest/ContentTypeInterceptorIntegrationTest.java
create mode 100644
plugins/rest/src/test/java/org/apache/struts2/rest/JuneauXmlHandlerIntegrationTest.java
create mode 100644
plugins/rest/src/test/java/org/apache/struts2/rest/RestActionMapperRootNamespaceTest.java
create mode 100644
plugins/rest/src/test/java/org/apache/struts2/rest/RestDefaultStackTest.java
create mode 100644
plugins/rest/src/test/java/org/apache/struts2/rest/SecureRestAction.java
copy core/src/main/java/org/apache/struts2/util/ListEntry.java =>
plugins/rest/src/test/java/org/apache/struts2/rest/handler/jackson/ForwardReferenceStateProbe.java
(56%)
create mode 100644
plugins/rest/src/test/java/org/apache/struts2/rest/handler/jackson/ParameterAuthorizingModuleTest.java
copy plugins/{xslt/src/main/resources/struts-plugin.xml =>
rest/src/test/resources/ww-5688.xml} (84%)
copy
plugins/tiles/src/main/java/org/apache/{tiles/ognl/OGNLAttributeEvaluator.java
=> struts2/tiles/DisabledOgnlAttributeEvaluator.java} (60%)
copy
core/src/main/java/org/apache/struts2/dispatcher/ComponentCacheDestroyable.java
=> plugins/tiles/src/main/java/org/apache/struts2/tiles/TilesConstants.java
(66%)
copy
plugins/{junit/src/test/java/org/apache/struts2/junit/StrutsJUnit4TestCaseTest.java
=>
tiles/src/test/java/org/apache/struts2/tiles/DisabledOgnlAttributeEvaluatorTest.java}
(51%)
copy
plugins/tiles/src/test/java/org/apache/struts2/tiles/{TilesTestActionMultipleAnnotations.java
=> StrutsTilesListenerTest.java} (71%)
create mode 100644
plugins/tiles/src/test/java/org/apache/struts2/tiles/TilesOgnlEvaluatorIntegrationTest.java
copy apps/showcase/src/main/resources/struts-tags.xml =>
plugins/tiles/src/test/resources/org/apache/struts2/tiles/struts-tiles-legacy.xml
(81%)
copy plugins/xslt/src/test/resources/{XSLTResultTest.xsl =>
XSLTResultTestDedup.xsl} (97%)
copy plugins/xslt/src/test/resources/{XSLTResultTest.xsl =>
XSLTResultTestNoCachePollution.xsl} (97%)
