[
https://issues.apache.org/jira/browse/WW-5653?focusedWorklogId=1031020&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1031020
]
ASF GitHub Bot logged work on WW-5653:
--------------------------------------
Author: ASF GitHub Bot
Created on: 18/Jul/26 06:13
Start Date: 18/Jul/26 06:13
Worklog Time Spent: 10m
Work Description: lukaszlenart opened a new pull request, #1793:
URL: https://github.com/apache/struts/pull/1793
Fixes [WW-5653](https://issues.apache.org/jira/browse/WW-5653)
Migrates both sample apps — `apps/showcase` and `apps/rest-showcase` — off
the vendored **Bootstrap 3.3.4** assets onto **Bootstrap 5.3.7**, served via
the framework's own `<s:webjar>` support. This is a **minimal port**: pages
keep their structure and look; only what Bootstrap 5 breaks was changed. Zero
vendored Bootstrap 3 assets and zero Bootstrap 3 markup remain.
Design + plan:
`docs/superpowers/specs/2026-07-17-WW-5653-bootstrap5-migration-design.md`,
`docs/superpowers/plans/2026-07-17-WW-5653-bootstrap5-migration.md`.
## What changed
**Asset delivery (WebJars)**
- Added `org.webjars:bootstrap:5.3.7` and
`org.webjars.npm:bootstrap-icons:1.13.1` (managed in `parent/pom.xml`, version
props in root `pom.xml`); both apps depend on them.
- Deleted all vendored Bootstrap/jQuery static files; references now use
`<s:webjar>` (`bootstrap/css/bootstrap.min.css`,
`bootstrap/js/bootstrap.bundle.min.js`,
`bootstrap-icons/font/bootstrap-icons.min.css`, `jquery/jquery.min.js`).
- WebJar allowlist configured per app (`struts.webjars.allowlist`).
**jQuery isolation (note for reviewers)**
- The showcase keeps jQuery (2 direct usages: prettyPrint + an AJAX demo),
pinned to **3.7.1** via a dedicated `webjars-jquery-showcase.version` property.
The shared `webjars-jquery.version` (now `4.0.0`, core **test scope**) is
intentionally **not** reused, so a future bump of the shared property won't
drag the showcase to jQuery 4. Bootstrap 5 itself needs no jQuery.
**Markup migration (BS3/BS2 → BS5)**
- Icons: `glyphicon-*` (and old BS2 `icon-*`) → Bootstrap Icons `bi bi-*`.
- `panel*`→`card*`, `btn-default`→`btn-secondary`, `btn-large`→`btn-lg`,
`well`→`bg-light border rounded p-3`, `pull-*`→`float-*`/`ms-auto`,
`table-condensed`→`table-sm`, `col-xs-*`→`col-*`, BS2 `spanN`→`col-N`,
`col-sm-offset-2`→`offset-sm-2`, `data-*`→`data-bs-*`,
`page-header`/`hero-unit` replaced, carets removed.
- Navbar rewritten to BS5 (`navbar-expand-lg`, toggler + `collapse`,
`dropdown-toggle`/`dropdown-menu`/`dropdown-item`).
- rest-showcase horizontal forms → BS5 (`row mb-3` + `col-form-label`);
fixed a pre-existing malformed `</apan>` tag.
## Runtime verification (manual, both apps under `mvn jetty:run`)
- **showcase**: home + fileupload + wait + tag-demo pages return 200; **all
webjar assets serve 200** (Bootstrap CSS/JS bundle, Bootstrap Icons CSS, jQuery
3.7.1); remaining webapp assets (prettify.js, main.css) still serve.
- **rest-showcase**: order pages render; Bootstrap + Bootstrap Icons CSS
serve 200; `bi` icons render; no glyphicons in output.
- Core webjar tests: 18/18 pass (jQuery 4.0.0 test-scope unaffected).
### Dogfooding find (already fixed here)
Serving the showcase via `<s:webjar>` surfaced a real bug in the showcase's
own config: `struts.action.excludePattern` still whitelisted the old vendored
layout (`.*/styles/.*\.css`, `.*/js/.*\.js`). The `.*/js/.*\.js` entry matched
the webjar JS path
(`/static/webjars/bootstrap/5.3.7/js/bootstrap.bundle.min.js`), so
`StrutsExecuteFilter` excluded it from the static handler and it fell through
to the container and 404'd (silently — no Struts logs). The CSS worked only
because its webjar path is under `/css/`, not `/styles/`. Fixed by dropping the
obsolete `/styles/` and `/js/` exclude entries. **No core/framework code was
changed** — this is showcase config only.
## Draft — remaining follow-up nits (non-blocking)
- Leftover harmless BS3 `navbar-header` wrapper div in `decorators/main.jsp`
(no BS5 CSS behind it).
- `page-header` replacement is `border-bottom pb-2 mb-3` on most pages vs a
bare `<div>` on a few — both valid, slightly inconsistent.
- `navbar-light` is soft-deprecated in BS 5.3 (works fine in 5.3.7;
`data-bs-theme` is the newer idiom).
- Pre-existing orphan `dropdown-submenu`/unclosed `<li>` in the navbar
Examples menu (not introduced here).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Issue Time Tracking
-------------------
Worklog Id: (was: 1031020)
Remaining Estimate: 0h
Time Spent: 10m
> Upgrade bundled Bootstrap in sample apps from 3.3.4 to 5.3.x
> ------------------------------------------------------------
>
> Key: WW-5653
> URL: https://issues.apache.org/jira/browse/WW-5653
> Project: Struts 2
> Issue Type: Improvement
> Components: Example Applications
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 7.3.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> h2. Summary
> Upgrade the bundled Bootstrap in the sample applications from the current
> *3.3.4* to the latest *5.3.x* release. Bootstrap 3.3.4 (released 2015) is
> long out of support, ships known-vulnerable assets, and predates the removal
> of the jQuery dependency in Bootstrap 5.
> h2. Current State
> * {{apps/showcase}} bundles static Bootstrap 3.3.4 assets:
> ** {{src/main/webapp/styles/bootstrap*.css}} (+ {{bootstrap-theme}})
> ** {{src/main/webapp/js/bootstrap.min.js}}
> * {{apps/rest-showcase}} bundles the same static Bootstrap 3.3.4 CSS under
> {{src/main/webapp/css/}}.
> * Assets are checked into the repo and loaded via {{<s:link>}} /
> {{<s:script>}} in the decorators (e.g.
> {{apps/showcase/src/main/webapp/WEB-INF/decorators/main.jsp}}).
> * Roughly *78 JSP files* in {{apps/showcase}} depend on Bootstrap 3 markup
> (glyphicons, {{panel-*}}, {{navbar-*}}, {{col-xs-*}}, {{btn-*}} conventions).
> h2. Motivation
> * Bootstrap 3.3.4 is unsupported and carries known XSS advisories fixed in
> later releases.
> * Bootstrap 5 *removes the jQuery dependency entirely*, which unblocks and
> simplifies the separate effort to migrate the sample apps to the framework's
> {{<s:webjar>}} support.
> * Keeps the showcase — the framework's public demo app — on a current,
> maintained UI toolkit.
> h2. Scope of Work
> # Replace bundled Bootstrap 3.3.4 assets with Bootstrap 5.3.x in
> {{apps/showcase}} and {{apps/rest-showcase}}.
> # Migrate Bootstrap 3 markup to Bootstrap 5 across all affected JSPs:
> #* {{glyphicon}} icons are removed in BS4+ — replace with an alternative
> (e.g. Bootstrap Icons, or inline SVG).
> #* {{panel-*}} → {{card-*}}.
> #* {{navbar}} markup and toggle behavior rewritten in BS5.
> #* Grid changes ({{col-xs-*}} removed, {{col-*}} breakpoints reworked).
> #* {{data-*}} JS hooks now namespaced as {{data-bs-*}}.
> # Update the decorators to drop the jQuery {{<s:script>}} include where it
> existed only to satisfy Bootstrap (Bootstrap 5 needs no jQuery). Retain
> jQuery only where the sample pages use it directly.
> # Verify all showcase pages render and interactive components (dropdowns,
> modals, collapses, tooltips) work in a real browser.
> h2. Risks / Notes
> * This is a *breaking UI migration*, not a version bump — BS3 → BS5 has no
> drop-in compatibility path. Expect changes in most showcase JSPs.
> * Coordinate with the "migrate showcase to {{<s:webjar>}} support" effort —
> dropping jQuery here changes that ticket's calculus.
> * Consider whether Bootstrap assets should be pulled via WebJars as part of
> this work rather than re-bundling static files.
> h2. Acceptance Criteria
> * No Bootstrap 3.x assets remain in {{apps/showcase}} or
> {{apps/rest-showcase}}.
> * All showcase and rest-showcase pages render correctly with Bootstrap 5.3.x.
> * Interactive Bootstrap components function without jQuery.
> * Build passes ({{mvn clean install -DskipAssembly}}) and the apps deploy and
> run.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
