Lukasz Lenart created WW-5721:
---------------------------------
Summary: Default Spring Framework line 6.2.x is out of OSS support
- move the default spring.version to 7.x
Key: WW-5721
URL: https://issues.apache.org/jira/browse/WW-5721
Project: Struts 2
Issue Type: Dependency
Reporter: Lukasz Lenart
Fix For: 8.0.0
The default profile on {{main}} pins {{spring.version}} = {{6.2.19}}. That is
the last open-source 6.2.x release: Spring's 2026-08-20 advisory wave
(CVE-2026-47883..47893, CVE-2026-59280..59283, CVE-2026-59313, CVE-2026-59314)
lists the fix for the 6.2 line as {{6.2.20}}, which is Enterprise-Support-only
and is not published to Maven Central. The 6.2 line will not receive further
OSS releases, so every future Spring CVE affecting 6.2.x stays open against the
default build forever.
WW-5717 bumped only the {{jakartaee11}} profile (7.0.8 -> 7.0.9), which is the
profile the OWASP workflow scans; the default profile was deliberately left
unsuppressed so the problem stays visible.
h3. What needs deciding
* Spring Framework 7.x has a Jakarta EE 11 baseline. Making it the default
{{spring.version}} means the Spring plugin (and anything else with
compile-scope Spring: {{rest}}, {{junit}}, {{testng}}) moves to that baseline,
so this is really "what is the Struts 8 servlet/Jakarta EE floor?" - the same
question the {{jakartaee11}} profile from WW-5533 postponed.
* If the floor stays at Jakarta EE 10 for 7.x, the default profile keeps
shipping an EOL Spring line and the OWASP suppression file would need a
permanent, ever-growing {{org.springframework/*@6.2.*}} entry.
h3. Related
* WW-5717 - the OWASP finding that surfaced this
* WW-5533 - added the {{jakartaee11}} profile (7.1.1)
* The same situation exists on {{support/struts-6-x-x}}
({{spring.platformVersion}} = {{5.3.39}}, last OSS 5.3.x; {{5.3.50}} is
ES-only), but 6.x has no OWASP workflow and is not in scope here.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
