[
https://issues.apache.org/jira/browse/WW-5721?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5721:
------------------------------
Component/s: Build Management
Plugin - Spring
> Default Spring Framework line 6.2.x is out of OSS support - move the default
> spring.version to 7.x
> --------------------------------------------------------------------------------------------------
>
> Key: WW-5721
> URL: https://issues.apache.org/jira/browse/WW-5721
> Project: Struts 2
> Issue Type: Dependency
> Components: Build Management, Plugin - Spring
> Reporter: Lukasz Lenart
> Priority: Major
> Fix For: 8.0.0
>
>
> The default profile on {{main}} pins {{spring.version}} = {{6.2.19}}. That is
> the last open-source 6.2.x release: Spring's 2026-08-20 advisory wave
> (CVE-2026-47883..47893, CVE-2026-59280..59283, CVE-2026-59313,
> CVE-2026-59314) lists the fix for the 6.2 line as {{6.2.20}}, which is
> Enterprise-Support-only and is not published to Maven Central. The 6.2 line
> will not receive further OSS releases, so every future Spring CVE affecting
> 6.2.x stays open against the default build forever.
> WW-5717 bumped only the {{jakartaee11}} profile (7.0.8 -> 7.0.9), which is
> the profile the OWASP workflow scans; the default profile was deliberately
> left unsuppressed so the problem stays visible.
> h3. What needs deciding
> * Spring Framework 7.x has a Jakarta EE 11 baseline. Making it the default
> {{spring.version}} means the Spring plugin (and anything else with
> compile-scope Spring: {{rest}}, {{junit}}, {{testng}}) moves to that
> baseline, so this is really "what is the Struts 8 servlet/Jakarta EE floor?"
> - the same question the {{jakartaee11}} profile from WW-5533 postponed.
> * If the floor stays at Jakarta EE 10 for 7.x, the default profile keeps
> shipping an EOL Spring line and the OWASP suppression file would need a
> permanent, ever-growing {{org.springframework/*@6.2.*}} entry.
> h3. Related
> * WW-5717 - the OWASP finding that surfaced this
> * WW-5533 - added the {{jakartaee11}} profile (7.1.1)
> * The same situation exists on {{support/struts-6-x-x}}
> ({{spring.platformVersion}} = {{5.3.39}}, last OSS 5.3.x; {{5.3.50}} is
> ES-only), but 6.x has no OWASP workflow and is not in scope here.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
