lukaszlenart opened a new pull request, #1735: URL: https://github.com/apache/struts/pull/1735
## Summary Hardens Struts against [Apache Commons FileUpload](https://commons.apache.org/proper/commons-fileupload/) milestone (`-M`) binary-incompatibility. [WW-5615](https://issues.apache.org/jira/browse/WW-5615) (#1584) fixed the reported `NoSuchMethodError` symptom for 7.2.0 by adapting to the renamed M5 setters; this PR closes the underlying *class of failure* it left open. - **Manage both artifacts (A1)** — introduce a single `commons-fileupload2.version` property and manage *both* `commons-fileupload2-core` and `commons-fileupload2-jakarta-servlet6` at it in `parent/pom.xml`. The volatile setters (`setMaxSize`/`setMaxFileCount`/`setMaxFileSize`) live in `-core`, which was previously **unmanaged** — so a transitive dep could pull a mismatched `-core` milestone and reproduce the crash even with `-jakarta-servlet6` pinned. - **Activate a scoped enforcer (A2)** — the `maven-enforcer-plugin` rule was configured only in `<pluginManagement>` and never actually ran. Bind it into the active build with a fileupload-scoped `bannedDependencies` rule (single source of truth via the property, actionable `<message>`), so any divergent commons-fileupload2 version fails the build early. - **Runtime guard (B)** — a once-per-JVM reflective check in `AbstractMultiPartRequest` throws a clear `StrutsException` reporting the `-core`/`-jakarta-servlet6` version skew instead of an opaque deep-stack `NoSuchMethodError`. This is the only protection that reaches downstream consumer runtimes the build-time enforcer can't. Fixes [WW-5632](https://issues.apache.org/jira/browse/WW-5632) ## Test Plan - [x] `mvn test -DskipAssembly -pl core` — BUILD SUCCESS, 2957 tests, 0 failures - [x] New unit tests `AbstractMultiPartRequestApiCheckTest` (compatible class passes; incompatible stub throws `StrutsException` with actionable message) - [x] Enforcer verified: passes on aligned tree; fails with the custom skew message when `-core` is forced to a different milestone - [x] `jakartaee11` profile unaffected (it does not override `commons-fileupload2.version`) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
