lukaszlenart opened a new pull request, #544: URL: https://github.com/apache/struts-examples/pull/544
Modernizes all 47 example applications to the current Apache Struts 7.3.0 standard. ## What changed | Area | Scope | |---|---| | Struts version | `7.2.1` → `7.3.0` (parent POM, plus `sitemesh3`'s own override) | | Struts config DTDs | 54 files → `struts-6.5.dtd` over `https` | | Validator DTDs | 13 files → `xwork-validator-1.0.3.dtd` over `https` | | Tiles DTDs | 7 files → `tiles-config_3_0.dtd` (`unknown-handler` was on 2.0) | | Maven POM schema | 48 POMs → `https://maven.apache.org/xsd/maven-4.0.0.xsd` | | `web.xml` | 29 descriptors migrated to Jakarta EE 6.0; all 47 now current | | `@StrutsParameter` | 17 annotations across 7 modules | | Naming | "Struts 2" → "Apache Struts" in POM/README prose | ## The part worth reviewing carefully `struts.parameters.requireAnnotations` has defaulted to `true` since before 7.2.1, so any action missing `@StrutsParameter` was **already silently dropping every submitted parameter**. This branch fixes seven such modules: - `crud` — `getPerson()` needed `depth = 2` (`person.country.countryId`) - `shiro-basic` — `LoginAction.username/password`, `WelcomeAction.username` - `unknown-handler` — `Login.email/password` - `validation-messages` — `Login.username/password` - `bean-validation`, `themes-override` — `getPersonBean()` needed `depth = 1` - `mailreader2` — `MailreaderSupport`: 5 setters + `getUser()`/`getSubscription()` `bean-validation` was the most misleading of these: with parameters dropped it validated an empty bean, so the demo appeared to work while showing violations unrelated to what the user typed. Annotations follow what `ParametersInterceptor` actually inspects — depth 0 on the setter, depth ≥ 1 on the getter — and nested POJOs are deliberately left unannotated, since only the action's root property is authorized. ## Verification - `mvn clean test` green on **JDK 17 and 21** (matching CI) - `xmllint` clean across all XML - Jetty runtime checks confirming nested parameter binding works in `crud` and still works in the untouched control `form-tags` - `dependency-check` reports 5 CVSS ≥ 7 findings; all are **pre-existing** — re-running the profile pinned to 7.2.1 reproduces them identically, so the bump introduces none. Left unsuppressed deliberately: suppression is a maintainer's judgment. (The `struts2-tiles-plugin` hit looks like a CPE false positive — the plugin has no `org.apache.tiles` dependency.) ## Known follow-ups (not addressed here) - **`Arrays.asList(getCarModels())` NPEs on the default happy path** in `form-tags`, `control-tags`, `bean-validation`, and `crud` — submit the form without ticking a car model. Pre-existing; worth its own issue. - The rename covers metadata only; **~104 "Struts 2" strings remain in the JSPs**, so page titles a learner sees still say "Struts 2". - `interceptors/pom.xml` describes itself as a form-XML-validation example (pre-existing copy-paste). - `basic-struts/README.md` intentionally still quotes `Welcome To Struts 2!` because `index.jsp` renders exactly that — documentation accuracy over branding consistency. Design and implementation notes are committed under `docs/superpowers/`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
