lukaszlenart opened a new pull request, #1926: URL: https://github.com/apache/struts/pull/1926
Fixes [WW-5735](https://issues.apache.org/jira/browse/WW-5735) ## What `struts2-jasperreports7-plugin` declared `net.sf.jasperreports:jasperreports` at compile scope, so the assembly's runtime dependency set has shipped `jasperreports-7.0.7.jar` in `struts-*-lib.zip` and `struts-*-all.zip` since 7.1.0 (verified in `struts-7.3.0-lib.zip`: `struts-7.3.0/lib/jasperreports-7.0.7.jar`), and every Maven consumer of the plugin pulled it transitively. JasperReports is LGPL, which may not be included in an Apache product. The 6.x plugin has always declared the same dependency as `provided` for exactly this reason. The dependency is now `provided`, matching the 6.x plugin. `jasperreports-pdf` was already `optional` and never propagated. Before / after, from `mvn -pl assembly dependency:list -DincludeScope=runtime`: ``` - net.sf.jasperreports:jasperreports:jar:7.0.7:compile ``` The plugin's own build and tests are unaffected (`provided` stays on the compile and test classpaths; the embedded-Tomcat test from WW-5734 still passes). The second commit drops the OWASP suppression for `jasperreports-*.jar` / CVE-2025-10492: the `dependency-check` profile skips provided scope, so the entry no longer matches anything. ## Migration note (for the Version Notes / Migration Guide) Applications using the jasperreports7 plugin must declare `net.sf.jasperreports:jasperreports` (and `jasperreports-pdf` for PDF output) themselves, as they already do with the 6.x plugin. The plugin page being added in WW-5728 should state this. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
