pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements. See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership. The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License. You may obtain a copy of the License at
 *
 *  http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied. See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
-->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/maven-v4_0_0.xsd">

    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts-master</artifactId>
        <version>15</version>
        <relativePath />
    </parent>

    <modelVersion>4.0.0</modelVersion>
    <artifactId>struts2-project</artifactId>
    <version>7.5.0-SNAPSHOT</version>
    <packaging>pom</packaging>
    <name>Struts 2</name>
    <url>https://struts.apache.org/</url>
    <description>Apache Struts 2</description>

    <inceptionYear>2000</inceptionYear>

    <!--
    <description>
        Apache Struts 2 is an elegant, extensible framework,
        well suited for creating moderate to large-scale Java web
        applications. The framework is designed to streamline the
        full development cycle, from building, to deploying,
        to maintaining applications over time.
    </description>
    -->

    <scm>
        <connection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</connection>
        <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</developerConnection>
        <url>https://github.com/apache/struts/</url>
        <tag>STRUTS_7_3_0</tag>
    </scm>

    <issueManagement>
        <system>JIRA</system>
        <url>https://issues.apache.org/jira/projects/WW</url>
    </issueManagement>

    <ciManagement>
        <system>Jenkins</system>
        <url>https://builds.apache.org/job/Struts/</url>
        <notifiers>
            <notifier>
                <type>mail</type>
                <configuration>
                    <address>dev@struts.apache.org</address>
                </configuration>
            </notifier>
        </notifiers>
    </ciManagement>

    <distributionManagement>
        <site>
            <id>struts-site</id>
            <name>Apache Struts</name>
            <url>https://struts.apache.org/maven/</url>
        </site>
    </distributionManagement>

    <modules>
        <module>bom</module>
        <module>parent</module>
        <module>jakarta</module>
        <module>core</module>
        <module>plugins</module>
        <module>boot</module>
        <module>apps</module>
    </modules>

    <licenses>
        <license>
            <name>The Apache Software License, Version 2.0</name>
            <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
            <distribution>repo</distribution>
            <comments />
        </license>
    </licenses>

    <organization>
        <name>Apache Software Foundation</name>
        <url>https://www.apache.org</url>
    </organization>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.build.outputTimestamp>2026-09-17T08:48:33Z</project.build.outputTimestamp>
        <maven.compiler.release>17</maven.compiler.release>

        <!-- Maven plugin -->
        <maven-javadoc-plugin.version>3.12.0</maven-javadoc-plugin.version>
        <maven-surefire-plugin.version>3.5.6</maven-surefire-plugin.version>
        <dependencycheck.version>13.0.0</dependencycheck.version>
        <owasp.skip>false</owasp.skip>

        <!-- dependency versions in alphanumeric order -->
        <asm.version>9.11.1</asm.version>
        <byte-buddy.version>1.18.16</byte-buddy.version>
        <commons-fileupload2.version>2.0.0-M5</commons-fileupload2.version>
        <freemarker.version>2.3.35</freemarker.version>
        <hibernate-validator.version>8.0.2.Final</hibernate-validator.version>
        <jackson.version>2.22.4</jackson.version>
        <jakarta-ee.version>10.0.0</jakarta-ee.version>
        <jaxb-impl.version>4.0.9</jaxb-impl.version>
        <log4j2.version>2.26.1</log4j2.version>
        <mockito.version>5.24.0</mockito.version>
        <ognl.version>3.4.17</ognl.version>
        <spring.version>6.2.19</spring.version>
        <struts-annotations.version>2.0</struts-annotations.version>
        <tomcat-embed.version>10.1.59</tomcat-embed.version>
        <velocity-tools.version>3.1</velocity-tools.version>
        <webjars-bootstrap.version>5.3.8</webjars-bootstrap.version>
        <webjars-bootstrap-icons.version>1.13.2</webjars-bootstrap-icons.version>
        <webjars-jquery.version>4.0.0</webjars-jquery.version>
        <webjars-jquery-showcase.version>4.0.0</webjars-jquery-showcase.version>
        <webjars-locator-lite.version>1.1.5</webjars-locator-lite.version>
        <weld.version>6.0.4.Final</weld.version>

        <!-- Site generation -->
        <fluido-skin.version>2.1.0</fluido-skin.version>

        <!-- Sonar -->
        <sonar.organization>apache</sonar.organization>
        <sonar.projectKey>apache_struts</sonar.projectKey>
        <sonar.moduleKey>${project.artifactId}</sonar.moduleKey>
        <sonar.host.url>https://sonarcloud.io</sonar.host.url>

        <argLine>-Duser.language=en -Duser.country=US -Duser.region=US</argLine>
    </properties>

    <profiles>
        <profile>
            <id>includeAssembly</id>
            <activation>
                <property>
                    <name>!skipAssembly</name>
                </property>
            </activation>
            <modules>
                <module>assembly</module>
            </modules>
        </profile>
        <profile>
            <id>jakartaee11</id>
            <properties>
                <jakarta-ee.version>11.0.0</jakarta-ee.version>
                <spring.version>7.0.9</spring.version>
                <tomcat-embed.version>11.0.27</tomcat-embed.version>
            </properties>
        </profile>
        <profile>
            <id>dependency-check</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.owasp</groupId>
                        <artifactId>dependency-check-maven</artifactId>
                        <version>${dependencycheck.version}</version>
                        <executions>
                            <execution>
                                <phase>initialize</phase>
                                <goals>
                                    <goal>check</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <id>dependency-update-only</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.owasp</groupId>
                        <artifactId>dependency-check-maven</artifactId>
                        <version>${dependencycheck.version}</version>
                        <executions>
                            <execution>
                                <goals>
                                    <goal>update-only</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
        <!-- -DNIST_NVD_API_KEY=${yourkey} so that owasp runs via api -->
        <id>owasp-nvd-api</id>
        <activation>
            <property>
                <name>NIST_NVD_API_KEY</name>
            </property>
        </activation>
        <build>
            <plugins>
                <plugin>
                    <groupId>org.owasp</groupId>
                    <artifactId>dependency-check-maven</artifactId>
                    <version>${dependencycheck.version}</version>
                    <configuration>
                        <suppressionFiles>owasp-suppressions.xml</suppressionFiles>
                        <failBuildOnCVSS>0</failBuildOnCVSS>
                        <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
                        <nvdApiKey>${NIST_NVD_API_KEY}</nvdApiKey>
                        <skip>${owasp.skip}</skip>
                    </configuration>
                </plugin>
            </plugins>
        </build>
    </profile>

        <profile>
            <!-- -Powasp-nvd-mirror so that owasp runs via mirror -->
            <id>owasp-nvd-mirror</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.owasp</groupId>
                        <artifactId>dependency-check-maven</artifactId>
                        <version>${dependencycheck.version}</version>
                        <configuration>
                            <suppressionFiles>owasp-suppressions.xml</suppressionFiles>
                            <failBuildOnCVSS>0</failBuildOnCVSS>
                            <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
                            <nvdDatafeedUrl>https://dependency-check.github.io/DependencyCheck_Builder/nvd_cache/nvdcve-{0}.json.gz</nvdDatafeedUrl>
                            <skip>${owasp.skip}</skip>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <id>coverage</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.jacoco</groupId>
                        <artifactId>jacoco-maven-plugin</artifactId>
                        <version>0.8.16</version>
                        <executions>
                            <execution>
                                <id>prepare-agent</id>
                                <goals>
                                    <goal>prepare-agent</goal>
                                    <goal>prepare-agent-integration</goal>
                                </goals>
                            </execution>
                            <execution>
                                <id>report</id>
                                <goals>
                                    <goal>report</goal>
                                    <goal>report-integration</goal>
                                </goals>
                                <configuration>
                                    <formats>
                                        <format>XML</format>
                                    </formats>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-project-info-reports-plugin</artifactId>
                    <version>3.9.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>${maven-surefire-plugin.version}</version>
                    <dependencies>
                        <dependency>
                            <groupId>org.apache.maven.surefire</groupId>
                            <artifactId>surefire-junit47</artifactId>
                            <version>${maven-surefire-plugin.version}</version>
                        </dependency>
                    </dependencies>
                    <configuration>
                        <argLine>
                            --add-opens java.base/java.lang=ALL-UNNAMED
                            --add-opens java.base/java.util=ALL-UNNAMED
                            @{argLine}
                        </argLine>
                        <includes>
                            <include>**/*Test.java</include>
                        </includes>
                        <excludes>
                            <exclude>**/TestBean.java</exclude>
                        </excludes>
                        <properties>
                            <property>
                                <name>junit</name>
                                <value>false</value>
                            </property>
                        </properties>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-war-plugin</artifactId>
                    <version>3.5.1</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.felix</groupId>
                    <artifactId>maven-bundle-plugin</artifactId>
                    <version>6.2.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-dependency-plugin</artifactId>
                    <version>3.11.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-source-plugin</artifactId>
                    <version>3.4.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-javadoc-plugin</artifactId>
                    <version>${maven-javadoc-plugin.version}</version>
                    <configuration>
                        <doclint>none</doclint>
                        <failOnError>false</failOnError>
                        <excludePackageNames>
                            org.apache.struts2.views.jasperreports:org.apache.tiles.request.velocity.*:org.demo.rest.example:org.apache.struts.beanvalidation.*
                        </excludePackageNames>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.rat</groupId>
                    <artifactId>apache-rat-plugin</artifactId>
                    <version>0.18</version>
                    <configuration>
                        <inputExcludeStds>ALL</inputExcludeStds>
                        <inputExcludes>
                            <exclude>CLAUDE.md</exclude>
                            <exclude>CODEOWNERS</exclude>
                            <exclude>SECURITY.md</exclude>
                            <exclude>AGENTS.md</exclude>
                            <exclude>**/README.md</exclude>
                            <exclude>docs/**/*.md</exclude>
                            <exclude>src/main/resources/*-LICENSE.txt</exclude>
                            <exclude>src/site/resources/tags/**/*.html</exclude>
                            <exclude>src/test/resources/**/*.txt</exclude>
                            <exclude>src/main/resources/org/apache/struts2/static/domTT.js</exclude>
                            <exclude>src/main/webapp/**/*.css</exclude>
                            <exclude>src/main/webapp/**/*.map</exclude>
                            <exclude>src/main/webapp/**/*.js</exclude>
                            <exclude>src/main/webapp/**/*.svg</exclude>
                            <exclude>src/main/webapp/**/*.txt</exclude>
                            <exclude>**/src/main/resources/**/docs-urls.txt</exclude>
                            <exclude>src/etc/header.txt</exclude>
                            <exclude>src/main/resources/static/css/**/*.css</exclude>
                            <exclude>src/main/resources/static/js/**/*.js</exclude>
                            <exclude>**/src/main/resources/docs.cfg</exclude>
                            <exclude>src/main/webapp/fonts/**/*</exclude>
                            <exclude>thoughts/**/*.md</exclude>
                            <exclude>test-output/**</exclude>
                        </inputExcludes>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.owasp</groupId>
                    <artifactId>dependency-check-maven</artifactId>
                    <version>13.0.0</version>
                    <configuration>
                        <suppressionFiles>
                            <suppressionFile>src/etc/project-suppression.xml</suppressionFile>
                        </suppressionFiles>
                        <failBuildOnCVSS>7</failBuildOnCVSS>
                        <skipProvidedScope>true</skipProvidedScope>
                        <skipRuntimeScope>true</skipRuntimeScope>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-assembly-plugin</artifactId>
                    <configuration>
                        <skipAssembly>true</skipAssembly>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-enforcer-plugin</artifactId>
                    <version>3.6.3</version>
                    <executions>
                        <execution>
                            <id>enforce</id>
                            <configuration>
                                <rules>
                                    <bannedDependencies>
                                        <message>commons-fileupload2 version skew detected: only ${commons-fileupload2.version} is allowed. Align all commons-fileupload2 artifacts (core and jakarta-servlet6) to the version defined by the commons-fileupload2.version property in the root POM.</message>
                                        <excludes>
                                            <exclude>org.apache.commons:commons-fileupload2-core</exclude>
                                            <exclude>org.apache.commons:commons-fileupload2-jakarta-servlet6</exclude>
                                        </excludes>
                                        <includes>
                                            <include>org.apache.commons:commons-fileupload2-core:${commons-fileupload2.version}</include>
                                            <include>org.apache.commons:commons-fileupload2-jakarta-servlet6:${commons-fileupload2.version}</include>
                                        </includes>
                                    </bannedDependencies>
                                </rules>
                            </configuration>
                            <goals>
                                <goal>enforce</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-wrapper-plugin</artifactId>
                    <version>3.3.4</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-site-plugin</artifactId>
                    <version>3.22.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-deploy-plugin</artifactId>
                    <!--
                      Releasing pushes a large number of artifacts to Nexus and a single dropped
                      connection fails the whole deploy. Configured here rather than passed on
                      the command line: release:perform forks a new Maven build, which does not
                      inherit -D properties from the outer invocation.
                    -->
                    <configuration>
                        <retryFailedDeploymentCount>10</retryFailedDeploymentCount>
                    </configuration>
                </plugin>
            </plugins>
        </pluginManagement>

        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-release-plugin</artifactId>
                <version>3.3.1</version>
                <configuration>
                    <!--
                      Every module shares the project version, so the release plugin should
                      version them automatically instead of prompting once per module.

                      The SCM tag is still entered at the prompt: our tags are STRUTS_X_Y_Z and
                      tagNameFormat can only interpolate @{project.version}, which would give
                      STRUTS_7.3.0.

                      useReleaseProfile, goals and releaseProfiles are inherited from the ASF
                      parent pom and are intentionally not repeated here.
                    -->
                    <autoVersionSubmodules>true</autoVersionSubmodules>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
            </plugin>
            <plugin>
                <artifactId>maven-jar-plugin</artifactId>
                <configuration>
                    <archive>
                        <manifestFile>${project.build.outputDirectory}/META-INF/MANIFEST.MF</manifestFile>
                    </archive>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.felix</groupId>
                <artifactId>maven-bundle-plugin</artifactId>
                <executions>
                    <execution>
                        <id>bundle-manifest</id>
                        <phase>process-classes</phase>
                        <goals>
                            <goal>manifest</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <artifactId>maven-site-plugin</artifactId>
                <configuration>
                    <relativizeSiteLinks>false</relativizeSiteLinks>
                    <pomPackagingOnly>false</pomPackagingOnly>
                </configuration>
                <executions>
                    <execution>
                        <id>site-inheritance</id>
                        <goals>
                            <goal>attach-descriptor</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>stage-for-scm-publish</id>
                        <phase>post-site</phase>
                        <goals>
                            <goal>stage</goal>
                        </goals>
                        <configuration>
                            <skipDeploy>false</skipDeploy>
                        </configuration>
                        <inherited>false</inherited>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.rat</groupId>
                <artifactId>apache-rat-plugin</artifactId>
                <executions>
                    <execution>
                        <phase>prepare-package</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>

        <defaultGoal>install</defaultGoal>

    </build>

    <reporting>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-project-info-reports-plugin</artifactId>
                <configuration>
                    <dependencyDetailsEnabled>false</dependencyDetailsEnabled>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <reportSets>
                    <reportSet>
                        <id>aggregate</id>
                        <inherited>false</inherited>
                        <reports>
                            <report>aggregate</report>
                        </reports>
                    </reportSet>
                    <reportSet>
                        <id>default</id>
                        <reports>
                            <report>javadoc</report>
                        </reports>
                    </reportSet>
                </reportSets>
            </plugin>
            <plugin>
                <groupId>org.apache.rat</groupId>
                <artifactId>apache-rat-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.owasp</groupId>
                <artifactId>dependency-check-maven</artifactId>
                <configuration>
                    <name>Dependency Check</name>
                    <failBuildOnCVSS>11</failBuildOnCVSS>
                </configuration>
                <reportSets>
                    <reportSet>
                        <reports>
                            <report>aggregate</report>
                        </reports>
                    </reportSet>
                </reportSets>
            </plugin>
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>versions-maven-plugin</artifactId>
                <version>2.23.0</version>
                <reportSets>
                    <reportSet>
                        <reports>
                            <report>dependency-updates-report</report>
                            <report>plugin-updates-report</report>
                            <report>property-updates-report</report>
                        </reports>
                    </reportSet>
                </reportSets>
            </plugin>
        </plugins>
    </reporting>

</project>