)]}' { "log": [ { "commit": "65f9784eba12f308581b337ed8e589ec51f277a6", "tree": "84d014e1ba789c40ec0a09c50f72504e69424927", "parents": [ "9a13f550c2f41abd5c768647a2509356915537c0" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 24 10:23:53 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 12:08:03 2026 +0200" }, "message": "WW-5792 fix(config): warn instead of silently skipping non-public action classes\n\nverifyAction threw \"is not public\" inside the try whose RuntimeException\nhandler swallowed it, so a non-public action class only produced a\nmisleading INFO line. It now logs a WARN naming the class and location\nand skips the constructor check, so startup behaves as before.\nFailing startup is tracked in WW-5809 for 8.0.0.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "9a13f550c2f41abd5c768647a2509356915537c0", "tree": "22e5eb214ff7ef1bb0c263b4e4625f17509eefd5", "parents": [ "1986ef59ed87970faffa27abb22c54db88fe16f5" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 24 09:37:21 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 09:52:36 2026 +0200" }, "message": "WW-5791 fix(boot): keep the base directory private and close on every start failure\n\nThe filter and Tomcat are created before the base directory, so nothing\ncan fail between creating the directory and the guarded start block. On\nfile systems without POSIX permissions the base directory is restricted\nto its owner after creation.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "1986ef59ed87970faffa27abb22c54db88fe16f5", "tree": "8a3bd1b2c501944b082a8a268147599aa8d5c05c", "parents": [ "faf00ebfb0f816636ae9c17ace1b5df32d27a8e4" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 15:30:57 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 09:52:36 2026 +0200" }, "message": "WW-5791 fix(boot): address Sonar findings in the starter\n\nThe Tomcat base directory is created owner-only (rwx------) where the\nfile system supports POSIX permissions, and the shutdown hook is\nregistered inside the guarded start block so a failure there still\ncloses the server. Settings keys get a _KEY suffix, the empty\nregister() says why it is empty, and test lambdas keep a single\nthrowing call.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "faf00ebfb0f816636ae9c17ace1b5df32d27a8e4", "tree": "c4efd382e2ef58a75d7262befeca8eb74194d7d3", "parents": [ "7574d9b31a84db4f93b9eac9c593f45aa6ecadd5" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 13:41:35 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 09:52:36 2026 +0200" }, "message": "WW-5791 docs: add Struts Boot to the threat model\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "7574d9b31a84db4f93b9eac9c593f45aa6ecadd5", "tree": "1a84b4d3776c36397a656f1081b71040255e5909", "parents": [ "6af507b421989b36b13a7475f73357e2e385b6ff" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 13:16:25 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 09:52:36 2026 +0200" }, "message": "WW-5791 docs: document bind address, logging and packaging in boot-hello\n\nREADME: struts.boot.address, error pages, the jar name, BOM usage, a\nlogging backend note, and non-Spring packaging alternatives. Spec: fix\nthe .method(name) row and state that registry config is never broader\nthan the equivalent struts.xml.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "6af507b421989b36b13a7475f73357e2e385b6ff", "tree": "97c12c1cb7966f728f7007ee62c427a9bc134801", "parents": [ "4187e7dfb6d5446c4a3ca3c9e1178d71fb90ca18" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 13:16:24 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 09:52:36 2026 +0200" }, "message": "WW-5791 fix(boot): skip deploying boot-hello and mark its jar Multi-Release\n\nThe shaded example jar merges dependency LICENSE/NOTICE files, so it is\nnot deployed. The manifest declares Multi-Release because log4j-api and\nTomcat are multi-release jars. The redundant version is inherited.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "4187e7dfb6d5446c4a3ca3c9e1178d71fb90ca18", "tree": "6e98ca2002b3e59aa4636b9da56fc8c2aa59fc55", "parents": [ "d3f444d8e53198e2c597a2b595b1ac1be243b6a4" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 13:16:24 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 09:52:36 2026 +0200" }, "message": "WW-5791 fix(boot): verify action classes and registry arguments at startup\n\nMirror XmlDocConfigurationProvider#verifyAction: a non-public action\nclass or one without a public no-arg constructor fails startup. A null\naction class or an empty redirectAction target is rejected with a\nConfigurationException.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "d3f444d8e53198e2c597a2b595b1ac1be243b6a4", "tree": "9eb7a1f403198dfda0933b04c15c368d40f16ef9", "parents": [ "f5a440942fb665f0971056262b3aa4d1acff4bf9" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 13:16:24 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 09:52:36 2026 +0200" }, "message": "WW-5791 fix(boot): harden embedded Tomcat defaults and normalise boot settings\n\nError pages no longer carry stack traces or the Tomcat version, the\nconnector is opened as an explicit step after the Struts filter started,\nstruts.boot.address restricts the listening interface (all interfaces\nstay the default), and struts.boot.context-path is normalised.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "f5a440942fb665f0971056262b3aa4d1acff4bf9", "tree": "3f1ac630da64d730b5ce548252b578926c1c0b7a", "parents": [ "35615ff0a7f2c2a9fa21e805a28bf89e2e7007c4" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 12:59:54 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 09:52:36 2026 +0200" }, "message": "WW-5791 feat(boot): add boot-hello example app with runnable jar\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "35615ff0a7f2c2a9fa21e805a28bf89e2e7007c4", "tree": "77f3f30887e3b17b0279d7a6665bfa06860e112e", "parents": [ "68e87198b74465d785591712b01e8c7efd8aeb12" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 12:54:45 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 09:52:36 2026 +0200" }, "message": "WW-5791 fix(boot): serve an empty docBase and capture every filter init failure\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "68e87198b74465d785591712b01e8c7efd8aeb12", "tree": "af36dce28e5ab567e11b83b6936c7713f3e68295", "parents": [ "1b518f1d8fae99ae86496003dc4fd76f65ffffdb" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 12:49:33 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 09:52:36 2026 +0200" }, "message": "WW-5791 feat(boot): launch Struts on embedded Tomcat from main()\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "1b518f1d8fae99ae86496003dc4fd76f65ffffdb", "tree": "aac38e8a01e83e375e9fc4d2e1f53b293ce26ccd", "parents": [ "8916f7763515723342fe4bccefd77816d983fed8" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 12:43:08 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 09:52:36 2026 +0200" }, "message": "WW-5791 feat(boot): read port and context path from struts.properties and arguments\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "8916f7763515723342fe4bccefd77816d983fed8", "tree": "a0f8c3de6d34f67e1b28a06ee727849c4e4ee799", "parents": [ "f74c99621d744baa29b6e626d5e99d4ebb1ca570" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 12:39:55 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 09:52:36 2026 +0200" }, "message": "WW-5791 feat(boot): translate the action registry into Struts package configs\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "f74c99621d744baa29b6e626d5e99d4ebb1ca570", "tree": "af39aebe9284cfda48fa23271ddc7bed1bb98995", "parents": [ "4b81e135a54c7ead2f1018e3813e74e02797013f" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 12:36:04 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 09:52:36 2026 +0200" }, "message": "WW-5791 feat(boot): add struts2-boot-starter module with fluent action registry\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "4b81e135a54c7ead2f1018e3813e74e02797013f", "tree": "82f1717d56bab4b62f5c5680dc5ea7169b0df6b5", "parents": [ "2d9c13694cd6310d2ec2af9293be14cece9a4460" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 12:33:19 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 09:52:36 2026 +0200" }, "message": "WW-5791 docs: implementation plan for Struts Boot\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "2d9c13694cd6310d2ec2af9293be14cece9a4460", "tree": "53fe94d78c0a21340b4c8e559d6fc5c1cce4ac9c", "parents": [ "fda6ca9f24e33ffcf2ce024b901abf8545d74dae" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 12:24:55 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Sat Oct 24 09:52:36 2026 +0200" }, "message": "WW-5791 docs: design for Struts Boot\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "fda6ca9f24e33ffcf2ce024b901abf8545d74dae", "tree": "6b265a72bedbbad140f8cef06981f68c4f0aa4fb", "parents": [ "c85ec6dfafeb7a898f1098b0e561aa445787f12b" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 10:25:03 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Fri Oct 23 13:37:34 2026 +0200" }, "message": "WW-5786 test(convention): pin HTTP method enforcement on Convention actions\n\nConvention actions have no XML declaration and so no http-method\nattribute; the HttpGet/HttpPost/... annotations on the class or method\nare what HttpMethodInterceptor enforces for them. Drive four annotated\nConvention actions through the real dispatcher and assert: an allowed\nmethod executes, a disallowed one gets 405 plus Allow when nothing maps\nbad-request, and the bad-request result is used when Convention\ndiscovers a template for it or @Result declares one. Covers class-level\nand method-level annotations, the latter on an @Action-mapped method\nwhose name differs from the action name, and pins that the scanned\nActionConfigs carry no http-method set of their own.\n\nThe fixtures sit in actions.httpmethod under a package-level @Namespace,\nso their templates and bad-request lookups cannot collide with other\nfixtures in the shared root namespace. A root-level package locator\n(\"actions\") only yields a namespace for sub-packages when a dot precedes\nit, hence the explicit annotation.\n\nVerified by mutating isAllowed() to always return true: the four\nrejection tests fail, the five others stay green.\n\nCo-Authored-By: Claude Mythos 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "c85ec6dfafeb7a898f1098b0e561aa445787f12b", "tree": "a85b4fba97bfaab7995a10ac0776094b7caaf7dd", "parents": [ "eb890e27b0050dd89060899253e3e153b01030be" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 08:26:06 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Fri Oct 23 10:04:03 2026 +0200" }, "message": "WW-5790 refactor(rest): read the baseline value only when a comparison needs it\n\nCo-Authored-By: Claude Mythos 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "eb890e27b0050dd89060899253e3e153b01030be", "tree": "48741460fcb4fac2af3e8168f675e0e4c71c4e95", "parents": [ "a0e3faed6794a1fd28a0de613dc78f55699271da" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 07:42:14 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Fri Oct 23 10:04:03 2026 +0200" }, "message": "WW-5790 fix(rest): compare nested beans leaf by leaf against a same-class baseline\n\nCo-Authored-By: Claude Mythos 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a0e3faed6794a1fd28a0de613dc78f55699271da", "tree": "84dac0db2c17dc113236dd4b2020eae57dd44595", "parents": [ "462670a13824cf91be5e075f91d961aca4e9bdd1" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 07:38:09 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Fri Oct 23 10:04:03 2026 +0200" }, "message": "WW-5790 docs: implementation plan for the two-phase copy baseline\n\nCo-Authored-By: Claude Mythos 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "462670a13824cf91be5e075f91d961aca4e9bdd1", "tree": "05dd6b939e115f9388acc60be0b34d0a7b32d04a", "parents": [ "8f3b4abde5672dee11f0467fc5145fd65420a466" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 23 07:36:11 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Fri Oct 23 10:04:03 2026 +0200" }, "message": "WW-5790 fix(rest): copy only what the body handler changed in the two-phase copy\n\nCo-Authored-By: Claude Mythos 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "8f3b4abde5672dee11f0467fc5145fd65420a466", "tree": "0155cf6f2d46957500e2cd608434cba494a44775", "parents": [ "f2ea51ac3e3c723d670e1734c413d5fe5c31104c" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Thu Oct 22 21:58:35 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Fri Oct 23 07:16:00 2026 +0200" }, "message": "WW-5789 fix(rest): keep params-bound values when the body handler binds nothing\n\nSince WW-5626 (7.2.0), ContentTypeInterceptor runs a two-phase copy for every\nhandler that is not AuthorizationAwareContentTypeHandler when\nstruts.parameters.requireAnnotations\u003dtrue: a fresh instance is built with the\nno-arg constructor, the handler fills it, and every non-null property is copied\nonto the real target. FormUrlEncodedHandler, MultipartFormDataHandler and\nHtmlHandler never touch the body, so the \"fresh\" instance holds only\nconstructor defaults, and those overwrote the values ParametersInterceptor had\nbound one step earlier. Null defaults were skipped, which is why the report\nreads \"works unless the field is null by default\".\n\nThe three handlers bind nothing, so they now declare the marker and take the\ndirect path. The marker Javadoc admits that case and names the subclass caveat.\n\nCo-Authored-By: Claude Mythos 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "f2ea51ac3e3c723d670e1734c413d5fe5c31104c", "tree": "3de3b37105b2d602a9979e7bce24daa0253c980b", "parents": [ "432ed91a6e09d82facf3d5cf70df38a23795a538" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Thu Oct 22 12:07:38 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukasz.lenart@gmail.com", "time": "Thu Oct 22 21:13:34 2026 +0200" }, "message": "WW-4323 test(core): pin that ParameterNameAware cannot accept an excluded name\n\nParameterNameAware narrows what the interceptor accepts; it never\noverrides the global name checks. The existing testParameterNameAware\ndoes not tell the two semantics apart because its action rejects every\nextra key itself.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "432ed91a6e09d82facf3d5cf70df38a23795a538", "tree": "938237cee9a6bc10128d97e6cf1eccfc7ec34e2c", "parents": [ "2345827665a7c45882ce2ca75db66aa955044169" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Thu Oct 22 09:22:25 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 09:22:25 2026 +0200" }, "message": "WW-3576 Keep SessionMap in step with the HttpSession (#2042)\n\nSessionMap reads its pinned session once per call, treats an invalidated\nsession as absent, drops the entries cache and the interned-id lock, and\nevery request\u0027s maps are detached at request end.\nStrutsBackgroundProcess.done is volatile." }, { "commit": "2345827665a7c45882ce2ca75db66aa955044169", "tree": "45979154e1f6e47d6fa3daa3ac73355dc8c41f9a", "parents": [ "a8a6ee5655d9fa7139b873ae6151d7f3758a468e" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 09:18:17 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 09:18:17 2026 +0200" }, "message": "build(deps): WW-5779 bump asm.version from 9.10.1 to 9.11 (#2030)\n\nBumps `asm.version` from 9.10.1 to 9.11.\n\nUpdates `org.ow2.asm:asm` from 9.10.1 to 9.11\n\nUpdates `org.ow2.asm:asm-commons` from 9.10.1 to 9.11\n\n---\nupdated-dependencies:\n- dependency-name: org.ow2.asm:asm\n dependency-version: \u00279.11\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: org.ow2.asm:asm-commons\n dependency-version: \u00279.11\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "a8a6ee5655d9fa7139b873ae6151d7f3758a468e", "tree": "f66f1b4af89357d04551db801c7c9476d1404ac2", "parents": [ "4175ad14d9f5d9329fbee02d0dfaaaececedf950" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 09:17:37 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 09:17:37 2026 +0200" }, "message": "build(deps): bump com.github.ben-manes.caffeine:caffeine from 3.3.0 to 3.3.1 (#2027)\n\nBumps [com.github.ben-manes.caffeine:caffeine](https://github.com/ben-manes/caffeine) from 3.3.0 to 3.3.1.\n- [Release notes](https://github.com/ben-manes/caffeine/releases)\n- [Commits](https://github.com/ben-manes/caffeine/compare/v3.3.0...v3.3.1)\n\n---\nupdated-dependencies:\n- dependency-name: com.github.ben-manes.caffeine:caffeine\n dependency-version: 3.3.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "4175ad14d9f5d9329fbee02d0dfaaaececedf950", "tree": "23108ae8514c5862348063356d34a690ac1359b6", "parents": [ "cfd410efebd0b5f40a407e3183d08298b3d08602" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 09:17:33 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 09:17:33 2026 +0200" }, "message": "build(deps): bump org.sitemesh:sitemesh from 3.2.3 to 3.3.0 (#2028)\n\nBumps [org.sitemesh:sitemesh](https://github.com/sitemesh/sitemesh3) from 3.2.3 to 3.3.0.\n- [Release notes](https://github.com/sitemesh/sitemesh3/releases)\n- [Commits](https://github.com/sitemesh/sitemesh3/compare/3.2.3...3.3.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.sitemesh:sitemesh\n dependency-version: 3.3.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "cfd410efebd0b5f40a407e3183d08298b3d08602", "tree": "6fcb551b583d3f0ec74ec5ce1077a52593e06fb7", "parents": [ "301b0788d4960b74b6c8cbc33f1316c6f33342ed" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 09:17:28 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 09:17:28 2026 +0200" }, "message": "build(deps): bump org.webjars.npm:bootstrap-icons from 1.13.1 to 1.13.2 (#2029)\n\nBumps [org.webjars.npm:bootstrap-icons](https://github.com/twbs/icons) from 1.13.1 to 1.13.2.\n- [Release notes](https://github.com/twbs/icons/releases)\n- [Commits](https://github.com/twbs/icons/compare/v1.13.1...v1.13.2)\n\n---\nupdated-dependencies:\n- dependency-name: org.webjars.npm:bootstrap-icons\n dependency-version: 1.13.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "301b0788d4960b74b6c8cbc33f1316c6f33342ed", "tree": "fa1dbe209800abe589c847a3acf863f61a0a3fbb", "parents": [ "0de95f8f83ace54f5928518b558f1ebe13def943" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 09:17:23 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 09:17:23 2026 +0200" }, "message": "build(deps): bump org.mockito:mockito-core from 5.23.0 to 5.24.0 (#2031)\n\nBumps [org.mockito:mockito-core](https://github.com/mockito/mockito) from 5.23.0 to 5.24.0.\n- [Release notes](https://github.com/mockito/mockito/releases)\n- [Commits](https://github.com/mockito/mockito/compare/v5.23.0...v5.24.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.mockito:mockito-core\n dependency-version: 5.24.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "0de95f8f83ace54f5928518b558f1ebe13def943", "tree": "9b8c7d55de5a1a3a0d00c46dade8fe77c7f168ff", "parents": [ "1aefa59824505e6391e73348762eb0d01534027c" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 09:17:07 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 09:17:07 2026 +0200" }, "message": "build(deps): bump github/codeql-action from 4.38.3 to 4.39.0 (#2046)\n\nBumps [github/codeql-action](https://github.com/github/codeql-action) from 4.38.3 to 4.39.0.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/v4.38.3...v4.39.0)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action\n dependency-version: 4.39.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "1aefa59824505e6391e73348762eb0d01534027c", "tree": "be05593e7802300df49de8d462506d60c28e074b", "parents": [ "638291af96dd5822909394ee7ddf2e95e26c83e1" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 09:17:02 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 09:17:02 2026 +0200" }, "message": "build(deps): bump github/codeql-action/upload-sarif from 4.38.2 to 4.39.0 (#2047)\n\nBumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.38.2 to 4.39.0.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/upload-sarif\n dependency-version: 4.39.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "638291af96dd5822909394ee7ddf2e95e26c83e1", "tree": "76f4daf777b85baeb3d5aad3c8a9ba41c71ac322", "parents": [ "83864b1ebd8a38e35838b79586ab7e8a073d97fb" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 17 17:17:54 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 17:17:54 2026 +0200" }, "message": "WW-3792 test(core): pin css_xhtml checkbox left-label wrappers to match other controls (#2041)\n\nUnder css_xhtml every control wraps its label and control in \u003cdiv\u003e for\nlabelPosition\u003d\"top\" and \u003cspan\u003e otherwise. Pins that a checkbox with\nlabelPosition\u003d\"left\" uses the same wrapper elements as a textfield.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "83864b1ebd8a38e35838b79586ab7e8a073d97fb", "tree": "ef3f43a6d7e470cc66d194cf884944bace5e1e4b", "parents": [ "6b2c315751b825638ead43bf14bdb4b93442e807" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 17 15:33:00 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 15:33:00 2026 +0200" }, "message": "WW-3720 test(core): cover comma-delimited interceptor params split across lines (#2040)\n\n* WW-3720 test(core): cover comma-delimited interceptor params split across lines\n\nPins that a multi-line \u003cparam\u003e value such as excludeMethods is parsed\ninto separate method names, both on the interceptor definition and on\nan interceptor-ref override.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3720 test(core): use struts- fixture prefix and drop unneeded throws\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "6b2c315751b825638ead43bf14bdb4b93442e807", "tree": "e1ca24f44aac62b69dac3072f255743430aa9486", "parents": [ "f69198c53a4726b517b88ff9ddcc703ed8b956c2" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 17 10:43:44 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 10:43:44 2026 +0200" }, "message": "WW-3666 Trim surrounding whitespace before converting to non-String types (#2039)\n\n* WW-3666 feat(core): trim surrounding whitespace before converting to non-String types\n\nPadded request values such as \" 42 \" or \" ACTIVE \" were rejected by the\nlocale-aware number, enum and java.time paths, while primitive int/long\nalready trimmed. Boolean and Character silently misread them (\" true \" was\nfalse, \" x\" was \u0027 \u0027).\n\nXWorkBasicConverter now trims String and String[] values for scalar targets.\nString/Object targets and converters registered for a type still receive the\nraw value; arrays and collections trim per element. Whitespace-only input\nfollows the existing \"\" path, so boxed Boolean blank becomes null and a\nwhitespace-only Character keeps its first character.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3666 refactor(core): keep the trimmed value in a local instead of reassigning the parameter\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "f69198c53a4726b517b88ff9ddcc703ed8b956c2", "tree": "4fa0c8a924de0c0667a3f5c07d1eb92428343491", "parents": [ "f648b288d868e9287ae418988eca42553612eb0b", "1dade4fa7695da4d93fe570f3d2623138adb9f9c" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 17 09:23:53 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 09:23:53 2026 +0200" }, "message": "Merge pull request #2038 from apache/feature/WW-3717-http-method-attribute\n\nWW-3717 feat(core): restrict an action to HTTP methods with an http-method attribute" }, { "commit": "1dade4fa7695da4d93fe570f3d2623138adb9f9c", "tree": "4fa0c8a924de0c0667a3f5c07d1eb92428343491", "parents": [ "ced991c4f56c48e8e90f457784de89a6d0962190" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 17 09:10:46 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 17 09:10:46 2026 +0200" }, "message": "WW-3717 refactor(core): address Sonar findings on the http-method change\n\nMakes ActionConfig.httpMethods private, narrows rejectRequest to throw\nIOException, simplifies the end of equals, and tidies two tests.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "ced991c4f56c48e8e90f457784de89a6d0962190", "tree": "e57c3ad7ef663ee0fa4e2ce6b180211a57c8558f", "parents": [ "c3155ce9b714bd9ca27f84e202bdb5f8f8f4ecba" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 16 17:24:12 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 16 17:24:12 2026 +0200" }, "message": "WW-3717 fix(core): look up the unknown handler manager when a request is rejected\n\nInjecting UnknownHandlerManager into HttpMethodInterceptor built the\nunknown handlers while the interceptor was created during configuration\nloading, before ConventionUnknownHandler could find its parent package,\nwhich broke every Convention plugin application at startup. Resolve the\nmanager from the request\u0027s container only on the reject path instead.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "c3155ce9b714bd9ca27f84e202bdb5f8f8f4ecba", "tree": "a3f1b9ddc2e40d058948d8fd65f7c880e602af34", "parents": [ "9b1fac7bfd397f4b814edfc331f508fad286f7f0" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 16 16:39:52 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 16 16:39:52 2026 +0200" }, "message": "WW-3717 fix(core): resolve the bad-request result like the action invocation does\n\nBefore answering 405 the interceptor now also accepts a catch-all \"*\"\nresult and a result supplied by an unknown handler (e.g. the Convention\nplugin\u0027s {action}-bad-request page), so existing annotation users keep\ntheir page. Adds a test where the annotation narrows the configured\nmethods.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "9b1fac7bfd397f4b814edfc331f508fad286f7f0", "tree": "ad7227f4e7a76aa8993c86749eb54bbe52d88443", "parents": [ "f648b288d868e9287ae418988eca42553612eb0b" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 16 16:34:24 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 16 16:34:24 2026 +0200" }, "message": "WW-3717 feat(core): restrict an action to HTTP methods with an http-method attribute\n\nAdds an optional http-method attribute to \u003caction\u003e in the 7.5 DTD,\nenforced by HttpMethodInterceptor together with the existing\n@HttpGet/@HttpPost/@AllowedHttpMethod annotations; when both apply the\nrequest must satisfy both. Wildcard and regex actions keep the\nrestriction, and an invalid method name fails configuration loading.\n\nA rejected request still gets the bad-request result when the action\nmaps one; otherwise the interceptor now answers 405 with an Allow\nheader instead of failing with \"No result defined\". A warning is logged\nfor an action that declares http-method but whose interceptors do not\ninclude httpMethod.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "f648b288d868e9287ae418988eca42553612eb0b", "tree": "5e9766411762bc5bb9124a0ff521b15e7b2b62dd", "parents": [ "2f7e08633337cda97126f632736fca2f949d0fbd" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 16 15:43:39 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 15:43:39 2026 +0200" }, "message": "WW-3655 test(freemarker): guard against resolving the result location from the request URI (#2037)\n\nThe behaviour was changed by WW-4169 (2.3.17): a relative location is\nresolved against the action namespace. The test fails when the old\nrequest-URI based resolution is restored.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "2f7e08633337cda97126f632736fca2f949d0fbd", "tree": "fea742eabf777dc4262847a426fe624d19549556", "parents": [ "76d6b140538a6fe9227ebf1674f5a999599158db" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 16 13:14:19 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 13:14:19 2026 +0200" }, "message": "WW-3624 feat(tags): allow regex matching of field names on fielderror tag (#2036)\n\nAdds a regex attribute (default false) to s:fielderror. When enabled,\nfieldName and nested param values are regular expressions matched\nagainst the whole field error name, e.g. to show all errors of one\niterated row. Each field error is rendered once even when several\npatterns match it. Implemented in the simple and html5 themes and\nthe javatemplates FieldErrorHandler.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "76d6b140538a6fe9227ebf1674f5a999599158db", "tree": "8f6ddb024a1311f8947a684500a7d3f5a7a2bafa", "parents": [ "98ee4e1d6e478af9dd8ee31878e5eaebd9e00506" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 16 12:29:16 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 12:29:16 2026 +0200" }, "message": "WW-5782 fix(tags): document and warn that s:a href ignores nested params (#2034)\n\nWith an explicit href the anchor tag never applies nested \u003cs:param\u003e tags;\nthey are only used when the URL is built from value or action. The javadoc\nexample showed exactly that combination.\n\nThe example now uses value, the javadoc and the href attribute description\nsay nested params are not applied to href, and in devMode the tag logs a\nwarning naming the ignored params. Rendered output is unchanged; applying\nparams to href is WW-5783 (8.0.0).\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "98ee4e1d6e478af9dd8ee31878e5eaebd9e00506", "tree": "22972984dfcde78759c7dcde8ec84b92d1b2bc95", "parents": [ "b8da6b5d2e6103b2375d71c710e66a876491dadf" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 16 09:11:42 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 09:11:42 2026 +0200" }, "message": "WW-5781 fix(tags): render a single class and style on checkboxlist and radio inputs (#2026)\n\ncheckboxlist always, and radio whenever listCssClass or listCssStyle was set,\nwrote class/style themselves and then again through css.ftl. Browsers keep the\nfirst duplicate attribute, so cssErrorClass and cssErrorStyle never applied.\n\nA shared list-item-css.ftl now computes one class and one style per item:\nthe item value replaces the tag value, the error class is appended and the\nerror style applied when the field has errors, following the css.ftl rules.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "b8da6b5d2e6103b2375d71c710e66a876491dadf", "tree": "bdac546d2dd9f683d93eb35690b201ec2938f518", "parents": [ "8f481e740797f80082b023feacf196407bcd14d1" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 16 09:10:52 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 09:10:52 2026 +0200" }, "message": "WW-5780 fix(html5): close the checkbox input in the html5 checkboxlist template (#2025)\n\nWithout the closing /\u003e the browser parsed the following \u003clabel as attribute\nnames of the input, so no label element was created for any item.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "8f481e740797f80082b023feacf196407bcd14d1", "tree": "cafaaa2dbf09d848b10e82df1407daeb585aa1cd", "parents": [ "7572dc6bf609f9766424e7c0cb30e04040a9db0f" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 16 07:01:17 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 07:01:17 2026 +0200" }, "message": "WW-5765 fix(interceptor): re-store only the token validated in the request in execAndWait (#2022)\n\nExecuteAndWaitInterceptor put a transaction token back into the session\non every wait result, reading the value from the \"token\" request\nparameter and the name from \"struts.token.name\". It did so whether or\nnot a token had been validated in the current request, including for\nexecAndWait actions without a token check, and it read the value and\nthe name under different names.\n\nTokenHelper.validToken() now records the token name and value it\naccepted in the current ActionContext, and the new\nTokenHelper.restoreValidatedToken() puts exactly that pair back into\nthe session. ExecuteAndWaitInterceptor calls it instead of reading\nrequest parameters, so with no validated token it leaves the session\ntoken store unchanged. Actions combining token or tokenSession with\nexecAndWait keep accepting wait-page refreshes as before (WW-1741).\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "7572dc6bf609f9766424e7c0cb30e04040a9db0f", "tree": "4bba72006cad51d70336af815894f19140252812", "parents": [ "545986b7fba251ce8ab99b932edd12c97ab35fdb" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 16 07:01:00 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 07:01:00 2026 +0200" }, "message": "build(ci): align GitHub Actions with the ASF Actions policy (#2024)\n\nGroup Dependabot security updates per ecosystem and branch, as the policy\nrecommends, so a burst of advisories opens one PR instead of many.\n\nMove the Scorecards SARIF upload off the deprecated codeql-action v2 pin\nonto the v4.38.2 commit already used by codeql.yml.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "545986b7fba251ce8ab99b932edd12c97ab35fdb", "tree": "656657747f5fca916eb828ae2d0c0763e897562c", "parents": [ "e3dbdccd519d2d259e8047956bd3ecd815fa3ab0" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 15 19:41:07 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 19:41:07 2026 +0200" }, "message": "build(deps-dev): bump org.apache.tomcat.embed:tomcat-embed-core from 11.0.26 to 11.0.27 (#2020)\n\nBumps org.apache.tomcat.embed:tomcat-embed-core from 11.0.26 to 11.0.27.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.tomcat.embed:tomcat-embed-core\n dependency-version: 11.0.27\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e3dbdccd519d2d259e8047956bd3ecd815fa3ab0", "tree": "56bd73612b830d9bb3ea49df8a87f85b896aaebb", "parents": [ "321a76fdd65e27a44daa864c8ff016a31cc12fab" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 15 19:41:01 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 19:41:01 2026 +0200" }, "message": "build(deps): bump com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.3 (#2019)\n\nBumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.22.2 to 2.22.3.\n- [Commits](https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.22.2...jackson-bom-2.22.3)\n\n---\nupdated-dependencies:\n- dependency-name: com.fasterxml.jackson:jackson-bom\n dependency-version: 2.22.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "321a76fdd65e27a44daa864c8ff016a31cc12fab", "tree": "0a8a8075fd19ee46e612333d3b45e08b89c5a8fe", "parents": [ "d313b32b75f021fbdc336d47c3df96999528a14f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 15 19:40:56 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 19:40:56 2026 +0200" }, "message": "build(deps): bump github/codeql-action from 4.38.2 to 4.38.3 (#2018)\n\nBumps [github/codeql-action](https://github.com/github/codeql-action) from 4.38.2 to 4.38.3.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/v4.38.2...v4.38.3)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action\n dependency-version: 4.38.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "d313b32b75f021fbdc336d47c3df96999528a14f", "tree": "f4207b9ca6f235f32470301a599382e729048ab4", "parents": [ "264be708a959a8934bbae2f2077146673eb42606" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 15 19:40:51 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 19:40:51 2026 +0200" }, "message": "build(deps): bump mikepenz/action-junit-report from 6.5.0 to 6.6.1 (#2017)\n\nBumps [mikepenz/action-junit-report](https://github.com/mikepenz/action-junit-report) from 6.5.0 to 6.6.1.\n- [Release notes](https://github.com/mikepenz/action-junit-report/releases)\n- [Commits](https://github.com/mikepenz/action-junit-report/compare/a9170d5795813c01ab4901ffb045b52bab4ab09d...6ef3fdcfcd5f0b5d14df3e659ef19b8c6820f93d)\n\n---\nupdated-dependencies:\n- dependency-name: mikepenz/action-junit-report\n dependency-version: 6.6.1\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "264be708a959a8934bbae2f2077146673eb42606", "tree": "c81f35c3d3a7bd4e895843a6bb56710750b9db8e", "parents": [ "becf04188f343134df3417776b4291a0e302337a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 15 19:40:46 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 19:40:46 2026 +0200" }, "message": "build(deps-dev): bump org.codehaus.mojo:versions-maven-plugin from 2.22.0 to 2.23.0 (#2016)\n\nBumps [org.codehaus.mojo:versions-maven-plugin](https://github.com/mojohaus/versions) from 2.22.0 to 2.23.0.\n- [Release notes](https://github.com/mojohaus/versions/releases)\n- [Changelog](https://github.com/mojohaus/versions/blob/master/ReleaseNotes.md)\n- [Commits](https://github.com/mojohaus/versions/compare/2.22.0...2.23.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.codehaus.mojo:versions-maven-plugin\n dependency-version: 2.23.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "becf04188f343134df3417776b4291a0e302337a", "tree": "31e6790c80ab1ceda3a3c26666824971737a4888", "parents": [ "e2580bea81e476d87d21c461e5e62e0421922a6b" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 15 19:40:41 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 19:40:41 2026 +0200" }, "message": "build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 (#2015)\n\nBumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.\n- [Release notes](https://github.com/ossf/scorecard-action/releases)\n- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)\n- [Commits](https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e)\n\n---\nupdated-dependencies:\n- dependency-name: ossf/scorecard-action\n dependency-version: 2.5.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e2580bea81e476d87d21c461e5e62e0421922a6b", "tree": "17357ab3e1e84ce5ee27ba96716d59f3489732e1", "parents": [ "a91460ab2f6e3944cd2f8d99c8e2514cfd28eb28" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 15 19:40:35 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 19:40:35 2026 +0200" }, "message": "build(deps): bump ognl:ognl from 3.4.15 to 3.4.16 (#2014)\n\nBumps [ognl:ognl](https://github.com/orphan-oss/ognl) from 3.4.15 to 3.4.16.\n- [Release notes](https://github.com/orphan-oss/ognl/releases)\n- [Commits](https://github.com/orphan-oss/ognl/commits)\n\n---\nupdated-dependencies:\n- dependency-name: ognl:ognl\n dependency-version: 3.4.16\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "a91460ab2f6e3944cd2f8d99c8e2514cfd28eb28", "tree": "08d0efd017b10684c18b82cfa284fa7d0d11a9db", "parents": [ "447ae1b2383f644a6cbb3bcd1f6260f54528e59b" ], "author": { "name": "aeon", "email": "aeonframework@proton.me", "time": "Thu Oct 15 03:09:03 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 09:09:03 2026 +0200" }, "message": "WW-5772 Remove inline event handlers from optiontransferselect, inputtransferselect, updownselect and combobox (#2012)\n\n* WW-5772 Bind transfer-select buttons from data attributes instead of inline onclick\n\nThe optiontransferselect, inputtransferselect and updownselect tags\nrendered every button with a framework-generated onclick handler that\nbuilt a JavaScript call from the select ids and the headerKey /\ndoubleHeaderKey tag attributes. Pages using these tags therefore needed\n\u0027unsafe-inline\u0027 in their Content-Security-Policy.\n\nEach button now carries its action, target select ids and header keys\nin data-* attributes, and optiontransferselect.js / inputtransferselect.js\nregister one delegated click listener per page (capture phase) that\ncalls the same functions with the same arguments as before. A\ndeveloper-supplied *Onclick attribute on optiontransferselect is still\nrendered as onclick and still runs after the framework action.\n\nThe rendered markup now depends on the matching static JS: an\napplication that serves its own copy of optiontransferselect.js or\ninputtransferselect.js through struts.ui.staticContentPath must update\nit together with the templates.\n\nGenerated-by: an AI coding assistant; reviewed and tested by the author.\n\n* WW-5772 Bind combobox select change handler from a nonce\u0027d script\n\nThe combobox tag (simple and html5 themes) rendered its select with an\ninline onChange\u003d\"autoPopulate_\u003cid\u003e(this)\" handler. The select now\ncarries data-struts-combobox\u003d\"\u003cescapedId\u003e\" and the handler is attached\nwith addEventListener inside an \u003c@s.script\u003e block, which carries the\nCSP nonce like the autoPopulate function the template already emits.\n\nThe script binds every select with its marker that is not bound yet,\nso comboboxes repeated with the same generated id, for example inside\nan iterator, each get exactly one handler, as they did with the inline\nattribute. It looks the selects up instead of using\ndocument.currentScript, so it also works when the fragment is loaded\nover AJAX and its scripts are evaluated after insertion (jQuery .html()\nevaluates them through a temporary script element in \u003chead\u003e).\n\nGenerated-by: an AI coding assistant; reviewed and tested by the author.\n\n---------\n\nCo-authored-by: Aaron Elijah Mars \u003c272311952+aeonframework@users.noreply.github.com\u003e" }, { "commit": "447ae1b2383f644a6cbb3bcd1f6260f54528e59b", "tree": "1caf118c73db1b91d5790b3f226d20ec324c3bd6", "parents": [ "6ad8d09c0091da5b9d053fff3b623853f45a39c0" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Thu Oct 15 07:23:11 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 07:23:11 2026 +0200" }, "message": "build(ci): build a reduced matrix on pull requests (#2011)\n\nEvery push to a pull request queued 8 jobs on the shared ASF runner\npool. Pull requests now build JDK 17 (the required check) and JDK 25\nwith Jakarta EE 11, covering the oldest JDK and the newest stack;\npushes to the long-lived branches still build the full matrix.\n\nOWASP runs on a pull request only when it changes a pom.xml, the\nsuppression file or the workflow itself. It is not a required check,\nso the path filter cannot leave a pull request waiting on it.\n\nA pull request push now queues 4 jobs instead of 8.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "6ad8d09c0091da5b9d053fff3b623853f45a39c0", "tree": "c804c44e3e42411be17e7c64f26ae5886c2af9b4", "parents": [ "3621514250368aa1d762558d9be7462dc7bcfcc8", "26cedce9e6fb631d286c9343478fe47494e18bca" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Wed Oct 14 13:40:29 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 13:40:29 2026 +0200" }, "message": "build(ci): detect changes in-job and cancel superseded PR runs (#2010)\n\nThe change detection ran as a job of its own that every build job\nneeded, so each build queued twice on the shared ASF runner pool: once\nfor the two-second detection job, then again for its own runner. Over\nthe last ~40 runs that first wait averaged 37 minutes (max 97) before\na build job could even enter the queue.\n\nDetection now runs as a step at the start of each job, from a local\ncomposite action, and gates the remaining steps. Each job queues once.\n\nEvery workflow also gets a concurrency group: a new push to a pull\nrequest cancels the superseded run, while pushes get a group per run\nso no branch build is dropped.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "3621514250368aa1d762558d9be7462dc7bcfcc8", "tree": "327cb04cbc4fc405b224cf3fbc014976913e5325", "parents": [ "65a8f86689ec887033fbca52f69d0ae18787c082" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Wed Oct 14 11:17:47 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 11:17:47 2026 +0200" }, "message": "WW-5770 Make struts.convention.result.path scopable per package (#2009)\n\n* WW-5770 docs: add design for scopable Convention result path\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-5770 docs: add implementation plan, make the provider method default in the design\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-5770 feat(core): resolve a scoped constant against an explicit package\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-5770 feat(convention): resolve the result path against the action\u0027s package\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-5770 feat(convention): honour the scoped result path when building results\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-5770 feat(convention): honour the scoped result path for unknown actions and results\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-5770 fix(core): resolve an explicit package without falling back to the current invocation\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-5770 chore: address review comments\n\nDrop the inert convention-default redeclaration from the test fixture,\nnarrow the @throws of the default getValue(String, PackageConfig),\nand mark the design as implemented.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "26cedce9e6fb631d286c9343478fe47494e18bca", "tree": "2799ed2da1ef323aec96481fee256a4697dd5a8b", "parents": [ "65a8f86689ec887033fbca52f69d0ae18787c082" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Wed Oct 14 10:38:30 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Wed Oct 14 10:38:30 2026 +0200" }, "message": "build(ci): detect changes in-job and cancel superseded PR runs\n\nThe change detection ran as a job of its own that every build job\nneeded, so each build queued twice on the shared ASF runner pool: once\nfor the two-second detection job, then again for its own runner. Over\nthe last ~40 runs that first wait averaged 37 minutes (max 97) before\na build job could even enter the queue.\n\nDetection now runs as a step at the start of each job, from a local\ncomposite action, and gates the remaining steps. Each job queues once.\n\nEvery workflow also gets a concurrency group: a new push to a pull\nrequest cancels the superseded run, while pushes get a group per run\nso no branch build is dropped.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "65a8f86689ec887033fbca52f69d0ae18787c082", "tree": "7b70dba61581903e154d9fb05ad2b8e56478f846", "parents": [ "da2bcf6783cda302da94216cd91d81e94d4aa3d0" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Mon Oct 12 21:30:00 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 21:30:00 2026 +0200" }, "message": "WW-5768 Make struts.ui.theme and struts.ui.templateDir scopable per package (#2008)\n\n* WW-5768 feat(ui): make struts.ui.theme and struts.ui.templateDir scopable per package\n\nA package can now override the default UI theme and template directory with\n\u003cscoped-constant\u003e, and child packages inherit it through extends. Only the last\nfallback in UIBean.getTheme()/getTemplateDir() changes: it asks the\nScopedConstantProvider, which returns the package override or the global\nconstant. The tag attribute, the enclosing form and the request/session/\napplication attributes keep their precedence.\n\nsetDefaultUITheme/setDefaultTemplateDir and their fields are no longer read and\nare deprecated for removal. Components built without the container now need a\nScopedConstantProvider, the same way they already need a CspNonceReader; the\njavatemplates tests set a stub.\n\nThe empty-registry validation test now loads only the bootstrap beans, because\nStrutsDefaultConfigurationProvider registers the UI names.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-5768 docs(ui): add @deprecated Javadoc to the deprecated UIBean fields\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "da2bcf6783cda302da94216cd91d81e94d4aa3d0", "tree": "933ef72de59263e21a5b56981d7f40b24f1d95df", "parents": [ "3355548b9384cf57efbeb56a9a3f79a62ffe6f70" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Mon Oct 12 19:56:39 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 19:56:39 2026 +0200" }, "message": "WW-5767 Apply value substitution to scoped-constant values (#2007)\n\n* WW-5767 feat(config): apply value substitution to scoped-constant values\n\n\u003cscoped-constant\u003e values now go through the injected ValueSubstitutor at\nload time, the same as \u003cconstant\u003e, so ${env.NAME} and ${system.property} resolve\ninstead of being stored literally. Both paths share one helper.\n\nThe test loads struts-default.xml so the substitutor comes from the main\ncontainer that loadPackages() is injected with; the ConfigurationTestBase\ncontainer registers none and could not observe the change.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-5767 test(config): cover scoped constants loaded without a ValueSubstitutor\n\nThe substitutor is injected with required \u003d false, so a provider used\nwithout injection keeps values as written. Every harness in the suite\ninjects one through DefaultConfiguration.bootstrapFactories, so nothing\nexercised that branch.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "3355548b9384cf57efbeb56a9a3f79a62ffe6f70", "tree": "e8beafd3fbf34326840d7c2d3e05df7d8674f6a1", "parents": [ "fd60b2073583a67d3cccb22c89ebed407d198af8", "260551ceb83097efc7d551ea05e40ea9c637e9cc" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Mon Oct 12 13:01:56 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 13:01:56 2026 +0200" }, "message": "WW-5766 feat(config): map struts.scopedConstantProvider in ConstantConfig (#2006)\n\nJava-based configuration can now select a custom ScopedConstantProvider\nthrough ConstantConfig instead of overriding getAllAsStringsMap().\n\nThe selection tests load providers in the Dispatcher\u0027s order rather than\nthrough StrutsDefaultConfigurationProvider: that bootstrap binds\nScopedConstantProvider under the default name, so alias() skips the\nconstant and the test could never observe the mapping.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "260551ceb83097efc7d551ea05e40ea9c637e9cc", "tree": "e8beafd3fbf34326840d7c2d3e05df7d8674f6a1", "parents": [ "fd60b2073583a67d3cccb22c89ebed407d198af8" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Mon Oct 12 11:16:40 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Mon Oct 12 11:16:40 2026 +0200" }, "message": "WW-5766 feat(config): map struts.scopedConstantProvider in ConstantConfig\n\nJava-based configuration can now select a custom ScopedConstantProvider\nthrough ConstantConfig instead of overriding getAllAsStringsMap().\n\nThe selection tests load providers in the Dispatcher\u0027s order rather than\nthrough StrutsDefaultConfigurationProvider: that bootstrap binds\nScopedConstantProvider under the default name, so alias() skips the\nconstant and the test could never observe the mapping.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "fd60b2073583a67d3cccb22c89ebed407d198af8", "tree": "90560b500008f82a3cffbc960f5aae4ef2770798", "parents": [ "6cbf4e79f7817efdbf90fb9a7d8f5404682aa453" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sun Oct 11 10:14:46 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 11 10:14:46 2026 +0200" }, "message": "WW-3476 Add package-scoped constants (#2005)\n\n* WW-3476 docs: add design spec for package-scoped constants\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3476 docs: add implementation plan for package-scoped constants\n\nWire the provider like other pluggable core services (struts-beans.xml,\nStrutsBeanSelectionProvider alias, struts.scopedConstantProvider).\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3476 feat(config): store scoped constants on PackageConfig\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3476 feat(config): add struts-7.5.dtd with \u003cscoped-constant\u003e\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3476 feat(config): reject unregistered scoped constants at startup\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3476 feat(config): add ScopedConstantProvider resolving package overrides\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3476 test(config): pin ScopedConstantProvider wiring on the Dispatcher path\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3476 test(config): drop the xwork prefix from scoped-constant fixtures\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3476 fix(config): skip ScopableConstants bean names without an instance\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3476 refactor(config): resolve Configuration and scopable names from the container once\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3476 refactor(config): address Sonar findings on scoped constants\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3476 test(config): name scoped-constant fixtures struts-*.xml\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3476 fix(mock): return an empty set from MockContainer.getInstanceNames\n\nMatches the Container contract ContainerImpl follows; callers iterate the\nresult without a null check.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3476 docs(config): document ScopedConstantProvider as a bean-selection extension point\n\nLists it in the StrutsBeanSelectionProvider extension-point table, adds\nstruts.scopedConstantProvider to default.properties, and pins that the\nconstant selects a custom bean.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3476 refactor(config): move StrutsScopedConstantProvider to config.providers\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-3476 refactor(config): complete the StrutsScopedConstantProvider move\n\nc93980593 committed only the renames; this adds the package declarations,\nimports and the struts-beans.xml class name.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "6cbf4e79f7817efdbf90fb9a7d8f5404682aa453", "tree": "f21973c7c5fc1eeb25750d3c6d463e3b32cf135e", "parents": [ "cca45ded15a0b01bcd71458c14becc5a1e04f87f", "14bb4d8a6d06c9515984cfe293d36e7fd1e90202" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 10 16:03:56 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 10 16:03:56 2026 +0200" }, "message": "Merge pull request #2004 from apache/WW-3464-wildcard-first-match-wins\n\nWW-3464 test(config): pin first-match-wins wildcard order" }, { "commit": "14bb4d8a6d06c9515984cfe293d36e7fd1e90202", "tree": "f21973c7c5fc1eeb25750d3c6d463e3b32cf135e", "parents": [ "cca45ded15a0b01bcd71458c14becc5a1e04f87f" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 10 14:44:29 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 10 14:44:29 2026 +0200" }, "message": "WW-3464 test(config): pin first-match-wins wildcard order\n\nWhen several XML wildcard action names match a request, the first one\ndeclared in the package wins. Cover both declaration orders with the\nticket\u0027s `**` / `Project**` patterns so the behaviour cannot drift from\nwhat the documentation describes.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "cca45ded15a0b01bcd71458c14becc5a1e04f87f", "tree": "281a098801ee6252a91791af30b67c04cc409a6d", "parents": [ "8503fb7e7d6cbc4bebbed57b0dd93e06d36bfdc5", "8b5af4262cda45a27a9f4d4776a0d8339726b080" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 10 13:18:19 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 10 13:18:19 2026 +0200" }, "message": "Merge pull request #2003 from apache/WW-3447-convention-flag-coverage\n\nWW-3447 test(convention): cover action-mapping flags with no tests" }, { "commit": "8b5af4262cda45a27a9f4d4776a0d8339726b080", "tree": "281a098801ee6252a91791af30b67c04cc409a6d", "parents": [ "8503fb7e7d6cbc4bebbed57b0dd93e06d36bfdc5" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 10 12:55:48 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 10 12:55:48 2026 +0200" }, "message": "WW-3447 test(convention): cover action-mapping flags with no tests\n\nAdd on/off tests for alwaysMapExecute, checkImplementsAction,\nmapAllMatches, disableScanning, package.locators.disable and\neagerLoading in PackageBasedActionConfigBuilderTest.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "8503fb7e7d6cbc4bebbed57b0dd93e06d36bfdc5", "tree": "4061ac44eec232f4a562279b9db1540867a30026", "parents": [ "6fb6e2ccaa6b4ad2e575a15f8ea38121fcda5e87", "999543a829f167fa9514424c2faeb592a54409d6" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 10 12:49:40 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 10 12:49:40 2026 +0200" }, "message": "Merge pull request #2002 from apache/WW-3364-json-writer-type-converters\n\nWW-3364 Use registered type converters in JSON serialization (opt-in)" }, { "commit": "999543a829f167fa9514424c2faeb592a54409d6", "tree": "4061ac44eec232f4a562279b9db1540867a30026", "parents": [ "cb06271f95fb4c31783daa317f5c68967544042c" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 10 12:42:09 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 10 12:42:09 2026 +0200" }, "message": "WW-3364 refactor(json): extract processObject to reduce process() complexity\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "cb06271f95fb4c31783daa317f5c68967544042c", "tree": "bb6eeb0529f9c864a87573fbb99ce0fa91ac9016", "parents": [ "6fb6e2ccaa6b4ad2e575a15f8ea38121fcda5e87" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 10 12:31:13 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Sat Oct 10 12:31:13 2026 +0200" }, "message": "WW-3364 feat(json): use registered type converters in JSON serialization\n\nAdds the opt-in struts.json.writer.useTypeConverters constant (default\nfalse). When enabled, StrutsJSONWriter serializes a value that is not a\nbuilt-in JSON type with the type converter registered for its class (or a\nsuperclass/interface) and writes the result as a JSON string, falling back\nto bean/record serialization when no converter is registered or the\nconverter fails. @JSONFieldBridge keeps precedence.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "6fb6e2ccaa6b4ad2e575a15f8ea38121fcda5e87", "tree": "a98b7da59b4db5a4cb7ebf5f9da74ae81257d50d", "parents": [ "44201d553197e2bdc7e6b03d5777b2b14b51f848", "56d6361b584fcf085b671e2bcb32db22c66de100" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Wed Oct 07 17:29:18 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 17:29:18 2026 +0200" }, "message": "Merge pull request #2001 from apache/chore/dependabot-skill-ticket-handoff\n\nchore: hand Dependabot tickets back open and read fix versions from Jira" }, { "commit": "56d6361b584fcf085b671e2bcb32db22c66de100", "tree": "a98b7da59b4db5a4cb7ebf5f9da74ae81257d50d", "parents": [ "44201d553197e2bdc7e6b03d5777b2b14b51f848" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Wed Oct 07 17:12:00 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Wed Oct 07 17:12:00 2026 +0200" }, "message": "chore: hand Dependabot tickets back open and read fix versions from Jira\n\nLessons from the 2026-10-07 queue run (#1995-#2000):\n\n- Step 5 no longer resolves the ticket; it reports it as ready to resolve.\n The ticket workflow belongs to the release manager.\n- The fix version comes from the latest tickets on the line, not the pom:\n support/struts-6-x-x reads 6.12.1-SNAPSHOT while its next release is 6.13.0,\n and 7.4.0 is still unreleased in Jira after shipping.\n- The Closes line anchors on the Bumps line; bodies without release notes have\n no \u003cdetails\u003e before the commands footer.\n- A red bump that is deferred gets a ticket at the next major and a closing\n comment with `@dependabot ignore this major version` (#1905, #1998).\n- The twin check also searches Jira, since a twin may have merged in an\n earlier run.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "44201d553197e2bdc7e6b03d5777b2b14b51f848", "tree": "a4c76f33156ea930a953f2d233eb20dfd8500ac1", "parents": [ "687b19247f7d089933bc60ff59c81e12b0b07937" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 07 12:08:29 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 12:08:29 2026 +0200" }, "message": "build(deps): WW-5764 bump com.github.ben-manes.caffeine:caffeine from 3.2.4 to 3.3.0 (#1995)\n\nBumps [com.github.ben-manes.caffeine:caffeine](https://github.com/ben-manes/caffeine) from 3.2.4 to 3.3.0.\n- [Release notes](https://github.com/ben-manes/caffeine/releases)\n- [Commits](https://github.com/ben-manes/caffeine/compare/v3.2.4...v3.3.0)\n\n---\nupdated-dependencies:\n- dependency-name: com.github.ben-manes.caffeine:caffeine\n dependency-version: 3.3.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "687b19247f7d089933bc60ff59c81e12b0b07937", "tree": "597e76d268729b592dba36a223631cd8df299ed6", "parents": [ "5582c3d7eab1f46996fcf44d0d36b4c6733bf644" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 07 12:08:22 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 12:08:22 2026 +0200" }, "message": "build(deps): WW-5763 bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 (#1997)\n\nBumps org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.commons:commons-lang3\n dependency-version: 3.21.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "5582c3d7eab1f46996fcf44d0d36b4c6733bf644", "tree": "edf8568875a1c9b648e694d6538c186933979a12", "parents": [ "bb777787ec0ddb8a1d5998553f3376624be80736" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 07 12:07:42 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 12:07:42 2026 +0200" }, "message": "build(deps): bump org.apache.maven:apache-maven from 3.9.16 to 3.10.0 (#1996)\n\nBumps org.apache.maven:apache-maven from 3.9.16 to 3.10.0.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven:apache-maven\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "bb777787ec0ddb8a1d5998553f3376624be80736", "tree": "bc351de86fd80d646d3816624a8cf1062ea55cfe", "parents": [ "445fd24240de0a1b94011747a059ed1c546b272c" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 07 12:07:36 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 12:07:36 2026 +0200" }, "message": "build(deps-dev): bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 (#1999)\n\nBumps [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) from 3.6.1 to 3.6.2.\n- [Release notes](https://github.com/mojohaus/build-helper-maven-plugin/releases)\n- [Commits](https://github.com/mojohaus/build-helper-maven-plugin/compare/3.6.1...3.6.2)\n\n---\nupdated-dependencies:\n- dependency-name: org.codehaus.mojo:build-helper-maven-plugin\n dependency-version: 3.6.2\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "445fd24240de0a1b94011747a059ed1c546b272c", "tree": "d8d22ebe8239abbb7b22eab31e704192f43e5365", "parents": [ "04373ae8b1f9415430ccb44d4ceedd59a6eed3c3", "18465c8c328e5e257d4db589d0023cbfac926bb8" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Wed Oct 07 10:39:53 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 10:39:53 2026 +0200" }, "message": "Merge pull request #1994 from apache/docs/claude-md-drop-version\n\ndocs: drop the hard-coded version from CLAUDE.md" }, { "commit": "18465c8c328e5e257d4db589d0023cbfac926bb8", "tree": "d8d22ebe8239abbb7b22eab31e704192f43e5365", "parents": [ "04373ae8b1f9415430ccb44d4ceedd59a6eed3c3" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Tue Oct 06 20:12:03 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Tue Oct 06 20:12:03 2026 +0200" }, "message": "docs: drop the hard-coded version from CLAUDE.md\n\nThe pom version is readable from pom.xml and the copy here went stale every\nrelease. Keep only what the pom does not say: the SNAPSHOT is a placeholder\nand released versions are STRUTS_X_Y_Z tags.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "04373ae8b1f9415430ccb44d4ceedd59a6eed3c3", "tree": "6f969f893a6cc59daa027bcdbeb3d9b0b954ed35", "parents": [ "87783686020a1417eb43669615fc7430ce452708" ], "author": { "name": "ⳕⲛτⲉⲅⲥⲉⳏτⲟⲅ 🕵🏻", "email": "192411347+g0w6y@users.noreply.github.com", "time": "Tue Oct 06 23:38:08 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 20:08:08 2026 +0200" }, "message": "WW-5758 Enforce @StrutsParameter authorization in AliasInterceptor\u0027s raw-parameter fallback (#1991)\n\n* WW-5758 Enforce @StrutsParameter authorization in AliasInterceptor\u0027s raw-parameter fallback\n\nAliasInterceptor copies a value from one named stack/request slot to another, falling back to the\nraw HTTP parameter of the source name when the source does not resolve on the stack (its own\ndocumented behavior). That fallback value was never checked against @StrutsParameter before being\nwritten to the alias target, unlike every other binding path in the framework (ParametersInterceptor,\nChainingInterceptor with struts.chaining.requireAnnotations, CookieInterceptor, the REST/JSON\nplugins): an alias target that is not annotated could still be set, with the value sourced directly\nfrom an attacker-controlled request parameter when the fallback fires.\n\nFix: inject the same shared ParameterAuthorizer used by ParametersInterceptor and\nCookieInterceptor, and check it for the alias target, but only when the value actually came from the\nraw-parameter fallback - not when the source name resolved directly on the stack. A name that\nresolves on the stack names something an earlier, properly-authorized bind already produced (e.g. an\nearlier action in a chain); copying that between properties is the same category of operation\nChainingInterceptor performs without requiring annotations by default, and must stay unaffected. No\nnew configuration flag: this follows the same struts.parameters.requireAnnotations default (true\nsince 7.0) the rest of the framework already uses.\n\nAffects 7.0.0 through 7.4.0 (verified directly on 7.0.0, 7.3.0, 7.4.0): struts.parameters.requireAnnotations\u003dtrue\nhas been the default since the first 7.0 release, and AliasInterceptor has never checked it. Does NOT\naffect 6.x: requireAnnotations is not set in 6.x\u0027s default.properties at all (falls back to the Java\nfield default of false), so there is no default-on control to bypass there.\n\n* Gate the stack-resolved alias copy on struts.chaining.requireAnnotations\n\nAddresses review feedback from lukaszlenart on PR #1991 / WW-5758:\n\n1. The stack-to-stack branch now follows struts.chaining.requireAnnotations (default false,\n matching WW-5631\u0027s ChainingInterceptor precedent) instead of being unconditionally exempt.\n An application that has turned struts.chaining.requireAnnotations on now gets the same\n enforcement on an aliased copy of an already-resolved value that it gets from chaining.\n2. Rejections now log at WARN, matching ChainingInterceptor.java:250, since this is a\n behavior change for existing applications using the documented aliases example.\n3. Trimmed the in-file comment to the one thing not visible from the code (the WW-5631 split);\n the full reasoning is in the PR description.\n\n* Fix spurious WARN, trim comments, address remaining review feedback\n\nAddresses the rest of lukaszlenart\u0027s review on PR #1991 / WW-5758:\n\n- Fix: the @StrutsParameter check now runs only inside the value.isDefined() branch, so an alias\n whose source never resolves at all (neither on the stack nor as a request parameter) is no\n longer spuriously warned about and rejected - there was nothing to copy either way.\n- WARN wording now matches his suggested text exactly (\u0027not set on\u0027, not \u0027not copied to\u0027).\n- Trimmed every flagged comment: the production fallback comment back to one line, the WW-5631\n cross-reference to one line above the check, removed the two test-method comment blocks (name\n and assertions already say what they said), removed the field comments in\n AliasAuthorizationTestAction (clear from field names and the test), removed the XML fixture\u0027s\n comment block (clear from the action name and aliases).\n- Changed the HTTP parameter value in the first test from \u0027PWNED_VIA_ALIAS\u0027 to the plain\n \u0027value-from-request\u0027, matching the other fixtures in this class.\n- setRequireChainingAnnotations now uses BooleanUtils.toBoolean, matching\n ChainingInterceptor.setRequireAnnotations exactly.\n- default.properties: struts.chaining.requireAnnotations now mentions AliasInterceptor alongside\n ChainingInterceptor.\n- New test (testNoWarningWhenAliasSourceNeverResolvesAtAll, using LogCapture) proves the spurious-\n warning bug is fixed; red/green proven by temporarily reverting the check\u0027s position." }, { "commit": "87783686020a1417eb43669615fc7430ce452708", "tree": "55f19eb277b5fcc548f9585d746e7e4c00514525", "parents": [ "9aa77f7219db00c5ae1c7b728e0bca93d16e2053", "056a6f30824efb11183befe41b9c2d1e8a830789" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Tue Oct 06 17:18:53 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 17:18:53 2026 +0200" }, "message": "WW-5760 build(deps): bump OGNL from 3.4.14 to 3.4.15 (#1993)\n\nOGNL 3.4.15 (orphan-oss/ognl#660) no longer reports a property as settable when its only\nbacking member is a static or final field, so CompoundRootAccessor does not offer the\nparameter to an object that cannot take it. The new test pins that for a ModelDriven action.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "056a6f30824efb11183befe41b9c2d1e8a830789", "tree": "55f19eb277b5fcc548f9585d746e7e4c00514525", "parents": [ "9aa77f7219db00c5ae1c7b728e0bca93d16e2053" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Tue Oct 06 15:19:30 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Tue Oct 06 15:22:18 2026 +0200" }, "message": "WW-5760 build(deps): bump OGNL from 3.4.14 to 3.4.15\n\nOGNL 3.4.15 (orphan-oss/ognl#660) no longer reports a property as settable when its only\nbacking member is a static or final field, so CompoundRootAccessor does not offer the\nparameter to an object that cannot take it. The new test pins that for a ModelDriven action.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "9aa77f7219db00c5ae1c7b728e0bca93d16e2053", "tree": "7ebf1ff3d619a81346077e8ddec177b599b00b36", "parents": [ "dcfdec9480c1787f8bbabe11bf657d6efa9e0631" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Tue Oct 06 15:15:06 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 15:15:06 2026 +0200" }, "message": "WW-5759 Resolve @StrutsParameter accessors the way OGNL does (#1992)\n\n* WW-5759 fix(core): resolve @StrutsParameter accessors the way OGNL does\n\nOGNL 3.4.14 tries setuRange before setURange for uRange, and reaches getURL() for both\nuRL and URL, while StrutsParameterAuthorizer looked only for set/get plus the capitalised\nname and matched nested parameters against the java.beans property name. findBindableAccessor\nnow tries OGNL\u0027s accessor base names in OGNL\u0027s order, and the root property is normalised\nwith Introspector.decapitalize so the candidates match OGNL\u0027s for the name as written.\n\nBumps OGNL from 3.4.13 to 3.4.14.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-5759 test(core): pin that case variants of an accessor name bind nothing on a ModelDriven action\n\nThey resolve to no accessor on the model or the action and take the \"declared on neither\"\nroute, which is only safe while OGNL does not bind them either.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* WW-5759 chore(core): address Sonar findings on the accessor resolution change\n\nMake the non-null target contract of ultimateClass explicit, drop throws clauses the new\ntests do not need and record the values the probe setters receive.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "dcfdec9480c1787f8bbabe11bf657d6efa9e0631", "tree": "370efc023cb702167e27ce4429bd98f3b1c0adbe", "parents": [ "a2352599e142a519df26303ca466b3844a085905", "17a26bf34b9cb3864e7ab794af423112a44105a5" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Tue Oct 06 14:42:17 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 14:42:17 2026 +0200" }, "message": "Merge pull request #1989 from apache/WW-5757-bean-validation-message-template\n\nWW-5757 fix(bean-validation): resolve the constraint message template as the text key" }, { "commit": "17a26bf34b9cb3864e7ab794af423112a44105a5", "tree": "370efc023cb702167e27ce4429bd98f3b1c0adbe", "parents": [ "95f205802f70117cacb26fe4b41b31ce312221fb" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Mon Oct 05 16:46:18 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Mon Oct 05 16:46:18 2026 +0200" }, "message": "WW-5757 test(bean-validation): cover message encoding and lookup failure in resolveMessage\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "95f205802f70117cacb26fe4b41b31ce312221fb", "tree": "6bf60e1524188eaabdc607ff3ccb8170e6b840d7", "parents": [ "a2352599e142a519df26303ca466b3844a085905" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Mon Oct 05 16:13:01 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Mon Oct 05 16:13:01 2026 +0200" }, "message": "WW-5757 fix(bean-validation): resolve the constraint message template as the text key\n\nLook up ConstraintViolation#getMessageTemplate() in the Struts bundles and use\nthe provider\u0027s message as-is when no key matches. A template that only\nreferences a provider message key is not looked up.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a2352599e142a519df26303ca466b3844a085905", "tree": "92209cf10924f3df21ba6bbd4f7b292640079fcb", "parents": [ "e3613f96d51fcbb1dc462bfc0dbda4437275b37c", "765f8af3a98c5d5bb4c217386380cb52480eeddd" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Mon Oct 05 15:37:19 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 05 15:37:19 2026 +0200" }, "message": "Merge pull request #1988 from apache/docs/threat-model-s2-075-to-s2-078\n\ndocs: re-baseline THREAT_MODEL.md against S2-075 to S2-078" }, { "commit": "e3613f96d51fcbb1dc462bfc0dbda4437275b37c", "tree": "41739fbad434065c6d181a7c872aa77afaabee5a", "parents": [ "c8c7b4e0f6f45827d5590ec921919e2e5fd882cf", "153a789973fb24cde6dcf36a2e193f4efc8b314d" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Mon Oct 05 15:36:45 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 05 15:36:45 2026 +0200" }, "message": "docs(skills): carry the 7.4.0 / 6.12.0 advisory lessons into the release skills (#1987)\n\nFour baseline scenarios run against the previous skills, with project\nmemory off-limits, each failed:\n\n- Friday publication: no skill held advisories over a weekend; the\n rule existed only in memory.\n- Version Notes after publication: \"the notes may link it\" led to\n inline bulletin links in the type sections, no Security section.\n- CVE record: nothing on the record\u0027s fields, so ranges were merged\n across lines and the title double-prefixed.\n- After the mails: nothing past the send button; reporter notices,\n the site PR and the THREAT_MODEL.md section 12 check went unmentioned.\n\ncreating-security-bulletins gains a publication-day rule, a \"Filling\nthe CVE record\" section (house JSON shape: one range per bulletin line,\nMaven purl, text severity with the GENERAL scenario, four-part\ndescription, JSON-editor write path, READY as the PMC\u0027s last step) and\nan \"After the advisory mails\" checklist. creating-version-notes defines\nthe Security section, its place and its line format. releasing-struts\nupdates the phase 7 gate and the publication ordering.\n\nThe same four scenarios rerun against these edits all pass.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "765f8af3a98c5d5bb4c217386380cb52480eeddd", "tree": "c4b28c0f8de19cf85f33041e518dcc0f7ce80e9c", "parents": [ "c8c7b4e0f6f45827d5590ec921919e2e5fd882cf" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Mon Oct 05 14:13:04 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Mon Oct 05 14:13:04 2026 +0200" }, "message": "docs: re-baseline THREAT_MODEL.md against S2-075 to S2-078\n\nThe four bulletins published on 2026-10-05 fire the section 12 trigger:\nS2-076 is an amplification case that section 8.7\u0027s read-or-retain\nwording did not describe, and 7.4.0 / 6.12.0 added default controls.\n\n- 8.7 widened to cover bounded work on request-derived values\n (amplification); 8.6 to cover mutable objects reused from framework\n caches (S2-078).\n- 5a records the 7.4.0 / 6.12.0 controls: the REST body bound, the\n isolation interceptors in the plugin stacks, action-name validation\n in the legacy restful mapper.\n- 5a and 8.5 corrected: FetchMetadata / COOP / COEP have been in core\u0027s\n defaultStack, enabled, since 6.0 - not opt-in.\n- Q-default records S2-075 as evidence, without answering it.\n- 16 gains the S2-075 to S2-078 back-map; header and section 12 updated.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "153a789973fb24cde6dcf36a2e193f4efc8b314d", "tree": "41739fbad434065c6d181a7c872aa77afaabee5a", "parents": [ "c8c7b4e0f6f45827d5590ec921919e2e5fd882cf" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Mon Oct 05 10:02:30 2026 +0200" }, "committer": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Mon Oct 05 10:02:30 2026 +0200" }, "message": "docs(skills): carry the 7.4.0 / 6.12.0 advisory lessons into the release skills\n\nFour baseline scenarios run against the previous skills, with project\nmemory off-limits, each failed:\n\n- Friday publication: no skill held advisories over a weekend; the\n rule existed only in memory.\n- Version Notes after publication: \"the notes may link it\" led to\n inline bulletin links in the type sections, no Security section.\n- CVE record: nothing on the record\u0027s fields, so ranges were merged\n across lines and the title double-prefixed.\n- After the mails: nothing past the send button; reporter notices,\n the site PR and the THREAT_MODEL.md section 12 check went unmentioned.\n\ncreating-security-bulletins gains a publication-day rule, a \"Filling\nthe CVE record\" section (house JSON shape: one range per bulletin line,\nMaven purl, text severity with the GENERAL scenario, four-part\ndescription, JSON-editor write path, READY as the PMC\u0027s last step) and\nan \"After the advisory mails\" checklist. creating-version-notes defines\nthe Security section, its place and its line format. releasing-struts\nupdates the phase 7 gate and the publication ordering.\n\nThe same four scenarios rerun against these edits all pass.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "c8c7b4e0f6f45827d5590ec921919e2e5fd882cf", "tree": "3dcfd01ac457e7782894392950cf45897a75577a", "parents": [ "c0628dd182fce19f72cccb1c8205b01bf0471654" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Oct 02 08:07:56 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 06:07:56 2026 +0000" }, "message": "docs(skills): resolve Dependabot tickets via Jira transition id (#1985)\n\n* docs(skills): close Dependabot tickets manually in Jira\n\nThe Jira MCP cannot transition an Open WW ticket to Closed and there is\nno transition tool, so step 5 of merging-dependabot-prs now hands the\nticket over for manual closing as Fixed (first seen on WW-5755).\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* docs(skills): resolve Dependabot tickets via transition id 5\n\nReplaces the manual hand-over from the previous commit: the Jira MCP can\ntransition the ticket when given the transition id rather than a status\nor transition name. Verified on WW-5755.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "c0628dd182fce19f72cccb1c8205b01bf0471654", "tree": "414ab171304505d8239ecfd193e2ce4d80a9f3bc", "parents": [ "608662d55917ee5e2a25798cc20f532288ecb551" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 02 07:57:36 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 07:57:36 2026 +0200" }, "message": "build(deps): bump ognl:ognl from 3.4.12 to 3.4.13 (#1971)\n\nBumps [ognl:ognl](https://github.com/orphan-oss/ognl) from 3.4.12 to 3.4.13.\n- [Release notes](https://github.com/orphan-oss/ognl/releases)\n- [Commits](https://github.com/orphan-oss/ognl/commits)\n\n---\nupdated-dependencies:\n- dependency-name: ognl:ognl\n dependency-version: 3.4.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "608662d55917ee5e2a25798cc20f532288ecb551", "tree": "97434b2ba3c473968de924115429414d74e74d2e", "parents": [ "3ae18dfb96500c1ae063eb9765d89af71aa6a7ab" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 02 07:57:31 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 07:57:31 2026 +0200" }, "message": "build(deps): bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 (#1972)\n\nBumps org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.felix:maven-bundle-plugin\n dependency-version: 6.2.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "3ae18dfb96500c1ae063eb9765d89af71aa6a7ab", "tree": "c104d375c2a5366d28a796e9ffb28b07abc80dce", "parents": [ "f06fc305eeb9c8582a1ee28243b15aec69ec4faf" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 02 07:57:27 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 07:57:27 2026 +0200" }, "message": "build(deps-dev): bump byte-buddy.version from 1.18.13 to 1.18.14 (#1974)\n\nBumps `byte-buddy.version` from 1.18.13 to 1.18.14.\n\nUpdates `net.bytebuddy:byte-buddy` from 1.18.13 to 1.18.14\n- [Release notes](https://github.com/raphw/byte-buddy/releases)\n- [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md)\n- [Commits](https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.13...byte-buddy-1.18.14)\n\nUpdates `net.bytebuddy:byte-buddy-agent` from 1.18.13 to 1.18.14\n- [Release notes](https://github.com/raphw/byte-buddy/releases)\n- [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md)\n- [Commits](https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.13...byte-buddy-1.18.14)\n\n---\nupdated-dependencies:\n- dependency-name: net.bytebuddy:byte-buddy\n dependency-version: 1.18.14\n dependency-type: direct:development\n update-type: version-update:semver-patch\n- dependency-name: net.bytebuddy:byte-buddy-agent\n dependency-version: 1.18.14\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "f06fc305eeb9c8582a1ee28243b15aec69ec4faf", "tree": "49b643feabf4bbe9037fed28790992a31d8e3a17", "parents": [ "edf2982da0f68173ea2a263a18bb4e05e39dad05" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 02 07:57:22 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 07:57:22 2026 +0200" }, "message": "build(deps): bump org.webjars:webjars-locator-lite from 1.1.4 to 1.1.5 (#1975)\n\nBumps [org.webjars:webjars-locator-lite](https://github.com/webjars/webjars-locator-lite) from 1.1.4 to 1.1.5.\n- [Release notes](https://github.com/webjars/webjars-locator-lite/releases)\n- [Commits](https://github.com/webjars/webjars-locator-lite/compare/webjars-locator-lite-1.1.4...webjars-locator-lite-1.1.5)\n\n---\nupdated-dependencies:\n- dependency-name: org.webjars:webjars-locator-lite\n dependency-version: 1.1.5\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "edf2982da0f68173ea2a263a18bb4e05e39dad05", "tree": "e39938708509b50d690ee6ffa5548ec4423c7c24", "parents": [ "54a1ca3ff61c40f0c9e26dacf81c0823ec4809fa" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 02 07:57:17 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 07:57:17 2026 +0200" }, "message": "build(deps): bump github/codeql-action from 4.38.0 to 4.38.2 (#1978)\n\nBumps [github/codeql-action](https://github.com/github/codeql-action) from 4.38.0 to 4.38.2.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/v4.38.0...v4.38.2)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action\n dependency-version: 4.38.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "54a1ca3ff61c40f0c9e26dacf81c0823ec4809fa", "tree": "40f4db8c7f260b9b3d1b401536c5c9e9b5d467a2", "parents": [ "707108b937e35d3d86188f6be588abbbd71a846c" ], "author": { "name": "ⳕⲛτⲉⲅⲥⲉⳏτⲟⲅ 🕵🏻", "email": "192411347+g0w6y@users.noreply.github.com", "time": "Fri Oct 02 11:23:42 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 07:53:42 2026 +0200" }, "message": "WW-5752 Normalize request-derived values in log messages (#1982)\n\n* WW-5752 Normalize request-derived values in log messages\n\nRequest-derived strings were logged unchanged, so a decoded line break in a URL path, parameter name, locale or JSON key produced forged log lines. Apply normalizeSpace, as TokenHelper, the multipart classes and ParametersInterceptor already do.\n\n* WW-5752 Normalize the token name in the missing-token debug message\n\nReview follow-up: validToken() still logged the request-supplied token name unchanged.\n\n---------\n\nCo-authored-by: Gouri Sankar A \u003cgourisankara@Gouris-MacBook-Air.local\u003e" }, { "commit": "707108b937e35d3d86188f6be588abbbd71a846c", "tree": "c5130759f93c7b64fe1638ae755dbd1159cc6b5f", "parents": [ "972fd8a02320834ab73082b68cc7baef22f13595", "9d2a40186e61c4fe05aaffce58dca953cc993106" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Thu Oct 01 20:45:51 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 01 20:45:51 2026 +0200" }, "message": "Release 7.4.0 RC-1 (#1968)\n\n* [maven-release-plugin] prepare release STRUTS_7_4_0\n\n* [maven-release-plugin] prepare for next development iteration" }, { "commit": "972fd8a02320834ab73082b68cc7baef22f13595", "tree": "a40791d7590e347a8f8cb1bf58a27c6cb5e8b8e1", "parents": [ "1d92b07b06c3b91ad5a4febc08b1800d0dec29fe" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Thu Oct 01 20:45:16 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 01 20:45:16 2026 +0200" }, "message": "WW-5751 Treat a negative maximumSize as no upload size limit (#1976)\n\n* WW-5751 fix(core): treat a negative maximumSize as no upload size limit\n\nSince 7.3.0 a maximumSize param that cannot be applied marks the upload\npolicy unresolved and the upload is rejected. The literal \"null\" some\nconfigurations used to lift the limit only worked in 7.2.1 because its\nconversion error was silently ignored, so it now rejects every upload.\n\nA negative maximumSize, e.g. -1, is now the explicit way to disable the\nsize check. Before this change -1 rejected every upload.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* WW-5751 refactor(core): extract the upload size check into a protected method\n\nexceedsMaximumSize(UploadPolicy, UploadedFile) lets a subclass of the\nupload interceptor replace the per-file size check.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* WW-5751 fix(core): format the too-large message without a maximum size\n\nAn overridden exceedsMaximumSize can reject a file when no maximumSize is\nconfigured; formatting the null size then threw IllegalArgumentException\ninstead of reporting the validation error.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 (1M context) \u003cnoreply@anthropic.com\u003e" }, { "commit": "1d92b07b06c3b91ad5a4febc08b1800d0dec29fe", "tree": "89a2e90c3fc5d0fd84c409bb4681e97700d99d53", "parents": [ "3e428e43879548af39293dd74a92e2e5ccfbef56" ], "author": { "name": "ⳕⲛτⲉⲅⲥⲉⳏτⲟⲅ 🕵🏻", "email": "192411347+g0w6y@users.noreply.github.com", "time": "Fri Oct 02 00:00:07 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 01 20:30:07 2026 +0200" }, "message": "WW-5753 Reject cross-site non-GET navigations and cross-site GET subresource requests in the Fetch Metadata policy (#1983)\n\nA cross-site request was accepted when it was a navigation or a GET. The documented policy and the Fetch Metadata reference policy require a navigation and a GET.\n\nCo-authored-by: Gouri Sankar A \u003cgourisankara@Gouris-MacBook-Air.local\u003e" }, { "commit": "3e428e43879548af39293dd74a92e2e5ccfbef56", "tree": "743cbe483e1a91226c975f7cb53f00c1f7dae653", "parents": [ "e5fb8e91d7673792d77b661075e95e704991ccc4" ], "author": { "name": "Lukasz Lenart", "email": "lukaszlenart@apache.org", "time": "Fri Sep 25 10:53:00 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 25 08:53:00 2026 +0000" }, "message": "docs: drop derivable layout and architecture sections from CLAUDE.md (#1977)\n\nCLAUDE.md is loaded into every Claude Code session. The Project Structure\ntree and the Core Architecture tour restate what `ls` and the source already\nshow, and the Testing section repeated the build command listed above it.\nKeep what a session cannot derive: the version gotcha, the non-standard\nbuild flags, security patterns and pointers, the JUnit 3/4 trap, PR rules.\n\nThe Copilot code-review skill described CLAUDE.md by the removed sections;\npoint it at what the file still covers.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" } ], "next": "e5fb8e91d7673792d77b661075e95e704991ccc4" }