What Is New in Apache Struts 6.3
Struts 6.3 is a maintenance release that brings the framework up to date with its latest dependencies and addresses several key issues. Here's a quick summary of the changes.
| Category | Description |
|---|---|
| Dependency Upgrades | Core updates to Log4j 2, Tiles, and Pluggable Validator. |
| Bug Fixes | Resolves issues with file uploads, OGNL expressions, and the Sitemesh plugin. |
| Improvements | Enhanced Content Security Policy (CSP) support and annotation processing. |
| Deprecations | Continued removal of deprecated, legacy code paths. |
What dependency updates should I be aware of in Struts 6.3?
The most immediate change is the bump in underlying library versions. This matters because it ensures compatibility and pulls in the latest fixes from those projects.
The framework now requires Apache Log4j 2.23.1, Apache Tiles 3.0.10, and Pluggable Validator 1.3.0. In practice, you'll need to align your project's dependency tree to avoid conflicts with older versions of these libraries.
Were there any critical bug fixes for file handling?
Yes, a significant bug related to file uploads was squashed. The issue was that the FileUpload interceptor would incorrectly throw an exception for requests without any multipart content.
This was a problem because it broke actions that conditionally handled file uploads. Now, the interceptor correctly skips non-multipart requests, which is how most of us expected it to work in the first place.
How has Content Security Policy support improved?
Struts 6.3 adds a new interface to make working with CSP nonces easier. The CspNonceProvider interface allows for custom implementations to generate and manage nonces.
This is useful if you need fine-grained control over your CSP headers beyond the default implementation. It integrates directly with the existing CspInterceptor, making the setup straightforward.
What's the deal with the Sitemesh plugin changes?
The Sitemesh plugin received a fix for a long-standing issue where the decorator parameter was being ignored when using the sitemesh result type. The parameter is now properly recognized and applied.
If your project uses Sitemesh for page templating, this fix finally makes the decorator parameter work as documented, giving you more dynamic control over your page layouts.
FAQ
Is Struts 6.3 a major breaking change from 6.2?
No, it's a maintenance release. The primary focus is on dependency upgrades and bug fixes. You should be able to upgrade from 6.2.x without major refactoring, but always check your dependency versions.
I use OGNL expressions extensively. Are there any changes?
Yes, a bug was fixed where an OGNL expression like %{''} would incorrectly return the value stack instead of an empty string. This fix ensures expression evaluation is more predictable.
Does the Log4j 2.23.1 upgrade address the recent security vulnerabilities?
Yes, upgrading to Log4j 2.23.1 includes fixes for security vulnerabilities that were present in earlier versions. This is a recommended upgrade for all Struts 6 applications.
What happens if I don't upgrade my Pluggable Validator dependency?
Struts 6.3 now requires Pluggable Validator 1.3.0. If your project pulls in an older version, you might encounter classloading issues or missing method errors at runtime.
Are there any new deprecations I need to plan for?
This release continues the removal of code that was previously deprecated. While no new deprecations are announced here, you should expect the ongoing cleanup of legacy APIs in future versions.