Apache Struts 7.3: What's New, Release History & Support Lifecycle

What Is New in Struts 7.3

What does WebJars support in Struts 7.3 change for static resource handling?

Struts 7.3 adds native WebJars support to the core framework, letting you pull front-end libraries like jQuery or Bootstrap in as versioned Maven/Gradle dependencies instead of manually vendoring JS and CSS files into your webapp. The resolution logic lives behind the new StrutsWebJarUrlProvider (a rename of the earlier DefaultWebJarUrlProvider), which maps requests to the correct jar-packaged asset at runtime.

In practice, this matters if you currently manage third-party static assets by hand in webapp/js or webapp/css directories. Moving those to WebJars gives you dependency-managed versioning and CVE tracking through your build tool instead of ad hoc file copies. Most teams adopting this will want to review the sample applications, which were also updated to Bootstrap 5.3.x during this cycle as a reference implementation.

Watch out for the provider rename if you had any custom code referencing DefaultWebJarUrlProvider directly -- update those references to StrutsWebJarUrlProvider before upgrading.

How does Struts 7.3 improve JSON plugin thread safety and serialization?

Struts 7.3 confines StrutsJSONReader and StrutsJSONWriter parse and write state to the thread handling the request, closing a class of bugs where concurrent requests on a shared instance could corrupt or leak each other's JSON state. On top of that, JSONInterceptor now obtains a fresh reader/writer per request rather than reusing a shared instance.

This matters if your application handles JSON-heavy REST endpoints under load, since the previous behavior could produce intermittent, hard-to-reproduce data corruption in high-concurrency environments. In addition, the JSON plugin can now serialize Java records and Optional values directly:

public record UserDto(String name, Optional<String> nickname) {}

Parameter filtering during JSON population was also tightened so that accepted-name and include patterns are evaluated correctly at nested-leaf keys, and the struts.json.writer / struts.json.reader override properties -- lost in an earlier refactor -- are restored.

What security-related fixes should drive an upgrade to Struts 7.3?

Struts 7.3 tightens several request-handling paths that affect both security posture and stability. @StrutsParameter authorization is now correctly enforced on record and creator-bound REST body properties, closing a gap where those properties could bypass parameter authorization checks. Static content paths are canonicalized before serving, removing a redundant URL decode step that could otherwise be a source of path-traversal ambiguity.

• Input length limits are now applied consistently when reading request bodies
• Small in-memory multipart uploads skip unnecessary disk writes
• The file upload interceptor counts only files toward maxFiles and adds a maxParameterCount setting to cap the number of request parameters
• CDI/Weld client proxies are now correctly recognized in SecurityMemberAccess, avoiding false rejections in CDI-based applications

Most teams running Struts behind a public-facing REST API or handling file uploads should treat this release as a priority upgrade, since these fixes directly affect input validation and request-parameter authorization.

What performance and caching improvements does Struts 7.3 include?

Struts 7.3 ships concurrency performance enhancements in the core invocation path along with several new or improved caches. AbstractLocalizedTextProvider now caches resolved text, with bounded cache sizes and request-locale resolution aligned to avoid stale or mismatched locales under concurrent load. The XSLT template cache switched to a ConcurrentHashMap, removing a synchronization bottleneck for applications rendering XSLT results frequently.

In practice, this matters most for high-traffic applications with heavy internationalization (many locale bundles) or XSLT-based result types, where the previous caches could become contention points. Lazy interceptor parameters are also now resolved per invocation rather than eagerly, which can reduce unnecessary work on the request path.

What validation and type-conversion bugs were fixed in Struts 7.3?

Struts 7.3 fixes a visitor-validator cache-key collision that could occur under wildcard actions, where two different wildcard-mapped actions could incorrectly share a cached validator. Annotated wildcard actions are now ordered most-specific-first, so overlapping wildcard patterns resolve predictably instead of depending on registration order.

• An opt-in setting now allows skipping field validators when a field already has a conversion error, reducing duplicate or misleading validation messages
• ConversionRule prefixes for @TypeConversion keys are now derived automatically
• A regression test was added covering conversion errors on aliased properties

This matters if you rely heavily on wildcard action mappings with per-action validation, since the cache-collision fix directly affects which validator rules get applied to a given request.