Security Update #Bump org.apache.struts:struts2-core from 2.3.1 to 6.3.0.2

[GCbeheo]

Bumps org.apache.struts:struts2-core from 2.3.1 to 6.3.0.2.

Release notes

Sourced from org.apache.struts:struts2-core's releases.

Struts 6.3.0

What's Changed

• [WW-5327] Stop using JavaBeans notation for setters in SecurityMemberAccess & MemberAccessValueStack by @​lukaszlenart in apache/struts#715
• [WW-5233] Include Apache Tiles code base in the Tiles plugin by @​lukaszlenart in apache/struts#608
• Update StreamResult.java - fix misspell by @​ervinpm in apache/struts#723
• WW-5332 Add validation for package name parsing by @​kusalk in apache/struts#726
• [WW-5327] Removes duplicated exclusion by @​lukaszlenart in apache/struts#729
• Uses Java 17 to perform Code Quality check by @​lukaszlenart in apache/struts#730
• WW-5334 Enable usage of junit-plugin inside velocity-plugin by @​kusalk in apache/struts#732
• [WW-5331] Uses proper signature of get() by @​lukaszlenart in apache/struts#727
• WW-5334 Extract ConventionJUnit4Test into correct module by @​kusalk in apache/struts#733
• Defines a proper CODEOWNERS file by @​lukaszlenart in apache/struts#728
• WW-5334 Misc VelocityManager code cleanup by @​kusalk in apache/struts#731
• WW-5337 Make SecurityMemberAccess exclusion checking more performant by @​kusalk in apache/struts#736
• WW-5336 Deprecate OgnlTool by @​kusalk in apache/struts#735
• WW-5334 Fix empty chained context names in VelocityManager by @​kusalk in apache/struts#744

Dependencies

• [WW-5315] Upgrades ASM to version 9.5 by @​lukaszlenart in apache/struts#695
• [WW-5316] Upgrades commons-io to version 2.13.0 by @​lukaszlenart in apache/struts#697
• [WW-5317] Upgrades log4j to version 2.20.0 by @​lukaszlenart in apache/struts#698
• upgrade Felix Maven Bundle Plugin by @​hboutemy in apache/struts#696
• Feature/update maven dependency plugin by @​sepe81 in apache/struts#699
• [WW-5318] Upgrades slf4j to version 2.0.7 by @​lukaszlenart in apache/struts#700
• Bump actions/upload-artifact from 3.1.0 to 3.1.2 by @​dependabot in apache/struts#702
• Bump actions/cache from 3.0.8 to 3.3.1 by @​dependabot in apache/struts#705
• Bump osgi.core from 7.0.0 to 8.0.0 by @​dependabot in apache/struts#701
• Bump stax2-api from 4.2 to 4.2.1 by @​dependabot in apache/struts#703
• Bump ossf/scorecard-action from 2.0.6 to 2.2.0 by @​dependabot in apache/struts#704
• Bump assertj-core from 3.15.0 to 3.24.2 by @​dependabot in apache/struts#707
• Bump jaxb-impl from 2.3.2 to 4.0.3 by @​dependabot in apache/struts#708
• Bump net.sf.jasperreports:jasperreports from 6.19.1 to 6.20.5 by @​dependabot in apache/struts#709
• Bump jackson.version from 2.14.1 to 2.15.2 by @​dependabot in apache/struts#713
• [WW-5325] Upgrades commons-lang3 to version 2.13.0 by @​lukaszlenart in apache/struts#714
• [WW-5329] Upgrades xstream to version 1.4.20 by @​lukaszlenart in apache/struts#721
• Drops duplicated dependency by @​lukaszlenart in apache/struts#737

New Contributors

• @​ervinpm made their first contribution in apache/struts#723

Full Changelog: apache/struts@STRUTS_6_2_0...STRUTS_6_3_0

Struts 6.2.0

What's Changed

• Updates OWASP suppressions as some reports are false positive by @​lukaszlenart in apache/struts#637
• Defines to autolink PRs to issues in ASF JIRA by @​lukaszlenart in apache/struts#638
• [WW-5263] Uses proper names for CSP, COOP and COEP interceptors by @​lukaszlenart in apache/struts#639
• [WW-5262] Extracts excluded classes and beans into dedicated XML config files by @​lukaszlenart in apache/struts#640

... (truncated)

Commits

• See full diff in compare view