Apache Struts Forward Compatibility 1.3 Release Notes

Notes

• Upload limits now apply as configured. maxSize limits the whole request, and maxFileSize each file; earlier 1.4 releases ignored maxSize and applied maxFileSize to both. If you set maxFileSize but not maxSize, your request limit is now the 250M default; to keep the old one, set maxSize to your maxFileSize value. maxHeaderSize now applies; earlier 1.4 releases always used 512 bytes. See Earlier releases for these and a memFileSize change.
• Multipart text fields that don't name a charset, which is what browsers send, are now decoded with the request's character encoding, as in Apache Struts 1.3.10. Earlier 1.4 releases always decoded them as ISO-8859-1, so non-ASCII text arrived garbled on containers that set a request encoding, such as Tomcat 10 and later. If your application re-decodes these values as UTF-8 to work around that, remove the workaround: it now corrupts the text. Without a request encoding, text is still decoded as ISO-8859-1.
• Serializable classes now declare Apache Struts 1.3.10's serialVersionUID values, so objects that Apache Struts 1.3.10 serialized, for example in a persisted or replicated HTTP session, deserialize on NES instead of failing with InvalidClassException.

Dependency Upgrades

• org.apache.commons:commons-fileupload2-core 2.0.0-M4 -> 2.0.0-M5
• org.apache.commons:commons-fileupload2-jakarta-servlet5 2.0.0-M4 -> 2.0.0-M5
• commons-io:commons-io 2.19.0 -> 2.21.0 (through commons-fileupload2-core)

Notes

• struts-core now tolerates a request that specifies no character encoding when handling multipart/form-data uploads. Containers that do not default the request encoding — including Eclipse Jetty, WildFly (Undertow) and GlassFish — previously failed every multipart upload with IllegalArgumentException: Null charset name. Apache Tomcat was unaffected, as it defaults the request encoding to UTF-8.

Notes

• struts-tiles removed its dependency on commons-io, as it is no longer required.
• struts-core now uses a more efficient implementation for its security-related regular expression.

Notes

• Added sources jar to the published artifacts.

Notes

• updates to struts-faces to fully support Jakarta EE 9

Notes

• This release originates from NES for Apache Struts 1.3.x and is designed to be compatible with Jakarta EE environments.

Dependency Upgrades

• commons-fileupload 2.0.0-M1
• Jakarta EE 9 compatibility:
  • jakarta.faces-api 3.0.0
  • jakarta.servlet-api 5.0.0
  • jakarta.servlet.jsp-api 3.0.0
  • jakarta.el-api 4.0.0 Full Version: 1.3.10-struts-1.4.0