[snyk-io]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• todolist-goof/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Asymmetric Resource Consumption (Amplification) SNYK-JAVA-ORGAPACHESTRUTS-21816516	721	org.apache.struts:struts2-core: 2.3.20 -> 6.12.0 org.apache.struts:struts2-spring-plugin: 2.3.20 -> 6.12.0 Major version upgrade No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[snyk-io]

This is a major version upgrade from Struts 2.3.x to 6.x, which represents a multi-generational leap with extensive breaking changes. This is not a simple dependency update but a significant migration project that will require a full codebase audit, refactoring, and extensive testing.

Key Breaking Changes:

• Mandatory Environment Upgrades:

  • Java: Struts 6.x requires a minimum of Java 8.
  • Servlet API: Struts 6.x requires Servlet API 3.1 or newer, which is a significant jump from the Servlet 2.4/2.5 API supported by Struts 2.3.

• OGNL (Object-Graph Navigation Language) Restrictions:

  • Static Method Access Removed: A critical breaking change is the complete removal of static method access from OGNL expressions (e.g., @com.my.Class@myStaticMethod()). This security-hardening measure requires rewriting all such expressions to use Action methods to expose data.
  • Expression Length Limit: OGNL expressions are now limited to 256 characters by default, which may break complex expressions in JSPs.

• Core API and Package Changes:

  • The internal XWork package structure has been reorganized, requiring updates to import statements across Action classes and other components.
  • Numerous classes, methods, and constants have been deprecated or removed. For example, ServletActionContext.ACTION_NAME must be replaced with ActionContext.getContext().getActionName().

• Configuration and Plugin Changes:

  • The struts.xml file's DOCTYPE declaration must be updated to the struts-6.0.dtd.
  • The struts2-spring-plugin is upgraded alongside the core, but its behavior is subject to all the core breaking changes. The fundamental integration pattern remains, but the application code must be adapted.
  • Many plugins from the 2.x era have been removed or replaced, such as the Tiles plugin, which was re-implemented within the Struts project after Apache Tiles was retired.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.