Status: DRAFT
Java 17
From this version of Struts, the framework requires Java 17 at least to run
Jakarta Servlet API 6
Struts 7.x.x requires a servlet container which supports Jakarta Servlet API 6 at least, it won't work with older versions.
Stronger security
The following constants have changed to increase the overall security of the framework. These are breaking changes, and can stop your application:
struts.ognl.allowStaticFieldAccess=false struts.ognl.expressionMaxLength=150 struts.disallowDefaultPackageAccess=true struts.disallowProxyMemberAccess=true struts.parameters.requireAnnotations=true struts.ognl.disallowCustomOgnlMap=true struts.allowlist.enable=true
Please read more details in OGNL Member Access and Struts OGNL Guard.
New constants
| Constant name | Description |
|---|---|
Deprecated interfaces
A set of action related interfaces have been marked as deprecated. These interfaces have a new proper versions in another package, please start using the new versions as the depretacted interfaces will be removed with the next major release.
| Deprecated | New version |
|---|---|
File upload support
Temp/Work directory of ApplicationServer/ServletContainer
Users reported it was necessary for them to remove temp/work directory of their ApplicationServer/ServletContainer. Likely to force server to recompile JSPs.