You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@struts.apache.org by Apache Jenkins Server <je...@builds.apache.org> on 2026/10/22 06:39:44 UTC
Build failed in Jenkins: Struts » Struts-master-dependency-check #267
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/267/display/redirect?page=changes>
Changes:
[Lukasz Lenart] [maven-release-plugin] prepare release STRUTS_7_4_0
[Lukasz Lenart] [maven-release-plugin] prepare for next development iteration
[github] WW-5753 Reject cross-site non-GET navigations and cross-site GET subresource requests in the Fetch Metadata policy (#1983)
[github] WW-5751 Treat a negative maximumSize as no upload size limit (#1976)
[github] WW-5752 Normalize request-derived values in log messages (#1982)
[github] build(deps): bump github/codeql-action from 4.38.0 to 4.38.2 (#1978)
[github] build(deps): bump org.webjars:webjars-locator-lite from 1.1.4 to 1.1.5 (#1975)
[github] build(deps-dev): bump byte-buddy.version from 1.18.13 to 1.18.14 (#1974)
[github] build(deps): bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 (#1972)
[github] build(deps): bump ognl:ognl from 3.4.12 to 3.4.13 (#1971)
[github] docs(skills): resolve Dependabot tickets via Jira transition id (#1985)
[Lukasz Lenart] docs(skills): carry the 7.4.0 / 6.12.0 advisory lessons into the release skills
[Lukasz Lenart] docs: re-baseline THREAT_MODEL.md against S2-075 to S2-078
[Lukasz Lenart] WW-5757 fix(bean-validation): resolve the constraint message template as the text key
[Lukasz Lenart] WW-5757 test(bean-validation): cover message encoding and lookup failure in resolveMessage
[github] WW-5759 Resolve @StrutsParameter accessors the way OGNL does (#1992)
[Lukasz Lenart] WW-5760 build(deps): bump OGNL from 3.4.14 to 3.4.15
[github] WW-5758 Enforce @StrutsParameter authorization in AliasInterceptor's raw-parameter fallback (#1991)
[Lukasz Lenart] docs: drop the hard-coded version from CLAUDE.md
[github] build(deps-dev): bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 (#1999)
[github] build(deps): bump org.apache.maven:apache-maven from 3.9.16 to 3.10.0 (#1996)
[github] build(deps): WW-5763 bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 (#1997)
[github] build(deps): WW-5764 bump com.github.ben-manes.caffeine:caffeine from 3.2.4 to 3.3.0 (#1995)
[Lukasz Lenart] chore: hand Dependabot tickets back open and read fix versions from Jira
[Lukasz Lenart] WW-3364 feat(json): use registered type converters in JSON serialization
[Lukasz Lenart] WW-3364 refactor(json): extract processObject to reduce process() complexity
[Lukasz Lenart] WW-3447 test(convention): cover action-mapping flags with no tests
[Lukasz Lenart] WW-3464 test(config): pin first-match-wins wildcard order
[github] WW-3476 Add package-scoped constants (#2005)
[Lukasz Lenart] WW-5766 feat(config): map struts.scopedConstantProvider in ConstantConfig
[github] WW-5767 Apply value substitution to scoped-constant values (#2007)
[github] WW-5768 Make struts.ui.theme and struts.ui.templateDir scopable per package (#2008)
[Lukasz Lenart] build(ci): detect changes in-job and cancel superseded PR runs
[github] WW-5770 Make struts.convention.result.path scopable per package (#2009)
[github] build(ci): build a reduced matrix on pull requests (#2011)
[github] WW-5772 Remove inline event handlers from optiontransferselect, inputtransferselect, updownselect and combobox (#2012)
[github] build(deps): bump ognl:ognl from 3.4.15 to 3.4.16 (#2014)
[github] build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 (#2015)
[github] build(deps-dev): bump org.codehaus.mojo:versions-maven-plugin from 2.22.0 to 2.23.0 (#2016)
[github] build(deps): bump mikepenz/action-junit-report from 6.5.0 to 6.6.1 (#2017)
[github] build(deps): bump github/codeql-action from 4.38.2 to 4.38.3 (#2018)
[github] build(deps): bump com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.3 (#2019)
[github] build(deps-dev): bump org.apache.tomcat.embed:tomcat-embed-core from 11.0.26 to 11.0.27 (#2020)
[github] build(ci): align GitHub Actions with the ASF Actions policy (#2024)
[github] WW-5765 fix(interceptor): re-store only the token validated in the request in execAndWait (#2022)
[github] WW-5780 fix(html5): close the checkbox input in the html5 checkboxlist template (#2025)
[github] WW-5781 fix(tags): render a single class and style on checkboxlist and radio inputs (#2026)
[github] WW-5782 fix(tags): document and warn that s:a href ignores nested params (#2034)
[github] WW-3624 feat(tags): allow regex matching of field names on fielderror tag (#2036)
[github] WW-3655 test(freemarker): guard against resolving the result location from the request URI (#2037)
[Lukasz Lenart] WW-3717 feat(core): restrict an action to HTTP methods with an http-method attribute
[Lukasz Lenart] WW-3717 fix(core): resolve the bad-request result like the action invocation does
[Lukasz Lenart] WW-3717 fix(core): look up the unknown handler manager when a request is rejected
[Lukasz Lenart] WW-3717 refactor(core): address Sonar findings on the http-method change
[github] WW-3666 Trim surrounding whitespace before converting to non-String types (#2039)
[github] WW-3720 test(core): cover comma-delimited interceptor params split across lines (#2040)
[github] WW-3792 test(core): pin css_xhtml checkbox left-label wrappers to match other controls (#2041)
------------------------------------------
Started by timer
Running as SYSTEM
[EnvInject] - Loading node environment variables.
Building remotely on builds24 (ubuntu) in workspace <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/>
The recommended git tool is: NONE
No credentials specified
> git rev-parse --resolve-git-dir <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/.git> # timeout=10
Fetching changes from the remote Git repository
> git config remote.origin.url https://gitbox.apache.org/repos/asf/struts.git # timeout=10
Fetching upstream changes from https://gitbox.apache.org/repos/asf/struts.git
> git --version # timeout=10
> git --version # 'git version 2.34.1'
> git fetch --tags --force --progress -- https://gitbox.apache.org/repos/asf/struts.git +refs/heads/*:refs/remotes/origin/* # timeout=10
> git rev-parse refs/remotes/origin/main^{commit} # timeout=10
Checking out Revision 638291af96dd5822909394ee7ddf2e95e26c83e1 (refs/remotes/origin/main)
> git config core.sparsecheckout # timeout=10
> git checkout -f 638291af96dd5822909394ee7ddf2e95e26c83e1 # timeout=10
Commit message: "WW-3792 test(core): pin css_xhtml checkbox left-label wrappers to match other controls (#2041)"
> git rev-list --no-walk 3e428e43879548af39293dd74a92e2e5ccfbef56 # timeout=10
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
[Struts-master-dependency-check] $ /bin/sh -xe /tmp/jenkins14070635496914086904.sh
+ export MAVEN_OPTS=-Xms2g -Xmx2g
+ /home/jenkins/tools/maven/latest3/bin/mvn verify -Pdependency-check
[INFO] Scanning for projects...
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO]
[INFO] Struts 2 [pom]
[INFO] Struts BOM [pom]
[INFO] Struts Parent POM [pom]
[INFO] Struts 2 Jakarta EE Compatible modules [pom]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View [jar]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp [jar]
[INFO] Struts 2 Core [jar]
[INFO] Struts 2 Plugins [pom]
[INFO] Struts 2 Async Plugin [jar]
[INFO] Struts 2 Bean Validation Plugin [jar]
[INFO] Struts 2 CDI Plugin [jar]
[INFO] Struts 2 Spring Plugin [jar]
[INFO] Struts 2 JUnit Plugin [jar]
[INFO] Struts 2 Velocity Plugin [jar]
[INFO] Struts 2 Configuration Browser Plugin [jar]
[INFO] Struts 2 Convention Plugin [jar]
[INFO] Struts 2 Jasper Reports Plugin [jar]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] [jar]
[INFO] Struts 2 Java Templates Plugin [jar]
[INFO] Struts 2 JFreeChart Plugin [jar]
[INFO] Struts 2 JSON Plugin [jar]
[INFO] Struts 2 REST Plugin [jar]
[INFO] Struts 2 TestNG Plugin [jar]
[INFO] Struts 2 Tiles Plugin [jar]
[INFO] Struts 2 XSLT Plugin [jar]
[INFO] Struts 2 Webapps [pom]
[INFO] Struts 2 Showcase Webapp [war]
[INFO] Struts 2 Rest Showcase Webapp [war]
[INFO] Struts 2 Assembly [pom]
[INFO]
[INFO] -----------------< org.apache.struts:struts2-project >------------------
[INFO] Building Struts 2 7.5.0-SNAPSHOT [1/29]
[INFO] from pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce) @ struts2-project ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.BannedDependencies passed
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce-maven-version) @ struts2-project ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.version.RequireMavenVersion passed
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce-java-version) @ struts2-project ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.version.RequireJavaVersion passed
[INFO]
[INFO] --- dependency-check:13.0.0:check (default) @ struts2-project ---
[INFO] Checking for updates
[ERROR] Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:387)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:873)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:678)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:605)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2072)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1272)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:919)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:285)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:207)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77)
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:569)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314)
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: Invalid API Key, length of 0 too short to provided a masked partial key
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:436)
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next (NvdCveClient.java:356)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:343)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:873)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:678)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:605)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2072)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1272)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:919)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:285)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:207)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77)
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:569)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314)
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (14173 ms)
[INFO] Check for updates complete (16796 ms)
[WARNING] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Created CPE Index (5 seconds)
[INFO] Finished CPE Analyzer (5 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (5 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/target/dependency-check-report.html>
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.5.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... FAILURE [ 27.937 s]
[INFO] Struts BOM ......................................... SKIPPED
[INFO] Struts Parent POM .................................. SKIPPED
[INFO] Struts 2 Jakarta EE Compatible modules ............. SKIPPED
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SKIPPED
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SKIPPED
[INFO] Struts 2 Core ...................................... SKIPPED
[INFO] Struts 2 Plugins ................................... SKIPPED
[INFO] Struts 2 Async Plugin .............................. SKIPPED
[INFO] Struts 2 Bean Validation Plugin .................... SKIPPED
[INFO] Struts 2 CDI Plugin ................................ SKIPPED
[INFO] Struts 2 Spring Plugin ............................. SKIPPED
[INFO] Struts 2 JUnit Plugin .............................. SKIPPED
[INFO] Struts 2 Velocity Plugin ........................... SKIPPED
[INFO] Struts 2 Configuration Browser Plugin .............. SKIPPED
[INFO] Struts 2 Convention Plugin ......................... SKIPPED
[INFO] Struts 2 Jasper Reports Plugin ..................... SKIPPED
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... SKIPPED
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 30.042 s
[INFO] Finished at: 2026-10-22T06:39:43Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:13.0.0:check (default) on project struts2-project: One or more exceptions occurred during dependency-check analysis: One or more exceptions occurred during analysis:
[ERROR] UpdateException: Error updating the NVD Data
[ERROR] caused by NvdApiException: Invalid API Key, length of 0 too short to provided a masked partial key
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #268
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/268/display/redirect?page=changes>
Changes:
[github] build(deps): bump github/codeql-action/upload-sarif from 4.38.2 to 4.39.0 (#2047)
[github] build(deps): bump github/codeql-action from 4.38.3 to 4.39.0 (#2046)
[github] build(deps): bump org.mockito:mockito-core from 5.23.0 to 5.24.0 (#2031)
[github] build(deps): bump org.webjars.npm:bootstrap-icons from 1.13.1 to 1.13.2 (#2029)
[github] build(deps): bump org.sitemesh:sitemesh from 3.2.3 to 3.3.0 (#2028)
[github] build(deps): bump com.github.ben-manes.caffeine:caffeine from 3.3.0 to 3.3.1 (#2027)
[github] build(deps): WW-5779 bump asm.version from 9.10.1 to 9.11 (#2030)
[github] WW-3576 Keep SessionMap in step with the HttpSession (#2042)
[Lukasz Lenart] WW-4323 test(core): pin that ParameterNameAware cannot accept an excluded name
[Lukasz Lenart] WW-5789 fix(rest): keep params-bound values when the body handler binds nothing
[Lukasz Lenart] WW-5790 fix(rest): copy only what the body handler changed in the two-phase copy
[Lukasz Lenart] WW-5790 docs: implementation plan for the two-phase copy baseline
[Lukasz Lenart] WW-5790 fix(rest): compare nested beans leaf by leaf against a same-class baseline
[Lukasz Lenart] WW-5790 refactor(rest): read the baseline value only when a comparison needs it
[Lukasz Lenart] WW-5786 test(convention): pin HTTP method enforcement on Convention actions
[Lukasz Lenart] WW-5791 docs: design for Struts Boot
[Lukasz Lenart] WW-5791 docs: implementation plan for Struts Boot
[Lukasz Lenart] WW-5791 feat(boot): add struts2-boot-starter module with fluent action registry
[Lukasz Lenart] WW-5791 feat(boot): translate the action registry into Struts package configs
[Lukasz Lenart] WW-5791 feat(boot): read port and context path from struts.properties and arguments
[Lukasz Lenart] WW-5791 feat(boot): launch Struts on embedded Tomcat from main()
[Lukasz Lenart] WW-5791 fix(boot): serve an empty docBase and capture every filter init failure
[Lukasz Lenart] WW-5791 feat(boot): add boot-hello example app with runnable jar
[Lukasz Lenart] WW-5791 fix(boot): harden embedded Tomcat defaults and normalise boot settings
[Lukasz Lenart] WW-5791 fix(boot): verify action classes and registry arguments at startup
[Lukasz Lenart] WW-5791 fix(boot): skip deploying boot-hello and mark its jar Multi-Release
[Lukasz Lenart] WW-5791 docs: document bind address, logging and packaging in boot-hello
[Lukasz Lenart] WW-5791 docs: add Struts Boot to the threat model
[Lukasz Lenart] WW-5791 fix(boot): address Sonar findings in the starter
[Lukasz Lenart] WW-5791 fix(boot): keep the base directory private and close on every start failure
[Lukasz Lenart] WW-5792 fix(config): warn instead of silently skipping non-public action classes
[Lukasz Lenart] WW-5778 feat(tags): support datetextfield in the html5 theme
[Lukasz Lenart] WW-5810 feat(tags): support java.time types in datetextfield
[Lukasz Lenart] WW-5810 fix(javatemplates): render java.time in the interceptor's calendar
[Lukasz Lenart] WW-5812 fix(conversion): select the date format by a strict whole-input parse
[Lukasz Lenart] WW-5812 test(conversion): build nl-NL date-time inputs from the JDK's pattern
[Lukasz Lenart] WW-5813 fix(conversion): reject date input with text after the parsed value
[Lukasz Lenart] WW-5814 feat(conversion): opt-in offset-aware ISO date-times for java.util.Date
[Lukasz Lenart] WW-5816 feat(validation): add a range validator for java.time.LocalDate
[Lukasz Lenart] WW-5816 fix(validation): parse localdate XML bounds strictly as ISO dates
[Lukasz Lenart] WW-5816 test(validation): cover LocalDateRangeBoundConverter directly
[Lukasz Lenart] WW-5811 feat(html5): derive date min/max and temporal required constraints
[Lukasz Lenart] WW-5811 test(html5): render min/max from java.util.Date XML bounds end to end
[Lukasz Lenart] WW-5811 fix(html5): never let derived date constraints reject what the server accepts
[Lukasz Lenart] WW-5811 refactor(html5): make the null action check explicit for Sonar S2259
[Lukasz Lenart] WW-5819 feat(validator): log a validator param that fails type conversion
[Lukasz Lenart] WW-5819 test: keep each captured log level with its message in LogCapture
[github] build(deps): bump github/codeql-action from 4.39.0 to 4.39.1 (#2071)
[github] build(deps): bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 (#2066)
[github] build(deps): bump com.fasterxml.jackson:jackson-bom from 2.22.3 to 2.22.4 (#2065)
[github] build(deps): bump asm.version from 9.11 to 9.11.1 (#2064)
[github] build(deps-dev): bump byte-buddy.version from 1.18.14 to 1.18.16 (#2063)
[Lukasz Lenart] WW-5823 fix(javatemplates): escape dynamic attributes and evaluate them only for lazy components
[Lukasz Lenart] docs: state output encoding by the framework's own tags as a §8 property
[Lukasz Lenart] WW-5824 fix(core): escape the radio name attribute like every other tag
[Lukasz Lenart] WW-5825 Normalize request-derived values in DateTextFieldInterceptor log message
[Lukasz Lenart] WW-5828 fix(conversion): bound integer digits when formatting BigDecimal
------------------------------------------
Started by timer
Running as SYSTEM
[EnvInject] - Loading node environment variables.
Building remotely on builds24 (ubuntu) in workspace <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/>
The recommended git tool is: NONE
No credentials specified
> git rev-parse --resolve-git-dir <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/.git> # timeout=10
Fetching changes from the remote Git repository
> git config remote.origin.url https://gitbox.apache.org/repos/asf/struts.git # timeout=10
Fetching upstream changes from https://gitbox.apache.org/repos/asf/struts.git
> git --version # timeout=10
> git --version # 'git version 2.34.1'
> git fetch --tags --force --progress -- https://gitbox.apache.org/repos/asf/struts.git +refs/heads/*:refs/remotes/origin/* # timeout=10
> git rev-parse refs/remotes/origin/main^{commit} # timeout=10
Checking out Revision a289c8458fa5702a18ca1c956608cc3c80838a59 (refs/remotes/origin/main)
> git config core.sparsecheckout # timeout=10
> git checkout -f a289c8458fa5702a18ca1c956608cc3c80838a59 # timeout=10
Commit message: "WW-5828 fix(conversion): bound integer digits when formatting BigDecimal"
> git rev-list --no-walk 638291af96dd5822909394ee7ddf2e95e26c83e1 # timeout=10
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
[Struts-master-dependency-check] $ /bin/sh -xe /tmp/jenkins1791430350170460662.sh
+ export MAVEN_OPTS=-Xms2g -Xmx2g
+ /home/jenkins/tools/maven/latest3/bin/mvn verify -Pdependency-check
[INFO] Scanning for projects...
[INFO] Loaded 24316 auto-discovered prefixes for remote repository central (prefixes-central.txt)
[WARNING] Using credentials of server 'apache.snapshots.https' for repository https://repository.apache.org/content/repositories/snapshots, although no repository or mirror with this id is declared in settings or on the command line and the server declares no <repositoryOrigins>. Declare 'https://repository.apache.org' in <repositoryOrigins> of that server in settings to bind these credentials explicitly, or set maven.repository.credentialScope=strict to refuse such credential use.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO]
[INFO] Struts 2 [pom]
[INFO] Struts BOM [pom]
[INFO] Struts Parent POM [pom]
[INFO] Struts 2 Jakarta EE Compatible modules [pom]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View [jar]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp [jar]
[INFO] Struts 2 Core [jar]
[INFO] Struts 2 Plugins [pom]
[INFO] Struts 2 Async Plugin [jar]
[INFO] Struts 2 Bean Validation Plugin [jar]
[INFO] Struts 2 CDI Plugin [jar]
[INFO] Struts 2 Spring Plugin [jar]
[INFO] Struts 2 JUnit Plugin [jar]
[INFO] Struts 2 Velocity Plugin [jar]
[INFO] Struts 2 Configuration Browser Plugin [jar]
[INFO] Struts 2 Convention Plugin [jar]
[INFO] Struts 2 Jasper Reports Plugin [jar]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] [jar]
[INFO] Struts 2 Java Templates Plugin [jar]
[INFO] Struts 2 JFreeChart Plugin [jar]
[INFO] Struts 2 JSON Plugin [jar]
[INFO] Struts 2 REST Plugin [jar]
[INFO] Struts 2 TestNG Plugin [jar]
[INFO] Struts 2 Tiles Plugin [jar]
[INFO] Struts 2 XSLT Plugin [jar]
[INFO] Struts 2 Boot Starter [jar]
[INFO] Struts 2 Webapps [pom]
[INFO] Struts 2 Showcase Webapp [war]
[INFO] Struts 2 Rest Showcase Webapp [war]
[INFO] Struts 2 Boot Hello [jar]
[INFO] Struts 2 Assembly [pom]
[INFO]
[INFO] -----------------< org.apache.struts:struts2-project >------------------
[INFO] Building Struts 2 7.5.0-SNAPSHOT [1/31]
[INFO] from pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce) @ struts2-project ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.BannedDependencies passed
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce-maven-version) @ struts2-project ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.version.RequireMavenVersion passed
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce-java-version) @ struts2-project ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.version.RequireJavaVersion passed
[INFO]
[INFO] --- dependency-check:13.0.0:check (default) @ struts2-project ---
[WARNING] Could not transfer metadata /.meta/prefixes.txt from/to jvnet-nexus-releases (https://maven.java.net/content/repositories/releases/): PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed
[INFO] Checking for updates
[ERROR] Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:387)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:873)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:678)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:605)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2072)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1272)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:127)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:336)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:324)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:220)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:181)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:79)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:169)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:166)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:106)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:74)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:121)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:267)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:179)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:1017)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:299)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:219)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77)
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:569)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314)
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: Invalid API Key, length of 0 too short to provided a masked partial key
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:436)
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next (NvdCveClient.java:356)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:343)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:873)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:678)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:605)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2072)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1272)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:127)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:336)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:324)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:220)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:181)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:79)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:169)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:166)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:106)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:74)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:121)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:267)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:179)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:1017)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:299)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:219)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77)
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:569)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314)
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (11350 ms)
[INFO] Check for updates complete (13903 ms)
[WARNING] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Created CPE Index (3 seconds)
[INFO] Finished CPE Analyzer (4 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (4 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/target/dependency-check-report.html>
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.5.0-SNAPSHOT:
[INFO]
[INFO] Struts BOM ......................................... SKIPPED
[INFO] Struts Parent POM .................................. SKIPPED
[INFO] Struts 2 Jakarta EE Compatible modules ............. SKIPPED
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SKIPPED
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SKIPPED
[INFO] Struts 2 Core ...................................... SKIPPED
[INFO] Struts 2 Plugins ................................... SKIPPED
[INFO] Struts 2 Async Plugin .............................. SKIPPED
[INFO] Struts 2 Bean Validation Plugin .................... SKIPPED
[INFO] Struts 2 CDI Plugin ................................ SKIPPED
[INFO] Struts 2 Spring Plugin ............................. SKIPPED
[INFO] Struts 2 JUnit Plugin .............................. SKIPPED
[INFO] Struts 2 Velocity Plugin ........................... SKIPPED
[INFO] Struts 2 Configuration Browser Plugin .............. SKIPPED
[INFO] Struts 2 Convention Plugin ......................... SKIPPED
[INFO] Struts 2 Jasper Reports Plugin ..................... SKIPPED
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... SKIPPED
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Boot Starter .............................. SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Boot Hello ................................ SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[ERROR] Struts 2 ........................................... FAILURE [ 24.073 s]
[INFO] ------------------------------------------------------------------------
[ERROR] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 27.708 s
[INFO] Finished at: 2026-11-01T06:39:41Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:13.0.0:check (default) on project struts2-project: One or more exceptions occurred during dependency-check analysis: One or more exceptions occurred during analysis:
[ERROR] UpdateException: Error updating the NVD Data
[ERROR] caused by NvdApiException: Invalid API Key, length of 0 too short to provided a masked partial key
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3