Expanders 5.15.0

Version 5.15.0 of the Expanders brings quite a few new features and improvements! This post will cover an overview of what's new and provide a migration guide to assist in updating. The full release notes can be found here.

Resources

The expansion resources below provide Expanders 5.15.0.

Resource	Version
Expanders	5.15.0
nsx-default-stack	2022.15.0
rest-jaxrs-stack	3.4.1

caution

Due to some structural changes in the way Struts is packaged, it is recommended to update to one of the listed stack resources. It is also recommended to update expanders-maven-plugin to at least version 2022.5.2.

Changes and improvements

Changes in GlobalOptionSettings

Several of the settings in GlobalOptionSettings have been replaced with options on the ApplicationInstance. The long-term goal is to make the GlobalOptionSettings, TechnicalInfrastructure, PresentationSettings and BusinessLogicSettings obsolete.

BeanInterfacePolicy

The beanInterfacePolicy setting could either be BOTH, LOCAL or REMOTE and controls which interfaces are present on the bean. However, in practice, only the LOCAL and BOTH settings were functional. The option ejb.interfaces.localOnly replaces beanInterfacePolicy='LOCAL', while beanInterfacePolicy='BOTH' becomes the default.

Security Options

The following flags have been migrated to options:

• enforceHttpMethod: replaced by option struts.security.enforceHttpMethod (Prevents requests to struts control layer from using the wrong HTTP Method.)
• useCsrfProtection: replaced by option struts.security.csrfProtection (Adds a security mechanism to protect against CSRF attacks.)
• useJavaEESecurity: replaced by option struts.security.custom, or simply remove account Component from the Application. (Removes login mechanism from the struts-header.xml file.)

GenerateArtifactLabel

This feature added a postfix to the versions of Component artifacts in the project. This allows you to install artifacts or deploy them to the nexus so speed up subsequent maven builds by using e.g. the -Pslim profile.

The flag has been replaced by the option mvn.version.appendUniqueLabel. It also now appends the applicationInstance shortname and expanders version, instead of the names of the settings objects. This change is necessary if we want to move away from the settings elements.

CounterDefault

The counterDefault settings on GlobalOptionSettings used to support a GLOBAL value. This would cause all of the id's to be set programmatically based on a single table.

This has been removed as there are better alternatives (see below).

Identity generation strategy for JPA

The options persistence.identifier, persistence.sequence.name and persistence.sequence.schema have been renamed from options previously marked as experimental. These options allow a specific identity generation strategy to be selected for a DataElement. The options are available at any level of the model above DataElement and cascaded down. They can be overridden on a lower level for granular control if needed.

The options support either auto-incremented identity columns or native sequences.

For more information, visit the documentation about id generation.

Struts2 6.0

Support for Struts2 6.0.3 was added to the expanders and is now the default version. From this version and onward, the expanders will start supporting a specific contemporary release version of Struts to improve the distribution of security patches.

There are some breaking changes both in how we handle Struts and the framework itself. See the migration guide for more information.

Migration guide

This release of expanders contains breaking changes. This guide will describe those changes and how to migrate existing projects.

GlobalOptionSettings

Use the transmutation Upgrade to migrate the GlobalOptionSettings to the new options. This transmutation should be available after updating to Expanders version 5.15.0.

Right-click the Application in the Micro-Radiant or use the expanders-maven-plugin on the command line:

mvn expanders:transmute-model -Dtransmutation=Upgrade

persistence.schemaUpdating

The option persistence.schemaUpdating has been added to the data resources of the expanders and now has a constraint applied to its value. Originally this option was given two distinct values update for automatic migration of schemas and none for no automatic migration. Only the value update was used and any other value was handled as none. Now all values other than update should be changed to none.

Identity generation options

With moving of the identity generation options from experimental to stable, their names have changed. They have been aliased to remain backwards compatible, but this will print a warning at expand. To remove the warning, change the name of the options to the new name.

• experimental.persistence.identifier
persistence.identifier
• experimental.persistence.defaultIdentifier
persistence.identifier
• experimental.persistence.sequence.name
persistence.sequence.name
• experimental.persistence.sequence.defaultName
persistence.sequence.name
• experimental.persistence.sequence.schema
persistence.sequence.schema
• experimental.persistence.sequence.defaultSchema
persistence.sequence.schema

Migrating from struts 2.5 to 6.0

Struts libraries typically accumulate many newly identified vulnerabilities over time because of their many dependencies. There are few (if any) security updates for older Struts libraries. As such we have decided to no longer support old struts versions in the future.

All code from the nsx-presentation-struts2 library from nsx-runtime, as well as the struts-shared library for Struts 2.5 (also available for 2.3) has been moved to a new library tied to the release cycle of Expanders. The new library net.democritus.struts:application-shared-struts2-presentation will be updated to the latest version of struts supported by Expanders at every release.

The option struts.version to revert to older versions of struts is still available to switch to versions 2.3 or 2.5, but will be removed alongside all expanders and libraries for these versions by 2023-07-01.

The official migration guide can be found here: https://cwiki.apache.org/confluence/display/WW/Struts+2.5+to+6.0.0+migration

Breaking changes in Struts

The number of breaking changes in version 6.0 relative to 2.5 are limited or not very impactful. Most changes will be handled automatically by the expanders and the migration of custom code should be low-effort in projects custom code for Struts.

DTD header

As with any struts release, the version number should be updated in the DTD header of struts.xml files:

Before

<!DOCTYPE struts PUBLIC
          "-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
          "http://struts.apache.org/dtds/struts-2.5.dtd">

After

<!DOCTYPE struts PUBLIC
          "-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
          "http://struts.apache.org/dtds/struts-6.0.dtd">

Package name changes

Some classes in struts have changed package names. These changes are handled in the expanders, but might also require some updates of imports in custom code:

• com.opensymphony.xwork2.config.providers.XmlConfigurationProvider
org.apache.struts2.config.StrutsXmlConfigurationProvider
• com.opensymphony.xwork2.conversion.TypeConversionException
org.apache.struts2.conversion.TypeConversionException
• com.opensymphony.xwork2.XWorkException
org.apache.struts2.StrutsException

caution

The changes in package names apply to the implementation of custom valuefield types.

Struts properties

The file xwork-conversion.properties is now deprecated as of Struts 6.0. It has been renamed to struts.properties. Though still supported with a warning, the expanders will now already only expand the struts.properties file (with the same content) instead of xwork-conversion.properties.

If your project uses the xwork-conversion.properties file, rename its harvest file from xwork-conversion.properties.harvest to struts.properties.harvest.