[Snyk] Fix for 4 vulnerabilities

[samsnyk]

Snyk has created this PR to fix 4 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• todolist-goof/todolist-web-struts/pom.xml
• todolist-goof/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Remote Code Execution (RCE) SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720	949	org.apache.logging.log4j:log4j-core: 2.7 -> 2.12.2 No Path Found Mature
	Remote Code Execution (RCE) SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2320014	919	org.apache.logging.log4j:log4j-core: 2.7 -> 2.12.2 No Path Found Mature
	Remote Code Execution (RCE) SNYK-JAVA-ORGAPACHESTRUTS-8496612	750	org.apache.struts:struts2-core: 2.3.20 -> 7.0.0 org.apache.struts:struts2-spring-plugin: 2.3.20 -> 7.0.0 Major version upgrade Reachable Proof of Concept
	Arbitrary Code Execution SNYK-JAVA-ORGAPACHESTRUTS-30207	712	org.apache.struts:struts2-core: 2.3.20 -> 7.0.0 org.apache.struts:struts2-spring-plugin: 2.3.20 -> 7.0.0 No Path Found Mature

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Remote Code Execution (RCE)

[samsnyk]

This upgrade includes a major, multi-version jump for Apache Struts from 2.3.20 to 7.0.0, which introduces significant and extensive breaking changes. The upgrade for log4j-core is a minor version change and considered low risk.

org.apache.struts:struts2-core@2.3.20 → 7.0.0 (HIGH RISK)

This is a massive migration across several major versions (2.3 → 2.5 → 6.x → 7.x) and requires significant developer effort. The application will not run without substantial code and configuration changes.

Key Breaking Changes:

• Java and Jakarta EE Migration:

  • Java 17 Required: The final version, Struts 7.0.0, requires a minimum of Java 17.
  • Jakarta EE Namespace: Struts 7 is built on Jakarta EE. All javax.* package imports (e.g., javax.servlet) must be migrated to the new jakarta.* namespace (e.g., jakarta.servlet). This is a fundamental and project-wide change.

• Progressive Java Requirements:

  • Struts 2.5 required Java 7.
  • Struts 6.0 required Java 8 and Servlet API 3.1.

• Removed Plugins and Classes:

  • Numerous plugins have been removed across versions, including JSON-plugin, REST, Dojo, Codebehind, and Tiles.
  • Core classes from com.opensymphony.xwork have been moved into org.apache.struts2, and many deprecated constants and classes have been removed.

• org.apache.struts:struts2-spring-plugin@2.3.20 → 7.0.0 (HIGH RISK)

  • This plugin's upgrade is tied to the core framework's migration. It will require updates to align with both the new Struts 7 architecture and a modern Spring Framework version compatible with Jakarta EE (e.g., Spring Framework 6.x).

Recommendation: This upgrade cannot be handled as a simple dependency bump. It requires a dedicated migration project. Developers must follow the official Struts migration guides for each major version jump (2.3 → 2.5, 2.5 → 6.0, 6.0 → 7.0).

org.apache.logging.log4j:log4j-core@2.7 → 2.12.2 (LOW RISK)

This is a minor version update within the same major series. The primary changes are security-focused.

• Java Version: No change in requirements for this range. Both versions 2.7 and 2.12.2 require Java 7. Version 2.12.2 is the final Log4j 2.x release to support Java 7.
• Breaking Changes: The most significant change is the disabling of JNDI lookups by default to mitigate the Log4Shell vulnerability (CVE-2021-44228). This is a security hardening measure and is unlikely to break applications unless they were using the insecure remote lookup feature.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.