Apache Struts 7.4.0: The Breaking Changes Developers Need to Check

Apache Struts 7.4.0 became generally available on October 2, 2026, alongside Struts 6.12.0, but the 7.4 release is not just a routine maintenance update for Java web applications. Its version notes contain a source-breaking change around SecurityMemberAccess, several deprecations, and a new HTML5 validation feature that can affect how older applications are configured. The 6.x line receives a separate release with a different compatibility profile, giving teams another path if moving to Struts 7 would require a larger Java and Jakarta EE migration.

Apache Struts 7.4.0 removes five SecurityMemberAccess setters

The most significant code-level change in Struts 7.4.0 is the removal of five development-mode configuration setters from SecurityMemberAccess. These include setters controlling development mode and several excluded-class and excluded-package settings, while the corresponding struts.devMode.* configuration properties themselves remain unchanged. Applications that directly call those Java setters can therefore encounter source-level failures even though an application's existing configuration properties may still look familiar. Apache's own release notes classify this as a breaking change, so it deserves a compile-and-test pass rather than being treated as an invisible patch update.

Most of the remaining configuration change is a warning for future upgrades

Struts 7.4.0 also deprecates the eleven remaining SecurityMemberAccess configuration setters and points developers toward SecurityMemberAccessConfig for configuration. Deprecation does not remove the API immediately, but it tells developers that code relying on those methods should be moved before a future release removes them. The release notes also deprecate the legacy content-security-policy nonce constant, with the newer struts.csp.nonce.source property becoming the preferred form. For teams maintaining long-lived enterprise applications, the practical value of this release is therefore partly in identifying configuration APIs that are already on their way out.

HTML5 validation is becoming the preferred client-side path

Struts 7.4.0 adds a feature that derives HTML5 constraint attributes from validators in the html5 theme. At the same time, JavaScript client-side validation in the older xhtml and css_xhtml themes is deprecated. This means applications using those themes should not interpret the new release as a requirement to rewrite every form immediately, but they should recognize that the framework is moving validation toward browser-native constraint attributes. The change can eventually reduce dependence on Struts-specific JavaScript validation behavior because the browser can enforce constraints such as required fields and input limits through standard HTML mechanisms.

REST applications need to pay attention to the 6.12 changes too

For teams staying on the 6.x branch, Struts 6.12.0 introduces changes that are particularly relevant to REST applications. Its default REST and Bean Validation interceptor stacks now include Cross-Origin Embedder Policy, Cross-Origin Opener Policy and Fetch Metadata interceptors, which are browser-facing security controls that can affect how cross-site clients interact with an API. A REST API serving cross-site browser clients may therefore need an explicit fetchMetadata.exemptedPaths configuration or a decision to disable that interceptor. This is a behavioral change that can appear only when a real browser client crosses the affected request boundary, making integration testing important even when the Java code itself compiles cleanly.

Struts 6.12 also puts a limit on REST request bodies

Another concrete change in Struts 6.12.0 is the REST plugin's handling of oversized request bodies. The framework now rejects a REST request body larger than struts.rest.content.maxLength before the action runs, with the documented default set to 2,097,152 bytes. That is a 2 MiB boundary, so applications accepting larger JSON or other request payloads need to check their configuration before upgrading. The change is designed to bound request-body processing, but it also means an application that previously accepted large requests can start returning an error before its controller or action receives the request.

Both releases continue the move away from legacy REST action mappers

Struts 7.4.0 and 6.12.0 both deprecate RestfulActionMapper and Restful2ActionMapper in favor of the REST plugin. An action mapper determines how incoming request paths are translated into Struts actions, so this is not merely a naming cleanup for applications that have configured those classes directly. The project has also fixed REST URI handling and validation-related issues in the 6.12 line, including cases involving identifiers in paths and action-name validation. Developers maintaining older REST configurations should therefore treat the mapper deprecation and the behavioral fixes as related migration work rather than changing only the dependency version.

Struts 7 still requires a newer Java and Jakarta EE baseline

The larger migration question is whether an application can move from the 6.x branch to 7.x at all without changing its platform assumptions. Apache lists Java 17 and Jakarta EE as the minimum specification requirements for the Struts 7 series, while Struts 6.12.0 retains requirements based on Servlet API 3.1, JSP API 2.1 and Java 8. That difference is significant because a Struts 7 migration can involve the application server and Java runtime as well as the Struts dependency itself. Teams with older production stacks therefore have a materially different upgrade path from applications already running on Java 17 and Jakarta EE.

Developers should test configuration code, REST requests and forms separately

A useful upgrade test for Struts 7.4.0 is not simply starting the application and checking that the home page loads. First compile code that interacts directly with SecurityMemberAccess, then exercise REST endpoints with normal and oversized request bodies, and finally submit forms using the themes and validation mechanisms already present in the application. For a 6.12.0 upgrade, browser-based cross-site REST clients deserve their own tests because the newly included resource-isolation interceptors can change which requests reach an action. Apache also recommends consulting the migration and version notes before adopting the new release, which is particularly relevant when moving between the 6.x and 7.x major lines.

The important choice is not simply 7.4 versus 6.12

Apache's October 2 release gives maintainers two current Struts branches, but they solve different upgrade problems. Struts 7.4.0 is the path for applications prepared for the Java 17 and Jakarta EE baseline and willing to address the framework's newer configuration direction, while 6.12.0 offers a current 6.x release with targeted REST and security-related changes for applications that are not ready for that larger platform transition. Neither version should be selected solely because its version number is newer; the affected APIs, server environment, REST behavior and validation setup determine how much work the upgrade actually creates. For an existing production application, the safest next step is to compare its configuration and dependencies against the 7.4.0 or 6.12.0 release notes before changing the version in the build file.