Library updates for cve's, suppression cleanup and not fail github action job SonarCloud if SONARCLOUD_TOKEN not found (summary report instead).

[duttonw]

Library updates:

• profile jakartaee11: jakarta-ee from 11.0.0-M5 to 11.0.0
• Spring Version from 6.2.12 to 7.0.7 (we are 2 months off OSS EOL for 6.2.x)
• struts2-jasperreports-plugin: jasperreports from 6.21.3 to 6.21.5
• struts2-jasperreports7-plugin: jasperreports from 7.0.4 to 7.0.6
• profile jakartaee11: jakarta-ee from 11.0.0-M5 to 11.0.0

Dependancy suppression cleanup

Sonar github workflow to be skipped if secret is not found

---

Struts & Spring Compatibility Matrix

Struts Plugin Version	Compatible Spring Version	Spring OSS End of Life (EOL)
7.1.1	6.2.x	2026-06
7.1.1	7.0.7 (Jakarta EE 11 only)	2027-06

[lukaszlenart]

I would wait with switching to Spring 7.x and Jakarta 11 - this is a major upgrade and it must be properly communicated, we need a JIRA ticket for that.

[lukaszlenart]

Merge conflicts

[duttonw]

@lukaszlenart rebased and put back to be spring6 base. Also fixed up owasp testing results (including caching of db). Enabled test results to be surfaced by github actions as well as annotations.

[lukaszlenart]

All looks good, let me know if you are going to address this few non-blocking issues? I'm fine to address them later

[lukaszlenart]

We do not use the "develop" branch, but that's fine

[duttonw]

This is more for forks

[duttonw]

Updated per your comments, I've allowed NIST_NVD_API_KEY usage as well as non (do note that NIST make take a very long time to load cache so lets see how we go on this utilisation, I've seen up to 6hours to re-create the cache db)
https://github.com/duttonw/struts/actions/runs/29867535204/job/88759383394

[lukaszlenart]

Hm... the OWASP workflow failed but with no reason except timeouts, any idea?
https://github.com/apache/struts/actions/runs/29901427242/job/88862811929

[duttonw]

Hm... the OWASP workflow failed but with no reason except timeouts, any idea? https://github.com/apache/struts/actions/runs/29901427242/job/88862811929

See: dependency-check/DependencyCheck#8633 (comment)

Its why I've put in the mirror json download structure instead. Its become very hit and miss on downloads as well as nist killing api keys and needing reissuing.