fix: 移除 pf4j 示例未使用的 Spring 4.3.6 依赖（关闭 22 条安全告警） - #39
Merged
Conversation
- 两个 pf4j 插件示例的源码零 Spring import（仅用 javax.servlet）， pom 中声明的 spring-aop/aspects/beans/context/context-support/ core/web/webmvc 4.3.6（depMgmt）与 spring-web（test 模块）从未使用 - Spring 4.3.x 已 EOL，相关 CVE（路径穿越/XSS/请求走私/DoS 等）在 4.x/5.x 线均无修复版本；移除未使用依赖即消除攻击面 - 同步移除 spring.version 属性
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
内容
pf4j 两个插件示例的源码零 Spring import（仅使用
javax.servlet.http.HttpServletRequest），pom 里声明的 Spring 全家桶（spring-aop/aspects/beans/context/context-support/core/web/webmvc 4.3.6）从未被使用——直接移除。Spring 4.3.x 已 EOL，所涉 CVE（路径穿越、XSS、multipart 请求走私、DoS 等）在 4.x 与 5.x 线均无修复版本，升级无法闭环；移除未使用依赖即消除攻击面。
验证
mvn clean verify全 14 模块 JDK 8 / 17 / 21 全绿 ✅安全收益
关闭 Dependabot 告警 ×22：CVE-2024-22262 / 2024-38819 / 2025-22233 / 2026-22741 / 2026-22745 / 2026-41841~41848 / 2026-41853（含 High：路径穿越、XSS、DoS）