Skip to content

Commit e043bf5

Browse files
loong10kloong10k
committed
fix: 移除 pf4j 示例中未使用的 Spring 4.3.6 依赖，关闭 22 条 Dependabot 告警
- 两个 pf4j 插件示例的源码零 Spring import（仅用 javax.servlet）， pom 中声明的 spring-aop/aspects/beans/context/context-support/ core/web/webmvc 4.3.6（depMgmt）与 spring-web（test 模块）从未使用 - Spring 4.3.x 已 EOL，相关 CVE（路径穿越/XSS/请求走私/DoS 等）在 4.x/5.x 线均无修复版本；移除未使用依赖即消除攻击面 - 同步移除 spring.version 属性
1 parent 3383266 commit e043bf5

4 files changed

Lines changed: 0 additions & 114 deletions

File tree

  • spring-boot-sample-pf4j2/pf4j2-plugin-sample
  • spring-boot-sample-pf4j/pf4j-plugin-sample

‎spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-test/pom.xml‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,6 @@
3939
<!-- ###################### Spring 4.x 核心框架 ###################### -->
4040

4141
<!-- Bean支持，包括Groovy -->
42-
<!-- For Spring Web -->
43-
<dependency>
44-
<groupId>org.springframework</groupId>
45-
<artifactId>spring-web</artifactId>
46-
<optional>true</optional>
47-
</dependency>
48-
4942
<!-- https://mvnrepository.com/artifact/ro.fortsoft.pf4j -->
5043
<dependency>
5144
<groupId>ro.fortsoft.pf4j</groupId>

‎spring-boot-sample-pf4j/pf4j-plugin-sample/pom.xml‎

Lines changed: 0 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@
2727
<ro.pf4j-update.version>0.4.0</ro.pf4j-update.version>
2828
<ro.pf4j-spring.version>0.3.2</ro.pf4j-spring.version>
2929
<slf4j.version>1.7.21</slf4j.version>
30-
<spring.version>4.3.6.RELEASE</spring.version><!-- 4.3.x（JDK 1.7 ）、4.1.x（JDK 1.6）、4.0.x（JDK 1.6） -->
3130
</properties>
3231

3332
<dependencyManagement>
@@ -116,62 +115,13 @@
116115
<!-- ###################### Spring 4.x 核心框架 ###################### -->
117116

118117
<!-- 基于代理的AOP支持 -->
119-
<!-- For Spring Aop -->
120-
<dependency>
121-
<groupId>org.springframework</groupId>
122-
<artifactId>spring-aop</artifactId>
123-
<version>${spring.version}</version>
124-
</dependency>
125118
<!-- 基于AspectJ的切面 -->
126-
<!-- For Spring Aspects -->
127-
<dependency>
128-
<groupId>org.springframework</groupId>
129-
<artifactId>spring-aspects</artifactId>
130-
<version>${spring.version}</version>
131-
</dependency>
132119
<!-- Bean支持，包括Groovy -->
133-
<!-- For Spring Beans -->
134-
<dependency>
135-
<groupId>org.springframework</groupId>
136-
<artifactId>spring-beans</artifactId>
137-
<version>${spring.version}</version>
138-
</dependency>
139120
<!-- 应用程序的运行时环境，包括调度和远程处理的抽象 -->
140-
<!-- For Spring Context -->
141-
<dependency>
142-
<groupId>org.springframework</groupId>
143-
<artifactId>spring-context</artifactId>
144-
<version>${spring.version}</version>
145-
</dependency>
146121
<!-- 用于把常用的第三方 类库集成到Spring的应用环境中的支持类 -->
147-
<!-- For Spring Context-Support -->
148-
<dependency>
149-
<groupId>org.springframework</groupId>
150-
<artifactId>spring-context-support</artifactId>
151-
<version>${spring.version}</version>
152-
</dependency>
153122
<!-- 被大多数其他Spring模块使用的核心工具类 -->
154-
<!-- For Spring Core -->
155-
<dependency>
156-
<groupId>org.springframework</groupId>
157-
<artifactId>spring-core</artifactId>
158-
<version>${spring.version}</version>
159-
</dependency>
160123
<!-- Web支持包，包括客户端和web的远程访问 -->
161-
<!-- For Spring Web -->
162-
<dependency>
163-
<groupId>org.springframework</groupId>
164-
<artifactId>spring-web</artifactId>
165-
<version>${spring.version}</version>
166-
</dependency>
167124
<!-- REST的web服务和用于web应用程序的mvc实现 -->
168-
<!-- For Spring Webmvc -->
169-
<dependency>
170-
<groupId>org.springframework</groupId>
171-
<artifactId>spring-webmvc</artifactId>
172-
<version>${spring.version}</version>
173-
</dependency>
174-
175125
</dependencies>
176126
</dependencyManagement>
177127

‎spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-test/pom.xml‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,6 @@
3939
<!-- ###################### Spring 4.x 核心框架 ###################### -->
4040

4141
<!-- Bean支持，包括Groovy -->
42-
<!-- For Spring Web -->
43-
<dependency>
44-
<groupId>org.springframework</groupId>
45-
<artifactId>spring-web</artifactId>
46-
<optional>true</optional>
47-
</dependency>
48-
4942
<!-- https://mvnrepository.com/artifact/org.pf4j/pf4j -->
5043
<dependency>
5144
<groupId>org.pf4j</groupId>

‎spring-boot-sample-pf4j2/pf4j2-plugin-sample/pom.xml‎

Lines changed: 0 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@
2727
<pf4j-update.version>2.0.0</pf4j-update.version>
2828
<pf4j-spring.version>0.4.0</pf4j-spring.version>
2929
<slf4j.version>1.7.21</slf4j.version>
30-
<spring.version>4.3.6.RELEASE</spring.version><!-- 4.3.x（JDK 1.7 ）、4.1.x（JDK 1.6）、4.0.x（JDK 1.6） -->
3130
</properties>
3231

3332
<dependencyManagement>
@@ -116,62 +115,13 @@
116115
<!-- ###################### Spring 4.x 核心框架 ###################### -->
117116

118117
<!-- 基于代理的AOP支持 -->
119-
<!-- For Spring Aop -->
120-
<dependency>
121-
<groupId>org.springframework</groupId>
122-
<artifactId>spring-aop</artifactId>
123-
<version>${spring.version}</version>
124-
</dependency>
125118
<!-- 基于AspectJ的切面 -->
126-
<!-- For Spring Aspects -->
127-
<dependency>
128-
<groupId>org.springframework</groupId>
129-
<artifactId>spring-aspects</artifactId>
130-
<version>${spring.version}</version>
131-
</dependency>
132119
<!-- Bean支持，包括Groovy -->
133-
<!-- For Spring Beans -->
134-
<dependency>
135-
<groupId>org.springframework</groupId>
136-
<artifactId>spring-beans</artifactId>
137-
<version>${spring.version}</version>
138-
</dependency>
139120
<!-- 应用程序的运行时环境，包括调度和远程处理的抽象 -->
140-
<!-- For Spring Context -->
141-
<dependency>
142-
<groupId>org.springframework</groupId>
143-
<artifactId>spring-context</artifactId>
144-
<version>${spring.version}</version>
145-
</dependency>
146121
<!-- 用于把常用的第三方 类库集成到Spring的应用环境中的支持类 -->
147-
<!-- For Spring Context-Support -->
148-
<dependency>
149-
<groupId>org.springframework</groupId>
150-
<artifactId>spring-context-support</artifactId>
151-
<version>${spring.version}</version>
152-
</dependency>
153122
<!-- 被大多数其他Spring模块使用的核心工具类 -->
154-
<!-- For Spring Core -->
155-
<dependency>
156-
<groupId>org.springframework</groupId>
157-
<artifactId>spring-core</artifactId>
158-
<version>${spring.version}</version>
159-
</dependency>
160123
<!-- Web支持包，包括客户端和web的远程访问 -->
161-
<!-- For Spring Web -->
162-
<dependency>
163-
<groupId>org.springframework</groupId>
164-
<artifactId>spring-web</artifactId>
165-
<version>${spring.version}</version>
166-
</dependency>
167124
<!-- REST的web服务和用于web应用程序的mvc实现 -->
168-
<!-- For Spring Webmvc -->
169-
<dependency>
170-
<groupId>org.springframework</groupId>
171-
<artifactId>spring-webmvc</artifactId>
172-
<version>${spring.version}</version>
173-
</dependency>
174-
175125
</dependencies>
176126
</dependencyManagement>
177127

0 commit comments

Comments
 (0)