From 484120d2f48ee71ec31930266d6a3cb3527f85f7 Mon Sep 17 00:00:00 2001
From: Andy Yang <39001142+andy-library@users.noreply.github.com>
Date: Mon, 13 Jul 2026 12:11:02 +0800
Subject: [PATCH 1/2] release: prepare 1.0.0-alpha.1
---
CHANGELOG.md | 28 ++++---
.../microservice-framework-demo/pom.xml | 2 +-
.../resources/application-full-embedded.yml | 2 +-
.../resources/application-full-middleware.yml | 2 +-
.../resources/application-local-smoke.yml | 2 +-
.../src/main/resources/application.yml | 2 +-
RELEASE_GUIDE.md | 17 +++--
RELEASE_NOTES_v1.0.0-alpha.1.md | 73 +++++++++++++++++++
.../microservice-framework-parent/README.md | 2 +-
.../documents/guide/getting-started.md | 2 +-
.../microservice-framework-parent/pom.xml | 2 +-
.../src/it/app-fat-jar-packaging/pom.xml | 4 +-
.../src/it/banned-dependency-fails/pom.xml | 4 +-
.../it/business-app-resolves-starters/pom.xml | 4 +-
.../src/it/business-parent-resolution/pom.xml | 4 +-
.../it/convergence-violation-fails/pom.xml | 4 +-
.../src/it/framework-bom-resolution/pom.xml | 4 +-
.../framework-starter-inherits-parent/pom.xml | 4 +-
.../it/no-runtime-starter-inheritance/pom.xml | 4 +-
.../protected-version-override-fails/pom.xml | 4 +-
20 files changed, 127 insertions(+), 43 deletions(-)
create mode 100644 RELEASE_NOTES_v1.0.0-alpha.1.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 040e9e8..37f8604 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,24 +2,32 @@
Author: Andy Yang
-All notable changes to Microservice Framework will be documented in this file.
-
-The project follows a pragmatic changelog style inspired by Keep a Changelog.
+All notable changes to Microservice Framework will be documented in this file. The project follows a pragmatic changelog style inspired by Keep a Changelog.
## [Unreleased]
+## [1.0.0-alpha.1] - 2026-07-13
+
### Added
-- Initial open-source repository layout with `PRD`, `SourceCode`, and `Microservice Demo`.
-- Apache-2.0 license.
-- Community contribution, security, conduct, roadmap, issue, pull request, and CI preparation.
-- Framework PRD, component catalog, design documents, starter PRDs, demo reports, and JMeter scripts.
+- Initial open source repository layout with `PRD`, `SourceCode`, and `Microservice Demo`.
+- Apache-2.0 license and community contribution, security, conduct, roadmap, Issue, Pull Request, and CI governance.
+- Parent, Dependencies BOM, Framework BOM, Starter Parent, and 19 production-oriented Spring Boot Starters.
+- Standalone Demo Controller APIs, real-middleware acceptance coverage, JMeter scripts, and bilingual reports.
+- Public PRDs, technical designs, bilingual project documentation, and AI-driven open source vision.
+- GitHub Discussions, structured Issue templates, Dependabot, Dependency Review, CodeQL, and protected-branch quality gates.
### Changed
-- Documentation standardized with `Andy Yang` as author.
-- Framework requirement documents cleaned to reflect current design baseline instead of internal process history.
+- Hardened Starter production boundaries, failure handling, security defaults, observability, and automated tests.
+- Standardized documentation with `Andy Yang` as author and removed internal process history from public requirements.
+- Unified all framework artifacts, consumer contracts, Demo dependencies, and displayed application metadata on version `1.0.0-alpha.1`.
### Removed
-- Local build artifacts, Git metadata, raw test outputs, local IDE files, and OS metadata from the open-source package.
+- Local build artifacts, Git metadata, raw test outputs, local IDE files, and operating-system metadata from the open source package.
+
+### Known limitations
+
+- Artifacts are not yet published to Maven Central; consumers must build and install them locally.
+- This is a community preview and not a final compatibility commitment.
diff --git a/Microservice Demo/SourceCode/microservice-framework-demo/pom.xml b/Microservice Demo/SourceCode/microservice-framework-demo/pom.xml
index 413cdfe..0fc3a80 100755
--- a/Microservice Demo/SourceCode/microservice-framework-demo/pom.xml
+++ b/Microservice Demo/SourceCode/microservice-framework-demo/pom.xml
@@ -9,7 +9,7 @@
com.microservice.framework
microservice-framework-starter-parent
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
diff --git a/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application-full-embedded.yml b/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application-full-embedded.yml
index ad57770..437dbfb 100644
--- a/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application-full-embedded.yml
+++ b/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application-full-embedded.yml
@@ -281,7 +281,7 @@ info:
app:
name: Microservice Framework Demo (Full Embedded)
description: Demonstration application with all starters using in-memory/embedded providers
- version: 1.0.0-SNAPSHOT
+ version: 1.0.0-alpha.1
profile: full-embedded
framework:
providers:
diff --git a/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application-full-middleware.yml b/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application-full-middleware.yml
index 51a20bb..06dfb45 100644
--- a/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application-full-middleware.yml
+++ b/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application-full-middleware.yml
@@ -309,5 +309,5 @@ info:
app:
name: Microservice Framework Demo (Full Middleware)
description: Demonstration application with all starters using real middleware connections
- version: 1.0.0-SNAPSHOT
+ version: 1.0.0-alpha.1
profile: full-middleware
diff --git a/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application-local-smoke.yml b/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application-local-smoke.yml
index 9fc2126..4b55e4d 100644
--- a/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application-local-smoke.yml
+++ b/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application-local-smoke.yml
@@ -231,7 +231,7 @@ info:
app:
name: Microservice Framework Demo (Local Smoke)
description: Demonstration application — no middleware dependencies, quick-start profile
- version: 1.0.0-SNAPSHOT
+ version: 1.0.0-alpha.1
profile: local-smoke
framework:
starters:
diff --git a/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application.yml b/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application.yml
index 8b19ff8..9aa63d9 100755
--- a/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application.yml
+++ b/Microservice Demo/SourceCode/microservice-framework-demo/src/main/resources/application.yml
@@ -238,7 +238,7 @@ info:
app:
name: Microservice Framework Demo
description: Demonstration application for all Microservice Framework starters
- version: 1.0.0-SNAPSHOT
+ version: 1.0.0-alpha.1
framework:
starters:
- microservice-framework-common-starter
diff --git a/RELEASE_GUIDE.md b/RELEASE_GUIDE.md
index 280a292..6b5ccb0 100644
--- a/RELEASE_GUIDE.md
+++ b/RELEASE_GUIDE.md
@@ -4,27 +4,27 @@ Author: Andy Yang
This guide describes how to publish a GitHub release for Microservice Framework.
-## First Release
+## Current Preview Release
-The first prepared tag is:
+The current prepared tag is:
```text
-v0.1.0-alpha
+v1.0.0-alpha.1
```
-Use `RELEASE_NOTES_v0.1.0-alpha.md` as the release description.
+Use `RELEASE_NOTES_v1.0.0-alpha.1.md` as the release description.
## GitHub UI Steps
1. Open `https://github.com/andy-library/microservice-framework/releases/new`.
-2. Select tag `v0.1.0-alpha`.
+2. Create tag `v1.0.0-alpha.1` from the reviewed `main` commit.
3. Set release title:
```text
-v0.1.0-alpha - Initial Open Source Preview
+v1.0.0-alpha.1 - AI-Driven Community Preview
```
-4. Paste the content of `RELEASE_NOTES_v0.1.0-alpha.md`.
+4. Paste the content of `RELEASE_NOTES_v1.0.0-alpha.1.md`.
5. Mark it as a pre-release.
6. Publish the release.
@@ -34,3 +34,6 @@ v0.1.0-alpha - Initial Open Source Preview
- Use annotated tags.
- Review release notes before publishing.
- Do not attach raw logs, `.jtl` files, local configuration files, or credentials.
+- Confirm Parent, BOM, all Starters, consumer contracts, Demo, Dependency Review, and CodeQL are green before tagging.
+- Keep the Git tag, Maven `revision`, Demo parent version, changelog, and release title aligned.
+- A GitHub source release does not imply Maven Central availability; state publication channels explicitly.
diff --git a/RELEASE_NOTES_v1.0.0-alpha.1.md b/RELEASE_NOTES_v1.0.0-alpha.1.md
new file mode 100644
index 0000000..ec98068
--- /dev/null
+++ b/RELEASE_NOTES_v1.0.0-alpha.1.md
@@ -0,0 +1,73 @@
+# v1.0.0-alpha.1 - AI-Driven Community Preview
+
+Author: Andy Yang
+
+[中文](#中文) | [English](#english)
+
+## 中文
+
+`v1.0.0-alpha.1` 是 Microservice Framework 在完成生产边界加固、公开 PRD 整理和社区治理建设后的首个统一版本预览。
+
+### 核心内容
+
+- Java 21、Spring Boot 3.3.13、Spring Cloud 2023.0.6 技术基线。
+- Parent、Dependencies BOM、Framework BOM 和 Starter Parent 统一治理。
+- 19 个面向生产场景的 Spring Boot Starter。
+- 独立 Demo 应用，通过 Controller API 验证面向应用开发者的公开能力。
+- MySQL、Redis、Kafka、Elasticsearch、Nacos 和 Apollo 真实中间件验收入口。
+- Maven 全量构建、消费方契约、Dependency Review 和 CodeQL 安全门禁。
+- 中英文 README、公开 PRD、技术设计、贡献指南和安全策略。
+
+### AI 驱动工程模式
+
+项目源于 Andy Yang 自 JDK 8 时代维护并在多个实际项目中验证的企业级脚手架。本次版本在既有实践上由 AI 参与需求整理、设计、实现、测试、审查和文档维护，维护者负责目标、架构约束、质量标准和最终验收。
+
+### 使用方式
+
+当前制品尚未发布到 Maven Central。请克隆源码并先安装 Parent 与 BOM：
+
+```bash
+git clone --branch v1.0.0-alpha.1 https://github.com/andy-library/microservice-framework.git
+cd microservice-framework/SourceCode/microservice-framework-parent
+mvn clean install
+```
+
+随后可以构建所需 Starter，并运行 `Microservice Demo/SourceCode/microservice-framework-demo` 进行验证。
+
+### 发布性质
+
+这是面向社区验证的预发布版本，不构成最终兼容性承诺。欢迎通过 Discussions、Issues 和 Pull Requests 提交真实项目反馈、测试证据和改进建议。
+
+## English
+
+`v1.0.0-alpha.1` is the first version-aligned preview of Microservice Framework after production-boundary hardening, public PRD curation, and community-governance improvements.
+
+### Highlights
+
+- Java 21, Spring Boot 3.3.13, and Spring Cloud 2023.0.6 baseline.
+- Governed Parent, Dependencies BOM, Framework BOM, and Starter Parent.
+- 19 production-oriented Spring Boot Starters.
+- Standalone Demo application with Controller APIs for application-facing capability verification.
+- Real-middleware acceptance entry points for MySQL, Redis, Kafka, Elasticsearch, Nacos, and Apollo.
+- Maven verification, consumer contracts, Dependency Review, and CodeQL security gates.
+- Bilingual README files, public PRDs, technical designs, contribution guidance, and security policy.
+
+### AI-Driven Engineering Model
+
+The project grew from an enterprise scaffold maintained by Andy Yang since the JDK 8 era and validated across multiple real projects. For this release, AI participated in requirements refinement, design, implementation, testing, review, and documentation, while the maintainer remained responsible for goals, architecture constraints, quality standards, and final acceptance.
+
+### Usage
+
+Artifacts are not yet available from Maven Central. Clone the source and install the Parent and BOMs first:
+
+```bash
+git clone --branch v1.0.0-alpha.1 https://github.com/andy-library/microservice-framework.git
+cd microservice-framework/SourceCode/microservice-framework-parent
+mvn clean install
+```
+
+You can then build the required Starters and run `Microservice Demo/SourceCode/microservice-framework-demo` for verification.
+
+### Release Status
+
+This is a community preview and not a final compatibility commitment. Real-world feedback, test evidence, and improvement proposals are welcome through Discussions, Issues, and Pull Requests.
diff --git a/SourceCode/microservice-framework-parent/README.md b/SourceCode/microservice-framework-parent/README.md
index ff613c7..5100a7d 100644
--- a/SourceCode/microservice-framework-parent/README.md
+++ b/SourceCode/microservice-framework-parent/README.md
@@ -59,7 +59,7 @@ Microservice Framework Parent 是企业级微服务框架的构建与版本治
com.microservice.framework
microservice-framework-starter-parent
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
```
diff --git a/SourceCode/microservice-framework-parent/documents/guide/getting-started.md b/SourceCode/microservice-framework-parent/documents/guide/getting-started.md
index e060387..e87e667 100644
--- a/SourceCode/microservice-framework-parent/documents/guide/getting-started.md
+++ b/SourceCode/microservice-framework-parent/documents/guide/getting-started.md
@@ -10,7 +10,7 @@ Author: Andy Yang
com.microservice.framework
microservice-framework-starter-parent
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
```
diff --git a/SourceCode/microservice-framework-parent/pom.xml b/SourceCode/microservice-framework-parent/pom.xml
index c60a8c4..f106c5b 100755
--- a/SourceCode/microservice-framework-parent/pom.xml
+++ b/SourceCode/microservice-framework-parent/pom.xml
@@ -21,7 +21,7 @@
======================================================================== -->
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
21
diff --git a/SourceCode/microservice-framework-parent/src/it/app-fat-jar-packaging/pom.xml b/SourceCode/microservice-framework-parent/src/it/app-fat-jar-packaging/pom.xml
index 07fa916..b41be31 100644
--- a/SourceCode/microservice-framework-parent/src/it/app-fat-jar-packaging/pom.xml
+++ b/SourceCode/microservice-framework-parent/src/it/app-fat-jar-packaging/pom.xml
@@ -8,12 +8,12 @@
com.microservice.framework
microservice-framework-starter-parent
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
app-fat-jar-packaging-fixture
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
diff --git a/SourceCode/microservice-framework-parent/src/it/banned-dependency-fails/pom.xml b/SourceCode/microservice-framework-parent/src/it/banned-dependency-fails/pom.xml
index 1df7ffe..2c0f4cc 100644
--- a/SourceCode/microservice-framework-parent/src/it/banned-dependency-fails/pom.xml
+++ b/SourceCode/microservice-framework-parent/src/it/banned-dependency-fails/pom.xml
@@ -8,12 +8,12 @@
com.microservice.framework
microservice-framework-starter-parent
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
banned-dependency-fails-fixture
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
diff --git a/SourceCode/microservice-framework-parent/src/it/business-app-resolves-starters/pom.xml b/SourceCode/microservice-framework-parent/src/it/business-app-resolves-starters/pom.xml
index 7f76ff7..13f94bc 100644
--- a/SourceCode/microservice-framework-parent/src/it/business-app-resolves-starters/pom.xml
+++ b/SourceCode/microservice-framework-parent/src/it/business-app-resolves-starters/pom.xml
@@ -10,12 +10,12 @@
com.microservice.framework
microservice-framework-starter-parent
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
business-app-resolves-starters-fixture
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
diff --git a/SourceCode/microservice-framework-parent/src/it/business-parent-resolution/pom.xml b/SourceCode/microservice-framework-parent/src/it/business-parent-resolution/pom.xml
index 1ab7298..0ee633e 100644
--- a/SourceCode/microservice-framework-parent/src/it/business-parent-resolution/pom.xml
+++ b/SourceCode/microservice-framework-parent/src/it/business-parent-resolution/pom.xml
@@ -7,12 +7,12 @@
com.microservice.framework
microservice-framework-starter-parent
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
business-parent-resolution-fixture
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
diff --git a/SourceCode/microservice-framework-parent/src/it/convergence-violation-fails/pom.xml b/SourceCode/microservice-framework-parent/src/it/convergence-violation-fails/pom.xml
index 34cd5cf..148d816 100644
--- a/SourceCode/microservice-framework-parent/src/it/convergence-violation-fails/pom.xml
+++ b/SourceCode/microservice-framework-parent/src/it/convergence-violation-fails/pom.xml
@@ -13,12 +13,12 @@
com.microservice.framework
microservice-framework-starter-parent
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
convergence-violation-fails-fixture
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
diff --git a/SourceCode/microservice-framework-parent/src/it/framework-bom-resolution/pom.xml b/SourceCode/microservice-framework-parent/src/it/framework-bom-resolution/pom.xml
index 07e634b..573e0e9 100644
--- a/SourceCode/microservice-framework-parent/src/it/framework-bom-resolution/pom.xml
+++ b/SourceCode/microservice-framework-parent/src/it/framework-bom-resolution/pom.xml
@@ -8,7 +8,7 @@
Uses observability-starter (already implemented) to verify BOM provides version. -->
com.example.fixture
framework-bom-resolution-fixture
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
pom
@@ -16,7 +16,7 @@
com.microservice.framework
microservice-framework-bom
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
pom
import
diff --git a/SourceCode/microservice-framework-parent/src/it/framework-starter-inherits-parent/pom.xml b/SourceCode/microservice-framework-parent/src/it/framework-starter-inherits-parent/pom.xml
index 3c25530..9df7d2d 100644
--- a/SourceCode/microservice-framework-parent/src/it/framework-starter-inherits-parent/pom.xml
+++ b/SourceCode/microservice-framework-parent/src/it/framework-starter-inherits-parent/pom.xml
@@ -9,12 +9,12 @@
com.microservice.framework
microservice-framework-parent
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
framework-starter-inherits-parent-fixture
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
diff --git a/SourceCode/microservice-framework-parent/src/it/no-runtime-starter-inheritance/pom.xml b/SourceCode/microservice-framework-parent/src/it/no-runtime-starter-inheritance/pom.xml
index 71557b1..1dbce15 100644
--- a/SourceCode/microservice-framework-parent/src/it/no-runtime-starter-inheritance/pom.xml
+++ b/SourceCode/microservice-framework-parent/src/it/no-runtime-starter-inheritance/pom.xml
@@ -7,10 +7,10 @@
com.microservice.framework
microservice-framework-starter-parent
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
no-runtime-starter-inheritance-fixture
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
diff --git a/SourceCode/microservice-framework-parent/src/it/protected-version-override-fails/pom.xml b/SourceCode/microservice-framework-parent/src/it/protected-version-override-fails/pom.xml
index b773178..78f66bb 100644
--- a/SourceCode/microservice-framework-parent/src/it/protected-version-override-fails/pom.xml
+++ b/SourceCode/microservice-framework-parent/src/it/protected-version-override-fails/pom.xml
@@ -12,12 +12,12 @@
com.microservice.framework
microservice-framework-starter-parent
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
protected-version-override-fails-fixture
- 1.0.0-SNAPSHOT
+ 1.0.0-alpha.1
From 7cca8438a59395497313d3395dd0bb92f38cb6de Mon Sep 17 00:00:00 2001
From: Andy Yang <39001142+andy-library@users.noreply.github.com>
Date: Mon, 13 Jul 2026 12:16:43 +0800
Subject: [PATCH 2/2] fix: secure preview release dependencies
---
CHANGELOG.md | 3 +++
RELEASE_NOTES_v1.0.0-alpha.1.md | 6 ++++++
.../drools/autoconfigure/DroolsAutoConfiguration.java | 2 +-
.../drools/autoconfigure/DroolsAutoConfigurationTest.java | 4 ++--
.../health/FrameworkHealthIndicatorTest.java | 4 ++--
.../microservice-framework-dependencies/pom.xml | 6 +++---
.../src/it/banned-dependency-fails/pom.xml | 8 ++++----
7 files changed, 21 insertions(+), 12 deletions(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 37f8604..9397b44 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,8 @@ All notable changes to Microservice Framework will be documented in this file. T
### Changed
- Hardened Starter production boundaries, failure handling, security defaults, observability, and automated tests.
+- Updated Bouncy Castle to `1.84`, MinIO Java Client to `8.6.0`, and Commons Lang to `3.18.0` to remove known vulnerable dependency ranges.
+- Reworked the banned-dependency negative contract so security scanners do not treat an intentionally vulnerable Log4j 1.x fixture as a shipped dependency.
- Standardized documentation with `Andy Yang` as author and removed internal process history from public requirements.
- Unified all framework artifacts, consumer contracts, Demo dependencies, and displayed application metadata on version `1.0.0-alpha.1`.
@@ -31,3 +33,4 @@ All notable changes to Microservice Framework will be documented in this file. T
- Artifacts are not yet published to Maven Central; consumers must build and install them locally.
- This is a community preview and not a final compatibility commitment.
+- XXL-JOB `2.4.2` has a published low-severity SSRF advisory with no patched upstream version; deployments must restrict executor callback and network access according to the Security documentation.
diff --git a/RELEASE_NOTES_v1.0.0-alpha.1.md b/RELEASE_NOTES_v1.0.0-alpha.1.md
index ec98068..9702ee7 100644
--- a/RELEASE_NOTES_v1.0.0-alpha.1.md
+++ b/RELEASE_NOTES_v1.0.0-alpha.1.md
@@ -16,6 +16,7 @@ Author: Andy Yang
- 独立 Demo 应用，通过 Controller API 验证面向应用开发者的公开能力。
- MySQL、Redis、Kafka、Elasticsearch、Nacos 和 Apollo 真实中间件验收入口。
- Maven 全量构建、消费方契约、Dependency Review 和 CodeQL 安全门禁。
+- Bouncy Castle 1.84、MinIO Java Client 8.6.0 和 Commons Lang 3.18.0 安全升级。
- 中英文 README、公开 PRD、技术设计、贡献指南和安全策略。
### AI 驱动工程模式
@@ -38,6 +39,8 @@ mvn clean install
这是面向社区验证的预发布版本，不构成最终兼容性承诺。欢迎通过 Discussions、Issues 和 Pull Requests 提交真实项目反馈、测试证据和改进建议。
+XXL-JOB `2.4.2` 存在上游尚未提供修复版本的低危 SSRF 公告。使用方必须限制执行器回调地址和网络访问，并按照安全策略完成部署评审。
+
## English
`v1.0.0-alpha.1` is the first version-aligned preview of Microservice Framework after production-boundary hardening, public PRD curation, and community-governance improvements.
@@ -50,6 +53,7 @@ mvn clean install
- Standalone Demo application with Controller APIs for application-facing capability verification.
- Real-middleware acceptance entry points for MySQL, Redis, Kafka, Elasticsearch, Nacos, and Apollo.
- Maven verification, consumer contracts, Dependency Review, and CodeQL security gates.
+- Security updates to Bouncy Castle 1.84, MinIO Java Client 8.6.0, and Commons Lang 3.18.0.
- Bilingual README files, public PRDs, technical designs, contribution guidance, and security policy.
### AI-Driven Engineering Model
@@ -71,3 +75,5 @@ You can then build the required Starters and run `Microservice Demo/SourceCode/m
### Release Status
This is a community preview and not a final compatibility commitment. Real-world feedback, test evidence, and improvement proposals are welcome through Discussions, Issues, and Pull Requests.
+
+XXL-JOB `2.4.2` has an upstream low-severity SSRF advisory without a patched release. Consumers must restrict executor callback targets and network access and complete a deployment security review.
diff --git a/SourceCode/microservice-framework-drools-starter/src/main/java/com/microservice/framework/drools/autoconfigure/DroolsAutoConfiguration.java b/SourceCode/microservice-framework-drools-starter/src/main/java/com/microservice/framework/drools/autoconfigure/DroolsAutoConfiguration.java
index ea310e3..1db5ab5 100644
--- a/SourceCode/microservice-framework-drools-starter/src/main/java/com/microservice/framework/drools/autoconfigure/DroolsAutoConfiguration.java
+++ b/SourceCode/microservice-framework-drools-starter/src/main/java/com/microservice/framework/drools/autoconfigure/DroolsAutoConfiguration.java
@@ -88,7 +88,7 @@ public RuleVersion ruleVersion(DroolsProperties properties) {
return new RuleVersion(
"com.microservice.framework",
"drools-rules",
- "1.0.0-SNAPSHOT",
+ "1.0.0-alpha.1",
properties.getRule().getRuleFiles().size());
}
diff --git a/SourceCode/microservice-framework-drools-starter/src/test/java/com/microservice/framework/drools/autoconfigure/DroolsAutoConfigurationTest.java b/SourceCode/microservice-framework-drools-starter/src/test/java/com/microservice/framework/drools/autoconfigure/DroolsAutoConfigurationTest.java
index f764ace..34ef2c8 100644
--- a/SourceCode/microservice-framework-drools-starter/src/test/java/com/microservice/framework/drools/autoconfigure/DroolsAutoConfigurationTest.java
+++ b/SourceCode/microservice-framework-drools-starter/src/test/java/com/microservice/framework/drools/autoconfigure/DroolsAutoConfigurationTest.java
@@ -64,8 +64,8 @@ void ruleVersionShouldContainDefaultVersionInfo() {
RuleVersion version = context.getBean(RuleVersion.class);
assertThat(version.getGroupId()).isEqualTo("com.microservice.framework");
assertThat(version.getArtifactId()).isEqualTo("drools-rules");
- assertThat(version.getVersion()).isEqualTo("1.0.0-SNAPSHOT");
- assertThat(version.getCoordinates()).isEqualTo("com.microservice.framework:drools-rules:1.0.0-SNAPSHOT");
+ assertThat(version.getVersion()).isEqualTo("1.0.0-alpha.1");
+ assertThat(version.getCoordinates()).isEqualTo("com.microservice.framework:drools-rules:1.0.0-alpha.1");
});
}
diff --git a/SourceCode/microservice-framework-observability-starter/src/test/java/com/microservice/framework/observability/health/FrameworkHealthIndicatorTest.java b/SourceCode/microservice-framework-observability-starter/src/test/java/com/microservice/framework/observability/health/FrameworkHealthIndicatorTest.java
index 2661dc7..0f158b7 100755
--- a/SourceCode/microservice-framework-observability-starter/src/test/java/com/microservice/framework/observability/health/FrameworkHealthIndicatorTest.java
+++ b/SourceCode/microservice-framework-observability-starter/src/test/java/com/microservice/framework/observability/health/FrameworkHealthIndicatorTest.java
@@ -22,7 +22,7 @@ void setUp() {
@Override
protected Health doHealthCheck() {
return Health.up()
- .withDetail("version", "1.0.0-SNAPSHOT")
+ .withDetail("version", "1.0.0-alpha.1")
.withDetail("module", "observability-starter")
.withDetail("startupTime", System.currentTimeMillis())
.build();
@@ -47,7 +47,7 @@ void testHealth_IncludesVersion() {
assertNotNull(health.getDetails());
assertTrue(health.getDetails().containsKey("version"),
"健康信息应包含版本");
- assertEquals("1.0.0-SNAPSHOT", health.getDetails().get("version"));
+ assertEquals("1.0.0-alpha.1", health.getDetails().get("version"));
}
@Test
diff --git a/SourceCode/microservice-framework-parent/microservice-framework-dependencies/pom.xml b/SourceCode/microservice-framework-parent/microservice-framework-dependencies/pom.xml
index 331a9b0..c73aed5 100755
--- a/SourceCode/microservice-framework-parent/microservice-framework-dependencies/pom.xml
+++ b/SourceCode/microservice-framework-parent/microservice-framework-dependencies/pom.xml
@@ -48,7 +48,7 @@
2.29.45
- 8.5.14
+ 8.6.0
2.4.2
@@ -57,13 +57,13 @@
5.5.1
3.41.0
2.27.0
- 3.15.0
+ 3.18.0
2.3
1.2
4.13.0
2023.0.3.4
2.5.0
- 1.78
+ 1.84
2.15.1
2.11.0
3.25.5
diff --git a/SourceCode/microservice-framework-parent/src/it/banned-dependency-fails/pom.xml b/SourceCode/microservice-framework-parent/src/it/banned-dependency-fails/pom.xml
index 2c0f4cc..11a1e1f 100644
--- a/SourceCode/microservice-framework-parent/src/it/banned-dependency-fails/pom.xml
+++ b/SourceCode/microservice-framework-parent/src/it/banned-dependency-fails/pom.xml
@@ -4,7 +4,7 @@
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
4.0.0
-
+
com.microservice.framework
microservice-framework-starter-parent
@@ -18,9 +18,9 @@
- log4j
- log4j
- 1.2.17
+ com.alibaba
+ fastjson
+ 2.0.60