andy-library · andy-library · Jul 13, 2026 · Jul 13, 2026 · Jul 13, 2026
@@ -2,24 +2,35 @@
 
 Author: Andy Yang
 
-All notable changes to Microservice Framework will be documented in this file.
-
-The project follows a pragmatic changelog style inspired by Keep a Changelog.
+All notable changes to Microservice Framework will be documented in this file. The project follows a pragmatic changelog style inspired by Keep a Changelog.
 
 ## [Unreleased]
 
+## [1.0.0-alpha.1] - 2026-07-13
+
 ### Added
 
-- Initial open-source repository layout with `PRD`, `SourceCode`, and `Microservice Demo`.
-- Apache-2.0 license.
-- Community contribution, security, conduct, roadmap, issue, pull request, and CI preparation.
-- Framework PRD, component catalog, design documents, starter PRDs, demo reports, and JMeter scripts.
+- Initial open source repository layout with `PRD`, `SourceCode`, and `Microservice Demo`.
+- Apache-2.0 license and community contribution, security, conduct, roadmap, Issue, Pull Request, and CI governance.
+- Parent, Dependencies BOM, Framework BOM, Starter Parent, and 19 production-oriented Spring Boot Starters.
+- Standalone Demo Controller APIs, real-middleware acceptance coverage, JMeter scripts, and bilingual reports.
+- Public PRDs, technical designs, bilingual project documentation, and AI-driven open source vision.
+- GitHub Discussions, structured Issue templates, Dependabot, Dependency Review, CodeQL, and protected-branch quality gates.
 
 ### Changed
 
-- Documentation standardized with `Andy Yang` as author.
-- Framework requirement documents cleaned to reflect current design baseline instead of internal process history.
+- Hardened Starter production boundaries, failure handling, security defaults, observability, and automated tests.
+- Updated Bouncy Castle to `1.84`, MinIO Java Client to `8.6.0`, and Commons Lang to `3.18.0` to remove known vulnerable dependency ranges.
+- Reworked the banned-dependency negative contract so security scanners do not treat an intentionally vulnerable Log4j 1.x fixture as a shipped dependency.
+- Standardized documentation with `Andy Yang` as author and removed internal process history from public requirements.
+- Unified all framework artifacts, consumer contracts, Demo dependencies, and displayed application metadata on version `1.0.0-alpha.1`.
 
 ### Removed
 
-- Local build artifacts, Git metadata, raw test outputs, local IDE files, and OS metadata from the open-source package.
+- Local build artifacts, Git metadata, raw test outputs, local IDE files, and operating-system metadata from the open source package.
+
+### Known limitations
+
+- Artifacts are not yet published to Maven Central; consumers must build and install them locally.
+- This is a community preview and not a final compatibility commitment.
+- XXL-JOB `2.4.2` has a published low-severity SSRF advisory with no patched upstream version; deployments must restrict executor callback and network access according to the Security documentation.
@@ -9,7 +9,7 @@
     <parent>
         <groupId>com.microservice.framework</groupId>
         <artifactId>microservice-framework-starter-parent</artifactId>
-        <version>1.0.0-SNAPSHOT</version>
+        <version>1.0.0-alpha.1</version>
         <relativePath/>
     </parent>
 

@@ -281,7 +281,7 @@ info:
   app:
     name: Microservice Framework Demo (Full Embedded)
     description: Demonstration application with all starters using in-memory/embedded providers
-    version: 1.0.0-SNAPSHOT
+    version: 1.0.0-alpha.1
     profile: full-embedded
   framework:
     providers:

@@ -309,5 +309,5 @@ info:
   app:
     name: Microservice Framework Demo (Full Middleware)
     description: Demonstration application with all starters using real middleware connections
-    version: 1.0.0-SNAPSHOT
+    version: 1.0.0-alpha.1
     profile: full-middleware
@@ -231,7 +231,7 @@ info:
   app:
     name: Microservice Framework Demo (Local Smoke)
     description: Demonstration application — no middleware dependencies, quick-start profile
-    version: 1.0.0-SNAPSHOT
+    version: 1.0.0-alpha.1
     profile: local-smoke
   framework:
     starters:

@@ -238,7 +238,7 @@ info:
   app:
     name: Microservice Framework Demo
     description: Demonstration application for all Microservice Framework starters
-    version: 1.0.0-SNAPSHOT
+    version: 1.0.0-alpha.1
   framework:
     starters:
       - microservice-framework-common-starter

@@ -4,27 +4,27 @@ Author: Andy Yang
 
 This guide describes how to publish a GitHub release for Microservice Framework.
 
-## First Release
+## Current Preview Release
 
-The first prepared tag is:
+The current prepared tag is:
 
 ```text
-v0.1.0-alpha
+v1.0.0-alpha.1
 ```
 
-Use `RELEASE_NOTES_v0.1.0-alpha.md` as the release description.
+Use `RELEASE_NOTES_v1.0.0-alpha.1.md` as the release description.
 
 ## GitHub UI Steps
 
 1. Open `https://github.com/andy-library/microservice-framework/releases/new`.
-2. Select tag `v0.1.0-alpha`.
+2. Create tag `v1.0.0-alpha.1` from the reviewed `main` commit.
 3. Set release title:
 
 ```text
-v0.1.0-alpha - Initial Open Source Preview
+v1.0.0-alpha.1 - AI-Driven Community Preview
 ```
 
-4. Paste the content of `RELEASE_NOTES_v0.1.0-alpha.md`.
+4. Paste the content of `RELEASE_NOTES_v1.0.0-alpha.1.md`.
 5. Mark it as a pre-release.
 6. Publish the release.
 
@@ -34,3 +34,6 @@ v0.1.0-alpha - Initial Open Source Preview
 - Use annotated tags.
 - Review release notes before publishing.
 - Do not attach raw logs, `.jtl` files, local configuration files, or credentials.
+- Confirm Parent, BOM, all Starters, consumer contracts, Demo, Dependency Review, and CodeQL are green before tagging.
+- Keep the Git tag, Maven `revision`, Demo parent version, changelog, and release title aligned.
+- A GitHub source release does not imply Maven Central availability; state publication channels explicitly.
@@ -0,0 +1,79 @@
+# v1.0.0-alpha.1 - AI-Driven Community Preview
+
+Author: Andy Yang
+
+[中文](#中文) | [English](#english)
+
+## 中文
+
+`v1.0.0-alpha.1` 是 Microservice Framework 在完成生产边界加固、公开 PRD 整理和社区治理建设后的首个统一版本预览。
+
+### 核心内容
+
+- Java 21、Spring Boot 3.3.13、Spring Cloud 2023.0.6 技术基线。
+- Parent、Dependencies BOM、Framework BOM 和 Starter Parent 统一治理。
+- 19 个面向生产场景的 Spring Boot Starter。
+- 独立 Demo 应用，通过 Controller API 验证面向应用开发者的公开能力。
+- MySQL、Redis、Kafka、Elasticsearch、Nacos 和 Apollo 真实中间件验收入口。
+- Maven 全量构建、消费方契约、Dependency Review 和 CodeQL 安全门禁。
+- Bouncy Castle 1.84、MinIO Java Client 8.6.0 和 Commons Lang 3.18.0 安全升级。
+- 中英文 README、公开 PRD、技术设计、贡献指南和安全策略。
+
+### AI 驱动工程模式
+
+项目源于 Andy Yang 自 JDK 8 时代维护并在多个实际项目中验证的企业级脚手架。本次版本在既有实践上由 AI 参与需求整理、设计、实现、测试、审查和文档维护，维护者负责目标、架构约束、质量标准和最终验收。
+
+### 使用方式
+
+当前制品尚未发布到 Maven Central。请克隆源码并先安装 Parent 与 BOM：
+
+```bash
+git clone --branch v1.0.0-alpha.1 https://github.com/andy-library/microservice-framework.git
+cd microservice-framework/SourceCode/microservice-framework-parent
+mvn clean install
+```
+
+随后可以构建所需 Starter，并运行 `Microservice Demo/SourceCode/microservice-framework-demo` 进行验证。
+
+### 发布性质
+
+这是面向社区验证的预发布版本，不构成最终兼容性承诺。欢迎通过 Discussions、Issues 和 Pull Requests 提交真实项目反馈、测试证据和改进建议。
+
+XXL-JOB `2.4.2` 存在上游尚未提供修复版本的低危 SSRF 公告。使用方必须限制执行器回调地址和网络访问，并按照安全策略完成部署评审。
+
+## English
+
+`v1.0.0-alpha.1` is the first version-aligned preview of Microservice Framework after production-boundary hardening, public PRD curation, and community-governance improvements.
+
+### Highlights
+
+- Java 21, Spring Boot 3.3.13, and Spring Cloud 2023.0.6 baseline.
+- Governed Parent, Dependencies BOM, Framework BOM, and Starter Parent.
+- 19 production-oriented Spring Boot Starters.
+- Standalone Demo application with Controller APIs for application-facing capability verification.
+- Real-middleware acceptance entry points for MySQL, Redis, Kafka, Elasticsearch, Nacos, and Apollo.
+- Maven verification, consumer contracts, Dependency Review, and CodeQL security gates.
+- Security updates to Bouncy Castle 1.84, MinIO Java Client 8.6.0, and Commons Lang 3.18.0.
+- Bilingual README files, public PRDs, technical designs, contribution guidance, and security policy.
+
+### AI-Driven Engineering Model
+
+The project grew from an enterprise scaffold maintained by Andy Yang since the JDK 8 era and validated across multiple real projects. For this release, AI participated in requirements refinement, design, implementation, testing, review, and documentation, while the maintainer remained responsible for goals, architecture constraints, quality standards, and final acceptance.
+
+### Usage
+
+Artifacts are not yet available from Maven Central. Clone the source and install the Parent and BOMs first:
+
+```bash
+git clone --branch v1.0.0-alpha.1 https://github.com/andy-library/microservice-framework.git
+cd microservice-framework/SourceCode/microservice-framework-parent
+mvn clean install
+```
+
+You can then build the required Starters and run `Microservice Demo/SourceCode/microservice-framework-demo` for verification.
+
+### Release Status
+
+This is a community preview and not a final compatibility commitment. Real-world feedback, test evidence, and improvement proposals are welcome through Discussions, Issues, and Pull Requests.
+
+XXL-JOB `2.4.2` has an upstream low-severity SSRF advisory without a patched release. Consumers must restrict executor callback targets and network access and complete a deployment security review.
@@ -88,7 +88,7 @@ public RuleVersion ruleVersion(DroolsProperties properties) {
         return new RuleVersion(
                 "com.microservice.framework",
                 "drools-rules",
-                "1.0.0-SNAPSHOT",
+                "1.0.0-alpha.1",
                 properties.getRule().getRuleFiles().size());
     }
 

@@ -64,8 +64,8 @@ void ruleVersionShouldContainDefaultVersionInfo() {
             RuleVersion version = context.getBean(RuleVersion.class);
             assertThat(version.getGroupId()).isEqualTo("com.microservice.framework");
             assertThat(version.getArtifactId()).isEqualTo("drools-rules");
-            assertThat(version.getVersion()).isEqualTo("1.0.0-SNAPSHOT");
-            assertThat(version.getCoordinates()).isEqualTo("com.microservice.framework:drools-rules:1.0.0-SNAPSHOT");
+            assertThat(version.getVersion()).isEqualTo("1.0.0-alpha.1");
+            assertThat(version.getCoordinates()).isEqualTo("com.microservice.framework:drools-rules:1.0.0-alpha.1");
         });
     }
 

@@ -22,7 +22,7 @@ void setUp() {
             @Override
             protected Health doHealthCheck() {
                 return Health.up()
-                        .withDetail("version", "1.0.0-SNAPSHOT")
+                        .withDetail("version", "1.0.0-alpha.1")
                         .withDetail("module", "observability-starter")
                         .withDetail("startupTime", System.currentTimeMillis())
                         .build();
@@ -47,7 +47,7 @@ void testHealth_IncludesVersion() {
         assertNotNull(health.getDetails());
         assertTrue(health.getDetails().containsKey("version"),
                 "健康信息应包含版本");
-        assertEquals("1.0.0-SNAPSHOT", health.getDetails().get("version"));
+        assertEquals("1.0.0-alpha.1", health.getDetails().get("version"));
     }
 
     @Test

@@ -59,7 +59,7 @@ Microservice Framework Parent 是企业级微服务框架的构建与版本治
 <parent>
     <groupId>com.microservice.framework</groupId>
     <artifactId>microservice-framework-starter-parent</artifactId>
-    <version>1.0.0-SNAPSHOT</version>
+    <version>1.0.0-alpha.1</version>
     <relativePath/>
 </parent>
 ```

@@ -10,7 +10,7 @@ Author: Andy Yang
 <parent>
     <groupId>com.microservice.framework</groupId>
     <artifactId>microservice-framework-starter-parent</artifactId>
-    <version>1.0.0-SNAPSHOT</version>
+    <version>1.0.0-alpha.1</version>
     <relativePath/>
 </parent>
 ```

@@ -48,7 +48,7 @@
 
         <!-- 对象存储 -->
         <aws-sdk.version>2.29.45</aws-sdk.version>
-        <minio.version>8.5.14</minio.version>
+        <minio.version>8.6.0</minio.version>
 
         <!-- 任务调度 -->
         <xxl-job.version>2.4.2</xxl-job.version>
@@ -57,13 +57,13 @@
         <shardingsphere.version>5.5.1</shardingsphere.version>
         <checker-qual.version>3.41.0</checker-qual.version>
         <error-prone-annotations.version>2.27.0</error-prone-annotations.version>
-        <commons-lang3.version>3.15.0</commons-lang3.version>
+        <commons-lang3.version>3.18.0</commons-lang3.version>
         <snakeyaml.version>2.3</snakeyaml.version>
         <commons-logging.version>1.2</commons-logging.version>
         <antlr4-runtime.version>4.13.0</antlr4-runtime.version>
         <spring-cloud-alibaba.version>2023.0.3.4</spring-cloud-alibaba.version>
         <apollo-client.version>2.5.0</apollo-client.version>
-        <bouncycastle.version>1.78</bouncycastle.version>
+        <bouncycastle.version>1.84</bouncycastle.version>
         <commons-io.version>2.15.1</commons-io.version>
         <gson.version>2.11.0</gson.version>
         <protobuf-java.version>3.25.5</protobuf-java.version>

@@ -21,7 +21,7 @@
          ======================================================================== -->
     <properties>
         <!-- 版本号管理：使用 ${revision} 配合 flatten-maven-plugin 实现 CI 友好的版本号注入 -->
-        <revision>1.0.0-SNAPSHOT</revision>
+        <revision>1.0.0-alpha.1</revision>
 
         <!-- Java 编译版本：统一使用 JDK 21 -->
         <java.version>21</java.version>

@@ -8,12 +8,12 @@
     <parent>
         <groupId>com.microservice.framework</groupId>
         <artifactId>microservice-framework-starter-parent</artifactId>
-        <version>1.0.0-SNAPSHOT</version>
+        <version>1.0.0-alpha.1</version>
         <relativePath/>
     </parent>
 
     <artifactId>app-fat-jar-packaging-fixture</artifactId>
-    <version>1.0.0-SNAPSHOT</version>
+    <version>1.0.0-alpha.1</version>
 
     <dependencies>
         <dependency>

@@ -4,23 +4,23 @@
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
 
-    <!-- Contract #10(b): Declaring banned dependency (log4j:log4j) should fail enforcer rule. -->
+    <!-- Contract #10(b): Declaring a banned legacy JSON coordinate should fail the enforcer rule. -->
     <parent>
         <groupId>com.microservice.framework</groupId>
         <artifactId>microservice-framework-starter-parent</artifactId>
-        <version>1.0.0-SNAPSHOT</version>
+        <version>1.0.0-alpha.1</version>
         <relativePath/>
     </parent>
 
     <artifactId>banned-dependency-fails-fixture</artifactId>
-    <version>1.0.0-SNAPSHOT</version>
+    <version>1.0.0-alpha.1</version>
 
     <dependencies>
         <!-- This dependency is banned by enforcer governance rules -->
         <dependency>
-            <groupId>log4j</groupId>
-            <artifactId>log4j</artifactId>
-            <version>1.2.17</version>
+            <groupId>com.alibaba</groupId>
+            <artifactId>fastjson</artifactId>
+            <version>2.0.60</version>
         </dependency>
     </dependencies>
 </project>
@@ -10,12 +10,12 @@
     <parent>
         <groupId>com.microservice.framework</groupId>
         <artifactId>microservice-framework-starter-parent</artifactId>
-        <version>1.0.0-SNAPSHOT</version>
+        <version>1.0.0-alpha.1</version>
         <relativePath/>
     </parent>
 
     <artifactId>business-app-resolves-starters-fixture</artifactId>
-    <version>1.0.0-SNAPSHOT</version>
+    <version>1.0.0-alpha.1</version>
 
     <dependencies>
         <!-- Third-party dependency: resolves from dependencies BOM without version -->

@@ -7,12 +7,12 @@
     <parent>
         <groupId>com.microservice.framework</groupId>
         <artifactId>microservice-framework-starter-parent</artifactId>
-        <version>1.0.0-SNAPSHOT</version>
+        <version>1.0.0-alpha.1</version>
         <relativePath/>
     </parent>
 
     <artifactId>business-parent-resolution-fixture</artifactId>
-    <version>1.0.0-SNAPSHOT</version>
+    <version>1.0.0-alpha.1</version>
 
     <dependencies>
         <dependency>

@@ -13,12 +13,12 @@
     <parent>
         <groupId>com.microservice.framework</groupId>
         <artifactId>microservice-framework-starter-parent</artifactId>
-        <version>1.0.0-SNAPSHOT</version>
+        <version>1.0.0-alpha.1</version>
         <relativePath/>
     </parent>
 
     <artifactId>convergence-violation-fails-fixture</artifactId>
-    <version>1.0.0-SNAPSHOT</version>
+    <version>1.0.0-alpha.1</version>
 
     <dependencies>
         <!-- spring-boot-starter transitively brings spring-boot-autoconfigure at 3.3.13 -->