Remove vulnerable legacy dependencies

Author: SovNodeAI

.github/workflows/ci.yml

@@ -62,9 +62,9 @@ jobs:
                   totals[key] += int(root.attrib.get(key, 0))
 
           print(f"reports={len(reports)} " + " ".join(f"{key}={value}" for key, value in totals.items()))
-          expected = {"tests": 216, "failures": 0, "errors": 0, "skipped": 0}
-          if totals != expected or len(reports) != 42:
-              print(f"Expected reports=42 and totals={expected}", file=sys.stderr)
+          expected = {"tests": 219, "failures": 0, "errors": 0, "skipped": 0}
+          if totals != expected or len(reports) != 43:
+              print(f"Expected reports=43 and totals={expected}", file=sys.stderr)
               raise SystemExit(1)
           PY
 

README.md

@@ -13,7 +13,7 @@ This release preserves eladmin's five-module backend structure while modernizing
 
 The publication candidate was verified on August 31, 2026 with:
 
-- 216 tests executed
+- 219 tests executed
 - 0 failures
 - 0 errors
 - 0 skipped tests
@@ -56,6 +56,7 @@ The project modules remain:
 - New-user and password-reset credentials are generated randomly and returned once.
 - Administrative storage, payment, mail, generator, and verification routes have explicit authorization controls.
 - Low-privilege negative tests verify denial behavior and the standard HTTP 403 response shape.
+- Vulnerable fastjson 1.x and Commons Configuration 1.x artifacts are excluded and banned from the complete dependency graph.
 
 See [`SECURITY.md`](SECURITY.md) for private vulnerability reporting.
 
@@ -124,7 +125,7 @@ Optional integrations remain disabled until explicitly configured. Set `S3_ENABL
 
 HTTP JSON and Redis value serialization continue to use fastjson2 to preserve the existing wire shape. Characterization tests pin date formatting, long-number precision, null handling, and reference behavior.
 
-Several inherited dependencies remain under documented risk acceptance because replacing them would change application behavior. The rationale and verification for each accepted dependency are recorded in [`docs/verification/RISK_MAP.md`](docs/verification/RISK_MAP.md) and [`docs/verification/CLAIMS_LEDGER.md`](docs/verification/CLAIMS_LEDGER.md).
+Compatibility choices that remain under documented risk acceptance are recorded with their rationale and verification in [`docs/verification/RISK_MAP.md`](docs/verification/RISK_MAP.md) and [`docs/verification/CLAIMS_LEDGER.md`](docs/verification/CLAIMS_LEDGER.md).
 
 ## Attribution
 

docs/verification/CLAIMS_LEDGER.md

@@ -36,6 +36,7 @@ bundle at `/srv/sovnode/evidence/sov-345/`.
 | 23 | The SOV-1322 low privilege negative control battery adds exactly 24 behavioral `@Test` methods across 5 new classes; the delta head count is 164 methods across 36 classes | Authored: `grep -rE '^[[:space:]]*@Test[[:space:]]*$' --include='*.java' eladmin-* | wc -l` returns 164 in the SOV-1322 worktree (`52eb188` plus this delta; module split 24+4+25+36+75); the 24 new methods are the five `*LowPrivilegeNegativeControlTest` classes (LocalStorage 3, AliPay 5, Email 4, Generator 9, GenConfig 3), one class level `@Tag("behavioral")` each. Red control executed 2026-08-31 on the pre fix base: all 19 denial tests fail with `缺少 @PreAuthorize` (authorization reason only), 5 positive controls pass, 0 skipped, 0 errors. Green control: with the committed GEN delta `bd98ed7` plus simulated SEC guards and the 403 denial mapping, all 24 pass with 0 skipped and the full tools+generator suites stay green; the definitive green run is owed on the integrated release head |
 | 24 | The SOV-346 integrated correction head carries 41 test classes and 212 `@Test` methods, all executed with zero failures, errors, and skips, and the negative control battery fails on the pre fix base for the authorization reason only | Authored at the integrated head: `grep -rE '^[[:space:]]*@Test[[:space:]]*$' --include='*.java' eladmin-* | wc -l` returns 212; class census `grep -rlE '^[[:space:]]*@(org\.junit\.jupiter\.api\.)?Tag\("' --include='*.java' eladmin-*/src/test | wc -l` returns 41. Executed 2026-08-31 by the CEO in the authoritative checkout: `DOCKER_HOST=unix:///run/sovnode-podman/podman.sock mvn -B -ntp clean verify` BUILD SUCCESS, Surefire roll-up reports=41 tests=212 failures=0 errors=0 skipped=0, module summaries 29+4+34+70+75. Red control re-derived the same day on a detached worktree at the pre fix base `52eb188` with only the battery test files applied: generator slice 12 run 10 failures, tools slice 12 run 9 failures, every failure an authorization expectation on a route the correction head now guards; logs in `evidence/sov-346/integration-20260831T1910Z` (mvn-clean-verify.log, red-control.log, red-control-tools.log, openapi-audit.log). The census was regenerated from source at this head: `java tools/endpoint-census/EndpointCensus.java . tools/endpoint-census/endpoint-census.txt generate` then `verify`, exit 0, 139 records, sha256 `2791d8685f40751893a047c6ae1252ff63d9eb0333d7760348a173e7e452f0ed`; OpenAPI audit exit 0 at 141 operations and 414 schemas with the 3 hidden split 1 class level plus 2 method level |
 | 25 | The final release head `65f91cc` (base `b425f0b` plus taxonomy corrections `bda77e1` plus the AVR 001 guard integration) carries 42 test classes and 216 `@Test` methods, all executed with zero failures, errors, and skips | Authored at the release head: `grep -rE '^[[:space:]]*@Test[[:space:]]*$' --include='*.java' eladmin-* | wc -l` returns 216; class census `grep -rlE '^[[:space:]]*@(org\.junit\.jupiter\.api\.)?Tag\("' --include='*.java' eladmin-*/src/test | wc -l` returns 42 (35 behavioral, 6 static-contract, 1 snapshot; method totals 182+33+1; form split 13 qualified plus 29 short). Executed 2026-08-31 by the CEO in the authoritative checkout: `DOCKER_HOST=unix:///run/sovnode-podman/podman.sock mvn -B -ntp clean verify` BUILD SUCCESS, Surefire roll-up reports=42 tests=216 failures=0 errors=0 skipped=0, module summaries 29+4+34+70+79, logs in `evidence/sov-346/integration-20260831T2200Z` with LOG-HASHES; independently reproduced by the SOV 1324 final closure run f14170f0. The delta over row 24 is exactly the four `VerifyLowPrivilegeNegativeControlTest` methods gating the three VerifyController code routes with `email:send` (AVR 001 from the SOV 1324 verdict, independently re-audited PASS on SOV 1325). Census regenerated at this head for VerifyController line shifts: verify exit 0, 139 records, sha256 `0fbdbf9120e9d727029ba406d92bc193ac2b85fa1b76ea4a6da4e7af32482f81`; OpenAPI audit exit 0 at 141 operations and 414 schemas, unchanged from row 24 as required |
+| 26 | The public release runtime graph excludes fastjson 1.x and Commons Configuration 1.x while preserving the Alipay signing and generator type-mapping paths used by the application | `eladmin-tools/pom.xml` excludes the SDK's `com.alibaba:fastjson` edge and provides no replacement 1.x artifact; `eladmin-generator/pom.xml` removes `commons-configuration:commons-configuration`; the inherited Maven Enforcer execution bans both coordinates transitively in every module. `AlipayDependencyGraphContractTest.legacyFastjsonIsAbsentFromTheRuntimeClasspath` failed before removal and passes after it; `AlipaySdkCompatibilitySmokeTest` still performs local RSA page signing and verification. `ColUtilTest` pins known mappings, the existing `unknowType` fallback, and classpath absence. A packaged-jar inventory finds neither legacy artifact. The public gate count is now 43 reports and 219 tests with zero failures, errors, or skips required. |
 
 ## Prose rules for future changes
 

docs/verification/RISK_MAP.md

@@ -7,16 +7,18 @@ cheapness of the check.
 
 | Rank | Subsystem | Silent failure mode | Guard added in this delta | Status |
 |---|---|---|---|---|
-| 1 | Email send path | `NoClassDefFoundError` on first send, escapes `catch (Exception)`, surfaces as 500 on both verification code flows and the Quartz failure alarm | `EmailServiceImplBehaviorTest` through a real SMTPS server; red on the old code | closed |
-| 2 | HTTP JSON converter | Framework 7 removes the deprecated registration hook; fastjson behaviors (date format, long precision, null omission, reference detection) silently flip to Jackson defaults and reshape the API | `FastJsonConverterShapeCharacterizationTest` pins the exact bytes; README documents the constraint | closed, monitor on Framework upgrades |
-| 3 | MapStruct codegen | Processor cannot see Lombok accessors, emits compilable empty mappers; all DTOs null at runtime | Processor line pinned via `annotationProcessorPaths`; field asserting round trips in three modules | closed |
-| 4 | Security chain registration | Anonymous route registration regression 401s the Alipay payment callbacks; ERROR dispatch flips error pages to 401 JSON | Parity stubs for both callbacks and the ALL bucket; ERROR dispatch assertion with red/green refuter evidence | closed |
-| 5 | Context boot | Autoconfiguration wiring (springdoc, Druid Boot 4 starter, Redis namespace) fails only at startup | `EladminSystemApplicationTests` with MySQL and Redis containers, executed green in the final gate | closed where Docker exists; skips honestly elsewhere |
-| 6 | Redis value wire format | Serializer change breaks reads of existing cached data | `@type` prefix pin plus round trip, unit and live | closed |
-| 7 | Endpoint inventory | Route normalization drift hides lost or invented endpoints | Checksummed census with the Spring `combine` join fix; verify mode detects tampering (observed failing against the stale baseline) | closed |
-| 8 | Quartz job execution | Job failures during scheduling changes never surface in unit gates | none in this delta | open, accepted |
-| 9 | Alipay live signing | BC 1.62 to 1.85.2 jump verified only by jar identity and local SDK signing | `AlipaySdkCompatibilitySmokeTest` (local), README risk register asks deployments to smoke test real signing | mitigated, residual accepted |
-| 10 | Generator template output | Template rendering diverges from expected annotations | `GeneratorTemplateContractTest` pins template text (static) | scaffolding only |
+| 1 | Alipay dependency graph | SDK transitively restores vulnerable fastjson 1.x and exposes remote-code-execution surface | SDK exclusion plus Maven Enforcer ban; classpath-absence regression and local RSA page-signing control | closed for the application paths in use |
+| 2 | Email send path | `NoClassDefFoundError` on first send, escapes `catch (Exception)`, surfaces as 500 on both verification code flows and the Quartz failure alarm | `EmailServiceImplBehaviorTest` through a real SMTPS server; red on the old code | closed |
+| 3 | HTTP JSON converter | Framework 7 removes the deprecated registration hook; fastjson behaviors (date format, long precision, null omission, reference detection) silently flip to Jackson defaults and reshape the API | `FastJsonConverterShapeCharacterizationTest` pins the exact bytes; README documents the constraint | closed, monitor on Framework upgrades |
+| 4 | MapStruct codegen | Processor cannot see Lombok accessors, emits compilable empty mappers; all DTOs null at runtime | Processor line pinned via `annotationProcessorPaths`; field asserting round trips in three modules | closed |
+| 5 | Security chain registration | Anonymous route registration regression 401s the Alipay payment callbacks; ERROR dispatch flips error pages to 401 JSON | Parity stubs for both callbacks and the ALL bucket; ERROR dispatch assertion with red/green refuter evidence | closed |
+| 6 | Context boot | Autoconfiguration wiring (springdoc, Druid Boot 4 starter, Redis namespace) fails only at startup | `EladminSystemApplicationTests` with MySQL and Redis containers, executed green in the final gate | closed where Docker exists; skips honestly elsewhere |
+| 7 | Redis value wire format | Serializer change breaks reads of existing cached data | `@type` prefix pin plus round trip, unit and live | closed |
+| 8 | Endpoint inventory | Route normalization drift hides lost or invented endpoints | Checksummed census with the Spring `combine` join fix; verify mode detects tampering (observed failing against the stale baseline) | closed |
+| 9 | Generator configuration | Unsupported Commons Configuration 1.x remains in the runtime graph for one packaged properties file | JDK `Properties` loader, known and unknown type controls, classpath-absence regression, and Maven Enforcer ban | closed |
+| 10 | Quartz job execution | Job failures during scheduling changes never surface in unit gates | none in this delta | open, accepted |
+| 11 | Alipay live signing | BC 1.62 to 1.85.2 jump verified only by jar identity and local SDK signing | `AlipaySdkCompatibilitySmokeTest` (local), README risk register asks deployments to smoke test real signing | mitigated, residual accepted |
+| 12 | Generator template output | Template rendering diverges from expected annotations | `GeneratorTemplateContractTest` pins template text (static) | scaffolding only |
 
 Budget lesson recorded from the review: the migration wrote roughly
 1,400 test lines while the five riskiest subsystems (mail, mappers,

docs/verification/TEST_TAXONOMY.md

@@ -4,16 +4,16 @@ Every authored test class carries exactly one class level JUnit `@Tag`
 declaring what kind of evidence it is. Counts in handoffs must be
 reported per category; the sum is never behavioral coverage.
 
-The class census measured for this inventory is 42 classes: 35 tagged
-`behavioral`, 6 `static-contract`, 1 `snapshot`. Thirteen classes use
+The class census measured for this inventory is 43 classes: 36 tagged
+`behavioral`, 6 `static-contract`, 1 `snapshot`. Fourteen classes use
 the fully qualified `@org.junit.jupiter.api.Tag("...")` form and twenty
 nine use the short `@Tag("...")` form; both spellings are the same
 annotation. Audit tags with a recipe that accepts both forms and
 anchors the match at line start:
 
     grep -rlE '^[[:space:]]*@(org\.junit\.jupiter\.api\.)?Tag\("' --include='*.java' eladmin-*/src/test | wc -l
 
-which returns 42. Do not audit with `grep '@Tag('`: it misses the
+which returns 43. Do not audit with `grep '@Tag('`: it misses the
 qualified form and false-matches the springdoc template strings
 asserted in `GeneratorTemplateContractTest` and
 `OpenApiMigrationContractTest` (`@Tag(name = "${apiAlias}")`). An
@@ -41,20 +41,19 @@ tagged. No tags were added to manufacture this result.
 |---|---|---|---|
 | eladmin-common | AnonTagUtilsTest 2, AsyncExecutorLifecycleTest 1, DateUtilsTest 3, EncryptUtilsTest 3, FastJsonConverterShapeCharacterizationTest 3, FastJsonRedisSerializerRoundTripTest 3, FileUtilTest 4, GlobalExceptionHandlerAccessDeniedTest 5, StringUtilsTest 5 (29) | 0 | 0 |
 | eladmin-logging | LogErrorMapperRoundTripTest 4 (4) | 0 | 0 |
-| eladmin-generator | GenConfigLowPrivilegeNegativeControlTest 3, GeneratorLowPrivilegeNegativeControlTest 9, GeneratorMethodSecurityTest 9 (21) | GeneratorTemplateContractTest 5, OpenApiMigrationContractTest 7 (12) | NativeCountTypingContractTest 1 (1) |
+| eladmin-generator | ColUtilTest 3, GenConfigLowPrivilegeNegativeControlTest 3, GeneratorLowPrivilegeNegativeControlTest 9, GeneratorMethodSecurityTest 9 (24) | GeneratorTemplateContractTest 5, OpenApiMigrationContractTest 7 (12) | NativeCountTypingContractTest 1 (1) |
 | eladmin-tools | AlipayDependencyGraphContractTest 3, AlipaySdkCompatibilitySmokeTest 1, AliPayLowPrivilegeNegativeControlTest 5, AliPayMethodSecurityTest 15, AmzS3OptInContractTest 7, EmailLowPrivilegeNegativeControlTest 4, EmailMethodSecurityTest 13, EmailServiceImplBehaviorTest 1, LocalStorageLowPrivilegeNegativeControlTest 3, LocalStorageMapperRoundTripTest 4, LocalStorageMethodSecurityTest 6, S3StorageMethodSecurityTest 8 (70) | 0 | 0 |
 | eladmin-system | BootstrapFailClosedTest 5, EladminSystemApplicationTests 3, ProdProfileContextBootTests 4, SecurityChainParityTest 23, StartupBannerVersionTest 1, TokenProviderRoundTripTest 4, UserControllerResetPasswordAuditTest 4, UserMapperRoundTripTest 4, UserPasswordNonSerializationTest 6, VerifyLowPrivilegeNegativeControlTest 4 (58) | DatasourceContractTest 9, RedisRuntimeContractTest 3, ReleaseIntegritySourceAuditTest 7, ShippedSecretsAbsentTest 2 (21) | 0 |
-| total | 182 | 33 | 1 |
+| total | 185 | 33 | 1 |
 
-Method totals: 182 behavioral, 33 static-contract, 1 snapshot, which is
-216 `@Test` methods across 42 classes. Class totals: 35 / 6 / 1. Every
+Method totals: 185 behavioral, 33 static-contract, 1 snapshot, which is
+219 `@Test` methods across 43 classes. Class totals: 36 / 6 / 1. Every
 per-class method count in the table was re-derived from the sources
-with `grep -cE '^[[:space:]]*@Test[[:space:]]*$'` per file at the
-integrated head, and the executed Surefire roll-up over
-`**/target/surefire-reports/TEST-*.xml` states reports=42 tests=216
-failures=0 errors=0 skipped=0 for the 2026-08-31 full `mvn -B -ntp
-clean verify` with real containers through the protected Podman
-socket. The five `*LowPrivilegeNegativeControlTest` classes are the
+with `grep -cE '^[[:space:]]*@Test[[:space:]]*$'` per file. The public
+GitHub Actions gate requires the Surefire roll-up over
+`**/target/surefire-reports/TEST-*.xml` to state reports=43 tests=219
+failures=0 errors=0 skipped=0 after a Docker-backed `mvn -B -ntp clean
+verify`. The five `*LowPrivilegeNegativeControlTest` classes are the
 SOV-1322 low privilege negative control battery: 24 behavioral methods
 that run without Docker or Redis, fail on the pre fix base for the
 authorization reason only, and require the guarded routes plus the 403
@@ -82,6 +81,6 @@ grandfathered under the `snapshot` tag; do not add more like it.
 
 ## Reporting rule
 
-Handoffs state the three counts separately, for example: 182 behavioral,
+Handoffs state the three counts separately, for example: 185 behavioral,
 33 static contract, 1 snapshot, census tooling separate. Never present
 the sum as coverage.

eladmin-generator/pom.xml

@@ -11,10 +11,6 @@
     <artifactId>eladmin-generator</artifactId>
     <name>代码生成模块</name>
 
-    <properties>
-        <configuration.version>1.10</configuration.version>
-    </properties>
-
     <dependencies>
         <dependency>
             <groupId>me.zhengjie</groupId>
@@ -27,12 +23,5 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-freemarker</artifactId>
         </dependency>
-
-        <!-- https://mvnrepository.com/artifact/commons-configuration/commons-configuration -->
-        <dependency>
-            <groupId>commons-configuration</groupId>
-            <artifactId>commons-configuration</artifactId>
-            <version>${configuration.version}</version>
-        </dependency>
     </dependencies>
-</project>
+</project>