ylrz_his_scrm_java/pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>

    <groupId>com.fs</groupId>
    <artifactId>fs</artifactId>
    <version>1.1.0</version>
    <name>FS</name>
    <description>互联网医院平台</description>
    <properties>
        <fs.version>1.1.0</fs.version>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <java.version>1.8</java.version>
        <maven-jar-plugin.version>3.1.1</maven-jar-plugin.version>
        <druid.version>1.2.6</druid.version>
        <bitwalker.version>1.21</bitwalker.version>
        <swagger.version>2.9.2</swagger.version>
		<kaptcha.version>2.3.2</kaptcha.version>
		<mybatis-spring-boot.version>2.1.4</mybatis-spring-boot.version>
        <!-- CVE-2022-28111: pagehelper orderBy SQL 注入，核心库需 >= 5.3.1 -->
        <pagehelper.boot.version>1.4.7</pagehelper.boot.version>
        <pagehelper.version>5.3.3</pagehelper.version>
        <!-- pcmgr-345005 / CVE-2022-25845: Fastjson <=1.2.80 autoType 绕过 RCE，需 >= 1.2.83 -->
        <fastjson.version>1.2.83</fastjson.version>
        <oshi.version>5.8.0</oshi.version>
        <jna.version>5.8.0</jna.version>
        <commons.io.version>2.11.0</commons.io.version>
        <commons.fileupload.version>1.4</commons.fileupload.version>
        <commons.collections.version>3.2.2</commons.collections.version>
        <poi.version>4.1.2</poi.version>
        <velocity.version>1.7</velocity.version>
        <jwt.version>0.9.1</jwt.version>
        <org.mapstruct.version>1.5.5.Final</org.mapstruct.version>
        <gson-version>2.10</gson-version>
        <ijpay-version>2.7.8</ijpay-version>
        <!-- CVE-2021-27568: json-smart 需 >= 2.3.1 或 >= 2.4.1 -->
        <json-smart.version>2.5.1</json-smart.version>
        <!-- CVE-2023-6378 / CVE-2023-6481: logback receiver 反序列化 DoS，1.2.x 需 >= 1.2.13 -->
        <logback.version>1.2.13</logback.version>
        <!-- CVE-2021-22112: 单请求内多次修改 SecurityContext 可能导致权限提升，5.2.x 需 >= 5.2.9.RELEASE -->
        <!-- CVE-2026-22732 / CVE-2026-22746: 5.2.x 无 OSS 补丁，见 fs-common 缓解配置 -->
        <spring-security.version>5.2.15.RELEASE</spring-security.version>
        <!-- CVE-2022-25857: snakeyaml 集合嵌套深度未限制导致 DoS，需 >= 1.31 -->
        <snakeyaml.version>1.33</snakeyaml.version>
        <!-- CVE-2026-42579: netty-codec-dns 未校验 RFC 1035 域名，4.1.x 需 >= 4.1.133.Final -->
        <netty.version>4.1.133.Final</netty.version>
        <!-- CVE-2022-45688 / CVE-2022-45690 / CVE-2022-4565: hutool-json DoS，需 >= 5.8.25（XML.toJSONObject）/ 5.8.11（ZipUtil） -->
        <hutool.version>5.8.38</hutool.version>
        <!-- CVE-2020-36518 / CVE-2021-46877 / CVE-2022-42003: jackson-databind DoS，2.12.x 需 databind >= 2.12.7.1（BOM 为 2.12.7.20221012，已覆盖 2.12.6+） -->
        <jackson.version>2.12.7</jackson.version>
        <jackson-databind.version>2.12.7.1</jackson-databind.version>
        <jackson-bom.version>2.12.7.20221012</jackson-bom.version>
        <!-- CVE-2021-44832: log4j2 JDBC Appender JNDI RCE，Java 8 需 >= 2.17.1 -->
        <log4j2.version>2.17.1</log4j2.version>
        <!-- CVE-2021-36090: commons-compress 畸形 ZIP 导致 OOM DoS，需 >= 1.21 -->
        <commons.compress.version>1.26.2</commons.compress.version>
        <!-- CVE-2026-24400: assertj isXmlEqualTo XXE，需 >= 3.27.7 -->
        <assertj.version>3.27.7</assertj.version>
        <!-- CVE-2024-31573: xmlunit-core XSLT 扩展函数默认启用，需 >= 2.10.0 -->
        <xmlunit.version>2.10.0</xmlunit.version>
        <!-- CVE-2022-45685: jettison 栈溢出 DoS，需 >= 1.5.2 -->
        <jettison.version>1.5.4</jettison.version>
        <!-- CVE-2023-42809: Redisson 反序列化 RCE，需 >= 3.22.0；Spring Boot 2.2 需配合 redisson-spring-data-22 -->
        <redisson.version>3.27.2</redisson.version>
        <!-- CVE-2023-0833: OkHttp 非法 Header 触发异常导致敏感信息泄露，需 >= 4.9.2 -->
        <okhttp.version>4.12.0</okhttp.version>
        <!-- 3.1.800+ 已迁移 okhttp3，消除 okhttp2 2.7.x 传递依赖 -->
        <tencentcloud-sdk.version>3.1.1200</tencentcloud-sdk.version>
    </properties>

    <!-- 依赖声明 -->
    <dependencyManagement>
        <dependencies>

            <dependency>
                <groupId>com.google.code.gson</groupId>
                <artifactId>gson</artifactId>
                <version>${gson-version}</version>
            </dependency>

            <!-- 修复 CVE-2021-27568（json-path 传递依赖的 json-smart 2.3 存在 DoS 风险） -->
            <dependency>
                <groupId>net.minidev</groupId>
                <artifactId>json-smart</artifactId>
                <version>${json-smart.version}</version>
            </dependency>

            <!-- 修复 CVE-2022-45685（覆盖 aliyun-sdk-oss 传递的 jettison 1.1） -->
            <dependency>
                <groupId>org.codehaus.jettison</groupId>
                <artifactId>jettison</artifactId>
                <version>${jettison.version}</version>
            </dependency>

            <!-- 修复 CVE-2023-42809（Redisson 反序列化 RCE，需 >= 3.22.0） -->
            <dependency>
                <groupId>org.redisson</groupId>
                <artifactId>redisson</artifactId>
                <version>${redisson.version}</version>
            </dependency>
            <dependency>
                <groupId>org.redisson</groupId>
                <artifactId>redisson-spring-boot-starter</artifactId>
                <version>${redisson.version}</version>
            </dependency>
            <dependency>
                <groupId>org.redisson</groupId>
                <artifactId>redisson-spring-data-22</artifactId>
                <version>${redisson.version}</version>
            </dependency>

            <!-- 修复 CVE-2023-0833（覆盖 tencentcloud-sdk / 微信 SDK 等传递的 okhttp 3.12.x~3.14.x） -->
            <dependency>
                <groupId>com.squareup.okhttp3</groupId>
                <artifactId>okhttp</artifactId>
                <version>${okhttp.version}</version>
            </dependency>
            <dependency>
                <groupId>com.squareup.okhttp3</groupId>
                <artifactId>logging-interceptor</artifactId>
                <version>${okhttp.version}</version>
            </dependency>
            <dependency>
                <groupId>com.tencentcloudapi</groupId>
                <artifactId>tencentcloud-sdk-java</artifactId>
                <version>${tencentcloud-sdk.version}</version>
            </dependency>

            <!-- 修复 CVE-2023-6378 / CVE-2023-6481（覆盖 Spring Boot 默认 logback 1.2.3） -->
            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-classic</artifactId>
                <version>${logback.version}</version>
            </dependency>
            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-core</artifactId>
                <version>${logback.version}</version>
            </dependency>

            <!-- SpringBoot的依赖配置-->
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <version>2.2.13.RELEASE</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <!-- 修复 CVE-2021-22112（覆盖 Spring Boot 默认 spring-security 5.2.8.RELEASE） -->
            <dependency>
                <groupId>org.springframework.security</groupId>
                <artifactId>spring-security-core</artifactId>
                <version>${spring-security.version}</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.security</groupId>
                <artifactId>spring-security-web</artifactId>
                <version>${spring-security.version}</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.security</groupId>
                <artifactId>spring-security-config</artifactId>
                <version>${spring-security.version}</version>
            </dependency>

            <!-- 修复 CVE-2022-25857（覆盖 Spring Boot 默认 snakeyaml 1.25） -->
            <dependency>
                <groupId>org.yaml</groupId>
                <artifactId>snakeyaml</artifactId>
                <version>${snakeyaml.version}</version>
            </dependency>

            <!-- 修复 CVE-2026-42579：netty-bom + 显式锁定（勿升级 netty-all，4.1.64+ 已非 fat jar） -->
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-bom</artifactId>
                <version>${netty.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-common</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-buffer</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-transport</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-handler</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-codec</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-resolver</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-codec-dns</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-resolver-dns</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-codec-http</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-transport-native-unix-common</artifactId>
                <version>${netty.version}</version>
            </dependency>

            <!-- 核心模块-->
            <dependency>
                <groupId>com.fs</groupId>
                <artifactId>fs-qw-company-api</artifactId>
                <version>${fs.version}</version>
            </dependency>

            <!-- 阿里数据库连接池 -->
            <dependency>
                <groupId>com.alibaba</groupId>
                <artifactId>druid-spring-boot-starter</artifactId>
                <version>${druid.version}</version>
            </dependency>

            <!-- 解析客户端操作系统、浏览器等 -->
            <dependency>
                <groupId>eu.bitwalker</groupId>
                <artifactId>UserAgentUtils</artifactId>
                <version>${bitwalker.version}</version>
            </dependency>

            <!-- SpringBoot集成mybatis框架 -->
            <dependency>
                <groupId>org.mybatis.spring.boot</groupId>
                <artifactId>mybatis-spring-boot-starter</artifactId>
                <version>${mybatis-spring-boot.version}</version>
            </dependency>

            <!-- pagehelper 分页插件 -->
            <dependency>
                <groupId>com.github.pagehelper</groupId>
                <artifactId>pagehelper-spring-boot-starter</artifactId>
                <version>${pagehelper.boot.version}</version>
            </dependency>
            <dependency>
                <groupId>com.github.pagehelper</groupId>
                <artifactId>pagehelper</artifactId>
                <version>${pagehelper.version}</version>
            </dependency>

            <!-- 修复 CVE-2022-45688 / CVE-2022-45690 / CVE-2022-4565（覆盖 fs-common 及传递依赖中的 hutool 5.3.x / 5.7.x） -->
            <dependency>
                <groupId>cn.hutool</groupId>
                <artifactId>hutool-all</artifactId>
                <version>${hutool.version}</version>
            </dependency>
            <dependency>
                <groupId>cn.hutool</groupId>
                <artifactId>hutool-json</artifactId>
                <version>${hutool.version}</version>
            </dependency>
            <dependency>
                <groupId>cn.hutool</groupId>
                <artifactId>hutool-core</artifactId>
                <version>${hutool.version}</version>
            </dependency>
            <dependency>
                <groupId>cn.hutool</groupId>
                <artifactId>hutool-http</artifactId>
                <version>${hutool.version}</version>
            </dependency>
            <dependency>
                <groupId>cn.hutool</groupId>
                <artifactId>hutool-crypto</artifactId>
                <version>${hutool.version}</version>
            </dependency>

            <!-- 修复 CVE-2020-36518 / CVE-2021-46877 / CVE-2022-42003（覆盖 Spring Boot 默认 jackson-databind 2.10.5.1） -->
            <dependency>
                <groupId>com.fasterxml.jackson</groupId>
                <artifactId>jackson-bom</artifactId>
                <version>${jackson-bom.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-databind</artifactId>
                <version>${jackson-databind.version}</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-core</artifactId>
                <version>${jackson.version}</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-annotations</artifactId>
                <version>${jackson.version}</version>
            </dependency>

            <!-- 修复 CVE-2021-44832（覆盖 Spring Boot 默认 log4j2 2.12.1） -->
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-bom</artifactId>
                <version>${log4j2.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-api</artifactId>
                <version>${log4j2.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-core</artifactId>
                <version>${log4j2.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-to-slf4j</artifactId>
                <version>${log4j2.version}</version>
            </dependency>

            <!-- 修复 CVE-2021-36090（覆盖 POI 等传递依赖的 commons-compress 1.19） -->
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-compress</artifactId>
                <version>${commons.compress.version}</version>
            </dependency>

            <!-- 修复 CVE-2026-24400（覆盖 Spring Boot 默认 assertj-core 3.13.2） -->
            <dependency>
                <groupId>org.assertj</groupId>
                <artifactId>assertj-core</artifactId>
                <version>${assertj.version}</version>
            </dependency>

            <!-- 修复 CVE-2024-31573（覆盖 Spring Boot / spring-test 传递的 xmlunit-core 2.6.4） -->
            <dependency>
                <groupId>org.xmlunit</groupId>
                <artifactId>xmlunit-core</artifactId>
                <version>${xmlunit.version}</version>
            </dependency>

            <!-- 获取系统信息 -->
            <dependency>
                <groupId>com.github.oshi</groupId>
                <artifactId>oshi-core</artifactId>
                <version>${oshi.version}</version>
            </dependency>

            <dependency>
                <groupId>net.java.dev.jna</groupId>
                <artifactId>jna</artifactId>
                <version>${jna.version}</version>
            </dependency>

            <dependency>
                <groupId>net.java.dev.jna</groupId>
                <artifactId>jna-platform</artifactId>
                <version>${jna.version}</version>
            </dependency>

            <!-- swagger2-->
            <dependency>
                <groupId>io.springfox</groupId>
                <artifactId>springfox-swagger2</artifactId>
                <version>${swagger.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>io.swagger</groupId>
                        <artifactId>swagger-annotations</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.swagger</groupId>
                        <artifactId>swagger-models</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <!-- swagger2-UI-->
            <dependency>
                <groupId>io.springfox</groupId>
                <artifactId>springfox-swagger-ui</artifactId>
                <version>${swagger.version}</version>
            </dependency>
            <dependency>
                <groupId>com.github.xiaoymin</groupId>
                <artifactId>swagger-bootstrap-ui</artifactId>
                <version>1.9.3</version>
            </dependency>

            <!-- io常用工具类 -->
            <dependency>
                <groupId>commons-io</groupId>
                <artifactId>commons-io</artifactId>
                <version>${commons.io.version}</version>
            </dependency>

            <!-- 文件上传工具类 -->
            <dependency>
                <groupId>commons-fileupload</groupId>
                <artifactId>commons-fileupload</artifactId>
                <version>${commons.fileupload.version}</version>
            </dependency>

            <!-- excel工具 -->
            <dependency>
                <groupId>org.apache.poi</groupId>
                <artifactId>poi-ooxml</artifactId>
                <version>${poi.version}</version>
            </dependency>

            <!-- velocity代码生成使用模板 -->
            <dependency>
                <groupId>org.apache.velocity</groupId>
                <artifactId>velocity</artifactId>
                <version>${velocity.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>commons-collections</groupId>
                        <artifactId>commons-collections</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <!-- collections工具类 -->
            <dependency>
                <groupId>commons-collections</groupId>
                <artifactId>commons-collections</artifactId>
                <version>${commons.collections.version}</version>
            </dependency>

            <!-- 阿里JSON解析器 -->
            <dependency>
                <groupId>com.alibaba</groupId>
                <artifactId>fastjson</artifactId>
                <version>${fastjson.version}</version>
            </dependency>

            <!-- Token生成与解析-->
            <dependency>
                <groupId>io.jsonwebtoken</groupId>
                <artifactId>jjwt</artifactId>
                <version>${jwt.version}</version>
            </dependency>

            <!-- 验证码 -->
            <dependency>
                <groupId>com.github.penggle</groupId>
                <artifactId>kaptcha</artifactId>
                <version>${kaptcha.version}</version>
            </dependency>

            <!-- 定时任务-->
            <dependency>
                <groupId>com.fs</groupId>
                <artifactId>fs-quartz</artifactId>
                <version>${fs.version}</version>
            </dependency>
            <dependency>
                <groupId>com.fs</groupId>
                <artifactId>fs-live-mq</artifactId>
                <version>${fs.version}</version>
            </dependency>

            <!-- 代码生成-->
            <dependency>
                <groupId>com.fs</groupId>
                <artifactId>fs-generator</artifactId>
                <version>${fs.version}</version>
            </dependency>

            <!-- 核心模块-->
            <dependency>
                <groupId>com.fs</groupId>
                <artifactId>fs-framework</artifactId>
                <version>${fs.version}</version>
            </dependency>

            <dependency>
                <groupId>com.fs</groupId>
                <artifactId>fs-service</artifactId>
                <version>${fs.version}</version>
            </dependency>

            <!-- 通用工具-->
            <dependency>
                <groupId>com.fs</groupId>
                <artifactId>fs-common</artifactId>
                <version>${fs.version}</version>
            </dependency>
            <dependency>
                <groupId>com.fs</groupId>
                <artifactId>fs-repeat-api</artifactId>
                <version>${fs.version}</version>
            </dependency>
            <dependency>
                <groupId>com.fs</groupId>
                <artifactId>fs-ipad-task</artifactId>
                <version>${fs.version}</version>
            </dependency>

            <!-- WebSocket服务-->
            <dependency>
                <groupId>com.fs</groupId>
                <artifactId>fs-websocket</artifactId>
                <version>${fs.version}</version>
            </dependency>

            <dependency>
                <groupId>com.github.javen205</groupId>
                <artifactId>IJPay-All</artifactId>
                <version>${ijpay-version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <modules>
        <module>fs-admin</module>
        <module>fs-framework</module>
        <module>fs-service</module>
        <module>fs-quartz</module>
        <module>fs-generator</module>
        <module>fs-common</module>
        <module>fs-user-app</module>
        <module>fs-qw-api-msg</module>
        <module>fs-store</module>
        <module>fs-company</module>
        <module>fs-doctor-app</module>
        <module>fs-ai-chat</module>
        <module>fs-wx-api</module>
        <module>fs-user-app-ai-chat</module>
        <module>fs-qwhook</module>
        <module>fs-qwhook-sop</module>
        <module>fs-qw-api</module>
        <module>fs-qw-company-api</module>
        <module>fs-qw-task</module>
        <module>fs-redis</module>
        <module>fs-watch</module>
        <module>fs-common-api</module>
        <module>fs-company-app</module>
        <module>fs-live-app</module>
        <module>fs-ad-api</module>
        <module>fs-qw-voice</module>
        <module>fs-qwhook-msg</module>
        <module>fs-qw-mq</module>
        <module>fs-repeat-api</module>
        <module>fs-ipad-task</module>
        <module>fs-websocket</module>
        <module>fs-ad-new-api</module>
        <module>fs-live-mq</module>
    </modules>
    <packaging>pom</packaging>
    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.1</version>
                <configuration>
                    <source>${java.version}</source>
                    <target>${java.version}</target>
                    <encoding>${project.build.sourceEncoding}</encoding>
                </configuration>
            </plugin>
        </plugins>
    </build>
    <repositories>
        <repository>
            <id>public</id>
            <name>aliyun nexus</name>
            <url>http://maven.aliyun.com/nexus/content/groups/public/</url>
            <releases>
                <enabled>true</enabled>
            </releases>
        </repository>
        <repository>
            <id>OceanengineOpenApi</id>
            <name>ad_open_sdk_java</name>
            <layout>default</layout>
            <url>https://artifact.bytedance.com/repository/releases/</url>
        </repository>
    </repositories>
    <pluginRepositories>
        <pluginRepository>
            <id>public</id>
            <name>aliyun nexus</name>
            <url>http://maven.aliyun.com/nexus/content/groups/public/</url>
            <releases>
                <enabled>true</enabled>
            </releases>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </pluginRepository>
    </pluginRepositories>

</project>