From e043bf59c9bb83e4094ce8ed0fe56856302f2b63 Mon Sep 17 00:00:00 2001
From: loong10k <20489781+loong10k@users.noreply.github.com>
Date: Fri, 14 Aug 2026 03:12:06 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E7=A7=BB=E9=99=A4=20pf4j=20=E7=A4=BA?=
 =?UTF-8?q?=E4=BE=8B=E4=B8=AD=E6=9C=AA=E4=BD=BF=E7=94=A8=E7=9A=84=20Spring?=
 =?UTF-8?q?=204.3.6=20=E4=BE=9D=E8=B5=96=EF=BC=8C=E5=85=B3=E9=97=AD=2022?=
 =?UTF-8?q?=20=E6=9D=A1=20Dependabot=20=E5=91=8A=E8=AD=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 两个 pf4j 插件示例的源码零 Spring import（仅用 javax.servlet），
  pom 中声明的 spring-aop/aspects/beans/context/context-support/
  core/web/webmvc 4.3.6（depMgmt）与 spring-web（test 模块）从未使用
- Spring 4.3.x 已 EOL，相关 CVE（路径穿越/XSS/请求走私/DoS 等）在
  4.x/5.x 线均无修复版本；移除未使用依赖即消除攻击面
- 同步移除 spring.version 属性
---
 .../pf4j-plugin-test/pom.xml                  |  7 ---
 .../pf4j-plugin-sample/pom.xml                | 50 -------------------
 .../pf4j2-plugin-test/pom.xml                 |  7 ---
 .../pf4j2-plugin-sample/pom.xml               | 50 -------------------
 4 files changed, 114 deletions(-)

diff --git a/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-test/pom.xml b/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-test/pom.xml
index 5482c97..a0166f0 100644
--- a/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-test/pom.xml
+++ b/spring-boot-sample-pf4j/pf4j-plugin-sample/pf4j-plugin-test/pom.xml
@@ -39,13 +39,6 @@
         <!-- ###################### Spring 4.x 核心框架 ###################### -->
 
         <!-- Bean支持，包括Groovy -->
-        <!-- For Spring Web -->
-        <dependency>
-            <groupId>org.springframework</groupId>
-            <artifactId>spring-web</artifactId>
-            <optional>true</optional>
-        </dependency>
-
         <!-- https://mvnrepository.com/artifact/ro.fortsoft.pf4j -->
         <dependency>
             <groupId>ro.fortsoft.pf4j</groupId>
diff --git a/spring-boot-sample-pf4j/pf4j-plugin-sample/pom.xml b/spring-boot-sample-pf4j/pf4j-plugin-sample/pom.xml
index 23040ec..07ae3cf 100644
--- a/spring-boot-sample-pf4j/pf4j-plugin-sample/pom.xml
+++ b/spring-boot-sample-pf4j/pf4j-plugin-sample/pom.xml
@@ -27,7 +27,6 @@
         <ro.pf4j-update.version>0.4.0</ro.pf4j-update.version>
         <ro.pf4j-spring.version>0.3.2</ro.pf4j-spring.version>
         <slf4j.version>1.7.21</slf4j.version>
-        <spring.version>4.3.6.RELEASE</spring.version><!-- 4.3.x（JDK 1.7 ）、4.1.x（JDK 1.6）、4.0.x（JDK 1.6） -->
     </properties>
 
     <dependencyManagement>
@@ -116,62 +115,13 @@
             <!-- ###################### Spring 4.x 核心框架  ###################### -->
             
             <!-- 基于代理的AOP支持 -->
-            <!-- For Spring Aop -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-aop</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
             <!-- 基于AspectJ的切面 -->
-            <!-- For Spring Aspects -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-aspects</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
             <!-- Bean支持，包括Groovy  -->
-            <!-- For Spring Beans -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-beans</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
             <!-- 应用程序的运行时环境，包括调度和远程处理的抽象 -->
-            <!-- For Spring Context -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-context</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
             <!-- 用于把常用的第三方 类库集成到Spring的应用环境中的支持类 -->
-            <!-- For Spring Context-Support -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-context-support</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
             <!-- 被大多数其他Spring模块使用的核心工具类 -->
-            <!-- For Spring Core -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-core</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
             <!-- Web支持包，包括客户端和web的远程访问 -->
-            <!-- For Spring Web -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-web</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
             <!-- REST的web服务和用于web应用程序的mvc实现 -->
-            <!-- For Spring Webmvc -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-webmvc</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
-            
         </dependencies>
     </dependencyManagement>
     
diff --git a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-test/pom.xml b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-test/pom.xml
index 657626b..5f8f5d5 100644
--- a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-test/pom.xml
+++ b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pf4j2-plugin-test/pom.xml
@@ -39,13 +39,6 @@
         <!-- ###################### Spring 4.x 核心框架 ###################### -->
 
         <!-- Bean支持，包括Groovy -->
-        <!-- For Spring Web -->
-        <dependency>
-            <groupId>org.springframework</groupId>
-            <artifactId>spring-web</artifactId>
-            <optional>true</optional>
-        </dependency>
-
         <!-- https://mvnrepository.com/artifact/org.pf4j/pf4j -->
         <dependency>
             <groupId>org.pf4j</groupId>
diff --git a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pom.xml b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pom.xml
index 1ea4f2e..636dfe4 100644
--- a/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pom.xml
+++ b/spring-boot-sample-pf4j2/pf4j2-plugin-sample/pom.xml
@@ -27,7 +27,6 @@
         <pf4j-update.version>2.0.0</pf4j-update.version>
         <pf4j-spring.version>0.4.0</pf4j-spring.version>
         <slf4j.version>1.7.21</slf4j.version>
-        <spring.version>4.3.6.RELEASE</spring.version><!-- 4.3.x（JDK 1.7 ）、4.1.x（JDK 1.6）、4.0.x（JDK 1.6） -->
     </properties>
 
     <dependencyManagement>
@@ -116,62 +115,13 @@
             <!-- ###################### Spring 4.x 核心框架  ###################### -->
             
             <!-- 基于代理的AOP支持 -->
-            <!-- For Spring Aop -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-aop</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
             <!-- 基于AspectJ的切面 -->
-            <!-- For Spring Aspects -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-aspects</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
             <!-- Bean支持，包括Groovy  -->
-            <!-- For Spring Beans -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-beans</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
             <!-- 应用程序的运行时环境，包括调度和远程处理的抽象 -->
-            <!-- For Spring Context -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-context</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
             <!-- 用于把常用的第三方 类库集成到Spring的应用环境中的支持类 -->
-            <!-- For Spring Context-Support -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-context-support</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
             <!-- 被大多数其他Spring模块使用的核心工具类 -->
-            <!-- For Spring Core -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-core</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
             <!-- Web支持包，包括客户端和web的远程访问 -->
-            <!-- For Spring Web -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-web</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
             <!-- REST的web服务和用于web应用程序的mvc实现 -->
-            <!-- For Spring Webmvc -->
-            <dependency>
-                <groupId>org.springframework</groupId>
-                <artifactId>spring-webmvc</artifactId>
-                <version>${spring.version}</version>
-            </dependency>
-            
         </dependencies>
     </dependencyManagement>