chore(deps): bump the all-maven group in /services with 11 updates

docs/DEVELOPMENT.md

@@ -347,6 +347,8 @@ Management forms use patched Zod 4 through `src/lib/toTypedSchema.ts`, which pre
 vee-validate 4 form contract for parsed values, defaults, field errors and required metadata.
 The published Zod 3 adapter is not used; production dependency audits retain the high-severity gate.
 
+Nacos 客户端使用官方 `pure` classifier，并显式引入同版本 `nacos-api`、`nacos-common`，由共享 RPC 模块提供给各 Owner/Worker；排除 Dubbo 引入的默认 shaded client，避免其内嵌依赖绕过 Maven 的安全版本管理。依赖升级须保留 protobuf 消息解析与 loopback gRPC 回归，并由镜像扫描及真实安装 CI 验证。Guava 升级不修复 Nacos 旧 protobuf 生成代码的资源放大风险；本地消息回归也不证明该风险已消除或线上可利用。
+
 后续变更必须保留以下基线契约：
 
 - Console 与 Management 保持各自路由、布局和权限边界，跨端行为归属现有 focused package；

pnpm-workspace.yaml

@@ -8,8 +8,12 @@ packages:
   - "apps/*"
   - "packages/*"
 overrides:
+  # Keep shared auto-installed peers on the patched Vue I18n line.
+  vue-i18n: 11.4.16
+  # Remove css/source-map-resolve and its vulnerable URI decoder.
+  stylus: 0.59.0
   dompurify: 3.4.17
-  follow-redirects: 1.16.1
+  follow-redirects: 1.16.2
   markdown-it: 15.0.3
   # Patch transitive CLI/parser dependencies without crossing consumer majors.
   brace-expansion@5: 5.0.12

services/admin/pom.xml

@@ -250,7 +250,7 @@
 			<plugin>
 				<groupId>org.jacoco</groupId>
 				<artifactId>jacoco-maven-plugin</artifactId>
-				<version>0.8.15</version>
+				<version>0.8.16</version>
 				<executions>
 					<execution>
 						<id>prepare-agent</id>

services/agent/data/repository_corpus_manifest.json

@@ -29,8 +29,8 @@
   },
   {
     "doc_id": "repository-development",
-    "version": "sha256-5417a89a3f26d82c4a92e2d643042659427ca9f2956bc300fdcace80b292d35c",
-    "chunk_id": "repository-development:sha256-5417a89a3f26d82c4a92e2d643042659427ca9f2956bc300fdcace80b292d35c:1",
+    "version": "sha256-a0bb91067cd22f2378b37df554238b4662d8f38c68117897389f2b41c31cb8dd",
+    "chunk_id": "repository-development:sha256-a0bb91067cd22f2378b37df554238b4662d8f38c68117897389f2b41c31cb8dd:1",
     "source_path": "docs/DEVELOPMENT.md",
     "access_scope": "repository-public",
     "sample_kind": "real",

services/app/app-web/pom.xml

@@ -239,7 +239,7 @@
 		<dependency>
 			<groupId>org.flywaydb</groupId>
 			<artifactId>flyway-core</artifactId>
-			<version>13.10.3</version>
+			<version>13.11.1</version>
 			<scope>test</scope>
 			<exclusions>
 				<!-- TOML configuration support is unused (programmatic Flyway.configure);
@@ -253,7 +253,7 @@
 		<dependency>
 			<groupId>org.flywaydb</groupId>
 			<artifactId>flyway-mysql</artifactId>
-			<version>13.10.3</version>
+			<version>13.11.1</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
@@ -305,7 +305,7 @@
 			<plugin>
 				<groupId>org.jacoco</groupId>
 				<artifactId>jacoco-maven-plugin</artifactId>
-				<version>0.8.15</version>
+				<version>0.8.16</version>
 				<executions>
 					<execution>
 						<id>prepare-agent</id>

services/auth/pom.xml

@@ -221,7 +221,7 @@
 			<plugin>
 				<groupId>org.jacoco</groupId>
 				<artifactId>jacoco-maven-plugin</artifactId>
-				<version>0.8.15</version>
+				<version>0.8.16</version>
 				<configuration>
 					<excludes>
 						<exclude>**/*Application.class</exclude>

services/core/pom.xml

@@ -119,7 +119,7 @@
         <dependency>
             <groupId>org.flywaydb</groupId>
             <artifactId>flyway-core</artifactId>
-            <version>13.10.3</version>
+            <version>13.11.1</version>
             <scope>test</scope>
             <exclusions>
                 <exclusion>
@@ -131,7 +131,7 @@
         <dependency>
             <groupId>org.flywaydb</groupId>
             <artifactId>flyway-mysql</artifactId>
-            <version>13.10.3</version>
+            <version>13.11.1</version>
             <scope>test</scope>
         </dependency>
     </dependencies>

services/notification/pom.xml

@@ -212,7 +212,7 @@
             <plugin>
                 <groupId>org.jacoco</groupId>
                 <artifactId>jacoco-maven-plugin</artifactId>
-                <version>0.8.15</version>
+                <version>0.8.16</version>
                 <executions>
                     <execution>
                         <id>prepare-agent</id>

services/platform/receipt/pom.xml

@@ -37,7 +37,7 @@
             <plugin>
                 <groupId>org.jacoco</groupId>
                 <artifactId>jacoco-maven-plugin</artifactId>
-                <version>0.8.15</version>
+                <version>0.8.16</version>
                 <executions>
                     <execution>
                         <id>prepare-agent</id>

services/platform/redis/pom.xml

@@ -41,7 +41,7 @@
             <plugin>
                 <groupId>org.jacoco</groupId>
                 <artifactId>jacoco-maven-plugin</artifactId>
-                <version>0.8.15</version>
+                <version>0.8.16</version>
                 <executions>
                     <execution>
                         <id>prepare-agent</id>

services/platform/rpc-resilience/pom.xml

@@ -14,6 +14,23 @@
     <name>UltiCode Backend (Dubbo dependency resilience)</name>
 
     <dependencies>
+        <!-- The shaded SDK embeds vulnerable Guava that dependency management cannot replace. -->
+        <dependency>
+            <groupId>com.alibaba.nacos</groupId>
+            <artifactId>nacos-client</artifactId>
+            <version>${nacos-client.version}</version>
+            <classifier>pure</classifier>
+        </dependency>
+        <dependency>
+            <groupId>com.alibaba.nacos</groupId>
+            <artifactId>nacos-common</artifactId>
+            <version>${nacos-client.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>com.alibaba.nacos</groupId>
+            <artifactId>nacos-api</artifactId>
+            <version>${nacos-client.version}</version>
+        </dependency>
         <dependency>
             <groupId>org.apache.dubbo</groupId>
             <artifactId>dubbo-config-spring</artifactId>

services/platform/rpc-resilience/src/test/java/com/ulticode/rpc/resilience/NacosRuntimeDependencyTest.java

@@ -0,0 +1,71 @@
+package com.ulticode.rpc.resilience;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import com.alibaba.nacos.api.grpc.auto.Metadata;
+import com.alibaba.nacos.api.grpc.auto.Payload;
+import com.alibaba.nacos.api.grpc.auto.RequestGrpc;
+import com.alibaba.nacos.client.naming.NacosNamingService;
+import com.google.protobuf.Any;
+import com.google.protobuf.ByteString;
+import io.grpc.ManagedChannel;
+import io.grpc.Server;
+import io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder;
+import io.grpc.netty.shaded.io.grpc.netty.NettyServerBuilder;
+import io.grpc.stub.StreamObserver;
+import java.net.InetSocketAddress;
+import java.util.concurrent.TimeUnit;
+import org.junit.jupiter.api.Test;
+
+class NacosRuntimeDependencyTest {
+
+    @Test
+    void excludesTheSdkWithUnmanagedShadedDependencies() throws Exception {
+        assertThat(NacosNamingService.class.getProtectionDomain().getCodeSource().getLocation().toString())
+                .endsWith("-pure.jar");
+        assertThat(getClass().getClassLoader().getResources(
+                "com/alibaba/nacos/api/NacosFactory.class").asIterator())
+                .toIterable().hasSize(1);
+        assertThat(getClass().getClassLoader().getResource(
+                "com/alibaba/nacos/shaded/com/google/common/collect/ImmutableList.class"))
+                .isNull();
+    }
+
+    @Test
+    void roundTripsNacosMessagesWithTheManagedProtobufRuntime() throws Exception {
+        Payload payload = payload();
+        assertThat(Payload.parseFrom(payload.toByteArray())).isEqualTo(payload);
+    }
+
+    @Test
+    void exchangesNacosMessagesOverTheManagedGrpcTransport() throws Exception {
+        Server server = NettyServerBuilder.forAddress(new InetSocketAddress("127.0.0.1", 0))
+                .addService(new RequestGrpc.RequestImplBase() {
+                    @Override
+                    public void request(Payload request, StreamObserver<Payload> response) {
+                        response.onNext(request);
+                        response.onCompleted();
+                    }
+                }).build().start();
+        ManagedChannel channel = null;
+        try {
+            channel = NettyChannelBuilder.forAddress("127.0.0.1", server.getPort())
+                    .usePlaintext().build();
+            assertThat(RequestGrpc.newBlockingStub(channel).withDeadlineAfter(5, TimeUnit.SECONDS)
+                    .request(payload())).isEqualTo(payload());
+        } finally {
+            if (channel != null) {
+                channel.shutdownNow().awaitTermination(5, TimeUnit.SECONDS);
+            }
+            server.shutdownNow().awaitTermination(5, TimeUnit.SECONDS);
+        }
+    }
+
+    private static Payload payload() {
+        return Payload.newBuilder()
+                .setMetadata(Metadata.newBuilder().setType("ServerCheckRequest")
+                        .putHeaders("requestId", "dependency-regression"))
+                .setBody(Any.newBuilder().setValue(ByteString.copyFromUtf8("{}")))
+                .build();
+    }
+}

services/platform/web-security/pom.xml

@@ -127,7 +127,7 @@
 		<plugin>
 			<groupId>org.jacoco</groupId>
 			<artifactId>jacoco-maven-plugin</artifactId>
-			<version>0.8.15</version>
+			<version>0.8.16</version>
 			<executions>
 				<execution>
 					<id>prepare-agent</id>

services/pom.xml

@@ -5,7 +5,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>4.1.1</version>
+		<version>4.1.2</version>
 		<relativePath/>
 	</parent>
 	<groupId>com.ulticode</groupId>
@@ -64,18 +64,20 @@
 		<jackson-2-bom.version>2.21.7</jackson-2-bom.version>
 		<jackson-bom.version>3.1.7</jackson-bom.version>
 		<tomcat.version>11.0.25</tomcat.version>
+		<guava.version>33.7.2-jre</guava.version>
+		<nacos-client.version>2.5.1</nacos-client.version>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-		<mybatis-plus.version>3.5.17</mybatis-plus.version>
+		<mybatis-plus.version>3.5.18.1</mybatis-plus.version>
 		<jjwt.version>0.13.0</jjwt.version>
 		<redisson.version>4.8.0</redisson.version>
-		<springdoc.version>3.1.1</springdoc.version>
+		<springdoc.version>3.2.0</springdoc.version>
 		<dubbo.version>3.3.6</dubbo.version>
 		<hutool.version>5.8.48</hutool.version>
 		<lombok.version>1.18.48</lombok.version>
 		<mapstruct.version>1.6.3</mapstruct.version>
 		<!-- OkHttp 5 ships an empty jar to Maven consumers; see the okhttp
 		     entry in dependencyManagement. -->
-		<okhttp.version>4.12.0</okhttp.version>
+		<okhttp.version>4.12.1</okhttp.version>
 		<japicmp.version>0.26.5</japicmp.version>
 		<coverage.bundle.minimum>0.50</coverage.bundle.minimum>
 		<!-- Submission has an explicit owner-specific floor because its current
@@ -225,6 +227,23 @@
 				<artifactId>okhttp</artifactId>
 				<version>${okhttp.version}</version>
 			</dependency>
+			<!-- CVE-2026-102554: use the pure Nacos SDK so Guava is managed. -->
+			<dependency>
+				<groupId>org.apache.dubbo</groupId>
+				<artifactId>dubbo-registry-nacos</artifactId>
+				<version>${dubbo.version}</version>
+				<exclusions>
+					<exclusion>
+						<groupId>com.alibaba.nacos</groupId>
+						<artifactId>nacos-client</artifactId>
+					</exclusion>
+				</exclusions>
+			</dependency>
+			<dependency>
+				<groupId>com.google.guava</groupId>
+				<artifactId>guava</artifactId>
+				<version>${guava.version}</version>
+			</dependency>
 			<dependency>
 				<groupId>org.testcontainers</groupId>
 				<artifactId>testcontainers-bom</artifactId>
@@ -367,7 +386,7 @@
 					<plugin>
 						<groupId>org.apache.maven.plugins</groupId>
 						<artifactId>maven-enforcer-plugin</artifactId>
-						<version>3.6.3</version>
+						<version>3.7.0</version>
 						<executions>
 							<execution>
 								<id>require-contract-baseline</id>

services/submission/pom.xml

@@ -175,7 +175,7 @@
             <plugin>
                 <groupId>org.jacoco</groupId>
                 <artifactId>jacoco-maven-plugin</artifactId>
-                <version>0.8.15</version>
+                <version>0.8.16</version>
                 <executions>
                     <execution>
                         <id>prepare-agent</id>