[DavidHLP]

Summary

• Replace the Nacos client API's legacy protobuf generated code implicated in GHSA-h4h5-3hr4-j3g2 using the independently owned artifact com.ulticode:nacos-api-patched:2.5.1-ulticode-1.
• Pin upstream inputs and protoc 3.25.6 by SHA-256. Regenerate five source families, replace exactly ten classes, preserve all other upstream bytes, and retain licenses, original metadata, provenance and explicit CycloneDX upstream identity.
• Keep the pure Nacos SDK and managed protobuf/gRPC dependencies. Add strict parser, allocation, class-origin and gRPC response tests, plus a disposable authenticated registry/reconnect CI gate.
• Add a separate upstream SBOM scan and require Trivy to actually recognize the original Nacos API identity. Existing image/security gates remain in place.
• Configure the seven backend versions as 1.0.8 for a later separately approved release. No tags are overwritten and no deployment is included.

Verified locally

• Independent source/ABI/dependency review found no concrete surviving client-parser bypass or regression.
• The initial candidate passed 148 common/RPC unit tests. The lifecycle correction passed 11 strict Nacos runtime tests, launcher (4), SBOM (4), workflow-policy (11), and zero-infrastructure static checks.
• Pinned regeneration, original-API-compiled compatibility, malformed/repeated-field parsing and unary/bidirectional gRPC checks passed.
• Two clean builds and an incremental package produced byte-identical jars under the same JDK 17 toolchain. Tampered schema, upstream jar, extra source, packaged BOM and untouched class probes fail closed.
• All 29 reactor modules packaged successfully with tests explicitly skipped in that packaging-only step. All seven Boot jars were inspected: six Nacos consumers contain exactly one patched API; Search intentionally has no Nacos. No original API duplicate or shaded SDK was found.

Open security review

GitGuardian incident 39745564, occurrence 310810284 remains needs review. Its external check failed on 46acaab. The reported test-source anchor is known, but the precise detector match span has not been obtained, so no false-positive disposition is claimed. The lifecycle correction preserves that source and scanner coverage. No alert is dismissed, ignored or treated as passing, and this PR will not be merged while the review remains unresolved.

Required before readiness

This remains a draft until full CI passes for the exact head. The prior run passed 27 jobs, including actual Trivy upstream inventory recognition, image checks and cold-start/business acceptance, but failed the original-role configuration callback. Those results do not count as a full pass.

The latest fixture separates two required controls: the unchanged AUTH workload must successfully use naming and direct configuration I/O, then receive explicit 403 for one ordinary batch-listen request through the same SDK transport. A separate non-admin principal in a disposable synthetic-only namespace has namespace-wide configuration read and one exact dataId write. It must receive normal SDK callbacks and recover subscriptions after restart. Missing/wrong credentials, bidirectional cross-namespace direct reads and out-of-scope writes must return explicit 403. Callback timeouts remain failures. Production ACLs are unchanged.

Prior full run: https://github.com/DavidHLP/UltiCode/actions/runs/42222847948 . Docker integration is unavailable locally. That run subsequently passed the live auth/callback/reconnect checks and cold-start/business acceptance, but failed the final config post-shutdown health assertion. Exact SDK source shows that health observation can create a new RPC client after close. The lifecycle correction captures original resources before close and requires their shutdown, termination and factory removal; New exact-head validation for 64bfbda is running: https://github.com/DavidHLP/UltiCode/actions/runs/42232574222 . GitGuardian is tracked separately and remains unresolved.

Scope boundary

This repairs the application client API only. The separately pinned Nacos server image is unchanged; its old generated-code risk remains OPEN as SVC-029. Authentication and private-network exposure limits do not substitute for repairing that server-side parser. Original workload batch-listen authorization also remains OPEN as SVC-030. Namespace-wide read is confined to the owned synthetic fixture and is not a production permission fix or proof of original-role callback compatibility. The unchanged pure SDK also retains per-task listener daemon pools, tracked OPEN as SVC-031. The lifecycle gate reports this retention separately and does not claim exhaustive or leak-free shutdown. No merge, publication or deployment is requested by this PR update.

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
39745564	Triggered	Generic Password	46acaab	scripts/test/test_nacos_client_integration.py	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}