Bump fastjson from 1.2.31 to 1.2.61 in /jugg-springboot-api

[dependabot]

Bumps fastjson from 1.2.31 to 1.2.61.

Release notes

Sourced from fastjson's releases.

Fastjson发布1.2.61版本，增加AutoType安全黑名单

最近Freebuf有人发表了文章，公布了两个不在autoType黑名单中可以被利用的类，某安全厂商把漏洞定义为高。这里要说明下，autoType默认是关闭的，需要显示配置打开并且依赖特定包的漏洞不应该算是高危漏洞。

欢迎 https://github.com/Omega-Ariston 成为 fastjson的committer。

Issues

1. 增加autoType安全黑名单
2. 恢复1.2.60版本SerializeConfig中误删的put方法
3. 修复JSONField.unwrapped在某些场景属性丢失的问题 #2753
4. 修复Feature.NonStringKeyAsString在某些场景不生效的问题 #2736
5. 修复不支持guava ArrayListMultimap的问题 #2430
6. 修复JSON.parseArray方法不能识别byte[].class和char[].class作为变长参数的问题 #2464
7. 修复snake_case配置在嵌套时不生效的问题 #2428
8. 修复BigInteger类属性在超大数时结果不对的问题 #2628
9. 修复java.sql.Date在某些场景丢失精度的问题

相关链接

• 下载 http://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.61/
• 文档 https://github.com/alibaba/fastjson/wiki/%E5%B8%B8%E8%A7%81%E9%97%AE%E9%A2%98
• 源码 https://github.com/alibaba/fastjson/tree/1.2.61

fastjson 1.2.60版本发布 修复拒绝服务安全问题

这又是一个BUG修复安全加固版本，增加了AutoType黑名单，修复了一个导致拒绝服务的问题。

安全修复建议

拒绝服务安全漏洞涉及之前所有FASTJSON版本，建议升级到最新版本1.2.60。如果遇到不兼容问题，可以使用如下兼容版本：

1.1.15~1.1.31 -> 1.1.31.sec07 这版本不一样是因为1.1.31.sec06发布后，发现1.1.31版本特有一个的问题，又发布了1.1.31.sec07
1.1.32~1.1.33 -> 1.1.33.sec06 
1.1.34        -> 1.1.34.sec06
1.1.35~1.1.46 -> 1.1.46.sec06
1.2.3~1.2.7   -> 1.2.7.sec06 因为1.2.7使用最多特别提供，也可以直接使用1.2.8.sec06
1.2.8 -> 1.2.8.sec06
1.2.9~1.2.29 -> 1.2.29.sec06

安卓版本1.1.71.android 不受此漏洞影响。

已知不兼容列表

https://github.com/alibaba/fastjson/wiki/1_2_60_incompatible

为了方便大家无缝升级，提供了如下原地升级版本

1.2.48.sec06
1.2.51.sec06
1.2.54.sec06
1.2.56.sec06
1.2.57.sec06
1.2.58.sec06

... (truncated)

Commits

• 488107e fix testcase
• 8b251cb add testcase
• 9950f34 Merge branch 'master' of https://github.com/alibaba/fastjson
• 37d4f92 add whitelist
• 9b88c77 update version
• 9da408c Merge pull request #2719 from Omega-Ariston/fix-issue1816
• 9d11d07 Merge pull request #2753 from Omega-Ariston/fix-unwrapped_lost_name
• 30824c9 Merge pull request #2748 from Omega-Ariston/fix-issue2736
• 3d2868d Merge pull request #2739 from Omega-Ariston/fix-issue2428
• 0e2a3ad Merge pull request #2740 from Omega-Ariston/fix-issue2464
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Superseded by #6.