Bump com.alibaba:fastjson from 1.2.70 to 1.2.84 in /springboot-argument

[dependabot]

Bumps com.alibaba:fastjson from 1.2.70 to 1.2.84.

Release notes

Sourced from com.alibaba:fastjson's releases.

fastjson 1.2.84版本发布

fastjson 1.2.84 Release Notes

Release Date: 29 Jul 2026 Tag: 1.2.84 (72553ed)

Security fix release, backporting the fastjson2 AutoType hardening to the 1.2.x line. All users parsing untrusted JSON are strongly recommended to upgrade.

Security Fixes

1. Reject type names containing URL-special characters (:/!) in ParserConfig.checkAutoType and TypeUtils.loadClass, so a non-class-name string never reaches the class loader
2. Verify the accept name text after a whitelist hash match, so a hash collision alone cannot whitelist a type name
3. An accept prefix no longer covers ClassLoader/DataSource/RowSet gadget base types; only an accept entry naming the type in full is an explicit opt-in
4. Fixed deny classes being cached by loadClass before the blacklist check, so a repeated checkAutoType call could return a blacklisted class from the cache

Maven Dependency Configuration

<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>fastjson</artifactId>
    <version>1.2.84</version>
</dependency>

概述

安全修复版本，将 fastjson2 的 AutoType 加固回移到 1.2.x 版本线。强烈建议所有解析不可信 JSON 的用户升级。

安全修复

1. 在 ParserConfig.checkAutoType 和 TypeUtils.loadClass 中拒绝包含 URL 特殊字符（:/!）的类型名，非类名字符串不再可能到达类加载器
2. 白名单 hash 命中后增加 accept 名称文本回验，仅 hash 碰撞无法再绕过白名单
3. accept 前缀不再覆盖 ClassLoader/DataSource/RowSet 等危险基类；只有完整类名的 accept 条目才视为显式放行
4. 修复危险类在黑名单检查前被 loadClass 缓存的问题：此前重复调用 checkAutoType 可能从缓存中直接返回黑名单类

Maven 依赖配置

<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>fastjson</artifactId>
    <version>1.2.84</version>
</dependency>

... (truncated)

Commits

• 72553ed build: disable javadoc doclint for modern JDK builds
• 6ac7847 1.2.84 release: add central-publishing plugin, bump version
• 73675f6 build: restore junit test dependency (as in 1.2.84 init)
• ad353ff fix: strengthen autoType type name validation and whitelist verification
• 26f13f8 1.2.83
• 8f3410f bug fix for autotype
• cd3c2de improved jdk8 java.time support
• c63866e remove unused import
• 35db4ad bug fix for autoType
• 3f009e1 Merge pull request #4085 from hengyunabc/fix_setAccessible
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.