pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.okayjam</groupId>
    <artifactId>JamJavaUtil</artifactId>
    <version>1.0-SNAPSHOT</version>

    <properties>
        <!-- 用 release 而非 source/target：构建机 JDK 可能高于 11，release 才能同时约束 API 面，
     避免编译期误用 JDK 12+ 的 API、运行到 JDK 11 上抛 NoSuchMethodError -->
        <maven.compiler.release>11</maven.compiler.release>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

        <commons-io.version>2.22.0</commons-io.version>
        <netty.version>4.2.18.Final</netty.version>
        <okhttp.version>4.12.0</okhttp.version>
        <okio.version>3.18.2</okio.version>
        <poi.version>5.5.1</poi.version>
        <mysql.version>9.7.0</mysql.version>
        <sqlite.version>3.53.4.0</sqlite.version>
        <!-- tess4j 5.19.0 起捆绑 Tesseract 5.5.2；5.20+ 需 Java 17，故 5.19.0 为 Java 11 下最高可用版本 -->
        <tess4j.version>5.19.0</tess4j.version>
        <!-- Selenium 4.x 是本仓库唯一强制 Java 11 运行时的依赖（class 文件版本 55）；
             3.141.59 已 EOL 且无法驱动新版浏览器，故不接受降回 Java 8 基线 -->
        <selenium.version>4.49.0</selenium.version>
        <msgpack.version>0.9.12</msgpack.version>
        <slf4j.version>2.0.18</slf4j.version>
        <opencsv.version>5.12.0</opencsv.version>
        <!-- 注：1.2x 以后部分版本的 native 在部分环境下加载失败，1.20.0 已验证可用 -->
        <onnxruntime.version>1.20.0</onnxruntime.version>
        <junit5.version>5.14.4</junit5.version>

        <!-- 以下用于修复传递依赖中的已知漏洞（见 dependencyManagement） -->
        <fastjson.version>2.0.65</fastjson.version>
        <jackson.version>2.22.2</jackson.version>
        <log4j.version>2.26.1</log4j.version>
    </properties>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.13.0</version>
                <configuration>
                    <encoding>UTF-8</encoding>
                </configuration>
            </plugin>
            <!-- 显式锁定版本：不锁的话随 Maven 版本漂移，JUnit5 provider 行为不确定 -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.5.6</version>
            </plugin>
        </plugins>
    </build>

    <!-- 统一管理传递依赖版本，修复已知漏洞 -->
    <dependencyManagement>
        <dependencies>
            <!-- jackson-databind / jackson-core 存在反序列化绕过等 HIGH 漏洞，统一升级 -->
            <dependency>
                <groupId>com.fasterxml.jackson</groupId>
                <artifactId>jackson-bom</artifactId>
                <version>${jackson.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <!-- log4j-api 存在编码相关漏洞，统一升级 -->
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-bom</artifactId>
                <version>${log4j.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <!-- BOM 必须在 dependencyManagement 里 import 才生效（放在 dependencies 里不管理版本） -->
            <dependency>
                <groupId>org.junit</groupId>
                <artifactId>junit-bom</artifactId>
                <version>${junit5.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>

        <!-- https://mvnrepository.com/artifact/commons-io/commons-io -->
        <dependency>
            <groupId>commons-io</groupId>
            <artifactId>commons-io</artifactId>
            <version>${commons-io.version}</version>
        </dependency>
        <!-- -->

        <!-- https://mvnrepository.com/artifact/io.netty/netty-all -->
        <dependency>
            <groupId>io.netty</groupId>
            <artifactId>netty-all</artifactId>
            <version>${netty.version}</version>
        </dependency>


        <!-- https://mvnrepository.com/artifact/com.squareup.okhttp3/okhttp -->
        <dependency>
            <groupId>com.squareup.okhttp3</groupId>
            <artifactId>okhttp</artifactId>
            <version>${okhttp.version}</version>
        </dependency>

        <dependency>
            <groupId>com.squareup.okio</groupId>
            <artifactId>okio</artifactId>
            <version>${okio.version}</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/org.apache.poi/poi -->
        <dependency>
            <groupId>org.apache.poi</groupId>
            <artifactId>poi</artifactId>
            <version>${poi.version}</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/org.apache.poi/poi-ooxml -->
        <dependency>
            <groupId>org.apache.poi</groupId>
            <artifactId>poi-ooxml</artifactId>
            <version>${poi.version}</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/com.alibaba/fastjson -->
        <!-- 1.2.83 存在 CRITICAL 的 RCE 漏洞(GHSA-crf3-v9rr-v7hj)且 1.x 已停止维护，
             升级到 2.0.x（fastjson2 兼容包，保持 com.alibaba.fastjson API 不变） -->
        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>fastjson</artifactId>
            <version>${fastjson.version}</version>
        </dependency>




        <!--============= Database ================================-->
        <!-- https://mvnrepository.com/artifact/com.mysql/mysql-connector-j -->
        <dependency>
            <groupId>com.mysql</groupId>
            <artifactId>mysql-connector-j</artifactId>
            <version>${mysql.version}</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/org.apache.commons/commons-dbcp2 -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-dbcp2</artifactId>
            <version>2.14.0</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/org.apache.commons/commons-pool2 -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-pool2</artifactId>
            <version>2.13.1</version>
        </dependency>



        <!-- https://mvnrepository.com/artifact/commons-beanutils/commons-beanutils -->
        <dependency>
            <groupId>commons-beanutils</groupId>
            <artifactId>commons-beanutils</artifactId>
            <version>1.11.0</version>
        </dependency>


        <!-- https://mvnrepository.com/artifact/cglib/cglib -->
        <dependency>
            <groupId>cglib</groupId>
            <artifactId>cglib</artifactId>
            <version>3.3.0</version>
        </dependency>






        <!-- https://mvnrepository.com/artifact/org.xerial/sqlite-jdbc -->
        <dependency>
            <groupId>org.xerial</groupId>
            <artifactId>sqlite-jdbc</artifactId>
            <version>${sqlite.version}</version>
        </dependency>


        <!-- OCR -->
        <!-- https://mvnrepository.com/artifact/net.sourceforge.tess4j/tess4j -->
        <!-- https://mvnrepository.com/artifact/net.sourceforge.tess4j/tess4j -->
        <dependency>
            <groupId>net.sourceforge.tess4j</groupId>
            <artifactId>tess4j</artifactId>
            <version>${tess4j.version}</version>
            <exclusions>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>log4j-over-slf4j</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>log4j</groupId>
                    <artifactId>log4j</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <!-- ddddocr 验证码识别：基于 ONNX Runtime，与 Tesseract 方案并存以便对比 -->
        <!-- https://mvnrepository.com/artifact/com.microsoft.onnxruntime/onnxruntime -->
        <dependency>
            <groupId>com.microsoft.onnxruntime</groupId>
            <artifactId>onnxruntime</artifactId>
            <version>${onnxruntime.version}</version>
        </dependency>

        <dependency>
            <groupId>org.seleniumhq.selenium</groupId>
            <artifactId>selenium-java</artifactId>
            <version>${selenium.version}</version>
        </dependency>

<!--        <dependency>-->
<!--            <groupId>org.msgpack</groupId>-->
<!--            <artifactId>msgpack</artifactId>-->
<!--            <version>0.6.12</version>-->
<!--        </dependency>-->

        <!-- https://mvnrepository.com/artifact/org.msgpack/msgpack-core -->
        <dependency>
            <groupId>org.msgpack</groupId>
            <artifactId>msgpack-core</artifactId>
            <version>${msgpack.version}</version>
        </dependency>

        <dependency>
            <groupId>org.msgpack</groupId>
            <artifactId>jackson-dataformat-msgpack</artifactId>
            <version>${msgpack.version}</version>
        </dependency>


<!--        <dependency>-->
<!--            <groupId>com.opencsv</groupId>-->
<!--            <artifactId>opencsv</artifactId>-->
<!--            <version>${opencsv.version}</version>-->
<!--        </dependency>-->


        <!-- log -->
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <version>${slf4j.version}</version>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-reload4j</artifactId>
            <version>${slf4j.version}</version>
        </dependency>
        <!-- POI / tess4j 走 log4j-api 2.x，此前 classpath 上没有它的实现，日志被丢弃并打
             StatusLogger WARN。这里把 log4j2 API 路由到 slf4j，最终由 reload4j 按现有
             src/main/resources/log4j.properties 输出。
             不要再加 log4j-slf4j2-impl：它和 slf4j-reload4j 都是 SLF4J provider，会重复绑定。
             版本由 log4j-bom 统一管理。 -->
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-to-slf4j</artifactId>
        </dependency>
        <!-- log -->


        <!-- JUnit 5：版本由上面的 junit-bom 管理。必须是 junit-jupiter（含 engine），
             只引 junit-jupiter-api 时 surefire 找不到引擎，测试会被静默跳过而不是失败。
             注：JUnit 6.x 最低要求 Java 17，故 5.x 是当前 JDK 基线下的最高可用大版本。 -->
        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter</artifactId>
            <scope>test</scope>
        </dependency>

    </dependencies>



</project>