网站建设行业分析华竣国际的展厅设计公司

网站建设行业分析,华竣国际的展厅设计公司,做网站用笔记本做服务器,西苑做网站公司升级背景 在私有化部署过程中#xff0c;客户使用安全扫描工具检测到大量安全漏洞#xff0c;主要集中在#xff1a; 框架版本过低#xff1a;Spring Boot 2.1.6.RELEASE#xff08;发布于 2019 年#xff09;JDK 版本过旧#xff1a;JDK 8#xff08;缺乏最新安全补…升级背景在私有化部署过程中客户使用安全扫描工具检测到大量安全漏洞主要集中在框架版本过低Spring Boot 2.1.6.RELEASE发布于 2019 年JDK 版本过旧JDK 8缺乏最新安全补丁第三方依赖多个依赖存在已知 CVE 漏洞基于安全合规和长期维护的考虑决定进行大版本升级。当前版本Spring Boot 2.1.6.RELEASE JDK 8目标版本Spring Boot 3.5.4 JDK 21 LTS升级目标与核心变化主要变化类别变化内容迁移方式命名空间javax.* → jakarta.*自动化迁移JDK 版本Java 8 → Java 21 LTS自动化迁移 手动调整第三方依赖大量依赖需要升级手动处理API 文档Swagger 2.x → SpringDoc OpenAPI 3.x配置调整安全配置WebSecurityConfigurerAdapter 废弃重写配置类为什么选择自动化迁移前两项命名空间和 JDK 版本涉及的代码改动量极大手动修改容易出错且效率低下。OpenRewrite作为业界成熟的自动化重构工具可以完成大部分繁琐工作。完整升级步骤第一阶段准备工作JDK 8 环境代码分支管理span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-shellspan stylecolor:#015692# /span确保主分支代码为最新 git checkout dev git pull origin dev span stylecolor:#015692 # /span创建升级专用分支 git checkout -b upgrade/springboot3-jdk21 /code/span/span引入 OpenRewrite Maven 插件什么是 OpenRewriteOpenRewrite 是一个自动化代码重构和迁移工具专为 Java 生态系统设计。核心优势精确安全在 AST抽象语法树层面操作不会破坏代码结构批量处理一次性处理整个代码库可预览使用rewrite:dryRun查看变更预览可定制支持声明式YAML或编程式自定义规则工作原理OpenRewrite 通过解析源代码生成无损语法树LST在 AST 层面进行精确转换完整保留原始格式和缩进所有注释代码风格配置方式在pom.xml的plugins节点下添加span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-xmlspan stylecolor:#b75501plugin/span span stylecolor:#b75501groupId/spanorg.openrewrite.maven/span stylecolor:#b75501groupId/span span stylecolor:#b75501artifactId/spanrewrite-maven-plugin/span stylecolor:#b75501artifactId/span span stylecolor:#b75501version/span6.15.0/span stylecolor:#b75501version/span span stylecolor:#b75501configuration/span span stylecolor:#b75501exportDatatables/spantrue/span stylecolor:#b75501exportDatatables/span span stylecolor:#b75501activeRecipes/span span stylecolor:#656e77!-- 升级到 Java 21 --/span span stylecolor:#b75501recipe/spanorg.openrewrite.java.migrate.UpgradeToJava21/span stylecolor:#b75501recipe/span span stylecolor:#656e77!-- JUnit 4 to 5 --/span span stylecolor:#b75501recipe/spanorg.openrewrite.java.spring.boot2.SpringBoot2JUnit4to5Migration/span stylecolor:#b75501recipe/span span stylecolor:#656e77!-- Spring Boot 3.4插件暂不支持 3.5升级后手动改 --/span span stylecolor:#b75501recipe/spanorg.openrewrite.java.spring.boot3.UpgradeSpringBoot_3_4/span stylecolor:#b75501recipe/span /span stylecolor:#b75501activeRecipes/span /span stylecolor:#b75501configuration/span span stylecolor:#b75501dependencies/span span stylecolor:#b75501dependency/span span stylecolor:#b75501groupId/spanorg.openrewrite.recipe/span stylecolor:#b75501groupId/span span stylecolor:#b75501artifactId/spanrewrite-migrate-java/span stylecolor:#b75501artifactId/span span stylecolor:#b75501version/span3.14.1/span stylecolor:#b75501version/span span stylecolor:#b75501scope/spanruntime/span stylecolor:#b75501scope/span /span stylecolor:#b75501dependency/span span stylecolor:#b75501dependency/span span stylecolor:#b75501groupId/spanorg.openrewrite.recipe/span stylecolor:#b75501groupId/span span stylecolor:#b75501artifactId/spanrewrite-spring/span stylecolor:#b75501artifactId/span span stylecolor:#b75501version/span6.11.1/span stylecolor:#b75501version/span /span stylecolor:#b75501dependency/span /span stylecolor:#b75501dependencies/span /span stylecolor:#b75501plugin/span /code/span/span配方Recipe说明UpgradeSpringBoot_3_4 升级至 Spring Boot 3.4.x插件暂不支持 3.5升级后手动修改版本号即可UpgradeToJava21 升级至 JDK 21Spring Boot 配方仅升级到 JDK 17需额外添加此配方SpringBoot2JUnit4to5Migration 升级测试框架避免自动化测试报错提示你也可以编写自定义配方来处理项目特定的迁移需求。执行自动化迁移span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-shellmvn rewrite:run /code/span/span或者在 IDEA 中通过 Maven 面板执行执行时间几分钟到几十分钟不等取决于项目规模。可能遇到的问题如果某些类包含特殊代码导致报错可以先注释掉待升级完成后再处理执行完成后可以删除该插件也可以保留以便后续增量升级OpenRewrite 自动完成的变更执行完成后主要变化包括依赖升级pom.xml中的依赖版本自动升级Spring Boot 版本升级到 3.4.x手动改为 3.5.4包名变更javax.servlet.* → jakarta.servlet.*javax.persistence.* → jakarta.persistence.*javax.validation.* → jakarta.validation.*API 文档迁移Swagger 2.x → SpringDoc OpenAPI 3.xJDK 新特性应用Text Blocks多行字符串的优雅处理span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-javaspan stylecolor:#656e77// 自动转换为/span span stylecolor:#b75501String/span span stylecolor:#54790djson/span span stylecolor:#ab5656/span span stylecolor:#54790d { name: user, age: 18 } /span; /code/span/spaninstanceof 模式匹配简化类型判断和转换span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-javaspan stylecolor:#015692if/span (obj span stylecolor:#015692instanceof/span String s) { System.out.println(s.toUpperCase()); } /code/span/spanString.formatted()替代String.format()span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-javaspan stylecolor:#54790dHello, %s!/span.formatted(name); /code/span/span集合增强 getFirst() 替代 get(0)Serial注解标记序列化相关字段第三方库升级Apache HttpClientApache Commons 系列其他常用工具库增量合并场景处理场景执行 Rewrite 后旧分支又有代码提交合并时出现大量javax包名和 Swagger 注解冲突。解决方案使用 IntelliJ IDEA 自带的 Refactor 功能本质也是基于 OpenRewrite操作步骤打开 IDEA选择Refactor → Migrate Packages and Classes选择迁移规则javax → jakarta预览变更并执行第二阶段环境切换JDK 21 环境重要分界线以下操作需在 JDK 21 环境下进行。6. 修改 IDEA 项目配置修改 SDK 和 Language Level快捷键Ctrl Alt Shift S修改 Modules 的 Language Level修改 Java Compiler快捷键Ctrl Alt S核心问题与解决方案问题一Hibernate DDL Auto 的陷阱严重警告在完成以下配置前切勿启动项目否则可能导致数据库结构被错误修改。问题背景新旧版本 Hibernate 的行为差异为什么要禁用在生产环境中使用spring.jpa.hibernate.ddl-autoupdate存在严重风险数据安全风险自动更新可能导致意外的数据丢失或结构变更性能问题启动时全表检查会显著增加应用启动时间版本控制缺失无法追踪数据库变更历史不利于团队协作和回滚升级后风险更高Hibernate 6.x 的校验更严格误操作概率增加解决方案方案一配置优先级控制推荐在 CI/CD 启动脚本中设置 VM 参数span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-shelljava -jar app.jar -Dspring.jpa.hibernate.ddl-autonone /code/span/span优先级VM 参数 配置中心Apollo/Nacos application.properties方案二使用专业的数据库版本管理工具推荐使用Flyway或Liquibase管理数据库脚本span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-xmlspan stylecolor:#b75501dependency/span span stylecolor:#b75501groupId/spanorg.flywaydb/span stylecolor:#b75501groupId/span span stylecolor:#b75501artifactId/spanflyway-core/span stylecolor:#b75501artifactId/span /span stylecolor:#b75501dependency/span /code/span/span方案三结构对比工具Navicat提供结构同步功能DataGripIntelliJ 系产品支持数据库结构对比问题二Spring Security 配置迁移核心变化WebSecurityConfigurerAdapter已废弃推荐使用Lambda DSL配置方式配置方式从继承改为 Bean 注册迁移示例旧版配置Spring Security 5.xspan stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-javaspan stylecolor:#015692Configuration/span span stylecolor:#015692EnableWebSecurity/span span stylecolor:#015692public/span span stylecolor:#015692class/span span stylecolor:#b75501SecurityConfig/span span stylecolor:#015692extends/span span stylecolor:#b75501WebSecurityConfigurerAdapter/span { span stylecolor:#015692Override/span span stylecolor:#015692protected/span span stylecolor:#015692void/span span stylecolor:#b75501configure/span(HttpSecurity http) span stylecolor:#015692throws/span Exception { http .csrf().disable() .sessionManagement() .sessionCreationPolicy(SessionCreationPolicy.STATELESS) .and() .authorizeRequests() .antMatchers(span stylecolor:#54790d/api/public/**/span).permitAll() .anyRequest().authenticated(); } } /code/span/span新版配置Spring Security 6.xspan stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-javaspan stylecolor:#015692Configuration/span span stylecolor:#015692EnableWebSecurity/span span stylecolor:#015692public/span span stylecolor:#015692class/span span stylecolor:#b75501SecurityConfig/span { span stylecolor:#015692private/span span stylecolor:#015692final/span TokenProvider tokenProvider; span stylecolor:#015692public/span span stylecolor:#b75501SecurityConfig/span(TokenProvider tokenProvider) { span stylecolor:#b75501this/span.tokenProvider tokenProvider; } span stylecolor:#015692Bean/span span stylecolor:#015692public/span SecurityFilterChain span stylecolor:#b75501filterChain/span(HttpSecurity http) span stylecolor:#015692throws/span Exception { http .csrf(AbstractHttpConfigurer::disable) .sessionManagement(sessionManagement - sessionManagement .sessionCreationPolicy(SessionCreationPolicy.STATELESS)) .authorizeHttpRequests(authorizeRequests - authorizeRequests span stylecolor:#656e77// 允许所有 OPTIONS 请求/span .requestMatchers(OPTIONS, span stylecolor:#54790d**/span).permitAll() .requestMatchers( span stylecolor:#54790d/swagger-ui/**/span, span stylecolor:#54790d/v3/api-docs/**/span, span stylecolor:#54790d/swagger-resources/**/span, span stylecolor:#54790d/images/**/span, span stylecolor:#54790d/webjars/**/span).permitAll() .anyRequest().authenticated()) .addFilterBefore(span stylecolor:#015692new/span span stylecolor:#b75501JWTFilter/span(tokenProvider), UsernamePasswordAuthenticationFilter.class); span stylecolor:#015692return/span http.build(); } } /code/span/spanRequestMatcher 调整注意事项新增 SpringDoc 路径必须span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-java/swagger-uispan stylecolor:#656e77/** /v3/api-docs/** /span/code/span/span修正通配符写法span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-java❌ 错误 span stylecolor:#656e77//**/*.js/span ✅ 正确 span stylecolor:#656e77/**/*.js 否则会抛出 PatternParseException /span/code/span/span问题三SpringDoc OpenAPI 配置Swagger → SpringDoc 迁移span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-java !-- 移除旧的 Swagger 依赖 -- !-- dependency groupIdio.springfox/groupId artifactIdspringfox-swagger2/artifactId /dependency -- !-- 添加新的 SpringDoc 依赖 -- dependency groupIdorg.springdoc/groupId artifactIdspringdoc-openapi-starter-webmvc-ui/artifactId versionspan stylecolor:#b755012.3/spanspan stylecolor:#b75501.0/span/version /dependency /code/span/span配置示例span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-javaspan stylecolor:#015692Configuration/span span stylecolor:#015692OpenAPIDefinition/span span stylecolor:#015692public/span span stylecolor:#015692class/span span stylecolor:#b75501SwaggerConfig/span { span stylecolor:#015692Bean/span span stylecolor:#015692public/span OpenAPI span stylecolor:#b75501openAPI/span() { span stylecolor:#b75501OpenAPI/span span stylecolor:#54790dopenAPI/span span stylecolor:#ab5656/span span stylecolor:#015692new/span span stylecolor:#b75501OpenAPI/span(); openAPI.info(span stylecolor:#015692new/span span stylecolor:#b75501Info/span().title(span stylecolor:#54790dAPI 文档/span).version(span stylecolor:#54790d1.0/span)); span stylecolor:#656e77// 配置 Authorization 登录鉴权/span MapString, SecurityScheme map Map.of(span stylecolor:#54790dAuthorization/span, span stylecolor:#015692new/span span stylecolor:#b75501SecurityScheme/span() .type(SecurityScheme.Type.APIKEY) .in(SecurityScheme.In.HEADER) .name(span stylecolor:#54790dAuthorization/span)); openAPI.components(span stylecolor:#015692new/span span stylecolor:#b75501Components/span().securitySchemes(map)); map.keySet().forEach(key - openAPI.addSecurityItem(span stylecolor:#015692new/span span stylecolor:#b75501SecurityRequirement/span().addList(key))); span stylecolor:#015692return/span openAPI; } } /code/span/span注解对应关系Swagger 2.xSpringDoc OpenAPI 3.xApiTagApiOperationOperationApiParamParameterApiModelSchemaApiModelPropertySchema访问地址变更原 Swagger UI 地址http://localhost:8080/swagger-ui.html新 SpringDoc 地址http://localhost:8080/swagger-ui/index.html问题四依赖冲突与安全漏洞修复检测工具使用 IDEA 自带的依赖分析工具必须升级的依赖存在高危漏洞推荐使用OWASP Dependency-Check或Snyk扫描span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-shellmvn dependency-check:check /code/span/span解决依赖冲突的技巧问题Maven 依赖解析采用最短路径优先和第一声明优先原则可能导致旧版本覆盖新版本。解决方案显式声明期望的版本span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-javadependencies !-- 显式声明 Spring Framework 版本避免被传递依赖覆盖 -- dependency groupIdorg.springframework/groupId artifactIdspring-core/artifactId versionspan stylecolor:#b755016.1/spanspan stylecolor:#b75501.3/span/version /dependency /dependencies /code/span/span快速检测技巧在 IDEA 的 Maven 依赖树中搜索RELEASESpring 新版本已不使用RELEASE后缀搜索到的基本都是旧版本。问题五URL 尾斜杠匹配策略变更行为变化版本行为Spring Boot 2.x/api/user/get 和 /api/user/get/ 视为同一接口Spring Boot 3.x/api/user/get 和 /api/user/get/ 视为不同接口常见导致尾斜杠的情况Case 1类注解带尾斜杠span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-javaspan stylecolor:#015692RequestMapping(/api/user/)/span span stylecolor:#015692public/span span stylecolor:#015692class/span span stylecolor:#b75501UserController/span { span stylecolor:#015692PostMapping(login)/span span stylecolor:#656e77// 实际路径/api/user/login/span } /code/span/spanCase 2空字符串映射span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-javaspan stylecolor:#015692RequestMapping(/api/user)/span span stylecolor:#015692public/span span stylecolor:#015692class/span span stylecolor:#b75501UserController/span { span stylecolor:#015692PostMapping()/span span stylecolor:#656e77// 实际路径/api/user/带尾斜杠/span } /code/span/spanCase 3根路径映射span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-javaspan stylecolor:#015692PostMapping(/)/span span stylecolor:#656e77// 实际路径/带尾斜杠/span /code/span/span**** 检查方式IDEA Endpoints 工具窗口查看所有端点SpringDoc UI访问 Swagger 页面检查临时解决方案不推荐长期使用span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-javaspan stylecolor:#015692import/span org.springframework.context.annotation.Configuration; span stylecolor:#015692import/span org.springframework.web.servlet.config.annotation.PathMatchConfigurer; span stylecolor:#015692import/span org.springframework.web.servlet.config.annotation.WebMvcConfigurer; span stylecolor:#015692Configuration/span span stylecolor:#015692public/span span stylecolor:#015692class/span span stylecolor:#b75501WebConfiguration/span span stylecolor:#015692implements/span span stylecolor:#b75501WebMvcConfigurer/span { span stylecolor:#015692Override/span span stylecolor:#015692public/span span stylecolor:#015692void/span span stylecolor:#b75501configurePathMatch/span(PathMatchConfigurer configurer) { span stylecolor:#656e77// 设 置 为 true 以 忽 略 尾 斜 杠 恢 复 旧 版 本 行 为/span configurer.setUseTrailingSlashMatch(span stylecolor:#b75501true/span); } } /code/span/span注意__ ·setUseTrailingSlashMatch在 Spring 6.x 后已标记为废弃后续版本将删除。建议逐步修正所有端点去除尾斜杠。根本解决方案修正所有 Controller 的路径映射通知前端团队同步修改调用路径如果有硬编码的 URL全局搜索并修正使用测试确保前后端调用正常问题六Apache POI / EasyExcel 升级背景Apache POI 旧版本 5.0存在多个 CVE 安全漏洞必须升级。推荐方案对于新项目直接使用FastExcelspan stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-javadependency groupIdcn.idev.excel/groupId artifactIdfastexcel/artifactId versionspan stylecolor:#b755011.0/spanspan stylecolor:#b75501.0/span/version /dependency /code/span/span对于使用 EasyExcel 的旧项目span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-javadependency groupIdcom.alibaba/groupId artifactIdeasyexcel/artifactId versionspan stylecolor:#b755014.0/spanspan stylecolor:#b75501.3/span/version /dependency /code/span/span说明EasyExcel 已不再维护FastExcel 是社区维护的替代方案API 基本兼容。迁移注意事项EasyExcel 跨大版本升级2.x → 4.xAPI 变化较大主要改动1.监听器接口方法签名调整2.部分工具类包路径变更3.自定义转换器需要适配新接口建议参考官方迁移文档EasyExcel官方文档 - 基于Java的Excel处理工具 | Easy Excel 官网问题七JDK 模块化限制--add-opens问题现象某些依赖库使用反射访问 JDK 内部 API在 JDK 9 模块化系统下会报错span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-javaInaccessibleObjectException: Unable to make field accessible: span stylecolor:#015692module/span java.base does not span stylecolor:#54790dopens java.net/span to unnamed span stylecolor:#015692module/span /code/span/span解决方案在 IDEA 运行配置中添加 VM 参数开启 VM 参数配置默认隐藏解决方案在 IDEA 运行配置中添加 VM 参数开启 VM 参数配置默认隐藏常见需要开放的模块span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-java--add-opens java.base/java.langALL-UNNAMED --add-opens java.base/java.utilALL-UNNAMED --add-opens java.base/java.lang.reflectALL-UNNAMED --add-opens java.base/sun.nio.chALL-UNNAMED /code/span/span问题八过期配置属性警告问题现象启动时出现警告span stylecolor:#000000span stylebackground-color:#fefef2code classlanguage-javaProperty span stylecolor:#54790dspring.xxx.yyy/span is deprecated /code/span/span解决方案查看 Spring Boot 官方迁移文档使用 IDEA 的智能提示查看替代属性修改配置文件 常见过期属性application.yml或配置中心)常见过期属性过期属性替代属性spring.datasource.type自动推断无需配置spring.jpa.properties.hibernate.temp.use_jdbc_metadata_defaults已移除management.metrics.export.prometheus.enabledmanagement.prometheus.metrics.export.enabled完整测试清单升级完成后务必进行全面的回归测试Spring Security认证、授权是否正常SpringDocAPI 文档是否可访问 /swagger-ui/index.html 数据库操作JPA/MyBatis 是否正常工作缓存Redis/Caffeine 等缓存是否生效消息队列RabbitMQ/Kafka 等是否正常定时任务Scheduled/Quartz 是否按预期执行文件上传/下载文件 IO 操作是否正常业务功能核心业务流程是否正常重点关注有代码改动的地方性能测试对比升级前后的性能指标升级感悟框架层面的变化趋势通过这次升级我观察到现代框架的一些发展趋势校验更严格Spring 不再容忍 URL 尾斜杠的模糊匹配循环依赖检测更严格默认禁止Hibernate 对实体状态的校验更精确安全性优先默认配置更保守废弃不安全的 API强制升级修复已知漏洞现代化 APILambda DSL 配置风格函数式编程支持更简洁的 API 设计依赖选择建议基于这次升级经验对于第三方库的选择建议优先选择✅ 国际主流项目Apache、Spring 生态等✅ 有完善文档和测试的项目✅ 活跃维护且社区规模大的项目✅ 语义化版本管理清晰的项目谨慎选择⚠️ 缺乏自动化测试的项目⚠️ 长期未更新的项目⚠️ API 设计不稳定、频繁 Breaking Change 的项目⚠️ 文档不全、维护团队不稳定的项目自动化迁移的价值OpenRewrite 等自动化工具在大版本升级中的价值无可替代减少 90% 以上的机械性改动避免手工替换导致的遗漏保持代码风格和注释降低升级风险建议在日常开发中也关注此类工具提升团队整体效率。