7.21.0-rc.478
- build(deps): bump the github-actions group across 1 directory with 15 updates by @dependabot[bot] in https://github.com/Activiti/Activiti/pull/5495
- build(deps): bump com.mycila:license-maven-plugin from 5.0.0 to 5.1.1 by @dependabot[bot] in https://github.com/Activiti/Activiti/pull/5494
- build(deps-dev): bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 in the maven-plugins group by @dependabot[bot] in https://github.com/Activiti/Activiti/pull/5493
Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.477...7.21.0-rc.478
Nightly
- 247f469: [java][bidi] Remove subscription scope (#17842) (Puja Jagani) #17842
- e21617c: [build] Merge vendor cddl files into shared BiDi schema and implement custom Firefox webExtension options (#17840) (Titus Fortner) #17840
- fc654de: [grid] honor client-advertised se:remoteUrl for reachable BiDi/CDP/VNC URLs (#17790) (Titus Fortner) #17790
- 618f12b: [rb] tolerate and warn on missing required inbound BiDi fields, with SE_BIDI_STRICT to escalate (#17844) (Titus Fortner) #17844
- 06be624: [build] reconcile API-compatibility invariant with the deprecation policy in AGENTS.md (Titus Fortner)
fastjson 1.2.84版本发布
Release Date: 29 Jul 2026 Tag: 1.2.84 (72553ed)
Security fix release, backporting the fastjson2 AutoType hardening to the 1.2.x line. All users parsing untrusted JSON are strongly recommended to upgrade.
- Reject type names containing URL-special characters (
:/!) inParserConfig.checkAutoTypeandTypeUtils.loadClass, so a non-class-name string never reaches the class loader - Verify the accept name text after a whitelist hash match, so a hash collision alone cannot whitelist a type name
- An accept prefix no longer covers
ClassLoader/DataSource/RowSetgadget base types; only an accept entry naming the type in full is an explicit opt-in - Fixed deny classes being cached by
loadClassbefore the blacklist check, so a repeatedcheckAutoTypecall could return a blacklisted class from the cache
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>fastjson</artifactId>
<version>1.2.84</version>
</dependency>
中文版本
安全修复版本，将 fastjson2 的 AutoType 加固回移到 1.2.x 版本线。强烈建议所有解析不可信 JSON 的用户升级。
- 在
ParserConfig.checkAutoType和TypeUtils.loadClass中拒绝包含 URL 特殊字符（:/!）的类型名，非类名字符串不再可能到达类加载器 - 白名单 hash 命中后增加 accept 名称文本回验，仅 hash 碰撞无法再绕过白名单
- accept 前缀不再覆盖
ClassLoader/DataSource/RowSet等危险基类；只有完整类名的 accept 条目才视为显式放行 - 修复危险类在黑名单检查前被
loadClass缓存的问题：此前重复调用checkAutoType可能从缓存中直接返回黑名单类
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>fastjson</artifactId>
<version>1.2.84</version>
</dependency>
Nightly
- 66f1b48: [build] Automated Browser Version Update (#17828) (Selenium CI Bot) #17828
- a9f2bc5: [py] Include generated files in API docs published on Read the Docs (#17794) (Corey Goldberg) #17794
- 0293446: [py] Fix docs build for RtD (#17830) (Corey Goldberg) #17830
- 3760c6c: [py] Revert RtD doc build changes (#17831) (Corey Goldberg) #17831
- 9fd65b5: [build] BiDi schema generation cleanup (#17837) (Titus Fortner) #17837