jianghang.loujh cf97b2ae31 fix: mitigate SnakeYAML deserialization RCE and enforce default password change ...

1. Use SafeConstructor in ApplicationConfigMonitor to block arbitrary
   object instantiation via YAML type tags (e.g. !!javax.script.ScriptEngineManager).
2. Detect default admin password (admin/123456) on login and enforce
   password change before allowing any other API operations (code 50015).

🤖 Generated with [Qoder][https://qoder.com]

2026-04-29 18:07:02 +08:00

..

src

fix: mitigate SnakeYAML deserialization RCE and enforce default password change

2026-04-29 18:07:02 +08:00

pom.xml

[maven-release-plugin] prepare for next development iteration

2025-01-16 16:07:08 +08:00