fix:20260904代码扫描漏洞问题修复

pom.xml

@@ -7,7 +7,7 @@
     <properties>
         <nutzboot.version>2.6.0-SNAPSHOT</nutzboot.version>
         <nutz.version>1.r.70-SNAPSHOT</nutz.version>
-        <jetty.cug-patch.version>9.4.57.v20241219-cug-patch1</jetty.cug-patch.version>
+        <tomcat.version>9.0.121</tomcat.version>
         <mysql-connector-java.version>8.0.28</mysql-connector-java.version>
         <jaxb-api.version>2.3.1</jaxb-api.version>
         <slf4j.version>2.0.8</slf4j.version>
@@ -145,8 +145,22 @@
         </dependency>
         <dependency>
             <groupId>org.nutz</groupId>
-            <artifactId>nutzboot-starter-jetty</artifactId>
+            <artifactId>nutzboot-starter-tomcat</artifactId>
             <version>${nutzboot.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.gandon.tomcat</groupId>
+                    <artifactId>juli-to-slf4j</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.tomcat.embed</groupId>
+            <artifactId>tomcat-embed-websocket</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.nutz</groupId>
+            <artifactId>nutz-plugins-websocket</artifactId>
         </dependency>
         <dependency>
             <groupId>org.nutz</groupId>
@@ -425,31 +439,39 @@
     </dependencies>
     <dependencyManagement>
         <dependencies>
-            <!-- 使用项目内的 Jetty 安全补丁，覆盖 NutzBoot 导入的受影响模块版本。 -->
+            <!-- Servlet API 由 Tomcat 提供，防止旧 API 混入可执行 JAR。 -->
             <dependency>
-                <groupId>org.eclipse.jetty</groupId>
-                <artifactId>jetty-http</artifactId>
-                <version>${jetty.cug-patch.version}</version>
+                <groupId>javax.servlet</groupId>
+                <artifactId>javax.servlet-api</artifactId>
+                <version>4.0.1</version>
+                <scope>provided</scope>
             </dependency>
             <dependency>
-                <groupId>org.eclipse.jetty</groupId>
-                <artifactId>jetty-server</artifactId>
-                <version>${jetty.cug-patch.version}</version>
+                <groupId>javax.websocket</groupId>
+                <artifactId>javax.websocket-api</artifactId>
+                <version>1.1</version>
+                <scope>provided</scope>
+            </dependency>
+            <!-- 显式覆盖导入的 NutzBoot BOM，避免回退到其默认 Tomcat 8.5。 -->
+            <dependency>
+                <groupId>org.apache.tomcat.embed</groupId>
+                <artifactId>tomcat-embed-core</artifactId>
+                <version>${tomcat.version}</version>
             </dependency>
             <dependency>
-                <groupId>org.eclipse.jetty</groupId>
-                <artifactId>jetty-security</artifactId>
-                <version>${jetty.cug-patch.version}</version>
+                <groupId>org.apache.tomcat.embed</groupId>
+                <artifactId>tomcat-embed-websocket</artifactId>
+                <version>${tomcat.version}</version>
             </dependency>
             <dependency>
-                <groupId>org.eclipse.jetty</groupId>
-                <artifactId>jetty-client</artifactId>
-                <version>${jetty.cug-patch.version}</version>
+                <groupId>org.apache.tomcat.embed</groupId>
+                <artifactId>tomcat-embed-el</artifactId>
+                <version>${tomcat.version}</version>
             </dependency>
             <dependency>
-                <groupId>org.eclipse.jetty</groupId>
-                <artifactId>jetty-jaspi</artifactId>
-                <version>${jetty.cug-patch.version}</version>
+                <groupId>org.apache.tomcat.embed</groupId>
+                <artifactId>tomcat-embed-jasper</artifactId>
+                <version>${tomcat.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.nutz</groupId>
@@ -543,17 +565,6 @@
         </resources>
     </build>
     <repositories>
-        <repository>
-            <id>cug-jetty-patch</id>
-            <url>file:///${project.basedir}/tools/jetty-security-patch/repository</url>
-            <releases>
-                <enabled>true</enabled>
-                <checksumPolicy>fail</checksumPolicy>
-            </releases>
-            <snapshots>
-                <enabled>false</enabled>
-            </snapshots>
-        </repository>
         <repository>
             <id>nutz</id>
             <url>https://jfrog.nutz.cn/artifactory/libs-release</url>