[Snyk] Fix for 3 vulnerabilities

[xiaobin]

Snyk has created this PR to fix 3 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• mi-blog/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Unsafe Dependency Resolution SNYK-JAVA-COMALIBABA-14908847	745	com.alibaba:fastjson: 1.2.31 -> 1.2.48 No Path Found Mature
	Time-of-check Time-of-use (TOCTOU) Race Condition SNYK-JAVA-ORGAPACHETOMCATEMBED-8523186	685	Major version upgrade No Path Found Proof of Concept
	Time-of-check Time-of-use (TOCTOU) Race Condition SNYK-JAVA-ORGAPACHETOMCATEMBED-8547999	610	Major version upgrade No Path Found No Known Exploit

Vulnerabilities that could not be fixed

• Upgrade:
  • Could not upgrade org.springframework.boot:spring-boot-starter-thymeleaf@1.5.2.RELEASE to org.springframework.boot:spring-boot-starter-thymeleaf@2.0.0.RELEASE; Reason could not apply upgrade, dependency is managed externally ; Location: https://maven-central.storage-download.googleapis.com/maven2/org/springframework/boot/spring-boot-dependencies/1.5.2.RELEASE/spring-boot-dependencies-1.5.2.RELEASE.pom

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Time-of-check Time-of-use (TOCTOU) Race Condition

[Copilot]

Pull request overview

This PR attempts to address security vulnerabilities identified by Snyk in the project's Maven dependencies. However, the actual changes are incomplete and insufficient compared to what is claimed in the PR description.

Changes:

• Upgrades fastjson dependency from version 1.2.31 to 1.2.48

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The upgrade to fastjson 1.2.48 is insufficient and leaves the application vulnerable. Fastjson version 1.2.48 has numerous known critical security vulnerabilities (CVEs) including remote code execution flaws. The minimum recommended version is 1.2.83 or higher. Consider upgrading to the latest stable version of fastjson (2.x series) to ensure all known vulnerabilities are addressed.

Suggested change

	<version>1.2.48</version>
	<version>2.0.52</version>

[Copilot]

The PR description claims to fix 3 vulnerabilities including two critical Tomcat vulnerabilities (SNYK-JAVA-ORGAPACHETOMCATEMBED-8523186 and SNYK-JAVA-ORGAPACHETOMCATEMBED-8547999), but this PR only upgrades the fastjson dependency. The Tomcat vulnerabilities are brought in through the Spring Boot dependencies (version 1.5.2.RELEASE) and remain unaddressed. This creates a false sense of security as the PR title suggests all 3 vulnerabilities are fixed when in reality only a partial fix for 1 vulnerability is attempted.

Suggested change

	<version>1.2.48</version>
	</dependency>
	<dependency>
	<version>1.2.83</version>
	</dependency>
	<!-- Override embedded Tomcat to secure versions to address SNYK-JAVA-ORGAPACHETOMCATEMBED-8523186 and SNYK-JAVA-ORGAPACHETOMCATEMBED-8547999 -->
	<dependency>
	<groupId>org.apache.tomcat.embed</groupId>
	<artifactId>tomcat-embed-core</artifactId>
	<version>8.5.88</version>
	</dependency>
	<dependency>
	<groupId>org.apache.tomcat.embed</groupId>
	<artifactId>tomcat-embed-el</artifactId>
	<version>8.5.88</version>
	</dependency>
	<dependency>
	<groupId>org.apache.tomcat.embed</groupId>
	<artifactId>tomcat-embed-websocket</artifactId>
	<version>8.5.88</version>
	</dependency>
	<dependency>