Skip to content

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 26, 2025

Bumps com.xuxueli:xxl-job-core from 3.1.0 to 3.2.0.

Release notes

Sourced from com.xuxueli:xxl-job-core's releases.

XXL-JOB v3.2.0 | 分布式任务调度平台

  • 1、【强化】AI任务(ollamaJobHandler)优化:针对 “model” 模型配置信息,从执行器侧文件类配置调整至调度中心“任务参数”动态配置,支持集成多模型、并结合任务动态配置切换。
  • 2、【安全】登录认证重构:密码加密算法从Md5改为Sha256;登录态改为登录后动态随机生成;提升系统安全性;(需要针对用户表进行字段调整,同时需要重新初始化密码信息;相关SQL脚本如下)
// 1、用户表password字段需要调整长度,执行如下命令
ALTER TABLE xxl_job_user
    MODIFY COLUMN `password` varchar(100) NOT NULL COMMENT '密码加密信息';
ALTER TABLE xxl_job_user
    ADD COLUMN `token` varchar(100) DEFAULT NULL COMMENT '登录token';

// 2、存量用户密码需要修改,可执行如下命令将密码初始化 “123456”;也可以自行通过 “SHA256Tool.sha256” 工具生成其他初始化密码;
UPDATE xxl_job_user t SET t.password = '8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92' WHERE t.username = {用户名};

  • 3、【强化】GLUE模式(Python) 扩展,支持 "GLUE(Python3)" 与 "GLUE(Python2)" 两种模式,分别支持 python3/2 多版本;
  • 4、【强化】调度中心系统日志调整,支持启动时指定 -DLOG_HOME 参数自定义日志位置;同时优化日志格式提升易读性;
  • 5、【优化】任务Bean扫描规则调整,过滤冗余不必要扫描,避免系统组件提前初始化;
  • 6、【优化】登录信息页面空值处理优化,避免空值影响ftl渲染;
  • 7、【优化】异常页面处理逻辑优化,新增兜底落地页配置;
  • 8、【重构】ReturnT 重构,简化代码结构,提升API易用性以及可维护性;
  • 9、【重构】项目结构重构,提升可维护性与易读性;
  • 10、【修复】漏洞修复(CVE-2025-7787),针对 httpJobHandler 支持配置URL白名单限制,防止服务器端请求伪造(SSRF)攻击。
  • 11、【修复】合并PR-3738,修复拼写问题;
  • 12、【修复】合并PR-3506,修复小概率情况下任务重复调度问题;
  • 13、【修复】合并PR-3747,修复异常情况下资源泄漏风险;
  • 14、【修复】IDOR越权问题修复,提升任务操作及日志管理安全性;
  • 15、【升级】升级多项maven依赖至较新版本,如 netty、groovy、mybatis、spring、spring-ai、dify 等;

XXL-JOB v3.1.1 | 分布式任务调度平台

  • 1、【调整】AI任务(difyWorkflowJobHandler)优化:针对 “baseUrl、apiKey” 等Dify配置信息,从执行器侧文件类配置调整至调度中心“任务参数”动态配置,支持多Dify应用集成并提升研发效率;
  • 2、【优化】合并PR-2417,修复任务管理时JobHandler录入空格问题;
  • 3、【优化】合并PR-2504,规避SQL注入问题;
  • 4、【升级】多个项目依赖升级至较新稳定版本,涉及 netty、spring/springboot、groovy 等;
Commits
  • 57b181b update doc
  • ed0d65a refactor(xxl-job-admin):重构管理员界面代码
  • c5d514b refactor(xxl-job-admin):优化代码结构和逻辑
  • 6fa7237 refactor(xxl-job): 重构错误处理和权限验证逻辑
  • be44018 refactor(xxl-job): 重构页面模板结构
  • 8c6f022 refactor(xxl-job): 重构页面模板结构
  • 8ae13cf refactor(xxl-job): 重构页面模板结构
  • bfe7687 refactor(admin): 重构管理员界面并优化用户体验
  • d71e69a refactor(xxl-job): 优化日志页面 JobGroup 和 JobId 的处理逻辑
  • 5429455 【修复】IDOR越权问题修复,提升任务操作及日志管理安全性;
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [com.xuxueli:xxl-job-core](https://github.com/xuxueli/xxl-job) from 3.1.0 to 3.2.0.
- [Release notes](https://github.com/xuxueli/xxl-job/releases)
- [Commits](xuxueli/xxl-job@3.1.0...3.2.0)

---
updated-dependencies:
- dependency-name: com.xuxueli:xxl-job-core
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Aug 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file java Pull requests that update java code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants