[wyhhai]

背景

安全扫描发现 java/pom.xml 的 io.micrometer:micrometer-core 存在 CVE-2026-40984（HIGH / CVSS 7.5）：HTTP server instrumentation 可被构造请求触发 DoS。当前 1.12.9 在官方受影响范围内（1.10.0–1.13.18），OSS 修复版为 1.15.12。

改动

仅改 java/pom.xml 的依赖坐标，无 Java 代码改动：

• micrometer.version：1.12.9 → 1.15.12
• Prometheus registry 坐标：micrometer-registry-prometheus → micrometer-registry-prometheus-simpleclient

第 2 点是必须的：1.15 线把 registry 包名从 io.micrometer.prometheus 改成 io.micrometer.prometheusmetrics，改用官方过渡产物 -simpleclient（仍提供旧包名）可让 SDK 对外 API 与接入方代码零改动。

验证

• mvn test：43 个用例全部通过（Tests run: 43, Failures: 0, Errors: 0）
• mvn dependency:list 确认：micrometer-core:1.15.12、micrometer-registry-prometheus-simpleclient:1.15.12

注意（重要，勿忽略）

1. 本 PR 只解决 obs-sdk 自身依赖。 接入方若仍锁 Boot 3.2.x，其 BOM（dependencyManagement 优先于传递版本）会把 micrometer-core 压回 1.12.9，CVE 在接入方仓库里不会真正清除；要真正清掉需接入方升级到 Boot 3.5.x（micrometer 1.15.12）。
2. micrometer-registry-prometheus-simpleclient 为官方过渡/弃用产物，其自动配置在 Boot 3.5 已被移除。建议后续 follow-up 将 SDK 迁移到官方新包 io.micrometer.prometheusmetrics（届时为 breaking change，需同步更新 README 与接入方 CollectorRegistry Bean）。

Test plan

• mvn test 全绿
• 核对有效依赖版本为 1.15.12

[opensourceways-bot]

Welcome To opensourceways Community

Hey @wyhhai , thanks for your contribution to the community.

Bot Usage Manual

I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.

Contact Guide

If you have any questions, please contact the SIG: infratructure ,
and any of the maintainers: @GeorgeCao-hw, @TangJia025, @pkking, @zhongjun2 ,
and any of the committers: @GeorgeCao-hw, @TangJia025, @pkking, @zkhzkhz .

[opensourceways-bot]

CLA Signature Guide

@wyhhai , thanks for your pull request.

The following commit(s) are not associated with a signed Contributor License Agreement (CLA).

Commit	Reason
09de046b fix(java): 升级 micrometer 至...	the email used in the commit is an invalid email! please check all commits.

To sign CLA, click here.

To check if your email is configured correctly, refer to the FAQs.

Once you've signed the CLA or updating your email, please comment /check-cla to revalidate CLA status.

[opensourceways-bot]

Linking Issue Notice

@wyhhai , the pull request must be linked to at least one issue.
If an issue has already been linked, but the needs-issue label remains, you can remove the label by commenting /check-issue .

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	maven/​io.micrometer/​micrometer-core@​1.12.9 ⏵ 1.15.12	+3	+16
	maven/​io.micrometer/​micrometer-registry-prometheus-simpleclient@​1.15.12

View full report