springbootAI 2.2.0__tar.gz → 2.2.2__tar.gz

{springbootai-2.2.0 → springbootai-2.2.2}/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [2.2.2] - 2026-08-13
+
+### 新增
+
+- ORM `@Entity` / `@Table` 注解对齐 Java JPA 分离风格，支持三种写法（均向后兼容）：
+
+  | 写法 | 说明 | 对齐 Java |
+  |------|------|-----------|
+  | `@Entity` + `@Table(...)` | 分离风格（推荐） | `@Entity` + `@Table` |
+  | `@Entity` 无括号 | 表名自动推导为 snake_case | `@Entity`（无 `@Table`） |
+  | `@Entity("name", ...)` | 一体化风格（完全兼容） | 原有写法不变 |
+
+- `Table` 类新增 `__call__`，可直接作为类装饰器使用（`@Table(name=..., indexes=[...], comment=...)`）。
+- `@Entity` 支持无括号形式（`@Entity`），检测到已有 `@Table` 时不覆盖表元数据。
+- 提取 `_auto_generate_init` 辅助函数，消除 `Entity` 与 `Table.__call__` 间的重复代码。
+
+## [2.2.1] - 2026-08-13
+
+### 修复
+
+- 修复 ORM `@Entity`/`@entity` 实体解析、DDL 字段推断和 MyBatis 连接池初始化。
+- 加强 SQL 注入检测、敏感数据脱敏、Mapper XML 解析和 Web 根路由映射。
+- 增加对应回归测试，确保实体描述符、容器参数和静态资源路由行为稳定。
+
 本项目从 `2.1.0` 开始按 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/) 记录面向使用者的变化，并使用语义化版本号。
 
 ## [2.2.0] - 2026-08-12

{springbootai-2.2.0/springbootAI.egg-info → springbootai-2.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: springbootAI
-Version: 2.2.0
+Version: 2.2.2
 Summary: Spring-style Python framework with Web, ORM, Cloud and AI integrations
 Author-email: YuConggen <1516933915@qq.com>
 License-Expression: MIT
@@ -151,7 +151,7 @@ SpringBootAI 是一个采用 Spring 风格注解和分层结构的 Python 应用
 | AI 与编排 | 模型调用、Tools、RAG、Chain、状态图、MCP client/server | LangChain / LangGraph / 官方 MCP SDK |
 | 生产治理 | 健康检查、Prometheus、限流熔断、追踪、Swagger | prometheus-client / OpenTelemetry / OpenAPI |
 
-当前版本是 `2.2.0`；支持 Python 3.10、3.11 和 3.12，许可证为 MIT。项目仍标记为 Beta。用于公网高并发、合规敏感或支付/订单/库存等核心系统前，必须完成目标数据库、流量模型、故障恢复和安全基线验证。内嵌 Gateway 适合内部路由，不替代公网 Nginx/Kong/WAF；Seata `distributed` 当前验证的是官方 TC + TCC 回调，不会为 Python 数据库操作自动生成 AT `undo_log`。
+当前版本是 `2.2.1`；支持 Python 3.10、3.11 和 3.12，许可证为 MIT。项目仍标记为 Beta。用于公网高并发、合规敏感或支付/订单/库存等核心系统前，必须完成目标数据库、流量模型、故障恢复和安全基线验证。内嵌 Gateway 适合内部路由，不替代公网 Nginx/Kong/WAF；Seata `distributed` 当前验证的是官方 TC + TCC 回调，不会为 Python 数据库操作自动生成 AT `undo_log`。
 
 [新手指南](https://github.com/YUCONGGEN/springbootAI/blob/master/doc/BEGINNER_GUIDE.md) | [全部文档](https://github.com/YUCONGGEN/springbootAI/tree/master/doc) | [变更日志](https://github.com/YUCONGGEN/springbootAI/blob/master/CHANGELOG.md) | [安全报告](https://github.com/YUCONGGEN/springbootAI/blob/master/SECURITY.md) | [发布检查](https://github.com/YUCONGGEN/springbootAI/blob/master/doc/RELEASE_CHECKLIST.md)
 
@@ -315,10 +315,10 @@ SpringBootAI 是一个 **Python Web 框架**。它把 Java Spring Boot 的"注
 
 | 组件 | 当前版本 |
 |------|----------|
-| `spring` 框架 API | 2.2.0 |
-| `spring.orm.pymybatis` | 2.2.0 |
-| `spring.ai` AI 模块 | 2.2.0 |
-| `spring.langchain` LangChain 模块 | 2.2.0 |
+| `spring` 框架 API | 2.2.1 |
+| `spring.orm.pymybatis` | 2.2.1 |
+| `spring.ai` AI 模块 | 2.2.1 |
+| `spring.langchain` LangChain 模块 | 2.2.1 |
 | Python | 3.10+ |
 
 ### 1.4 适合什么场景

{springbootai-2.2.0 → springbootai-2.2.2}/README.md

@@ -17,7 +17,7 @@ SpringBootAI 是一个采用 Spring 风格注解和分层结构的 Python 应用
 | AI 与编排 | 模型调用、Tools、RAG、Chain、状态图、MCP client/server | LangChain / LangGraph / 官方 MCP SDK |
 | 生产治理 | 健康检查、Prometheus、限流熔断、追踪、Swagger | prometheus-client / OpenTelemetry / OpenAPI |
 
-当前版本是 `2.2.0`；支持 Python 3.10、3.11 和 3.12，许可证为 MIT。项目仍标记为 Beta。用于公网高并发、合规敏感或支付/订单/库存等核心系统前，必须完成目标数据库、流量模型、故障恢复和安全基线验证。内嵌 Gateway 适合内部路由，不替代公网 Nginx/Kong/WAF；Seata `distributed` 当前验证的是官方 TC + TCC 回调，不会为 Python 数据库操作自动生成 AT `undo_log`。
+当前版本是 `2.2.1`；支持 Python 3.10、3.11 和 3.12，许可证为 MIT。项目仍标记为 Beta。用于公网高并发、合规敏感或支付/订单/库存等核心系统前，必须完成目标数据库、流量模型、故障恢复和安全基线验证。内嵌 Gateway 适合内部路由，不替代公网 Nginx/Kong/WAF；Seata `distributed` 当前验证的是官方 TC + TCC 回调，不会为 Python 数据库操作自动生成 AT `undo_log`。
 
 [新手指南](https://github.com/YUCONGGEN/springbootAI/blob/master/doc/BEGINNER_GUIDE.md) | [全部文档](https://github.com/YUCONGGEN/springbootAI/tree/master/doc) | [变更日志](https://github.com/YUCONGGEN/springbootAI/blob/master/CHANGELOG.md) | [安全报告](https://github.com/YUCONGGEN/springbootAI/blob/master/SECURITY.md) | [发布检查](https://github.com/YUCONGGEN/springbootAI/blob/master/doc/RELEASE_CHECKLIST.md)
 
@@ -181,10 +181,10 @@ SpringBootAI 是一个 **Python Web 框架**。它把 Java Spring Boot 的"注
 
 | 组件 | 当前版本 |
 |------|----------|
-| `spring` 框架 API | 2.2.0 |
-| `spring.orm.pymybatis` | 2.2.0 |
-| `spring.ai` AI 模块 | 2.2.0 |
-| `spring.langchain` LangChain 模块 | 2.2.0 |
+| `spring` 框架 API | 2.2.1 |
+| `spring.orm.pymybatis` | 2.2.1 |
+| `spring.ai` AI 模块 | 2.2.1 |
+| `spring.langchain` LangChain 模块 | 2.2.1 |
 | Python | 3.10+ |
 
 ### 1.4 适合什么场景

{springbootai-2.2.0 → springbootai-2.2.2}/pyproject.toml

@@ -12,7 +12,7 @@ build-backend = "setuptools.build_meta"
 [project]
 # 发行名 springbootAI（PyPI 包名，pip install springbootAI）；导入包名仍为 spring
 name = "springbootAI"
-version = "2.2.0"
+version = "2.2.2"
 description = "Spring-style Python framework with Web, ORM, Cloud and AI integrations"
 readme = "README.md"
 license = "MIT"

{springbootai-2.2.0 → springbootai-2.2.2}/spring/__init__.py

@@ -5,7 +5,7 @@ from .config import *
 from .utils import *
 from .main import create_app, run, SpringApplication, run_cli
 
-__version__ = "2.2.0"
+__version__ = "2.2.1"
 __author__ = "yuconggen"
 __license__ = "MIT"
 

{springbootai-2.2.0 → springbootai-2.2.2}/spring/ai/__init__.py

@@ -47,7 +47,7 @@ from spring.ai.resilience import (
 from spring.ai.observability import AIMetrics, ai_metrics
 from spring.ai.autoconfig import AIProperties, bind_ai_config, configure_ai
 
-__version__ = "2.2.0"
+__version__ = "2.2.1"
 
 __all__ = [
     # core

{springbootai-2.2.0 → springbootai-2.2.2}/spring/csv/__init__.py

@@ -33,7 +33,7 @@ from .reader import CsvReader
 from .writer import CsvWriter
 from .easy_csv import EasyCsv, read_csv, write_csv
 
-__version__ = "2.2.0"
+__version__ = "2.2.1"
 
 __all__ = [
     # 异常

{springbootai-2.2.0 → springbootai-2.2.2}/spring/data/__init__.py

@@ -39,7 +39,7 @@ from spring.data.repository import (
     get_data_repository_entity,
 )
 
-__version__ = "2.2.0"
+__version__ = "2.2.1"
 
 __all__ = [
     # 分页/排序

{springbootai-2.2.0 → springbootai-2.2.2}/spring/datasource/__init__.py

@@ -43,7 +43,7 @@ from .annotations import (
     ds_route_decorator, ds_decorator_factory, apply_ds_annotations, is_slave_placeholder,
 )
 
-__version__ = "2.2.0"
+__version__ = "2.2.1"
 
 __all__ = [
     "DataSourceContextHolder",

{springbootai-2.2.0 → springbootai-2.2.2}/spring/excel/__init__.py

@@ -33,7 +33,7 @@ from .reader import ExcelReader
 from .writer import ExcelWriter
 from .easy_excel import EasyExcel, read_excel, write_excel
 
-__version__ = "2.2.0"
+__version__ = "2.2.1"
 
 __all__ = [
     # 异常

{springbootai-2.2.0 → springbootai-2.2.2}/spring/i18n/__init__.py

@@ -65,7 +65,7 @@ from .properties import load_properties, parse_properties
 from .middleware import LocaleResolverMiddleware, get_request_locale
 from .auto_config import MessageSourceAutoConfiguration, configure_message_source
 
-__version__ = "2.2.0"
+__version__ = "2.2.1"
 
 __all__ = [
     # Locale

{springbootai-2.2.0 → springbootai-2.2.2}/spring/langchain/__init__.py

@@ -90,7 +90,7 @@ from spring.langchain.annotations import (
     bind_langchain_client,
 )
 
-__version__ = "2.2.0"
+__version__ = "2.2.1"
 
 __all__ = [
     # core

{springbootai-2.2.0 → springbootai-2.2.2}/spring/orm/__init__.py

@@ -146,6 +146,7 @@ from spring.orm.ddl_auto import (
     UpdateTime,
     Transient,
     Index,
+    Entity,
     entity,
     table as table_decorator,
     column as column_decorator,
@@ -247,6 +248,7 @@ __all__ = [
     'UpdateTime',
     'Transient',
     'Index',
+    'Entity',
     'entity',
     'table_decorator',
     'column_decorator',

{springbootai-2.2.0 → springbootai-2.2.2}/spring/orm/ddl_auto.py

@@ -244,12 +244,47 @@ class Transient:
 
 
 class Table:
-    """表注解"""
+    """``@Table`` 表注解（对齐 JPA ``javax.persistence.Table``）。
+
+    既可作为元数据类使用（内部 ``EntityTable`` 解析），也可直接作为类装饰器使用。
+    作为装饰器时等价于 JPA 的 ``@Table``，与 ``@Entity`` 组合使用::
+
+        @Entity
+        @Table(name="sys_user", indexes=[Index("idx_name", ["name"])], comment="用户表")
+        class User:
+            id: int = Id()
+            name: str = Column(length=50)
+
+    也可单独使用（隐含 ``@Entity`` 语义，与 ``@Entity("sys_user")`` 等价）::
+
+        @Table(name="sys_user", comment="用户表")
+        class User:
+            id: int = Id()
+    """
     def __init__(self, name: str = "", indexes: List['Index'] = None, comment: str = ""):
         self.name = name
         self.indexes = indexes or []
         self.comment = comment
 
+    def __call__(self, cls):
+        """装饰器形式：将表元数据挂载到类上并标记为实体，返回类本身。
+
+        装饰器应用顺序（Python 底向上）::
+
+            @Entity          # 外层，后执行
+            @Table(...)      # 内层，先执行
+            class User: ...
+
+        ``@Table`` 先设置 ``__table__`` 与 ``__entity__``，随后 ``@Entity``
+        检测到已有 ``__table__`` 则不覆盖。
+        """
+        if not self.name:
+            self.name = _camel_to_snake(cls.__name__)
+        setattr(cls, '__table__', self)
+        setattr(cls, '__entity__', True)
+        _auto_generate_init(cls)
+        return cls
+
 
 class Index:
     """索引定义"""
@@ -480,37 +515,53 @@ class DdlAutoManager:
                 col_meta = self._get_field_meta(df)
                 columns.append(col_meta)
         else:
-            # 处理普通类：从 __init__ 方法中提取 self.xxx 字段
+            # 普通实体同时支持显式 self.xxx 赋值、类型注解和类级 Column 描述符。
+            # 只依赖源码中的 self.xxx 会漏掉循环赋值或动态赋值的实体。
             init_fields = self._extract_init_fields(cls)
-            # 同时检查类级别的类型注解（__init__ 的参数注解）
             init_hints = {}
             try:
                 init_hints = get_type_hints(cls.__init__)
             except Exception:
                 pass
-            cls_annotations = getattr(cls, '__annotations__', {})
-            for attr_name, default_val in init_fields.items():
+            try:
+                cls_annotations = get_type_hints(cls)
+            except Exception:
+                cls_annotations = getattr(cls, '__annotations__', {})
+
+            descriptor_fields = {}
+            for cls_base in reversed(cls.__mro__):
+                for attr_name, value in cls_base.__dict__.items():
+                    if isinstance(value, (Column, Transient)) or hasattr(value, '__column__'):
+                        descriptor_fields[attr_name] = value
+
+            field_names = dict(init_fields)
+            for attr_name in cls_annotations:
+                field_names.setdefault(attr_name, None)
+            for attr_name in descriptor_fields:
+                field_names.setdefault(attr_name, None)
+
+            for attr_name, default_val in field_names.items():
                 # @Transient 字段不持久化，跳过
                 if _is_transient_field(cls, attr_name):
                     continue
-                # 优先取 __init__ 注解，其次取类注解
                 py_type = init_hints.get(attr_name) or cls_annotations.get(attr_name)
                 # 解包 Optional[X]：Python 3.10 的 get_type_hints 会把带 None 默认值的
                 # 参数注解自动包装为 Optional[X]，3.11+ 不再包装。此处统一解包为承载类型，
                 # 否则 _get_sql_type 在 3.10 上识别失败回退到 TEXT，导致数值列被当字符串存储。
                 py_type = unwrap_optional_type(py_type)
+                descriptor = descriptor_fields.get(attr_name)
+                if py_type is None and isinstance(descriptor, Id):
+                    py_type = int
+                elif py_type is None and isinstance(descriptor, (CreateTime, UpdateTime)):
+                    py_type = str
+                elif py_type is None and isinstance(descriptor, Column) \
+                        and descriptor.default is not None:
+                    py_type = type(descriptor.default)
                 if py_type is None:
                     py_type = type(default_val) if default_val is not None and default_val != "" else str
-                # 检查Column注解
-                col_info = None
-                for cls_base in cls.__mro__:
-                    if attr_name in cls_base.__dict__:
-                        cval = cls_base.__dict__[attr_name]
-                        if isinstance(cval, Column):
-                            col_info = cval
-                        elif hasattr(cval, '__column__'):
-                            col_info = getattr(cval, '__column__')
-                        break
+                col_info = descriptor
+                if not isinstance(col_info, Column) and hasattr(col_info, '__column__'):
+                    col_info = getattr(col_info, '__column__')
                 col_meta = self._build_column_meta(attr_name, py_type, col_info)
                 columns.append(col_meta)
 
@@ -1030,31 +1081,97 @@ class DdlAutoManager:
 
 # ==================== 装饰器API（便捷使用） ====================
 
-def entity(table_name: str = "", indexes: List[Index] = None, comment: str = ""):
+def _auto_generate_init(cls):
+    """为描述符风格实体类自动生成 ``__init__``（若类未显式声明）。
+
+    扫描 MRO 中所有 ``Column`` 实例属性，生成关键字构造器。
+    若类已显式声明 ``__init__`` 则跳过，保持兼容。
     """
-    @Entity 装饰器，标注一个类为JPA风格的实体类
-    
-    Usage:
-        @entity("sys_user")
+    if '__init__' in cls.__dict__:
+        return
+    fields = {}
+    for cls_base in reversed(cls.__mro__):
+        for name, value in cls_base.__dict__.items():
+            if isinstance(value, Column):
+                fields[name] = value
+
+    def __init__(self, **values):
+        unknown = set(values) - set(fields)
+        if unknown:
+            names = ', '.join(sorted(unknown))
+            raise TypeError(f"Unexpected entity field(s): {names}")
+        for name, column in fields.items():
+            setattr(self, name, values.get(name, column.default))
+
+    cls.__init__ = __init__
+
+
+def Entity(table_name: str = "", indexes: List[Index] = None, comment: str = ""):
+    """``@Entity`` 装饰器，标注一个类为 JPA 风格的实体类。
+
+    三种用法（均向后兼容）：
+
+    1. **Java JPA 风格**（``@Entity`` + ``@Table`` 分离，推荐）::
+
+        @Entity
+        @Table(name="sys_user", indexes=[Index("idx_name", ["name"])], comment="用户表")
+        class User:
+            id: int = Id()
+            name: str = Column(length=50)
+
+    2. **简化风格**（仅 ``@Entity``，表名自动推导为类名 snake_case）::
+
+        @Entity
+        class User:
+            id: int = Id()
+            name: str = Column(length=50)
+        # 表名自动推导为 "user"
+
+    3. **一体化风格**（当前写法，完全兼容）::
+
+        @Entity("sys_user", indexes=[...], comment="用户表")
         class User:
-            def __init__(self, id: int = None, username: str = "", email: str = ""):
-                self.id = id
-                self.username = username
-                self.email = email
+            id: int = Id()
+            name: str = Column(length=50)
     """
-    t = Table(name=table_name, indexes=indexes, comment=comment)
+    # 支持 @Entity 无括号形式：直接接收类
+    if inspect.isclass(table_name):
+        cls = table_name
+        setattr(cls, '__entity__', True)
+        # 未显式指定表信息时，不覆盖已有 @Table 设置的 __table__
+        existing = getattr(cls, '__table__', None)
+        if not isinstance(existing, Table):
+            setattr(cls, '__table__', Table(name=_camel_to_snake(cls.__name__)))
+        _auto_generate_init(cls)
+        return cls
+
+    # @Entity("table_name", ...) 或 @Entity() 形式
+    has_explicit_meta = bool(table_name or indexes or comment)
+    t = Table(name=table_name, indexes=indexes, comment=comment) if has_explicit_meta else None
+
     def decorator(cls):
         setattr(cls, '__entity__', True)
-        setattr(cls, '__table__', t)
-        if not table_name:
-            t.name = _camel_to_snake(cls.__name__)
+        if t is not None:
+            if not t.name:
+                t.name = _camel_to_snake(cls.__name__)
+            setattr(cls, '__table__', t)
+        else:
+            # 无显式表信息：不覆盖已有 @Table 设置
+            existing = getattr(cls, '__table__', None)
+            if not isinstance(existing, Table):
+                setattr(cls, '__table__', Table(name=_camel_to_snake(cls.__name__)))
+        _auto_generate_init(cls)
         return cls
     return decorator
 
 
+# Backward-compatible alias. New code should use the Spring-style @Entity name.
+entity = Entity
+
+
 def table(name: str = "", indexes: List[Index] = None, comment: str = ""):
     """@Table 装饰器，标注实体类对应的表（与@entity功能相同，别名）"""
-    return entity(name, indexes, comment)
+    return Entity(name, indexes, comment)
 
 
 # ==================== 全局集成 ====================
@@ -1106,12 +1223,6 @@ def init_ddl_auto(connection_pool, config: dict = None) -> Optional[DdlAutoManag
     
     # 执行DDL
     if manager._entities:
-        # 临时关闭DDL阻断
-        try:
-            if hasattr(connection_pool, 'config'):
-                connection_pool.config['security_block_ddl'] = False
-        except Exception:
-            pass
         manager.execute()
     
     _global_ddl_manager = manager

{springbootai-2.2.0 → springbootai-2.2.2}/spring/orm/mybatis_integration.py

@@ -247,9 +247,9 @@ class MyBatisConfigurer:
         try:
             from spring.orm.ddl_auto import init_ddl_auto
             # 获取连接池
-            pool = None
+            pool = getattr(self.sql_session_factory, 'connection_pool', None)
             if hasattr(self.sql_session_factory, 'configuration'):
-                pool = getattr(self.sql_session_factory.configuration, 'pool', None)
+                pool = pool or getattr(self.sql_session_factory.configuration, 'pool', None)
             if pool is None and hasattr(self.sql_session_factory, '_pool'):
                 pool = self.sql_session_factory._pool
             if pool is not None:

{springbootai-2.2.0 → springbootai-2.2.2}/spring/orm/pymybatis/__init__.py

@@ -34,7 +34,7 @@ from .security import SensitiveDataMasker, SQLInjectionDetector
 from .interceptor import Interceptor
 from .type_handler import TypeHandler
 
-__version__ = "2.2.0"
+__version__ = "2.2.1"
 __author__ = "PyMyBatis Team"
 
 # 基础导出列表

{springbootai-2.2.0 → springbootai-2.2.2}/spring/orm/pymybatis/security/sensitive_data_masker.py

@@ -5,6 +5,7 @@ PyMyBatis敏感数据脱敏模块
 """
 
 import re
+from copy import copy
 from typing import Any, Dict, Optional, Callable
 from enum import Enum
 
@@ -159,6 +160,7 @@ class SensitiveDataMasker:
         if strategy is None:
             return value
 
+        original_value = value
         # 转换为字符串进行脱敏
         if not isinstance(value, str):
             value = str(value)
@@ -170,7 +172,7 @@ class SensitiveDataMasker:
         # 如果匹配失败，使用替换策略或返回原值
         if strategy.pattern.pattern == r'.+':
             return strategy.replacer(None)
-        return value
+        return original_value
 
     def mask_dict(self, data: Dict[str, Any], field_types: Optional[Dict[str, SensitiveDataType]] = None) -> Dict[str, Any]:
         """
@@ -227,7 +229,22 @@ class SensitiveDataMasker:
         if not self.enabled:
             return data_list
 
-        return [self.mask_dict(item, field_types) for item in data_list]
+        masked = []
+        for item in data_list:
+            if isinstance(item, dict):
+                masked.append(self.mask_dict(item, field_types))
+            elif hasattr(item, '__dict__'):
+                clone = copy(item)
+                attributes = {
+                    key: value for key, value in vars(item).items()
+                    if not key.startswith('_')
+                }
+                for key, value in self.mask_dict(attributes, field_types).items():
+                    setattr(clone, key, value)
+                masked.append(clone)
+            else:
+                masked.append(item)
+        return masked
 
     def mask_log(self, log_message: str) -> str:
         """

{springbootai-2.2.0 → springbootai-2.2.2}/spring/orm/pymybatis/security/sql_injection_detector.py

@@ -11,6 +11,7 @@ PyMyBatis SQL注入检测模块
 
 import re
 import logging
+from collections.abc import Mapping, Sequence, Set as AbstractSet
 from typing import Optional, Any, Dict, Set
 from enum import Enum
 
@@ -458,7 +459,11 @@ class SQLInjectionDetector:
 
     def is_safe(self, value: Any) -> bool:
         """
-        判断值是否安全
+        判断值是否安全。
+
+        Mapper XML 支持通过 ``#{entity.field}`` 绑定实体对象，因此这里需要检查
+        容器中的叶子值，而不是检查对象的 ``repr``（其中通常包含内存地址）。
+        循环引用通过对象 id 集合截断。
 
         Args:
             value: 待检测的值
@@ -466,6 +471,40 @@ class SQLInjectionDetector:
         Returns:
             是否安全
         """
+        return self._is_safe_value(value, set())
+
+    def _is_safe_value(self, value: Any, visited: Set[int]) -> bool:
+        if value is None or isinstance(value, (str, bytes, int, float, bool)):
+            return not self.is_blocked(value)
+
+        if isinstance(value, Mapping):
+            object_id = id(value)
+            if object_id in visited:
+                return True
+            visited.add(object_id)
+            return all(self._is_safe_value(item, visited) for item in value.values())
+
+        if isinstance(value, (Sequence, AbstractSet)) and not isinstance(
+            value, (str, bytes, bytearray)
+        ):
+            object_id = id(value)
+            if object_id in visited:
+                return True
+            visited.add(object_id)
+            return all(self._is_safe_value(item, visited) for item in value)
+
+        attributes = getattr(value, '__dict__', None)
+        if isinstance(attributes, Mapping):
+            object_id = id(value)
+            if object_id in visited:
+                return True
+            visited.add(object_id)
+            return all(
+                self._is_safe_value(item, visited)
+                for key, item in attributes.items()
+                if not str(key).startswith('_')
+            )
+
         return not self.is_blocked(value)
 
     def sanitize(self, value: Any) -> Any:

{springbootai-2.2.0 → springbootai-2.2.2}/spring/orm/pymybatis/version.py

@@ -2,7 +2,7 @@
 PyMyBatis版本信息
 """
 
-__version__ = '2.2.0'
+__version__ = '2.2.2'
 __author__ = 'PyMyBatis Team'
 __email__ = 'dev@pymybatis.org'
 __license__ = 'MIT'

{springbootai-2.2.0 → springbootai-2.2.2}/spring/orm/pymybatis/xml_parser/xml_parser.py

@@ -282,6 +282,19 @@ class XmlParser:
 
     @classmethod
     def _secure_fromstring(cls, xml_content: str):
+        # MyBatis mapper files conventionally contain this fixed public DTD.
+        # It is metadata only for this parser, so strip the exact allowlisted
+        # declaration without resolving the remote system identifier. Any
+        # other DTD or entity declaration remains forbidden by defusedxml.
+        xml_content = re.sub(
+            r'<!DOCTYPE\s+mapper\s+PUBLIC\s+'
+            r'["\']-//mybatis\.org//DTD Mapper 3\.0//EN["\']\s+'
+            r'["\']https?://mybatis\.org/dtd/mybatis-3-mapper\.dtd["\']\s*>',
+            '',
+            xml_content,
+            count=1,
+            flags=re.IGNORECASE,
+        )
         return DefusedET.fromstring(
             cls._normalize_comparison_operators(xml_content),
             forbid_dtd=True,

{springbootai-2.2.0 → springbootai-2.2.2}/spring/test/__init__.py

@@ -34,7 +34,7 @@
 """
 from .slicing import TestPool, SpringBootTest, WebMvcTest, DataJpaTest
 
-__version__ = "2.2.0"
+__version__ = "2.2.1"
 
 __all__ = [
     "TestPool",

{springbootai-2.2.0 → springbootai-2.2.2}/spring/tx/__init__.py

@@ -39,7 +39,7 @@ from .synchronization import (
 )
 from .events import TransactionalEventListener, TransactionalEventPublisher
 
-__version__ = "2.2.0"
+__version__ = "2.2.1"
 
 __all__ = [
     "TransactionPhase",

{springbootai-2.2.0 → springbootai-2.2.2}/spring/utils/banner.py

@@ -11,7 +11,7 @@ class BannerPrinter:
     |_|                 |___/                                  
     """
 
-    def __init__(self, version: str = "2.2.0"):  # v1.8.7 修复 import 时提前创建 logs/ 目录
+    def __init__(self, version: str = "2.2.1"):  # v1.8.7 修复 import 时提前创建 logs/ 目录
         self.version = version
         self.logger = SpringLogger()
 

{springbootai-2.2.0 → springbootai-2.2.2}/spring/validation/__init__.py

@@ -34,7 +34,7 @@ from .constraints import (
 from .validator import BeanValidator
 from .aop import BeanValidate, bean_validate_decorator
 
-__version__ = "2.2.0"
+__version__ = "2.2.1"
 
 __all__ = [
     # 异常