# Tech stack

A library inventory for the **in-scope** framework — 11 framework-core
modules (`xlyEntry`, `xlyApi`, `xlyManage`, `xlyBusinessService`,
`xlyPersist`, `xlyEntity`, `xlyFlow`, `xlyInterface`, `xlyMsg`,
`xlyErpJmsProductor`, `xlyErpJmsConsumer`), one plugin (`xlyPlc`), and
one shared utility (`xlyPlatConstant` — load-bearing for `xlyPersist`'s
use of `MultiThreadServer` and `TimeContant`, despite the `Plat*`
naming).

The other plat-tier modules (`xlyPlat*` except `xlyPlatConstant`),
`xlyFace` (in build, out of documentation scope), and AI libraries are
[out of scope](../../index.md#whats-out-of-scope) and are not listed
here.

## How to read this page

Two columns carry evidence:

- **Where** — the `build.gradle` files that declare the library as
  `api(...)` or `implementation(...)`. Most libraries are declared in
  `xlyPersist/build.gradle` and propagate transitively to the modules
  that depend on `xlyPersist`.
- **In-scope source references** — file count from
  `grep -rln <package> xly-src/<module>/src/` across the in-scope
  modules above, with a representative file path. A "no source
  references found" entry means the library is declared but no Java,
  HTML, or yaml source under any in-scope module references it
  directly. Such libraries may still be loaded into the classpath as
  transitive dependencies or consumed via Spring Boot autoconfig.

What this page does not do: explain *why* a particular library was
chosen. Where the gradle file or yaml carries an explicit comment
(e.g., the Netty version pin), that comment is quoted. Otherwise the
page records facts only.

## 1. Application platform

| Library | Version | Where | In-scope source references |
|---|---|---|---|
| Spring Boot | 2.2.5 | `xlyPersist/build.gradle` (web, starter, aop, data-redis, data-mongodb, websocket, activemq, freemarker), `xlyApi/build.gradle`, `xlyFlow/build.gradle` | All `*ApplicationBoot.java` classes (`xlyEntry`, `xlyApi`, `xlyInterface`, `xlyPlc`, `xlyFace`-when-built) extend `SpringBootServletInitializer`. |
| Embedded Tomcat | (Spring Boot 2.2.5 BOM) | transitively from `spring-boot-starter-web` | `xlyEntry/src/main/resources/application-local.yml` lines 10-29 configure `server.port: 8080`, `server.servlet.context-path: /xlyEntry`, `server.tomcat.*`. |
| Netty | 4.1.65.Final | `xlyPersist/build.gradle` | No direct Java imports. The gradle file comment states: "*引入mq后netty-common-4.1.45.Final.jar、与netty-all-4.0.42.Final.jar冲突，所以引入*" — the version is pinned to override conflicting transitive versions pulled in by MQ libraries. |
| AspectJ Weaver | 1.9.6 | `xlyApi/build.gradle` (declared twice) | 1 file: `xlyFlow/src/main/java/...` (one Java import). Spring Boot's AOP starter is the dominant consumer; the explicit pin in xlyApi is independent of imports. |
| Lombok | 1.18.8 (`xlyPersist`, `xlyFlow`) / 1.18.20 (`xlyApi`) | `xlyPersist/build.gradle`, `xlyApi/build.gradle`, `xlyFlow/build.gradle` | 19 files import `lombok.*`. xlyApi declares it as both `implementation` and `annotationProcessor`. |

## 2. Persistence

| Library | Version | Where | In-scope source references |
|---|---|---|---|
| MyBatis | 2.1.2 (`mybatis-spring-boot-starter`) | `xlyPersist/build.gradle`, `xlyApi/build.gradle`, `xlyFlow/build.gradle` | 102 Java files import `org.apache.ibatis.*` or `org.mybatis.*` — 76 in `xlyPersist`, the rest spread across xlyApi, xlyFlow, xlyInterface. Mapper XMLs live at `xlyPersist/src/main/resources/mapper/{erptable,business,test}/`. |
| MyBatis-Plus | 3.3.0 | `xlyApi/build.gradle` | 2 files: `xlyApi/src/main/java/com/xly/api/util/SqlUtil.java`, `xlyApi/src/main/java/com/xly/api/web/BaseController.java`. Not used outside xlyApi. |
| MySQL Connector/J | 8.0.13 | `xlyPersist/build.gradle`, `xlyApi/build.gradle`, `xlyFlow/build.gradle` | yaml `spring.datasource.driverClassName: com.mysql.cj.jdbc.Driver` (e.g., `xlyEntry/.../application-local.yml:127`). |
| MSSQL JDBC | sqljdbc4 3.0 (Maven) + `mssql-jdbc-6.2.2.jre8.jar` (local jar in `xlyFlow/`, `xlyInterface/`) | `xlyApi/build.gradle`, `xlyInterface/build.gradle`, `xlyFlow/build.gradle` | 5 files: 3 in `xlyFlow/src/`, 2 in `xlyInterface/src/`. |
| Oracle JDBC | `ojdbc6-11.2.0.4.jar` (local jar in `xlyFlow/`) | `xlyFlow/build.gradle` | 2 files in `xlyFlow/src/`. |
| Druid | `druid-spring-boot-starter` 1.2.16; `druid` 1.2.16 | `xlyPersist/build.gradle`, `xlyApi/build.gradle` | 6 Java files import `com.alibaba.druid.*` (xlyBusinessService=2, xlyFlow=3, xlyInterface=1). 16 `application-*.yml` files reference Druid configuration (xlyEntry=8 yml profiles, xlyPlc=8 yml profiles). yaml: `xlyEntry/.../application-local.yml:126` sets `spring.datasource.type: com.alibaba.druid.pool.DruidDataSource`; lines 308-313 configure the `/druid/*` stat-view servlet. |
| HikariCP | 4.0.3 | `xlyApi/build.gradle` | 8 files reference `com.zaxxer.hikari` (xlyApi=6, xlyInterface=2). Java config: `xlyApi/.../api/config/MasterDataSourceConfig.java`, `SlaveDataSourceConfig.java`. yaml: `xlyApi/.../application-{local,dev,linux,win}.yml`. |
| Flyway | 5.2.1 | `xlyPersist/build.gradle` | No Java imports. Configured via yaml `spring.flyway.*` (e.g., `xlyEntry/.../application-local.yml:316-327`) with `enabled: false`. Migration scripts at `xlyEntry/src/main/resources/flyway/V*__*.sql`. |
| PageHelper | 4.1.1 | `xlyPersist/build.gradle`, `xlyApi/build.gradle`, `xlyFlow/build.gradle` | 19 files import `com.github.pagehelper.*`. yaml `pagehelper.helperDialect: mysql` at `xlyEntry/.../application-local.yml:427`. |
| jsqlparser | 3.2 | `xlyPersist/build.gradle` | 1 file: `xlyPersist/src/...` imports `net.sf.jsqlparser`. |

## 3. Cache & in-memory

| Library | Version | Where | In-scope source references |
|---|---|---|---|
| Spring Data Redis | 2.2.5 | `xlyPersist/build.gradle`, `xlyApi/build.gradle`, `xlyFlow/build.gradle` | 3 Java files import `org.springframework.data.redis.*` (xlyEntry=1, xlyInterface=2). yaml: `spring.redis.*` blocks across all modules. |
| Lettuce | (Spring Data Redis 2.2.5 default driver) | transitive | No direct Java imports. Configured via yaml `spring.redis.lettuce.pool.*` (e.g., `xlyEntry/.../application-local.yml:385-394`). |
| Jedis | 2.9.0 | `xlyPersist/build.gradle`, `xlyApi/build.gradle`, `xlyFlow/build.gradle` | 5 files import `redis.clients.jedis` (xlyPersist=2, xlyApi=2, xlyMsg=1, e.g. `xlyMsg/.../wechat/util/JedisMsgUtil.java`). |
| Guava | 18.0 (`xlyPersist`, `xlyApi`); 20.0 (`xlyFlow`) | `xlyPersist/build.gradle`, `xlyApi/build.gradle`, `xlyFlow/build.gradle` | 8 files import `com.google.common.*`. |

## 4. Workflow & scheduling

| Library | Version | Where | In-scope source references |
|---|---|---|---|
| Activiti Engine | 5.17.0 | `xlyPersist/build.gradle`, `xlyApi/build.gradle`; consumed by `xlyFlow` | 35 files import `org.activiti.*` (xlyFlow=32, plus 1 each in xlyPersist, xlyApi, xlyEntry — the xlyEntry hit is the `SecurityAutoConfiguration` exclusion in `EntryApplicationBoot.java`; the xlyApi and xlyPersist hits are both `IdGen.java`, near-identical crypto-utility copies that import `org.activiti.engine.identity.User`). The version skew with the 6.0 modeler libs is documented in [Activiti integration](activiti.md). |
| Activiti Spring Boot REST API | 6.0.0 | `xlyFlow/build.gradle` | Consumed via Spring Boot autoconfig + REST endpoints under `xlyFlow`. |
| Activiti JSON Converter | 6.0.0 | `xlyFlow/build.gradle` | (Used by xlyFlow's modeler save path.) |
| Quartz | 2.3.0 | `xlyFlow/build.gradle` | 16 files import `org.quartz.*` (xlyEntry=8, xlyFlow=8). yaml: `xlyEntry/.../application-local.yml:329-365` configures `spring.quartz.*` with JDBC JobStore (`qrtz_*` tables), `instanceName: xlyflowScheduler`. |

## 5. Messaging

| Library | Version | Where | In-scope source references |
|---|---|---|---|
| Spring JMS + ActiveMQ starter | 2.2.5 | `xlyPersist/build.gradle` (`spring-boot-starter-activemq`) | 3 files import `org.springframework.jms.*` (xlyErpJmsProductor=2, xlyErpJmsConsumer=1); 2 files import `org.apache.activemq.*` (xlyErpJmsProductor=2). yaml: `spring.activemq.*` at `xlyEntry/.../application-local.yml:402-414`. See also [Messaging](../../api-reference/messaging.md). |
| RocketMQ Spring Boot Starter | 2.0.2 | `xlyPersist/build.gradle` | 4 files import `org.apache.rocketmq.*` in `xlyBusinessService/src/`. |

## 6. View / templates

| Library | Version | Where | In-scope source references |
|---|---|---|---|
| Thymeleaf | 3.0.15 | `xlyApi/build.gradle`, `xlyFlow/build.gradle`; transitive via `spring-boot-starter-thymeleaf` | 2 Java files import `org.thymeleaf.*` (both in xlyFlow). Modeler templates in `xlyFlow/src/main/resources/templates/`. |
| Freemarker | 2.2.5 (Spring starter) | `xlyPersist/build.gradle`, `xlyApi/build.gradle`, `xlyFlow/build.gradle` | 1 Java file imports `freemarker.*` (xlyFlow). |
| Apache Batik | 1.8 (`xlyPersist`) / 1.7 (`xlyFlow`: codec, css, svg-dom, svggen) | `xlyPersist/build.gradle`, `xlyFlow/build.gradle` | 1 Java file imports `org.apache.batik.*` (xlyFlow). xlyFlow's modeler ships Batik static assets under `src/main/resources/static/modeler/editor-app/`. |

## 7. Auth

| Library | Version | Where | In-scope source references |
|---|---|---|---|
| Apache Shiro (`shiro-spring`) | 1.3.2 (`xlyPersist`) / 1.4.2 (`xlyApi`, `xlyFlow`) | `xlyPersist/build.gradle`, `xlyApi/build.gradle`, `xlyFlow/build.gradle` | 6 Java files import `org.apache.shiro.*` (xlyPersist=1, xlyApi=1, xlyFlow=4). The xlyPersist and xlyApi hits are both `IdGen.java` (crypto utilities); the xlyFlow hits are the modeler's auth helpers (`PermissionUtils`, `CacheUtils`, `IpUtils`, `ActExceptionHandler`). `EntryApplicationBoot.java` excludes Spring Security autoconfig. **No `@ConfigurationProperties("shiro")` or `shiro.*` property binding was found in any in-scope module**, despite a `shiro:` yaml block at `xlyEntry/.../application-local.yml:432-464`. The framework's HTTP auth pattern is documented in [API Reference cross-cutting facts](../../api-reference/index.md#cross-cutting-facts). |
| `shiro-ehcache` | 1.4.2 | `xlyFlow/build.gradle` | No direct Java imports under `xlyFlow/src/`. |
| `shiro-core` | 1.4.2 | `xlyFlow/build.gradle` | (Counted within the 6 `org.apache.shiro` hits above.) |
| `thymeleaf-extras-shiro` | 2.0.0 | `xlyFlow/build.gradle` | 47 `.html` template files reference Shiro tags (xlyApi=5, xlyFlow=42). No Java imports. |
| Bouncy Castle | `bcprov-jdk14:138` | `xlyApi/build.gradle` | 2 files: `xlyApi/src/main/java/com/xly/api/util/RsaEncrypt.java`, `xlyInterface/src/main/java/com/xly/util/RsaEncrypt.java`. |
| commons-codec | 1.16.0 | `xlyPersist/build.gradle`, `xlyApi/build.gradle` | 18 files import `org.apache.commons.codec.*` (xlyApi=6, xlyInterface=6, xlyMsg=4, xlyPersist=2). |

## 8. Reporting & export

The framework's print/export surface is the largest single consumer of
third-party code.

| Library | Version | Where | In-scope source references |
|---|---|---|---|
| iText (5.x branch) | itextpdf 5.5.0 + itext-pdfa 5.5.0 + itext-asian 5.2.0 | `xlyPersist/build.gradle` | 1 file: `xlyPersist/src/main/java/com/xly/jxls/Util/PdfConverUtil.java` imports `com.itextpdf.*`. |
| iText (legacy 2.x via lowagie) | `com.lowagie:itext` 2.1.7 | `xlyPersist/build.gradle` | 1 file in `xlyPersist/src/` imports `com.lowagie.text.*`. Both iText branches coexist on classpath. |
| Aspose Cells | `aspose-cells-21.8.cracked.jar` (local jar) | `xlyPersist/build.gradle` (`api files(...)`) | 6 files in `xlyPersist/src/` import `com.aspose.cells.*`. |
| Aspose Words | `aspose-words-15.8.0-jdk16.jar` (local jar) | `xlyPersist/build.gradle` | 1 file in `xlyPersist/src/` imports `com.aspose.words.*`. |
| Apache POI | 4.1.2 (`xlyPersist`, `xlyFlow`) / 3.15 (`xlyApi`) | `xlyPersist/build.gradle`, `xlyApi/build.gradle`, `xlyFlow/build.gradle` | 36 files import `org.apache.poi.*` (xlyPersist=19, xlyFlow=6, xlyEntry=5, xlyBusinessService=5, xlyApi=1). |
| jxls + jxls-poi | 2.8.1 | `xlyPersist/build.gradle` | 22 files import `org.jxls.*` (xlyPersist=17, xlyEntry=5). |
| jxls-jexcel | 1.0.9 | `xlyPersist/build.gradle` | (Counted within jxls hits above.) |
| commons-jexl3 | 3.1 | `xlyPersist/build.gradle` | (Pulled in by jxls; no direct imports detected.) |
| EasyExcel | 4.0.3 (local jars: `easyexcel-4.0.3.jar` + `-support-4.0.3.jar` + `-core-4.0.3.jar`) | `xlyPersist/build.gradle` | 10 files in `xlyBusinessService/src/` import `com.alibaba.excel.*`. |
| JasperReports | `jasperreports-6.0.0.jar` + `jasperreports-fonts-6.0.0.jar` (local jars) | `xlyPersist/build.gradle` | 11 files import `net.sf.jasperreports.*` (xlyPersist=5, xlyEntry=3, xlyBusinessService=3). |
| OLAP4J | `olap4j-1.2.0.jar` + `olap4j-xmlaserver-1.2.0.jar` (local jars) | `xlyPersist/build.gradle` (the `-xmlaserver` line is also commented out) | **0 Java imports of `org.olap4j.*` anywhere in source.** Dead jars on the classpath; xly's BI/dashboard layer ([bi-engine.md](bi-engine.md)) is stored-proc-driven, not OLAP-cube-driven. |
| ZXing | core 3.4.0 + javase 3.4.0 | `xlyPersist/build.gradle` | 5 files import `com.google.zxing.*` (xlyPersist=4, xlyEntry=1). |
| Barcode4J | `barcode4j-light` 2.0 | `xlyPersist/build.gradle` | 1 file in `xlyPersist/src/` imports `org.krysalis.barcode4j.*`. |
| Pinyin4j | 2.5.0 | `xlyPersist/build.gradle` | 1 file: `xlyPersist/src/main/java/com/xly/utils/ChineseCharacterUtil.java`. |
| PDFBox | 2.0.6 | `xlyPersist/build.gradle` | 2 files import `org.apache.pdfbox.*` (xlyPersist=1, xlyBusinessService=1). |
| Thumbnailator | 0.4.8 (`net.coobird`) | `xlyPersist/build.gradle` | 2 files import `net.coobird.*` (xlyPersist=1, xlyEntry=1). |
| jacob | `jacob.jar` (local jar) | `xlyPersist/build.gradle` | 2 files in `xlyPersist/src/` import `com.jacob.*`. |

## 9. File storage & HTTP clients

| Library | Version | Where | In-scope source references |
|---|---|---|---|
| Aliyun OSS SDK | `aliyun-sdk-oss` 2.2.0 | `xlyPersist/build.gradle` | 1 file: `xlyPersist/src/main/java/com/xly/utils/OssUtil.java`. |
| commons-fileupload | 1.5 | `xlyFlow/build.gradle` | 1 file in `xlyFlow/src/` imports `org.apache.commons.fileupload.*`. |
| commons-io | 2.5 | `xlyFlow/build.gradle` | 7 files import `org.apache.commons.io.*` (xlyFlow=3, xlyPersist=2, xlyEntry=1, xlyBusinessService=1). |
| OkHttp + Okio | 4.10.0 / 2.10.0 | `xlyPersist/build.gradle` | 2 files in `xlyApi/src/` import `okhttp3.*`. |
| Apache HttpClient | 4.5.5 | `xlyPersist/build.gradle` | 1 file in `xlyBusinessService/src/` imports `org.apache.http.*`. |
| javax.mail | 1.6.2 | `xlyPersist/build.gradle` | 1 file in `xlyPersist/src/` imports `javax.mail.*`. |

## 10. JSON & general utilities

| Library | Version | Where | In-scope source references |
|---|---|---|---|
| FastJson | 1.2.15 (`xlyPersist`, `xlyApi`) / 1.2.60 (`xlyFlow`) | `xlyPersist/build.gradle`, `xlyApi/build.gradle`, `xlyFlow/build.gradle` | 83 files import `com.alibaba.fastjson.*` across in-scope modules (xlyBusinessService=39, xlyEntry=11, xlyInterface=9, xlyPersist=9, xlyFlow=6, xlyMsg=5, xlyApi=4). |
| Jackson | `jackson-databind` 2.9.7 (`xlyFlow` explicit) + transitive via Spring | `xlyFlow/build.gradle` | 22 files import `com.fasterxml.jackson.*` (xlyFlow=8, xlyInterface=9, xlyApi=2, xlyPersist=2, xlyEntry=1). |
| Hutool | `hutool-all` 5.6.5 (`xlyPersist`) / 5.8.5 (`xlyApi`, `xlyFlow`) | `xlyPersist/build.gradle`, `xlyApi/build.gradle`, `xlyFlow/build.gradle` | 271 files import `cn.hutool.*` across every in-scope module (xlyBusinessService=93, xlyFlow=47, xlyApi=37, xlyPersist=33, xlyEntry=25, xlyInterface=23, xlyMsg=10, xlyManage=2, xlyPlc=1). |
| commons-lang3 | 3.6 (`xlyPersist`) / 3.8.1 (`xlyFlow`) | `xlyPersist/build.gradle`, `xlyFlow/build.gradle` | 39 files import `org.apache.commons.lang3.*` (xlyFlow=23, xlyPersist=7, xlyEntry=3, xlyApi=2, xlyBusinessService=3, xlyMsg=1). |
| commons-collections4 | 4.1 | `xlyPersist/build.gradle` | 1 file in `xlyBusinessService/src/`. |
| Groovy | `groovy-all` 3.0.2 | `xlyPersist/build.gradle`, `xlyApi/build.gradle` | 5 Java files import `groovy.util.logging.Slf4j` (xlyPersist=3, xlyApi=2). The annotation is from Groovy's runtime; the Java files using it appear to be vestigial — the import is present but the annotation does not affect Java compilation. |
| Struts2 JSON plugin | 2.5.30 | `xlyPersist/build.gradle` | 1 file: `xlyPersist/src/main/java/com/xly/utils/FeedPage.java`. The framework otherwise runs on Spring MVC. |
| SnakeYAML | 1.27 | `xlyPersist/build.gradle`, `xlyFlow/build.gradle` | 1 file in `xlyFlow/src/` imports `org.yaml.snakeyaml.*`. |
| JDOM | 1.1 | `xlyApi/build.gradle` | 3 files import `org.jdom.*` (xlyApi=1, xlyInterface=1, xlyMsg=1). |
| validation-api | 2.0.1.Final | `xlyFlow/build.gradle` | 2 files in `xlyFlow/src/` import `javax.validation.*`. |

## 11. Hardware integration

| Library | Version | Where | In-scope source references |
|---|---|---|---|
| HslCommunication | `HslCommunication.jar` (local jar; no version metadata in filename) | `xlyPersist/build.gradle` | 9 files reference `HslCommunication` (xlyPersist=3, xlyBusinessService=3, xlyPlc=3). xlyPlc is the PLC bridge — see [Slice 6](../../slices/06-hardware.md). |

## 12. Notifications

| Library | Version | Where | In-scope source references |
|---|---|---|---|
| Aliyun DingTalk SDK | `com.aliyun:dingtalk` 2.1.14 | `xlyMsg/build.gradle` | 1 file in `xlyMsg/src/main/java/com/xly/dingtalk/`. See [Notifications](../../api-reference/notifications.md). |
| `alibaba-dingtalk-service-sdk` | 2.0.0 | `xlyMsg/build.gradle` | 1 file in `xlyMsg/src/` imports `com.dingtalk.api.*`. |
| Jeewx-API (WeChat) | `jeewx-api-1.3.2.jar` (local jar) | `xlyInterface/build.gradle` | 5 files in `xlyInterface/src/` reference Jeewx packages. |

## 13. Licensing

| Library | Version | Where | In-scope source references |
|---|---|---|---|
| TrueLicense | `trueswing.jar` + `truexml.jar` + `turelicense.jar` (local jars) | `xlyBusinessService/build.gradle` | 5 files in `xlyBusinessService/src/main/java/com/xly/license/`: `LicenseManager.java`, `LicenseManagerHolder.java`, `VerifyLicense.java`, `CustomKeyStoreParam.java`, `Resources.java`. yaml: `License:` block at `xlyEntry/.../application-local.yml:80-87` (`checkLic: false` in local). |

## 14. Logging

| Library | Version | Where | In-scope source references |
|---|---|---|---|
| Logback | `logback-classic` 1.2.3 | `xlyPersist/build.gradle` | 5 files import `ch.qos.logback.*` across modules. Configuration: `xlyEntry/src/main/resources/logback-spring.xml`. |
| log4j (1.x) | 1.2.17 | `xlyPersist/build.gradle` | 1 file in `xlyFlow/src/` imports `org.apache.log4j.*`. yaml: Druid stat filter `filters: stat,log4j2` at `xlyEntry/.../application-local.yml:282`. |

## 15. Build & dev

| Library | Version | Where | What |
|---|---|---|---|
| Gradle wrapper | committed | repo root (`gradlew`, `gradle/`) | Build tool. See [Running locally](running-locally.md). |
| Spring Boot Gradle plugin | 2.2.5.RELEASE | repo-root `build.gradle` | Builds runnable WARs. |
| Spring Boot configuration processor | 2.2.5.RELEASE | `xlyApi/build.gradle` (`annotationProcessor`) | Generates IDE metadata for `@ConfigurationProperties` classes in xlyApi. |

## Declared but no in-scope source references found

The following libraries appear in `build.gradle` files but no Java
imports, HTML template references, or yaml property bindings were
found under `xly-src/<in-scope module>/src/`. They may exist on the
classpath as required transitive dependencies, may be consumed via
Spring Boot autoconfiguration, may have been used by code that has
since been removed, or may be vestigial.

| Library | Declared in | Notes |
|---|---|---|
| Kaptcha (`kaptcha` 2.3.2) | `xlyFlow/build.gradle` | No imports found. Captcha JPEG generator. |
| JNA + jna-platform 4.5.2 | `xlyFlow/build.gradle` | No imports found. Native code access library. |
| oshi-core 3.9.1 | `xlyFlow/build.gradle` | No imports found. (oshi-core depends on JNA.) |
| UserAgentUtils 1.19 | `xlyFlow/build.gradle` | No imports found. |
| Barbecue `1.5-beta1` | `xlyPersist/build.gradle` | No imports found. (Alternate barcode library; Barcode4J + ZXing are the active paths.) |
| Gson 2.8.6 | `xlyPersist/build.gradle` | No `com.google.gson` imports found. FastJson and Jackson are the active JSON paths. |
| commons-pool2 2.8.0 | `xlyPersist/build.gradle` | No direct imports. Likely transitive support for Jedis or similar. |
| Baidu SDK (`baidu-sdk-1.4.5.jar`, local) | `xlyInterface/build.gradle` | No `com.baidu` imports found. |
| `mchange-commons-java` 0.2.11 | `xlyFlow/build.gradle` | No direct imports. |
| Springfox (`springfox-swagger-ui` 2.9.2 + `springfox-swagger2` 2.9.2) | `xlyInterface/build.gradle` | No direct Java imports. Consumed via Spring Boot auto-config to serve `/swagger-ui.html` for the xlyInterface tier. Cited from [API Reference / webhooks](../../api-reference/webhooks.md). |

## Notable version skew & local jars

Pulled directly from the `build.gradle` files. Each is a fact, not a recommendation.

| Item | Detail |
|---|---|
| Shiro | 1.3.2 in `xlyPersist`; 1.4.2 in `xlyApi` and `xlyFlow`. |
| FastJson | 1.2.15 in `xlyPersist` and `xlyApi`; 1.2.60 in `xlyFlow`. |
| Hutool | 5.6.5 in `xlyPersist`; 5.8.5 in `xlyApi` and `xlyFlow`. |
| Apache POI | 4.1.2 in `xlyPersist` and `xlyFlow`; 3.15 in `xlyApi`. |
| Guava | 18.0 in `xlyPersist` and `xlyApi`; 20.0 in `xlyFlow`. |
| commons-lang3 | 3.6 in `xlyPersist`; 3.8.1 in `xlyFlow`. |
| Lombok | 1.18.8 in `xlyPersist` and `xlyFlow`; 1.18.20 in `xlyApi`. |
| iText | `itextpdf` 5.5.0 *and* `com.lowagie:itext` 2.1.7 are both declared in `xlyPersist`. |
| Activiti | engine 5.17.0 (declared in `xlyPersist` and `xlyApi`); rest-api and json-converter 6.0.0 (`xlyFlow`) — see [Activiti integration](activiti.md). |
| Local jars (not from Maven) | `xlyPersist/src/main/java/lib/`: `aspose-cells-21.8.cracked.jar`, `aspose-words-15.8.0-jdk16.jar`, `jacob.jar`, `HslCommunication.jar`, `QRCode.jar`, `olap4j-1.2.0.jar`, `olap4j-xmlaserver-1.2.0.jar`, `jasperreports-6.0.0.jar`, `jasperreports-fonts-6.0.0.jar`, `easyexcel-{,-support-,-core-}4.0.3.jar`. `xlyFlow/src/main/java/lib/`: `mssql-jdbc-6.2.2.jre8.jar`, `ojdbc6-11.2.0.4.jar`. `xlyInterface/src/main/java/lib/`: `mssql-jdbc-6.2.2.jre8.jar`, `baidu-sdk-1.4.5.jar`, `jeewx-api-1.3.2.jar`. `xlyBusinessService/src/main/java/lib/`: `trueswing.jar`, `truexml.jar`, `turelicense.jar`. |
| Spring Boot | 2.2.5.RELEASE — pinned in the root `build.gradle` plugin block and declared at every module that uses Spring Boot starters. |

## What's intentionally not in this list

- The plat tier (`xlyPlat*` modules) and dependencies declared only there — out of scope per [index](../../index.md#whats-out-of-scope).
- AI / LLM libraries (`com.theokanning.openai-gpt3-java:service` 0.11.1 and `com.unfbx:chatgpt-java` 1.0.8 in `xlyApi/build.gradle`) — out of scope.
- The MongoDB starter declared in `xlyEntity/build.gradle` (`spring-boot-starter-data-mongodb` 2.2.5). The `xlyEntity` module contains 22 `@Document`-annotated classes under `xlyentity/mongo/` — 20 named `PLAT_*` plus 2 `DIKE_TEST*` test fixtures. A grep for `MongoTemplate` and `MongoRepository` in in-scope modules returned only `xlyPersist/.../dao/platmongo/BaseMongoDao.java` (which serves the plat tier); no in-scope module invokes Mongo APIs. See the [out-of-scope note in index](../../index.md#whats-out-of-scope).
- `xlyFace` — out of scope.