* [ISSUE #15718] Escape every LIKE predicate in the embedded role search
The embedded role search appended ESCAPE '\' once, after both LIKE predicates
had been built. ESCAPE qualifies only the predicate it immediately follows, so
the clause applied to the role filter alone and the username filter was left
without one. generateLikeArgument had already rewritten _ into \_, so Derby
matched the backslash literally and the query returned no row whenever both
filters were combined and the username contained an underscore.
Append the clause to each LIKE predicate instead, matching how the user and
permission searches in the same module already build theirs.
Add a Derby test that executes the generated SQL with the bound parameters,
since asserting the SQL text alone cannot prove which predicate the clause
qualifies, and document the rule in the default auth plugin spec.
Assisted-by: Claude Code
Signed-off-by: 吴世元 <wushiyuanwork@outlook.com>
* [ISSUE #15718] Escape the auth name searches like the paged searches
findRolesLikeRoleName and findUserLikeUsername bound "%" + value + "%"
directly, while findRolesLike4Page and findUsersLike4Page routed the same
value through generateLikeArgument. An underscore therefore stayed a
wildcard in the name searches backing the console autocompletion and was a
literal character in the paged searches, so one keyword selected different
rows depending on which control the operator used. Searching ro_le matched
both ro_le and roXle in the dropdown and only ro_le in the table.
Route the argument through generateLikeArgument in all four services. The
embedded SQL already declared ESCAPE '\' on these predicates, so it now
qualifies an argument that actually carries the escape; the external SQL
keeps relying on the backslash that MySQL and PostgreSQL default to, exactly
as its own paged search does.
Extend the Derby test to execute the name search against the real database,
since asserting the bound argument alone cannot prove the underscore stops
matching, and state the parity rule in the default auth plugin spec.
Assisted-by: Claude Code
Signed-off-by: 吴世元 <wushiyuanwork@outlook.com>
---------
Signed-off-by: 吴世元 <wushiyuanwork@outlook.com>
Activate AI Resource Search independently from ARD, add typed predicates and stable numbered pagination, and align built-in datasource indexes with resource-key scanning.
Assisted-by: Claude Code
* [ISSUE #15710] Declare the LIKE escape clause for dialects without a default escape character
Fuzzy search parameters escape the _ wildcard with a backslash, which only
works on a database treating the backslash as the default LIKE escape
character. Derby and Oracle have no such default, so the predicate matches
the backslash literally and silently returns no row.
Report the clause through the new Mapper#getLikeEscapeClause() dialect hook,
override it for Derby and Oracle, and append it to every LIKE bound to such a
parameter, in both the shared mapper defaults and the Oracle overrides. MySQL
and PostgreSQL keep an empty clause, so their SQL is unchanged.
Assisted-by: Claude Code
Signed-off-by: wushiyuanmaimob <wushiyuanwork@outlook.com>
* [ISSUE #15710] Escape the LIKE escape character in fuzzy search arguments
Declaring ESCAPE '\' on the LIKE predicates also constrains the bound
parameter: generateLikeArgument escaped the _ wildcard but left a literal
backslash in the search value untouched, so a value such as C:\path formed
the invalid escape sequence \p. Oracle rejects it with ORA-01424 and Derby
with SQLSTATE 22025, and a value such as a\_b silently kept _ as a wildcard.
Escape the escape character itself before escaping _, keeping the Config and
AI implementations consistent, and document the required order in the
datasource dialect spec.
Add a Derby test that executes the SQL generated by the mapper with the bound
parameter, since asserting the SQL text alone cannot detect an invalid escape
sequence in the argument.
Assisted-by: Claude Code
Signed-off-by: wushiyuanmaimob <wushiyuanwork@outlook.com>
---------
Signed-off-by: wushiyuanmaimob <wushiyuanwork@outlook.com>
HistoryConfigInfoMapper#getNextHistoryInfo backs the config history
detail/diff lookup for UPDATE records. It had two defects.
The interface default SQL ends with 'ORDER BY nid LIMIT 1'. LIMIT is
MySQL/PostgreSQL syntax, and HistoryConfigInfoMapperByDerby overrode the
other row-limiting queries but not this one, so Derby inherited it and
the query failed with a syntax error. Derby is the standalone default
datasource. Add the missing Derby override using FETCH FIRST 1 ROWS
ONLY, matching the existing Oracle override.
The gray filter read grayName through getContextParameter, while both
repository implementations publish it with putWhereParameter and
MapperContext keeps those maps separate. 'AND gray_name = ?' was
therefore never emitted and gray history records of one config were not
separated by gray version. Read grayName from the where parameters and
derive both the predicate and its bound parameter from a single guard,
which also removes the isBlank/isEmpty mismatch that could emit a
placeholder without its predicate.
The existing default-mapper test only passed because it wrote grayName
into both maps; it now uses the where parameters alone, as production
does.
Assisted-by: Claude Code
Signed-off-by: wushiyuanmaimob <wushiyuanwork@outlook.com>
Keep derived resource identity and task comparisons case-sensitive while retaining keyword case folding in query normalization.
Assisted-by: Claude Code
* Fix ARD filter compatibility
* Remove ARD naming from AI search internals
* Document durable AI resource index enhancement
Assisted-by: Claude Code
* Extend AI resource index task schemas
Assisted-by: Claude Code
* Make AI resource index enhancement durable
Assisted-by: Claude Code
* Fix AI resource index task consumer injection
Assisted-by: Claude Code
* Refactor durable AI resource task model
Generalize the durable search-index task contract with versioned payload and result data while preserving lease, retry, and revision fencing semantics.
Assisted-by: Claude Code
* Update AI resource task schemas
Replace the search-index-specific task table with the generic AI resource task schema across supported databases and align Derby persistence test resources.
Assisted-by: Claude Code
* Use epoch millis for AI resource task scheduling
Assisted-by: Claude Code
* Improve AI resource index convergence
Harden task fencing, lease handling, reconciliation, vector readiness, and ARD filter compatibility.
Assisted-by: Claude Code
* fix: use latest published MCP version by default
Resolve omitted MCP versions through latestPublishedVersion so draft versions do not trigger repeated index reconciliation. Add unit and Admin API regression coverage.
Assisted-by: Claude Code
* fix: fence AI resource task leases
Preserve active leases across coalesced lifecycle schedules and use a monotonic lease token to fence stale workers from renewing, completing, retrying, or releasing newer work.
Assisted-by: Claude Code
* test: align MCP latest published version lookup
Assisted-by: Claude Code
* feat: ai-visibility grant api
* fix: add User existence verification and fix test
* fix: Modify naming to remove AI semantics
* feat: retain at most one visibility role
* feat: keep the authorization chain as identity -> role -> permission
* feat: expand 'resource' to 512
* feat: mark the new visibility APIs as ADMIN_API
* feat: remove list api
* feat: Complete the 512-character schema and upgrade delivery
* feat: Align the API contract and specifications
* feat: complete focused tests for the new authorization model
* feat: remove the grant-list-only indexes
* feat: fix md
* feat: revert the role-wide cache reload changes
* fix: add @NacosApi
* fix: codecov
* fix: add EnvUtil MockEnvironment
---------
Co-authored-by: 杨翊 SionYang <xiweng.yy@alibaba-inc.com>
* [ISSUE #15475] Integrate AI resource importer plugin configuration
Unify AI resource importer builders with plugin configuration management and remove the redundant source abstraction.
Assisted-by: Claude Code
* [ISSUE #15475] Align AI importer OpenAPI error assertions
Update the focused admin and console API integration tests to match the unified plugin lookup error message.\n\nAssisted-by: Claude Code
* Align AI resource description column sizes
Align Derby, PostgreSQL, and Oracle AI resource description columns with the existing MySQL and Agent contract limit, and cover Derby's 2048-character boundary.
Assisted-by: Claude Code
* Implement Agent draft persistence
Persist complete Agent draft replacements through the existing AI Resource update flow while preserving stable storage pointers and enforcing the current-draft lifecycle contract.
Assisted-by: Claude Code
* Enhance skill upload precheck result
# Conflicts:
# console/src/main/resources/static/next/js/client.js
# Conflicts:
# ai/src/test/java/com/alibaba/nacos/ai/service/skills/SkillOperationServiceImplTest.java
* Enhance skill upload permission owner reporting
Conflicts:
ai/src/main/java/com/alibaba/nacos/ai/service/skills/SkillOperationServiceImpl.java
ai/src/test/java/com/alibaba/nacos/ai/service/skills/SkillOperationServiceImplTest.java
* Support ZIP-based skill batch precheck
* [ISSUE #15486] Simplify Skill upload precheck contract
Return a compact single-code precheck result and expose the maximum published version across online and offline versions.
Assisted-by: Claude Code
* [ISSUE #15486] Adapt console UI to compact Skill precheck
Handle precheckCode directly and display the highest published version together with the version after upload.
Assisted-by: Claude Code
* [ISSUE #15486] Rebuild console next UI assets
* [ISSUE #15486] Unify Skill ZIP precheck API
Replace the unpublished metadata precheck contract with multipart ZIP precheck across Admin, Console, and Maintainer APIs. Return invalid ZIP entries with explicit precheck codes and cover the unified contract in specs and tests.\n\nAssisted-by: Claude Code
* [ISSUE #15486] Use server-side ZIP precheck in console UI
Send the original ZIP to the unified precheck endpoint, render server precheck codes, and keep full invalid-entry paths in tooltips while showing concise folder names.\n\nAssisted-by: Claude Code
* [ISSUE #15486] Refresh console assets for ZIP precheck
Regenerate the bundled Console Next assets after adopting the unified server-side Skill ZIP precheck flow.\n\nAssisted-by: Claude Code
* Stabilize OIDC authorization client test timeout
Centralize plugin execution capabilities and separate core module gates from plugin state. Migrate AI pipeline services to direct PluginConfigSpec lifecycle management with unified runtime ordering and legacy configuration compatibility.
Assisted-by: Claude Code
Follow-up to #15509: override DatabaseDialect#isDuplicateKeyException in
PostgresqlDatabaseDialect so the PostgreSQL plugin classifies a unique_violation
(SQLState 23505) as a duplicate-key conflict. Spring's exception translation can
surface such a conflict as a BadSqlGrammarException that the database-agnostic
default cannot recognize; the dialect inspects the original driver exception in the
cause chain to close that gap.
The override first delegates to the default (Spring DuplicateKeyException detection)
and then walks the cause chain for a SQLException whose SQLState is 23505. Other
SQLStates and non-SQL throwables remain non-duplicates.
Add unit tests for the unique_violation, wrapped unique_violation, other-SQLState,
and non-SQL cases.
Related issue: #15468
Related PRs: #15509, #15465
Assisted-by: Claude Code
Signed-off-by: wushiyuanmaimob <wushiyuanwork@outlook.com>
Move OIDC settings into PluginConfigSpec with immutable plugin-owned runtime state, standard keys, legacy aliases, specs, and API coverage.
Assisted-by: Claude Code
Make DatabaseDialect#isDuplicateKeyException(Throwable) the single entry point for
classifying duplicate unique-key conflicts, per the direction agreed in the issue.
The interface default walks the throwable cause chain and recognizes Spring's
DuplicateKeyException, matched by class name so the datasource plugin modules keep
their Spring-free dependency footprint. This reproduces the former database-agnostic
classification as the safe baseline and deliberately does not treat a raw vendor
SQLState such as 23505 as a duplicate on its own, preserving the #15465 rethrow
contract.
ExternalConfigInfoPersistServiceImpl now delegates duplicate-key judgement to the
active dialect, and only falls back to the inline Spring DuplicateKeyException check
when no dialect can be resolved (for example before datasource plugins are loaded).
Vendor dialects can override the SPI default to additionally inspect the original
driver exception (SQLState or vendor error code) via DatabaseDialect.super.
Update the datasource dialect plugin spec (en + zh-cn) and add regression tests: the
plugin-base default rejects non-Spring exceptions and raw SQLState, and the config
module verifies the default recognizes a wrapped Spring DuplicateKeyException.
Related issue: #15468
Related PRs: #15465, #15272, #15278
Assisted-by: Claude Code
Signed-off-by: wushiyuanmaimob <wushiyuanwork@outlook.com>
* Fix config namespace isolation for delete and export
Scope config export-by-ids and batch delete-by-ids to the requested namespace across admin, console, and maintainer SDK paths.
Update specs and IT scenario coverage for namespace-scoped storage ID operations.
Assisted-by: Claude Code
* Document config storage ID selector deprecation
Assisted-by: Claude Code
* Fix config clone namespace isolation
Ensure config clone resolves source IDs within the requested source namespace before writing to the target namespace. Update console and maintainer SDK paths plus API/SDK test specs.
Assisted-by: Claude Code
* Refine config clone service coverage
Extract shared clone logic into ConfigCloneService and move clone behavior coverage from controller tests into service-level tests.
Assisted-by: Claude Code
* Refine config clone source authorization
Add source namespace READ authorization for config clone paths and keep auth identity/resource context available for diagnostics.
Assisted-by: Claude Code
* Refresh legacy console clone namespace assets
Assisted-by: Claude Code
* Fix datasource export namespace isolation tests
* Cover datasource export namespace isolation tests
* Fix auth admin filter test header stubbing
* Stabilize clone source auth checker tests
* Apply spotless to clone auth checker
* chore(deps): spring-boot upgrade from 3.4.10 to 4.0.5
* chore(deps): micrometer upgrade from 1.12.8 to 1.13.0
* chore(deps): replace javax.annotation with jakarta.annotation
* chore(deps): spring-boot upgrade from 3.4.10 to 4.0.5
* chore(deps): spring-boot upgrade from 3.4.10 to 4.0.5: fix controller response
* chore(deps): spring-boot upgrade from 4.0.5 to 4.0.6
* chore(deps): spring-boot upgrade from 3.5.13 to 4.0.6: Restore blank line indentation whitespace to match develop
Blank lines adjacent to @Mock → @MockitoBean changes lost their
indentation spaces (e.g., 4 spaces became empty). Restore the
original whitespace to minimize unrelated diff noise.
* chore(deps): spring-boot upgrade from 3.5.13 to 4.0.6: Remove duplicate micrometer version override in pom.xml
The old 1.13.0 override was superseded by 1.15.10 (for Spring Boot
upgrade compatibility, see #15033). Having two definitions is
confusing; only the latter takes effect in Maven.
* chore(deps): spring-boot upgrade from 3.5.13 to 4.0.6: Restore blank line indentation whitespace to match develop
* style: apply spotless formatting fixes
Assisted-by: Claude Code
* Merge branch 'develop' into xuxiaowei/spring-boot-4
# Conflicts:
# .github/workflows/it-new.yml
# config/src/test/java/com/alibaba/nacos/config/server/controller/v3/ConfigOpsControllerV3Test.java
# config/src/test/java/com/alibaba/nacos/config/server/exception/GlobalExceptionHandlerTest.java
# config/src/test/java/com/alibaba/nacos/config/server/service/capacity/CapacityServiceTest.java
* style: apply spotless formatting
* chore(build): bump MCP SDK from 0.17.0 to 0.18.2
Assisted-by: Claude Code
* Remove spring-boot-starter-ldap-test dependency from console module
* Apply spotless formatting to ConfigOpenApiITCase
* Update TomcatConnectorCustomizer import for Spring Boot 4 compatibility
Assisted-by: Claude Code
* Replace ObjectNode with Map<String, Object> in ClientService API for Spring Boot 4 compatibility
* Remove redundant dependencies from test aggregator POM for Spring Boot 4 compatibility
* Makefile: Enhance Makefile for local dev workflow: add auth-disabled args, release-nacos profile, and IT test targets
* Makefile: Extract auth-disabled JVM args into standalone AUTH_DISABLED_ARGS variable
* Makefile: Add missing IT test targets to .PHONY declaration
Assisted-by: Claude Code
* build(deps): Refactor LDAP dependency: move spring-boot-starter-ldap to nacos-ldap-auth-plugin only
* build(deps): Add nacos-ldap-auth-plugin dependency to nacos-server module
* build(deps): Add nacos-ldap-auth-plugin dependency to nacos-console module
* build(deps): Remove nacos-ldap-auth-plugin dependency and LdapAutoConfiguration exclusion
* build(deps): Remove nacos-ldap-auth-plugin dependency and LdapAutoConfiguration exclusion
* Remove ConfigInfoBetaPersistService references and fix formatting in tests
Assisted-by: Claude Code
* Migrate javax.annotation to jakarta.annotation for Spring Boot 4 compatibility
Replace javax.annotation.{PostConstruct,PreDestroy,Resource} imports and
native-image reflect-config entries with jakarta.annotation equivalents.
* Add issue link for Makefile usage guide (#15338)
* Add test, check-maven, build-maven-test targets to Makefile (#15338)
---------
Co-authored-by: 杨翊 SionYang <xiweng.yy@alibaba-inc.com>
The pg-upgrade-null-tenant-id.sql migration script, introduced in #15150,
was not being copied to the distribution/conf directory during the Maven
build, making it inaccessible to Docker users upgrading from 3.2.1 with
PostgreSQL. Add the copy step alongside the existing PostgreSQL schema
SQL files so the migration script is available in the distribution.
Skip skills.sh search results whose source cannot be resolved as an owner/repo repository before turning them into import candidates.
Fetch at least the default skills.sh page size before local filtering so unsupported sources do not underfill the requested result page.
Assisted-by: Claude Code
Guard RemoteServerUtil static initialization when EnvUtil has no Spring environment, and isolate AgentSpec cache test events by using per-test names.
Assisted-by: OpenAI Codex
Enable the built-in official MCP and skills.sh import sources by default, upgrade safe dependency patch versions, and add missing v3 API @Since metadata.
Assisted-by: OpenAI Codex
* chore(build): bump project revision from 3.2.1 to 3.2.2.
* Add since annotation requirements to API specs
* Add API since annotation
* Add since annotations to SDK service APIs
* Add since annotations to core APIs
* Add since annotations to config and naming APIs
* Add since annotations to AI and lock APIs
* Add since annotations to console and plugin APIs
* Add since annotations to address APIs
* Refactor AI resource trace logging to subscriber
Assisted-by: Claude Code
* Ignore codegraph metadata
Assisted-by: Claude Code
* Exclude codegraph metadata from RAT checks
* Move AI trace log to default plugin
# Conflicts:
# plugin-default-impl/nacos-default-plugin-all/pom.xml
# plugin-default-impl/pom.xml
* Document default AI trace plugin
* [ISSUE #15183] Add AI importer config examples
Add commented default AI importer plugin configuration examples to distribution application.properties.\n\nAssisted-by: Claude Code
* [ISSUE #15183] Add built-in skills.sh importer
Add a default skills.sh import source preset and importer implementation that searches skills.sh, fetches selected Skill snapshots, and packages them as Skill ZIP artifacts.
Update importer specs, sample configuration comments, and unit tests for the new preset.
Assisted-by: Claude Code
* [ISSUE #15183] Fix skills.sh empty search query
Default blank skills.sh searches to skill and reject one-character queries locally before calling the upstream API.
Update importer specs and unit tests for the query boundary behavior.
Assisted-by: Claude Code
* [ISSUE #15183] Improve AI import selection behavior
Do not select import candidates by default in the shared AI import dialog. Add explicit select-all and clear controls, accumulate validated candidates across validation batches, and make import-all-valid execute the accumulated valid set.
Also update MCP and Skill import locale text, the AI import plugin spec, and regenerated console-next static assets.
Assisted-by: Claude Code
Move built-in MCP registry and Skill well-known importers into a default AI importer plugin.\n\nAdd source provider SPI and nacos.plugin.ai.importer preset configuration.\n\nUpdate import plugin specs and tests.\n\nAssisted-by: Claude Code
Add packaging verification for the LDAP plugin distribution contract introduced by #15118.
Assert that nacos-ldap-auth-plugin is present in distribution/plugins after packaging, while spring-ldap-core is not copied by default.
Assisted-by: Codex
* Resolve PostgreSQL tenant fix on top of current develop
This rebuilds the PR branch on top of the current develop branch to remove merge conflicts while preserving the intended PostgreSQL tenant safety fix.
The resulting patch keeps namespace normalization at the service entry layer, retains explicit PostgreSQL schema hardening, and adds an operator-run PostgreSQL migration SQL so existing deployments have an upgrade path before startup validation rejects incompatible schemas.
Constraint: PR must preserve namespace compatibility behavior while no longer pushing default-namespace semantics down into DAO or row-mapper layers
Constraint: Upstream develop advanced enough that the previous branch history became conflict-prone and noisy
Rejected: Rebase the historical branch commit-by-commit | earlier superseded commits and reverts caused low-value conflicts
Rejected: Drop PostgreSQL startup validation | would keep silent schema drift possible after MySQL-to-PostgreSQL imports
Confidence: medium
Scope-risk: moderate
Reversibility: clean
Directive: If this PR evolves further, keep the branch diff minimal and prefer rebuilding from current develop over reviving the old conflicting history
Tested: git diff --cached --check
Tested: ./mvnw -pl config -am -DskipITs -Dtest=ConfigOperationServiceTest -Dsurefire.failIfNoSpecifiedTests=false test
Tested: ./mvnw -pl persistence -am spotless:apply -DskipTests -DskipITs
Tested: ./mvnw -pl persistence -am -DskipITs -Dtest=ExternalDataSourceServiceImplTest -Dsurefire.failIfNoSpecifiedTests=false test
Not-tested: Full upstream CI rerun after force-pushing the rebuilt branch
Not-tested: Local full-reactor runs can intermittently fail in nacos-consistency protobuf temp cleanup on this machine
Assisted-by: Claude Code
* Resolve PostgreSQL tenant fix on top of current develop
This rebuilds the PostgreSQL tenant hardening patch on top of the current develop branch to remove merge conflicts while preserving the intended fix shape: service-layer namespace handling, PostgreSQL schema hardening, startup validation, and an operator-run migration SQL.
Constraint: The previous PR branch history became conflict-prone after develop advanced and contained superseded commits plus reverts
Constraint: CI must pass spotless before it even reaches the build/test stages
Rejected: Rebase the old history commit-by-commit | produced low-value conflicts through superseded commits
Rejected: Drop the PostgreSQL migration SQL | maintainer explicitly requested an upgrade path for existing deployments
Confidence: medium
Scope-risk: moderate
Reversibility: clean
Directive: If the branch conflicts again, prefer reconstructing the minimal final diff from current develop rather than reviving the old intermediate history
Tested: ./mvnw -pl config -am -DskipITs -Dtest=ConfigOperationServiceTest -Dsurefire.failIfNoSpecifiedTests=false test
Tested: ./mvnw -pl persistence -am spotless:apply -DskipTests -DskipITs
Tested: ./mvnw -pl persistence -am spotless:check -DskipTests -DskipITs
Tested: ./mvnw -pl persistence -am -DskipITs -Dtest=ExternalDataSourceServiceImplTest -Dsurefire.failIfNoSpecifiedTests=false test
Not-tested: Full upstream CI rerun after force-pushing the rebuilt branch
Not-tested: Local full-reactor validation remains noisy here because nacos-consistency protobuf temp cleanup is flaky in this environment
Assisted-by: Claude Code
* fix ci, mvn spotless:apply
* Align config operation tests with NamespaceUtil-based namespace handling
The service-layer namespace handling was adjusted manually to route namespaceId through NamespaceUtil.processNamespaceParameter, which changes the effective behavior for explicit empty namespace inputs from '' to the default namespace.
This commit updates the affected ConfigOperationService tests to match the new behavior without altering the manually changed production logic.
Constraint: Keep the manually updated ConfigOperationService behavior unchanged
Rejected: Revert the service-layer namespace handling change | user explicitly asked to preserve manual edits
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: If namespace handling semantics change again, update the service tests together with the behavior change so CI failures remain diagnostic instead of noisy
Tested: git diff --check
Tested: ./mvnw -pl persistence -am spotless:check -DskipTests -DskipITs
Tested: ./mvnw -pl config -am -DskipITs -Dtest=ConfigOperationServiceTest -Dsurefire.failIfNoSpecifiedTests=false test
Not-tested: Full reactor build after the manual ConfigOperationService behavior change still fails earlier in nacos-api due to the existing easyj-maven-plugin simplify-pom issue
Assisted-by: Claude Code
* [ISSUE #14911] Fix missing spring-ldap-core in default plugin distribution
Add spring-ldap-core to nacos-default-plugin-all and include it in the
plugin packaging copy list so LDAP auth runtime classes are present in
distribution/plugins.
Assisted-by: Codex
* [ISSUE #14911] refactor(plugin/auth): split LDAP into optional plugin
Move LDAP-specific auth code out of default-auth-plugin into a dedicated
nacos-ldap-auth-plugin module.
Add guarded LDAP auto-configuration and dependency precondition handling
so missing spring-ldap-core no longer causes startup classloading
failures. Instead, log a clear hint and install a fallback auth manager.
Keep the default plugin package minimal by removing spring-ldap-core and
LDAP packaging from nacos-default-plugin-all.
* feat: spring-ldap-core plugin refactor Impl
* refactor(plugin/auth): split LDAP into optional plugin and package LDAP plugin jar
吴世元