Update fastjson version

[Fengxq2014]

Which Issue(s) This PR Fixes

• Fixes CVE-2026-16723 QVD-2026-45876

Brief Description

How Did You Test This Change?

[RockteMQ-AI]

Review by github-manager-bot

Summary

Dependency version bump to address CVE-2026-16723 (QVD-2026-45876):

• fastjson 1.2.83 → 1.2.84 (patch)
• fastjson2 2.0.59 → 2.0.63 (minor)

Findings

• [Info] Both are minor/patch version bumps within the same major series, so backward compatibility is expected.
• [Info] Only pom.xml property declarations changed — no code modifications required.

Suggestions

• Ensure CI passes to confirm no transitive dependency conflicts with the new versions.
• Consider adding a brief description in the PR body summarizing what the CVEs address, to help future maintainers understand the urgency.

LGTM — straightforward security version bump.

---

Automated review by github-manager-bot

[fuyou001]

The selected versions are valid upstream security releases and the upgrade direction looks correct. However, this PR currently reports no checks and contains no test evidence, so please add compatibility validation before merging.

fastjson2 2.0.63 includes behavior changes beyond AutoType hardening, including reference detection for collection elements and JSON/JSONB parser changes. Please run the full JDK 8 build and unit-test suite and add focused compatibility tests for RocketMQ configuration, route data, ACL data, message metadata, and any persisted JSON/JSONB representations.

The required upgrade matrix should include old-version write/new-version read, new-version write/old-version read, existing persisted data followed by restart/recovery, malformed or truncated input, and rolling upgrade/downgrade. Please also exercise AutoType enabled/disabled, safe mode enabled/disabled, and custom accept/deny configurations. These assertions are especially important because this is a dependency-management change affecting all modules rather than a single isolated call path.