[BUG] PluginServiceImpl.importData never publishes the create event (resource init skipped for imported plugins)

[Aias00]

• severity: High
• files: shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/PluginServiceImpl.java:257-274
• description: In the import loop, after pluginMapper.insertSelective(pluginDO) > 0, the comment says // publish create event. init plugin data, but unlike the normal create() path (line 299-302 which calls pluginEventPublisher.onCreated(pluginDO)), the import path only increments successCount and never calls pluginEventPublisher.onCreated. So ResourceServiceImpl.onPluginCreated is never triggered for imported plugins.
• impact: Plugins imported via config import are persisted but their plugin-resource/permission initialization is silently skipped, leaving them in a half-initialized state.
• suggested_fix: Add pluginEventPublisher.onCreated(pluginDO); inside the if (pluginMapper.insertSelective(pluginDO) > 0) block.
• confidence: High
• related_existing: none. FUNC-A1/[BUG] NamespacePluginServiceImpl.create never publishes a sync event; new namespace-plugin relation never reaches the gateway #6537 is about NamespacePluginServiceImpl.create, not PluginServiceImpl.importData.

---

Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.

[github-actions]

👋 Hello @yuluo-yx

A new issue has been opened by @Aias00:

• Title: [BUG] PluginServiceImpl.importData never publishes the create event (resource init skipped for imported plugins)
• Link: [BUG] PluginServiceImpl.importData never publishes the create event (resource init skipped for imported plugins) #6619

Please review when you have time. Thank you! 🙏