[devin-ai-integration]

Summary

Fixes code-scan finding sfind-eb08b49a (Snyk SNYK-JAVA-MYSQL-174574, CVE-2019-2692, CVSS 6.3, privilege escalation in mysql:mysql-connector-java@5.1.42, pulled in transitively from the Spring Boot 1.5.4 BOM).

 <properties>
   <java.version>1.8</java.version>
+  <mysql.version>8.0.16</mysql.version>
 </properties>

spring-boot-dependencies pins mysql-connector-java to ${mysql.version}, so overriding that property is enough. No coordinate change, no Boot upgrade, and no Java version change. 8.0.16 is the smallest version that fixes this CVE, and it still targets Java 8.

Major bump (5.1 -> 8.0), flagged for review:

• com.mysql.jdbc.Driver is still there in 8.0 as a deprecated shim, so Boot's auto-detected driver keeps working. It logs a deprecation warning at startup. Setting spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver would silence it, but I left it out to keep this change minimal.
• Connector/J 8.0 is stricter about time zones and SSL. If the MySQL server reports a non-IANA time zone name, the connection fails, and you'd need to add serverTimezone=UTC to spring.datasource.url.
• 8.0.16 still has later Connector/J CVEs (for [REDACTED SECRET] CVE-2021-2471, fixed in 8.0.27, and CVE-2023-22102, fixed in com.mysql:mysql-connector-j 8.2.0). Those are separate findings and are not covered here.

Verification: limited. Please read before merging.

• This session's network allowlist only includes git-manager.devin.ai. Maven Central and api.snyk.io are blocked, and a request for access to them is pending.
• Because of that, mvn clean compile / mvn test did not run. Neither the Boot 1.5.4 parent nor Connector/J 8.0.16 is in the local ~/.m2, and the only existing test is a @SpringBootTest context load that needs a live MySQL onlinebanking DB.
• snyk test --file=UserFront/pom.xml also failed on network, so I can't give before/after Snyk issue counts. The expected result is that this issue goes from 1 to 0 for mysql-connector-java.
• What I did check: the Boot 1.5.x spring-boot-dependencies BOM manages mysql-connector-java via ${mysql.version} (confirmed on the cached 1.5.8 BOM), and none of the application code imports MySQL driver classes.
• Please run cd UserFront && mvn clean test against MySQL, then snyk test, before merging.

Overlap: several open PRs switch to com.mysql:mysql-connector-j as part of full Spring Boot 2.x/3.x upgrades (e.g. #33 pins 8.0.33, #109 pins 5.1.49, which does not fix this CVE). This PR is the minimal, standalone fix for this finding only.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/00f3696d3adb43809d708b1711765c56
Open in Devin Desktop: https://app.devin.ai/desktop/session/00f3696d3adb43809d708b1711765c56?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring