[devin-ai-integration]

Summary

Finding sfind-72af087c / SNYK-JAVA-ORGSPRINGFRAMEWORKDATA-17279540 (CVE-2026-41721, CVSS 8.2, CWE-400). UserFront gets spring-data-commons@1.13.4.RELEASE through spring-boot-starter-data-jpa (Boot 1.5.4).

This PR mitigates the issue. It does not upgrade the dependency. Snyk lists fixes only in 3.5.12 and 4.0.6, with nothing on the 1.x or 2.x lines. Spring Data Commons 3.5.x needs Boot 3, Spring 6 and Java 17 (javax -> jakarta). The remediation guidance says "do not change the Java version" (1.8), so the smallest version that clears the finding would be a major, Java-changing migration. That needs a human decision.

The advisory says the bug is exploitable only when Spring Data Web Support is enabled and a controller binds a @ProjectedPayload (ProxyingHandlerMethodArgumentResolver). Boot turns web support on automatically through SpringDataWebAutoConfiguration. UserFront never uses it: it has no Pageable, Sort, @ProjectedPayload or interface-typed handler params. This PR switches it off:

-@SpringBootApplication
+@SpringBootApplication(exclude = SpringDataWebAutoConfiguration.class)

That removes the Sort, Pageable and Proxying MVC argument resolvers, so the vulnerable binding path can't be reached. JPA repositories are not affected.

Duplicate notice: this change is identical to open PR #197 (an earlier trigger of the same CVE, sfind-da6c33d2). It was opened separately under the one-finding-one-PR rule. Only one of #197 and this PR should land.

Verification

• I couldn't run the full mvn compile or mvn test. The Boot 1.5.4.RELEASE parent and the thymeleaf/security/mysql starters aren't in the local Maven cache, and Maven Central is blocked in this session. UserFront/src/test contains no tests.
• UserFrontApplication.java compiles against the Boot 1.5.8 classpath.
• I ran a runtime harness on the closest cached Boot line: 1.5.8, which has spring-data-commons 1.13.8, webmvc 4.3.12, Tomcat and H2. It has one controller with a @ProjectedPayload interface Form parameter, and I sent POST /p -d name=alice to it:

app annotation	result
before: @SpringBootApplication	bound:alice via com.sun.proxy.$Proxy76: the projection proxy is bound, so the vulnerable path is reachable
after: @SpringBootApplication(exclude = SpringDataWebAutoConfiguration.class)	500 BeanInstantiationException: ... Specified class is an interface: no projecting resolver is registered

• Snyk before/after: I couldn't re-scan. snyk test --file=UserFront/pom.xml fails with SNYK-CLI-0000 because the session's network allowlist blocks api.snyk.io. Expected count is 1 -> 1 for this issue, because the dependency version doesn't change. I added no Snyk ignore and changed no thresholds.

Actual upgrade paths (all change Java)

• Track A: upgrade UserFront backend from Spring Boot 1.5 / Java 8 to Spring Boot 3.5 / Java 21 #62 / feature: upgrade UserFront to Spring Boot 3.5.16 on Java 17 #71: Boot 3.5.16 on Java 21 / 17.
• feature: [COG-1118] bump UserFront to Spring Boot 4.1.1 + Java 21, Maven wrapper, CI skeleton #100: Boot 4.1.1 on Java 21.

If one of those lands, this exclusion can stay as defense in depth or be reverted.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/62b85211e98e4a069b18edf9ebead0e7
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/62b85211e98e4a069b18edf9ebead0e7?variant=devin

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.