[devin-ai-integration]

Summary

Fixes Snyk SNYK-JAVA-ORGAPACHETOMCATEMBED-8547999 / CVE-2024-56337 (critical, TOCTOU in tomcat-embed-core@8.5.15, which comes in through spring-boot-starter-web 1.5.4). Code-scan finding sfind-43a5867e79d245d3840085f41d176840.

The only fixed lines are 9.0.98, 10.1.34 and 11.0.2, so there is no 8.5.x fix. A plain <tomcat.version> override can't do it either: Boot 1.5 crashes on Tomcat 9 at default-servlet registration (NoSuchMethodError Context.addServletMapping). This PR does the smallest upgrade that works and keeps Java 1.8:

 parent spring-boot-starter-parent  1.5.4.RELEASE -> 2.7.18     # last Boot line that still supports Java 8
+<tomcat.version>9.0.98</tomcat.version>                        # smallest fixed version (2.7.18 ships 9.0.83)
 mysql:mysql-connector-java -> com.mysql:mysql-connector-j      # 2.7 BOM no longer manages the old coordinates
 appointmentDao.findOne(id) -> findById(id).orElse(null)        # Spring Data 2.x API
+spring.main.allow-circular-references=true                     # existing SecurityConfig <-> UserService wiring
+spring.jpa.hibernate.use-new-id-generator-mappings=false       # keep IDENTITY ids for GenerationType.AUTO (no hibernate_sequence)
+spring-boot-maven-plugin jvmArguments -Dsun.io.useCanonCaches=false   # mitigation the advisory requires on Java 8/11
 UserFrontApplicationTests: JUnit4 SpringRunner -> JUnit 5

Flag: this is a major bump (Boot 1.5 -> 2.7). Snyk's suggested path, Boot 3.3.7, needs Java 17, and the remediation rules say not to change the Java version.

Exploitability on master is low. The CVE needs the DefaultServlet with writes enabled (readonly=false), and UserFront doesn't enable that: PUT /evil.jsp/ gets redirected to login. If you run the jar directly on Java 8/11, also pass -Dsun.io.useCanonCaches=false. The pom setting only applies to mvn spring-boot:run.

Verification

• mvn -o dependency:tree -Dincludes=org.apache.tomcat.embed resolves spring-boot-starter-tomcat:2.7.18 -> tomcat-embed-core/el/websocket:9.0.98.
• Tomcat 9.0.98 jars aren't in the offline cache and Maven Central is blocked in this session. So the build and runtime checks below used the same Boot 2.7.18 BOM with -Dtomcat.version=9.0.83 as a stand-in.
  • mvn -o test-compile passes on JDK 11.
  • UserFrontApplicationTests (context load against MySQL 5.7) passed: 1 test, 1 successful, 0 failed. It was run through a JUnit Platform launcher because surefire's junit-platform provider isn't cached.
  • I booted the app on Tomcat 9 against mysql:5.7 and checked with curl: GET /index 200, then signup, login, and a $250 deposit to primary all worked (primary balance 250.00). The user got user_id=1 and no hibernate_sequence table was created.
• No Snyk before/after issue count. snyk test fails with SNYK-CLI-0000 because api.snyk.io isn't on this session's network allowlist. Please re-run the Snyk scan in CI or after merge.

Duplicates

Only one of these should land:

• Branch devin/1790739588-tomcat-cve-2024-56337 has the same pom change.
• bug: upgrade embedded Tomcat to 9.0.117 (CVE-2026-34500) — Spring Boot 1.5.4 -> 2.7.18 #229 (Boot 2.7.18 + Tomcat 9.0.117) and bug(security): upgrade embedded Tomcat to 9.0.113 (CVE-2025-66614) via Spring Boot 2.7.18, Java 8 kept #231 (9.0.113) also clear this CVE.

This PR is a separate one because the code-scan finding is a new ticket. Compared with that branch, it adds the use-new-id-generator-mappings=false and useCanonCaches changes.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/582175d996bb4c34acd25034736f8491
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/582175d996bb4c34acd25034736f8491?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)