[devin-ai-integration]

Summary

Fixes code-scan finding sfind-32ca70e4 (SNYK-JAVA-ORGYAML-3016888 / CVE-2022-38752, low, CWE-121). UserFront pulls in org.yaml:snakeyaml:1.17 through spring-boot-starter-web 1.5.4 → spring-boot-starter. Crafted YAML can overflow the stack while parsing, which is a DoS.

 <properties>
   <java.version>1.8</java.version>
+  <snakeyaml.version>1.32</snakeyaml.version>
 </properties>

The Boot 1.5 parent's dependency management reads snakeyaml.version, so this one line changes only the transitive snakeyaml version.

• The Boot parent, the Java version (1.8) and all other dependencies are unchanged.
• No Snyk ignores or threshold changes.
• 1.32 is the smallest version that fixes this CVE. It is a minor bump within 1.x, not a major one.
• CVE-2022-1471 is not fixed here. It needs snakeyaml 2.x, which requires a Boot upgrade.

Duplicate notice: open PR #290 (sfind-eee2a2ff) makes the identical change, and #210 (1.32) and #226 (1.33) also clear this CVE. This PR exists because each scan finding/ticket gets its own PR. Only one of them should land.

Verification

• Snyk before/after issue count: not available. This session's network allowlist (git-manager only) blocks api.snyk.io, so snyk test --file=UserFront/pom.xml fails with a connection error. I requested network access, but it was not granted during the session. After this lands, the scan profile re-run should no longer report SNYK-JAVA-ORGYAML-3016888, and the resolved version should be snakeyaml:1.32.

• mvn compile / mvn test: could not run. Maven Central is blocked. The 1.5.4 parent and the snakeyaml 1.32 jar are not in ~/.m2. The only test (contextLoads) also needs MySQL.

• Dependency resolution (offline): I ran maven-dependency-plugin:3.6.1:tree -Dincludes=org.yaml on a copy of this pom with the cached Boot 1.5.8 parent, which manages snakeyaml the same way:

  • master (no property) → org.yaml:snakeyaml:jar:1.17
  • this branch → org.yaml:snakeyaml:jar:1.32

• Runtime harness: Boot 1.5.8 YamlPropertySourceLoader with Spring 4.3.12, run on -Xss512k with a PoC of 100k nested [. snakeyaml 1.33 stands in for 1.32 because 1.32 is not cached; both include the nesting-depth limit added in 1.31/1.32.

  snakeyaml	Boot YAML property loading	PoC
  1.17 (master)	OK (server.port=8080)	StackOverflowError (vulnerable)
  1.33 (stand-in)	OK (server.port=8080)	YAMLException: Nesting Depth exceeded max 50

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/20b1f5f535b447eab523e5381a29fd5d
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/20b1f5f535b447eab523e5381a29fd5d?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.