[devin-ai-integration]

Summary

Fixes code-scan finding sfind-b6f3745f / SNYK-JAVA-ORGAPACHETOMCATEMBED-15989812 (CVE-2026-34483, JsonAccessLogValve JSON escaping, CWE-116, medium) on UserFront/pom.xml. tomcat-embed-core was 8.5.15, pulled in by Boot 1.5.4.

This is a major bump. Please review it as one. The earliest fixed version is 9.0.117, and no fixed 8.5.x exists because 8.5 is EOL. Boot 1.5 can't run Tomcat 9: you get NoSuchMethodError Context.addServletMapping at startup. So the parent has to go to the last Boot 2.x line. The Java version is unchanged (java.version 1.8).

 parent spring-boot-starter-parent 1.5.4.RELEASE -> 2.7.18
+<tomcat.version>9.0.117</tomcat.version>   (2.7.18 ships 9.0.83; this pins the smallest fixed version)
 mysql:mysql-connector-java -> com.mysql:mysql-connector-j   (renamed coordinates in Boot 2.7)

Boot 2.x compatibility changes, with no behaviour change intended:

• AppointmentServiceImpl.findAppointment: findOne(id) -> findById(id).orElse(null) (Spring Data 2.x).
• SecurityConfig: the @Autowired configureGlobal(AuthenticationManagerBuilder) method is now @Override configure(AuthenticationManagerBuilder). This keeps the same userSecurityService + BCrypt setup.
• application.properties: spring.main.allow-circular-references=true, because UserServiceImpl and AccountServiceImpl inject each other and Boot 2.6+ rejects that by default. Also spring.jpa.hibernate.use-new-id-generator-mappings=false, which keeps GenerationType.AUTO on MySQL auto-increment as in Boot 1.x, so existing schemas still work.
• UserFrontApplicationTests: JUnit 4 SpringRunner -> JUnit 5.

Duplicate: open PR #272 has the identical change for this same CVE (#229 is the same recipe for CVE-2026-34500; #33 and others pin 9.0.118 but also change the Java version). Only one of these should land. This PR exists because each new scan finding gets its own PR.

Verification

The session only had git access (Maven Central and api.snyk.io were blocked), so I used stand-ins:

• mvn -o dependency:tree -Dincludes=org.apache.tomcat.embed resolves tomcat-embed-core/-el/-websocket:9.0.117 under spring-boot-starter-tomcat:2.7.18.
• 9.0.117 jars aren't cached, so I built with -Dtomcat.version=9.0.83: mvn -o test-compile (JDK 17, target 1.8) passes.
• I booted UserFrontApplication on Boot 2.7.18 / Tomcat 9.0.83 against MySQL 5.7, then ran sign-up, login, a $125 deposit and an anonymous request:
  • Sign-up, login and deposit each returned a 302 to the expected page.
  • primary_account.account_balance = 125.00, with a primary_transaction row (Account, 125, Finished).
  • The anonymous /userFront request redirected to /index.
• Snyk before/after counts: not measured. snyk test fails with SNYK-CLI-0000 because the network is restricted. Expected from the advisory ranges: this issue goes 1 -> 0, since 9.0.117 is outside [,9.0.117).
• Not run: mvn test with the real 9.0.117 jars, and a Snyk rescan. Both need network access.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/eb715c08a49a42de9c07c649e8625202
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/eb715c08a49a42de9c07c649e8625202?variant=devin

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.