[devin-ai-integration]

Summary

Fixes code-scan finding sfind-f8a0cebe (high, CVSS 7.5): org.yaml:snakeyaml@1.17 arrives transitively through spring-boot-starter-web@1.5.4.RELEASE. It has no limit on collection nesting depth, so deeply nested YAML can crash the parser (CVE-2022-25857 / CWE-400). Vulnerable range: [0,1.31).

 <properties>
   <java.version>1.8</java.version>
+  <snakeyaml.version>1.33</snakeyaml.version>
 </properties>

The Boot 1.5.x parent manages snakeyaml through ${snakeyaml.version}, so overriding that property is enough. This avoids the major bump Snyk suggests (Boot 3.0.0, which needs Java 17). The Spring Boot parent and Java version (1.8) stay the same.

Why 1.33 and not 1.31: 1.31 is the smallest version that fixes this CVE. 1.33 is the last 1.x release, and it also fixes the related 1.x DoS CVEs (CVE-2022-38749/38750/38751/38752 and CVE-2022-41854, which need 1.32). It is also the version cached on the build VM, so it could be verified offline. Not fixed by this PR: CVE-2022-1471 needs snakeyaml 2.x, which Boot 1.5's YAML loader doesn't support.

Duplicate notice: this is the same one-line change as the older PR #226 (sfind-760a250f). This PR exists because each new finding gets its own PR. Only one of them should land.

Verification (offline: the network policy blocks Maven Central and api.snyk.io)

• Dependency tree. Ran dependency:tree -Dincludes=org.yaml on a copy of the pom. The copy uses the cached Boot 1.5.8 parent because 1.5.4 isn't cached:
  • before: spring-boot-starter-web > spring-boot-starter > org.yaml:snakeyaml:jar:1.17
  • after: ... > org.yaml:snakeyaml:jar:1.33
• Exploit check. Ran Boot's YamlPropertySourceLoader and parsed a payload of 100,000 [ characters with new Yaml().load(...):
  • 1.17: normal YAML loads; the payload throws StackOverflowError (vulnerable)
  • 1.33: normal YAML loads; the payload is rejected with YAMLException: Nesting Depth exceeded max 50
• Boot smoke test. Started a Spring Boot 1.5.8 web app on snakeyaml 1.33. It read application.yml, Tomcat 8.5 served /ping, and the response reported snakeyaml-1.33.jar.
• Not run: mvn test (needs the Boot 1.5.4 parent and starters from Maven Central, plus MySQL) and snyk test. Snyk fails with SNYK-CLI-0000 because it can't reach its API. So there is no Snyk before/after issue count. Based on the advisory range, this finding should go from 1 to 0, but no Snyk rescan confirmed it. Network access has been requested. Note: UserFront ships only application.properties and doesn't parse YAML itself.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/8185c1cf437841d5861b828a81ea1e5c
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/8185c1cf437841d5861b828a81ea1e5c?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring