[devin-ai-integration]

Summary

Fixes Snyk SNYK-JAVA-ORGYAML-6056527 / CVE-2022-38749 (high, CWE-400). snakeyaml 1.17 has no nesting-depth limit, so deeply nested YAML collections crash the parser with StackOverflowError. UserFront gets it transitively through spring-boot-starter-web@1.5.4.RELEASE (code-scan finding sfind-9a91b6ed).

 <java.version>1.8</java.version>
+<snakeyaml.version>1.31</snakeyaml.version>

The Boot 1.5.x parent manages snakeyaml through ${snakeyaml.version}, so this one property is enough. 1.31 is the smallest fixed version, as the remediation guidance asks. There is no Spring Boot or Java change. Snyk's suggested path (Boot 3.0.0) would be a major bump plus Java 17, so it was not used. Within the 1.x line this is a minor bump only. CVE-2022-1471 is out of scope: it still needs snakeyaml 2.x.

Verification (offline: Maven Central and api.snyk.io are blocked in this session)

• Snyk before/after issue count: not available. snyk test --file=UserFront/pom.xml fails with SNYK-CLI-0000 because it can't reach the network. Based on the advisory, which lists [0,1.31) as vulnerable, this issue should no longer appear after the change. That is inferred, not a rescan result.
• mvn compile / mvn test on the real pom: not run. The 1.5.4 parent and the snakeyaml 1.31 jar aren't in the local cache. The repo also has no src/test.
• Override check: I copied the pom and changed only the parent to the cached Boot 1.5.8.RELEASE, then ran mvn -o dependency:3.6.1:tree -Dincludes=org.yaml. The default resolves snakeyaml:1.17. With the property set to 1.31 or 1.33, the same version replaces it (org.yaml:snakeyaml:jar:1.31:runtime).
• Behaviour PoC: new Yaml().load("[" x 100000) throws StackOverflowError on 1.17. On 1.33, the closest cached jar that contains fix commit fc300780 (which shipped in 1.31), it throws YAMLException: Nesting Depth exceeded max 50.
• UserFront only has application.properties (no YAML config), so the bump doesn't change how Boot loads its config.

Duplicates

Older open PRs/branches already pin snakeyaml for this CVE family: #160, #171 (2.0), #218, #226 (1.33), #228 (1.31). This PR exists because each new finding gets its own PR. Only one of them should land.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/059adebdab50487994ce985698d4e8cf
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/059adebdab50487994ce985698d4e8cf?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring