[devin-ai-integration]

Summary

Fixes code-scan finding sfind-05313227 / SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-16198880 (CVE-2026-40973, CWE-377). In spring-boot 1.5.4, ApplicationTemp builds its temp directory from a predictable name and uses it even if another local user created it first. Fixed versions are 3.5.14 and 4.0.6. This PR moves to 3.5.14, the smallest version that clears the issue.

Warning

This is a major-version bump (1.5 → 3.5), and it changes the Java version (java.version 1.8 → 17). The remediation guidance says "do not change the Java version", but there's no way around it here: every fixed release of Spring Boot requires Java 17. Earlier runs on this same CVE escalated without opening a PR. This PR exists because of the rule that every new ticket gets its own PR. Reviewers need to decide whether Java 17 is acceptable.

The diff is the same as PR #178 (Boot 3.5.14 for CVE-2026-40977), cherry-picked from ed8f9cb. Open PRs #71 and #62 (Boot 3.5.16) also clear this CVE. Only one of these should land.

Changes the migration needed:

• pom.xml: parent 1.5.4.RELEASE → 3.5.14, java.version 17, mysql:mysql-connector-java → com.mysql:mysql-connector-j. The Maven wrapper moves to 3.9.9.
• javax.persistence / javax.servlet → jakarta.* in domain/** and RequestFilter.
• SecurityConfig: WebSecurityConfigurerAdapter is replaced by a SecurityFilterChain bean plus a DaoAuthenticationProvider(userSecurityService) bean. @EnableGlobalMethodSecurity becomes @EnableMethodSecurity. Behaviour is unchanged: same public matchers, form login on /index, logout, remember-me, and CSRF/CORS still disabled exactly as on master.
• application.properties: adds spring.main.allow-circular-references=true, because UserServiceImpl and AccountServiceImpl depend on each other. Drops the hard-coded MySQL5Dialect (Hibernate 6 detects the dialect itself).
• UserFrontApplicationTests: JUnit 4 → JUnit 5.

Verification

The build ran offline. Maven Central is blocked by this session's network policy, and the Boot 3.5.14 artifacts aren't in the local cache, so I used the cached Boot 3.3.4 parent as a stand-in. The 3.3.4 stand-in ships Security 6.3, so in that copy only, DaoAuthenticationProvider used the setter form (the constructor is Security 6.4+, which 3.5.14 includes).

• All of src/main/java compiled with javac on JDK 17 against the dependency:build-classpath output, with no errors.
• UserFrontApplicationTests.contextLoads ran through the JUnit Platform launcher against H2 in MySQL mode: 1 test found, 1 passed.
• I booted the app on H2 and ran curl flows. /index returned 200. Signup gave a 302. Login gave a 302 to /userFront, which then returned 200. Depositing 125 into the primary account gave a 302, and the primary account page showed 125.00. A bad password redirected to /index?error. Anonymous /userFront redirected to /index.

Snyk before/after: not available. snyk test fails with SNYK-CLI-0000 because api.snyk.io is blocked here, so I can't quote issue counts. Expected effect: the spring-boot@1.5.4.RELEASE path for SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-16198880 is gone (it resolves to spring-boot@3.5.14). Please re-run the Snyk scan in CI to confirm.

Untested: a real build and run on the 3.5.14 artifacts, and a run against MySQL.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/a5252fda2066499d9a6f0b4d726107b0
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/a5252fda2066499d9a6f0b4d726107b0?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.

1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)