[devin-ai-integration]

Summary

Fixes code-scan finding sfind-156b41a8 (Snyk SNYK-JAVA-ORGYAML-3113851, CVE-2022-41854, stack overflow on deeply nested YAML; low, CVSS 3.7). org.yaml:snakeyaml@1.17 came in transitively via spring-boot-starter-web@1.5.4.RELEASE.

 <properties>
   <java.version>1.8</java.version>
+  <snakeyaml.version>1.32</snakeyaml.version>
 </properties>

The Boot 1.5.x spring-boot-dependencies BOM manages snakeyaml at ${snakeyaml.version}, so overriding the property is all that's needed. 1.32 is the lowest fixed version. It's a minor bump within 1.x. The Boot parent and Java 1.8 are unchanged, and Snyk's suggested path (Boot 3.0) is not used.

Verification

I couldn't run the real build here: this session's network allowlist blocks Maven Central and api.snyk.io, and the 1.5.4 parent isn't in the local ~/.m2. To check the change anyway, I copied UserFront/pom.xml and switched it to the cached Boot 1.5.8 parent:

• dependency:tree -Dincludes=org.yaml resolves spring-boot-starter-web -> spring-boot-starter -> org.yaml:snakeyaml:jar:1.32:runtime, where it was 1.17 before.
• I ran a small check against the spring-boot-starter-web runtime classpath with -Xss512k. 1.32 isn't cached, so 1.33 stood in for it:
  • 1.17: Boot's YamlPropertySourceLoader loads a sample config fine. new Yaml().load("[[[[…" x100000) throws StackOverflowError (vulnerable).
  • 1.33: YamlPropertySourceLoader still loads fine. The same input throws YAMLException: Nesting Depth exceeded max 50 (fixed).
• UserFront has no application.yml; config is application.properties. snakeyaml is only used if a YAML config is added.

Not done (network): mvn test (the only test is UserFrontApplicationTests, which also needs MySQL) and a Snyk re-scan. snyk test fails with SNYK-CLI-0000, so I have no before/after Snyk issue count. The expected result is that this issue (and the other snakeyaml 1.x issues fixed by 1.32) disappears and CVE-2022-1471 remains, since that one needs 2.x.

Overlap

This duplicates earlier work, and only one of these should land: open PR #226 (snakeyaml.version 1.33), the existing branch devin/1790739497-snakeyaml-1.32 (identical diff), and PR #171 (2.0, which also covers CVE-2022-1471). I opened a new PR anyway because each new finding gets its own PR.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/8e6dbf5bad884f4aae779d4373dfaae7
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/8e6dbf5bad884f4aae779d4373dfaae7?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring