[devin-ai-integration]

Summary

Fixes CVE-2026-40975 / SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-16191649 (weak PRNG behind ${random.value}, ${random.int}, ${random.long}; CWE-338, high, finding sfind-7890640a) in UserFront/pom.xml. The vulnerable spring-boot@1.5.4.RELEASE comes in through spring-boot-starter-web. Fixes exist only in 3.5.14 and 4.0.6, so the parent moves to the smallest of those:

- <version>1.5.4.RELEASE</version>   <!-- spring-boot-starter-parent -->
+ <version>3.5.14</version>
- <java.version>1.8</java.version>
+ <java.version>17</java.version>
- mysql:mysql-connector-java
+ com.mysql:mysql-connector-j

Flag 1: major bump (1.5 -> 3.5). No 1.x or 2.x release fixes this CVE.
Flag 2: the Java version changes from 8 to 17, which goes against the remediation guidance "do not change the Java version". Boot 3.x / Spring Framework 6 needs Java 17 or later, so this CVE can't be fixed on Java 8. Reviewers need to decide whether that's acceptable. If it isn't, the finding needs a risk-acceptance decision instead. Mitigating factor: UserFront never uses ${random.*} (nothing in src/ or application.properties refers to it), so the vulnerable property source isn't reached today.

The Boot 3 / Spring Security 6 / Hibernate 6 code changes are the same as in PR #178, which this PR cherry-picks:

• javax.persistence|servlet.* -> jakarta.* (entities, RequestFilter). Ids stay GenerationType.IDENTITY.
• SecurityConfig: WebSecurityConfigurerAdapter -> SecurityFilterChain bean + DaoAuthenticationProvider(userSecurityService). /error/**/* -> /error/**, because PathPatternParser rejects the old pattern. URL rules, form login, logout and remember-me stay the same.
• application.properties: adds spring.main.allow-circular-references=true (UserServiceImpl <-> AccountServiceImpl) and drops the MySQL5Dialect override.
• The test moves to JUnit 5. The Maven wrapper moves to 3.9.9.

Duplicate note: open PR #178 (CVE-2026-40977) has the identical diff and also clears this CVE. So do #71 / #62 (3.5.16) and the #100-#116 series (4.1.1). This PR was opened because each finding gets its own PR. Only one of them should be merged.

Verification (the session's network allowlist only reaches git-manager.devin.ai; Maven Central and api.snyk.io access was requested but not yet granted)

• Snyk before/after count: not available. snyk test --file=UserFront/pom.xml fails with SNYK-CLI-0000, because api.snyk.io can't be reached. Expected result: SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-16191649 disappears, because spring-boot resolves to 3.5.14. Please confirm in Snyk or CI.
• Not run: mvn compile / mvn test on the real 3.5.14 parent. It isn't in ~/.m2, Maven Central is blocked, and mvn test also needs MySQL.
• Run as a proxy: I copied the module and switched the parent to the cached Boot 3.3.4 on JDK 17. The DaoAuthenticationProvider constructor exists only in Security 6.4+, so I used the setter form there. mvn -o test-compile succeeds. I then booted the app on H2 (MySQL mode) and checked it over HTTP:

  POST /signup                 302 -> /
  POST /index (login)          302 -> /userFront
  POST /account/deposit 250    302 -> /userFront; Primary Balance 250.00, transaction row "Deposit to Primary Account 250.0"
  POST /index bad password     302 -> /index?error
  server ERROR lines: 0
  

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/0e8ab947eb234e09835117d9817c6b66
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/0e8ab947eb234e09835117d9817c6b66?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.