[devin-ai-integration]

Summary

Fixes code scan finding sfind-c6c165d7 (Snyk SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-8399269, CVE-2024-38827, medium). Spring Security did locale-dependent toLowerCase()/toUpperCase() in authorization matching. UserFront gets spring-security-core 4.2.3 through spring-boot-starter-security from the Boot 1.5.4 parent.

Major bump (flagged): no 4.x or 5.x line below 5.7.14 has the fix, and Spring Security 5.7 needs Spring 5.3 / Boot 2.7. So the smallest upgrade that clears the issue while keeping Java 8 is:

- spring-boot-starter-parent 1.5.4.RELEASE
+ spring-boot-starter-parent 2.7.18
+ <spring-security.version>5.7.14</spring-security.version>   # 2.7.18's BOM ships 5.7.11 (still vulnerable)
  <java.version>1.8</java.version>                             # unchanged

The Boot 2.7 upgrade forces these follow-on changes:

• mysql:mysql-connector-java → com.mysql:mysql-connector-j. Boot 2.7 manages only the new coordinates.
• SecurityConfig: the @Autowired configureGlobal(AuthenticationManagerBuilder) becomes @Override configure(AuthenticationManagerBuilder). On Boot 2.x the old version creates a circular bean reference with passwordEncoder().
• AppointmentServiceImpl.findAppointment: findOne(id) → findById(id).orElse(null). This is the Spring Data 2.x API.
• spring.main.allow-circular-references=true. UserServiceImpl and AccountServiceImpl inject each other, and Boot 2.6+ refuses circular references by default.
• UserFrontApplicationTests moves to JUnit 5, because Boot 2.7's spring-boot-starter-test dropped the vintage engine.

Duplicate notice: this has the same diff as open PR #227 (CVE-2024-38827 from an earlier finding, sfind-0e22b79f). Per the one-ticket-one-PR rule this is a separate PR. Only one of the two should land.

Verification

The session's network allowlist blocks Maven Central and api.snyk.io. Because of that, the 5.7.14 jars couldn't be downloaded, and I used the cached 5.7.11 jars instead (same API as 5.7.14; 5.7.14 is a patch release on that line). The pom itself pins 5.7.14.

• mvn -o -Dspring-security.version=5.7.11 test-compile on JDK 17 with --release 8: compiles.
• UserFrontApplicationTests.contextLoads against MySQL 5.7, run through the JUnit Platform launcher because the surefire junit-platform provider isn't cached: 1 test found, 1 successful, 0 failed.
• Booted the app against MySQL and ran it with curl:
  • anonymous /userFront → 302 /index
  • signup → 302
  • wrong password → /index?error
  • correct password → /userFront (200)
  • /USERFRONT while anonymous → 302 /index (still protected)
  • deposit 100 → balance 100.00
• Snyk before/after counts: not available. snyk test --file=UserFront/pom.xml fails with SNYK-CLI-0000 because api.snyk.io is unreachable. Before the fix the finding is reported on 4.2.3. After the fix the resolved version is 5.7.14, which is the advisory's first fixed version on the 5.7 line. Please confirm with a Snyk re-scan in CI.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/e789ac48191c4b74b2b73f0554d5a964
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/e789ac48191c4b74b2b73f0554d5a964?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)