[devin-ai-integration]

Summary

Fixes code-scan finding sfind-cb41afa4 / SNYK-JAVA-ORGSPRINGFRAMEWORK-7687447 (CVE-2024-38809, ETag If-Match/If-None-Match parsing DoS) in UserFront/pom.xml. spring-boot-starter-web@1.5.4 pulls in spring-web@4.3.9. The fix ships only in 5.3.38+, 6.0.23+ and 6.1.12+.

Major bump, please review: Spring Boot 1.5.x can't run Spring 5. So the parent goes 1.5.4.RELEASE → 2.7.18, the last Boot 2.x release and the last one that supports Java 8. <java.version>1.8</java.version> stays the same. Spring 6 / Boot 3 would need Java 17, which the remediation guidance rules out.

<parent>spring-boot-starter-parent 2.7.18</parent>
<spring-framework.version>5.3.39</spring-framework.version>   <!-- Boot 2.7.18 BOM default is 5.3.31, still vulnerable -->
mysql:mysql-connector-java -> com.mysql:mysql-connector-j        <!-- 2.7.18 only manages the new coordinates -->

I chose 5.3.39 rather than the minimum 5.3.38. It's the final OSS 5.3 patch, and in the same framework BOM unit it also clears CVE-2024-38808 (spring-expression).

Code and config changes the Boot 2 upgrade needs:

• AppointmentServiceImpl.findAppointment: appointmentDao.findOne(id) → findById(id).orElse(null) (Spring Data 2.x API).
• application.properties:
  • spring.main.allow-circular-references=true, because UserServiceImpl and AccountServiceImpl depend on each other.
  • spring.jpa.hibernate.use-new-id-generator-mappings=false, so GenerationType.AUTO keeps using MySQL auto-increment.
  • The Boot 1.x testWhileIdle/validationQuery settings are replaced by spring.datasource.hikari.connection-test-query.
• UserFrontApplicationTests: JUnit 4 → JUnit 5, because Boot 2.7's spring-boot-starter-test doesn't include JUnit 4.

Same recipe as the earlier PR #180 (sfind-c72b47e5). Both PRs fix this CVE, so only one should land. This one is opened separately because the new finding gets its own PR.

Verification

The automation network policy blocks Maven Central and api.snyk.io. Spring 5.3.39 jars and the surefire JUnit Platform provider aren't in the local Maven cache, so I verified offline with the cached 5.3.31 jars:

• mvn -o dependency:tree on this pom resolves every org.springframework:* artifact to 5.3.39.
• mvn -o -Dspring-framework.version=5.3.31 test-compile: BUILD SUCCESS on Java 17, targeting 1.8.
• UserFrontApplicationTests.contextLoads, run through JUnit Platform Launcher 1.9.3 against MySQL 5.7: 1 test found, 1 successful, 0 failed.
• Booted the app against MySQL 5.7 and seeded role(1,'ROLE_USER'), then ran these curl checks:
  • GET /index returns 200.
  • POST /signup returns 302.
  • Login (POST /index) returns 302 to /userFront.
  • POST /account/deposit of 125 returns 302, and the DB shows a primary balance of 125.00 plus a Finished transaction.
• Snyk before/after counts: not available. snyk test --file=UserFront/pom.xml fails with SNYK-CLI-0000 because api.snyk.io is unreachable. Expected after: spring-web resolves to 5.3.39, which is ≥ 5.3.38, so SNYK-JAVA-ORGSPRINGFRAMEWORK-7687447 should clear. Please re-run the Snyk scan on this branch to confirm.
• Not tested: a full mvn test/package with the real 5.3.39 jars (not cached), and the AdminPortal against this backend.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/1293a16d546b45f1b2c2b25691997888
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/1293a16d546b45f1b2c2b25691997888?variant=devin

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.