[devin-ai-integration]

Summary

Fixes code-scan finding sfind-88c741b8 (SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-1078232 / CVE-2021-22112, privilege escalation via SecurityContext not re-saved). UserFront got spring-security-core 4.2.3.RELEASE through spring-boot-starter-security 1.5.4. The vulnerable range is everything below 5.2.9, so a 4.2.x patch pin can't fix it. Spring Security 5.x needs Spring 5 and Boot 2.

This is a major bump (Boot 1.5.4 -> 2.7.18, Spring Security 4.2.3 -> 5.7.11). java.version stays at 1.8.

- spring-boot-starter-parent 1.5.4.RELEASE          (spring-security-core 4.2.3.RELEASE)
+ spring-boot-starter-parent 2.7.18                 (spring-security-core 5.7.11)
- mysql:mysql-connector-java                         (not managed by the Boot 2.7 BOM)
+ com.mysql:mysql-connector-j

Why 2.7.18 and not Snyk's minimum path (Boot 2.3.9 -> Security 5.3.8): 2.3.x is EOL, and its starters/BOM aren't available in this build environment, so it couldn't be built or verified. 2.7.18 is the last OSS Boot 2.x release that still supports Java 8, and it builds and runs end to end here. If you'd rather have the smaller 2.3.9 bump, it's a one-line parent change on top of this PR.

Code changes Boot 2 requires:

• SecurityConfig: @Autowired configureGlobal(AuthenticationManagerBuilder) becomes @Override configure(AuthenticationManagerBuilder).
• AppointmentServiceImpl.findAppointment: findOne(id) becomes findById(id).orElse(null) (Spring Data 2.x API).
• application.properties:
  • spring.main.allow-circular-references=true: the existing UserServiceImpl <-> AccountServiceImpl cycle is rejected by Boot 2.6+.
  • spring.jpa.hibernate.use-new-id-generator-mappings=false: keeps the Boot 1.5 GenerationType.AUTO -> MySQL AUTO_INCREMENT behaviour instead of a new hibernate_sequence table, so existing schemas keep working.
• UserFrontApplicationTests: JUnit 4 SpringRunner -> JUnit 5 (Boot 2.7's starter-test is Jupiter-only).

Overlap: open PRs #227 / #184 / #281 make the same Boot 2.7.18 move for other spring-security CVEs. Only one of them should land. This PR differs by not pinning spring-security.version (5.7.11 already clears this CVE) and by adding the id-generator setting.

Verification

• mvn -o -DskipTests package (JDK 17, --release 8 target): BUILD SUCCESS. master can't be built in this environment because the 1.5.4 parent isn't in the local Maven cache.
• dependency:tree -Dincludes=org.springframework.security: spring-security-{config,core,web}:5.7.11.
• Existing test UserFrontApplicationTests.contextLoads against MySQL 5.7: 1 found / 1 successful / 0 failed. It was run with the JUnit Platform launcher 1.9.3, because the surefire junit-platform provider isn't cached offline.
• Ran the fat jar against a fresh MySQL 5.7 DB (role rows seeded) and tested with curl. Every check behaved as expected:
  • Anonymous /userFront -> 302 /index.
  • POST /signup -> 302.
  • Wrong password -> /index?error. Correct password -> /userFront (200).
  • POST /account/deposit of 150 -> balance 150.00 and a primary_transaction row.
  • /logout -> /index?logout, after which /userFront redirects to login again.
  • Tables were created with AUTO_INCREMENT ids, and the log has no errors.
• Snyk issue count (before/after): snyk test fails here with SNYK-CLI-0000 because the network is restricted, so there is no rescan result. Counted by hand against the advisory's vulnerable range (spring-security-core < 5.2.9): before 1 (4.2.3.RELEASE), after 0 (5.7.11). Please confirm with the Snyk/code-scan rescan in CI.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/27982402420f4e7487f724ecc88cab1e
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/27982402420f4e7487f724ecc88cab1e?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[devin-ai-integration]

Ran the app in a browser on Boot 2.7.18 (JDK 17) against a real MySQL 5.7 database.

• Passed: signup in the UI, the wrong-password error, correct login, and navigating while signed in.
• Passed: deposits, withdrawals, and a Primary→Savings transfer. Balances stayed at 150.00 / 115.00 after a refresh and after logging in again.
• Passed: transaction history, saving a recipient, scheduling an appointment (checked in the DB), and the profile page.
• Passed: logout confirmation, and protected pages redirect to sign-in afterwards.
• No 500s, Whitelabel error pages or stack traces. Entity IDs use MySQL auto_increment.

Not covered: remember-me persistence, appointment confirmation in the AdminPortal, running on a Java 8 JVM, and a Snyk rescan (Snyk's API is blocked from this environment).

Written by Devin