[devin-ai-integration]

Summary

Fixes Snyk finding SNYK-JAVA-ORGAPACHETOMCATEMBED-6435948 / CVE-2024-24549 (HTTP/2 header-limit DoS, high, CVSS 7.5) in org.apache.tomcat.embed:tomcat-embed-core@8.5.15. UserFront gets it transitively from spring-boot-starter-web (Boot 1.5.4.RELEASE parent).

 <properties>
   <java.version>1.8</java.version>
+  <tomcat.version>8.5.99</tomcat.version>
 </properties>

• Boot 1.5's dependency management drives every org.apache.tomcat* artifact off tomcat.version (tomcat-embed-core/-el/-websocket, tomcat-jdbc, tomcat-annotations-api), so they all move 8.5.15 -> 8.5.99.
• 8.5.99 is the smallest fixed version and stays on the same 8.5 minor line: no Spring Boot parent change, no major bump, Java stays 1.8. Snyk suggested Boot 3.1.9 / Tomcat 10.1.19 instead; that's a major upgrade that needs Java 17, so I didn't take it.
• Heads-up: Tomcat 8.5 is EOL, and 8.5.99 still carries later Tomcat CVEs that are only fixed on 9.x/10.x. The Boot 2.7.18 + Tomcat 9 PRs (bug: upgrade embedded Tomcat to 9.0.117 (CVE-2026-34500) — Spring Boot 1.5.4 -> 2.7.18 #229, bug(security): upgrade embedded Tomcat to 9.0.118 (CVE-2026-43515) via Spring Boot 2.7.18, Java 8 kept #230) cover those. Duplicate: branch devin/1790739493-tomcat-cve-2024-24549 (pins 8.5.100) fixes the same finding. Only one of them should land.

Verification

The automation network policy blocks Maven Central and api.snyk.io. Boot 1.5.4 and Tomcat 8.5.99 aren't in the VM's Maven cache, so this exact pom could not be built, the existing tests could not run, and Snyk could not be re-run. I asked for network access; it was still pending when this PR was opened.

• Snyk before/after issue count: not measured. Going by Snyk's own advisory data (vulnerable [8.5.0,8.5.99), fixed in 8.5.99), this PR clears this finding (1 -> 0 for SNYK-JAVA-ORGAPACHETOMCATEMBED-6435948). Someone with network access still needs to run snyk test --file=UserFront/pom.xml to confirm the total count.
• Stand-in check: a minimal Boot 1.5.8 (Spring 4.3.12) spring-boot-starter-web app on JDK 11. With its default Tomcat 8.5.23 jars it serves requests (Starting Servlet Engine: Apache Tomcat/8.5.23). With the newer 8.5.31 jars swapped onto the classpath it also serves requests (Apache Tomcat/8.5.31). That shows Boot 1.5.x runs on a newer Tomcat 8.5 patch release, but 8.5.99 itself was not booted.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/d3eb0ed581874ce89567c74976c5a035
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/d3eb0ed581874ce89567c74976c5a035?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---