[devin-ai-integration]

Summary

Fixes Snyk SNYK-JAVA-ORGSPRINGFRAMEWORK-8230373 / CVE-2024-38819 (spring-webmvc path traversal, CWE-23) reported on UserFront/pom.xml:30 (finding sfind-d5ea2c99). The fix moves the spring-boot-starter-parent from 1.5.4.RELEASE to 3.2.11, the smallest upgrade path Snyk lists (Boot 3.2.11 brings in spring-webmvc 6.1.14).

Warning

Two things go against the remediation guidance. Please review before merging.

• This is a major bump (Boot 1.5 → 3.2, Spring 4.3 → 6.1, javax.* → jakarta.*, Security 4.2 → 6.2, Hibernate 5.0 → 6.4).
• The Java version has to change: java.version 1.8 → 17. Spring Framework 6 / Boot 3 need Java 17, and OSS Spring on the Java 8 line ends at 5.3.x, where this CVE isn't fixed. So "do not change the Java version" can't be satisfied together with this fix.
• On 4.3.9 the CVE isn't reachable in practice: the vulnerable WebMvc.fn (org.springframework.web.servlet.function) didn't exist before Spring 5.2. If keeping Java 8 matters more, close this PR and accept/track the finding instead.
• This overlaps the open Boot 3.x migration PRs (e.g. feature: upgrade UserFront to Spring Boot 3.5.16 on Java 17 #71, Track A: upgrade UserFront backend from Spring Boot 1.5 / Java 8 to Spring Boot 3.5 / Java 21 #62, Phase 5 + 6: Spring Boot 1.5 → 3.3 / Java 17 / Jakarta + Spring Security 6 rewrite #51, feature: clear spring-webmvc CVE-2026-22735 via Spring Boot 3.5.16 / Java 17 (major bump, needs sign-off) #274). Only one of them should land.

Code changes the migration requires (based on the existing Boot 3 migration branch devin/1790739508-spring-webmvc-cve-2026-22735, re-pinned to 3.2.11):

• pom.xml: parent 3.2.11, java.version 17, mysql:mysql-connector-java → com.mysql:mysql-connector-j.
• javax.persistence/javax.servlet → jakarta.* in domain/** and RequestFilter.
• SecurityConfig: WebSecurityConfigurerAdapter removed (it no longer exists) → a SecurityFilterChain bean plus a DaoAuthenticationProvider bean. Matchers, form login, logout and remember-me stay the same, and CSRF/CORS stay disabled as before. "/error/**/*" → "/error/**", because PathPattern rejects ** in the middle of a pattern.
• AppointmentServiceImpl: findOne(id) → findById(id).orElse(null) (Spring Data 2+).
• application.properties: spring.main.allow-circular-references=true (UserServiceImpl ↔ AccountServiceImpl), and the hard-coded MySQL5Dialect is dropped because Hibernate 6 auto-detects the dialect.
• Test moved to JUnit 5. Maven wrapper → 3.9.9 (Boot 3 needs Maven 3.6.3 or newer).

Verification

Not fully verified. Maven Central and the Snyk API can't be reached from the build environment (network allowlist), so neither the exact 3.2.11 build nor a Snyk re-scan could run:

• Snyk before/after issue count: not measured. snyk test --file=UserFront/pom.xml fails with SNYK-CLI-0000 (no network). Expected result: this finding clears, because Boot 3.2.11 manages spring-webmvc 6.1.14 ([,6.1.14) is vulnerable).
• What I could run, on a copy of this branch with the parent swapped to the locally cached Boot 3.3.4 (Spring 6.1.13, Security 6.3.3, Hibernate 6.5.3, Tomcat 10.1.30), JDK 17, against mysql:5.7:
  • mvn -o compile passed.
  • UserFrontApplicationTests.contextLoads ran through the JUnit Platform launcher (surefire's junit-platform provider isn't cached): 1 test, 1 successful, 0 failed.
  • App boot plus a curl smoke test: Started UserFrontApplication. POST /signup → 302, POST /index → 302 /userFront, GET /userFront → 200, POST /account/deposit (Primary, 250) → 302 and the DB shows balance 250.00 plus the Deposit to Primary Account row. A wrong password → /index?error. Anonymous /account/primaryAccount → 302 /index. Encoded traversal requests (/css/..%2f..%2f..%2fetc/passwd, /webjars/%2e%2e/...) → 400.
• SecurityConfig uses new DaoAuthenticationProvider() + setUserDetailsService(...) because the DaoAuthenticationProvider(UserDetailsService) constructor only exists from Security 6.3 on, and 3.2.11 ships Security 6.2.
• Before merging: run cd UserFront && ./mvnw verify and snyk test with network access to confirm the exact 3.2.11 dependency set and the issue count.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/5a088181a4fa43be81175e8f8ff32a4e
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/5a088181a4fa43be81175e8f8ff32a4e?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.

1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)