[devin-ai-integration]

Summary

Fixes code-scan finding sfind-40d42824 / SNYK-JAVA-ORGSPRINGFRAMEWORK-8230366 (CVE-2024-38820, low): org.springframework:spring-web@4.3.9.RELEASE, pulled in by spring-boot-starter-web@1.5.4.RELEASE in UserFront/pom.xml.

Warning

This is a major upgrade, and it changes the Java version (1.8 → 17). The remediation guidance says not to change Java, but no Java 8 fix exists in open source. The only OSS fix is Spring Framework 6.1.14 (5.3.41 is commercial-only), and 6.x needs Java 17. This PR uses the smallest bump that clears the issue: Snyk's own upgrade path, Boot 3.2.11 → spring-web 6.1.14. Reviewers need to approve the Java change, or reject the PR and accept the risk.

Changes: the same Boot 3 / Jakarta migration as open PR #71 (Boot 3.5.16), but pinned to the minimal 3.2.11:

• pom.xml: parent 1.5.4.RELEASE → 3.2.11, java.version 1.8 → 17, mysql:mysql-connector-java → com.mysql:mysql-connector-j
• javax.persistence/javax.servlet → jakarta.* (domain entities, RequestFilter)
• SecurityConfig: WebSecurityConfigurerAdapter removed → SecurityFilterChain bean + DaoAuthenticationProvider bean. This uses the setter form setUserDetailsService(...) because the constructor form only exists in Security 6.4+, and Boot 3.2 ships 6.2. @EnableGlobalMethodSecurity → @EnableMethodSecurity, and /error/**/* → /error/** (PathPattern).
• AppointmentServiceImpl: findOne(id) → findById(id).orElse(null)
• application.properties: spring.main.allow-circular-references=true (UserServiceImpl and AccountServiceImpl reference each other) and the MySQL5Dialect line dropped (Hibernate 6 auto-detects the dialect)
• Test migrated to JUnit 5. The Maven wrapper is bumped to 3.9.9.

Duplicates: open PRs #51 (Boot 3.3.5), #71 / #62 / #274 (3.5.16) and #178 (3.5.14) also clear this CVE. Only one Boot 3 migration should land.

Verification

Maven Central and api.snyk.io are blocked in this sandbox, and the Boot 3.2.11 artifacts aren't cached, so I verified against the closest cached Boot 3 line (parent 3.3.4, Spring 6.1.13 / Security 6.3) on JDK 17:

• mvn -o compile: OK
• UserFrontApplicationTests (context load) against MySQL 5.7, run through the JUnit Platform launcher (the surefire provider isn't cached): 1 test found, 1 successful
• Booted the app against MySQL 5.7 and checked with curl: signup → 302 /; login POST /index → 302 /userFront; wrong password → /index?error; anonymous /userFront → 302 /index; deposit 250 then withdraw 50 → primary_account.account_balance = 200.00, plus 2 primary_transaction rows

Snyk before/after: not measured. snyk test --file=UserFront/pom.xml fails with SNYK-CLI-0000 because the network is blocked. Expected result: SNYK-JAVA-ORGSPRINGFRAMEWORK-8230366 goes 1 → 0 (Snyk's own path: Boot 3.2.11 → spring-web 6.1.14). Please re-run the Snyk check on this PR to confirm.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/235dc74945a240e98e0c5ba50303bca1
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/235dc74945a240e98e0c5ba50303bca1?variant=devin

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.

2 flags not posted on this PR by your GitHub settings — view them in Devin Review. (Configure)