[devin-ai-integration]

Summary

This fixes Snyk SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 / CVE-2026-47838 (high, CWE-290: SubjectDnX509PrincipalExtractor user impersonation) in org.springframework.security:spring-security-web@4.2.3.RELEASE, which comes in through spring-boot-starter-security on the Boot 1.5.4 parent (code scan finding sfind-4c9ef168).

The fix exists only in Security 6.5.11+. Snyk's upgrade path is spring-boot-starter-security@3.5.15, so the parent goes 1.5.4.RELEASE -> 3.5.15, the smallest Boot version that clears the issue.

Flag: this is a major bump, and it changes the Java version (1.8 -> 17). The scan guidance says "do not change the Java version", but Spring Boot 3 / Security 6 need Java 17, and no Java 8-compatible release has the fix. Please confirm this trade-off before merging.

Changes (the same Boot 3/jakarta migration as #178, re-pinned to 3.5.15):

• pom.xml: parent 3.5.15, java.version 17, mysql:mysql-connector-java -> com.mysql:mysql-connector-j
• javax.persistence / javax.servlet -> jakarta.* (domain entities, RequestFilter)
• SecurityConfig: the WebSecurityConfigurerAdapter subclass is replaced by a SecurityFilterChain bean using authorizeHttpRequests / requestMatchers, plus new DaoAuthenticationProvider(userSecurityService) with BCrypt. The public matchers, the form-login pages and the remember-me setup stay the same.
• AppointmentServiceImpl: findOne(id) -> findById(id).orElse(null) (Spring Data 3)
• application.properties: spring.main.allow-circular-references=true (UserServiceImpl and AccountServiceImpl depend on each other) and the hard-coded MySQL5Dialect is removed (Hibernate 6 detects the dialect)
• The test moves to JUnit 5 @SpringBootTest, and the Maven wrapper goes to 3.9.9

UserFront does not configure X.509 / SubjectDnX509PrincipalExtractor, so the vulnerable code path is not reachable today. This PR clears the dependency finding.

Duplicates: open PRs #71 / #62 / #274 (Boot 3.5.16) and #178 (3.5.14) make the same migration, and the 3.5.16 ones also clear this CVE. This PR exists because each new finding gets its own PR. Only one of them should land.

Verification

• Maven Central and api.snyk.io are blocked in this session, so mvn against the real 3.5.15 parent and snyk test could not run, and I have no before/after Snyk issue counts. Expected result: this finding goes from 1 to 0. It still needs a Snyk rescan in CI or by a reviewer.
• Stand-in check: a copy of UserFront built against the closest cached parent (Boot 3.3.4 / Security 6.3.3, Java 17):
  • javac of main and test sources: the only error was new DaoAuthenticationProvider(UserDetailsService). That constructor was added in Security 6.4, so 3.5.15 has it. In the stand-in only, I swapped it for setUserDetailsService to finish the check.
  • UserFrontApplicationTests.contextLoads against mysql:5.7: 1 test found, 1 successful, 0 failed
  • The app booted against mysql:5.7 and these curl calls behaved as expected: GET /index 200, POST /signup 302, bad login -> /index?error, good login -> /userFront (200), and anonymous /userFront -> 302 to /index.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/27310626eeb94f8fa08d11446af64d8f
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/27310626eeb94f8fa08d11446af64d8f?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.