[devin-ai-integration]

Summary

Fixes Snyk SNYK-JAVA-ORGSPRINGFRAMEWORK-19267099 / CVE-2026-47887 (open redirect in spring-webmvc UrlFileNameViewController, CWE-601, medium) from code scan finding sfind-33d98bf9. spring-webmvc 4.3.9.RELEASE comes in through spring-boot-starter-web 1.5.4.RELEASE. The only fixed version is 7.0.9.

Needs a reviewer decision: this changes the Java version. The remediation guidance says "do not change the Java version", but Spring Framework 7 / Boot 4 need Java 17 or later. No Java 8 release of Spring fixes this CVE, and Snyk marks it unpatchable. So this PR is a major bump (Boot 1.5 → 4.0, java.version 1.8 → 17) that has to be approved on purpose. Note that UserFront never maps UrlFileNameViewController, so the vulnerable path can't be reached on master today. Closing this as accepted risk is a reasonable option. Open PRs #100 (Boot 4.1.1 / Java 21), #71 / #62 (Boot 3.5.16) and #274 (Boot 3.5.16) are overlapping migrations; only one should land. This PR is opened separately because of the one-PR-per-finding rule.

UserFront/pom.xml:

parent spring-boot-starter-parent 1.5.4.RELEASE -> 4.0.1   (smallest cached Boot 4; Snyk path = starter-web 4.0.0)
java.version 1.8 -> 17                                    (Boot 4 minimum)
+ <spring-framework.version>7.0.9</spring-framework.version>   (pins the fixed webmvc)
mysql:mysql-connector-java -> com.mysql:mysql-connector-j  (old coordinates aren't managed anymore)

Code changes that the upgrade forces (same approach as #274, adjusted for Security 7):

• javax.persistence / javax.servlet → jakarta.*. @GeneratedValue(AUTO) → IDENTITY, so Hibernate 7 keeps using the existing AUTO_INCREMENT columns that Boot 1.5 created, instead of switching to sequence tables.
• SecurityConfig: WebSecurityConfigurerAdapter was removed, so it's now a SecurityFilterChain bean plus DaoAuthenticationProvider(userSecurityService). AntPathRequestMatcher (removed in Security 7) → PathPatternRequestMatcher.withDefaults().matcher("/logout"). /error/**/* → /error/**, because PathPattern rejects the old form. Public matchers, form login and logout URLs, disabled CSRF/CORS and remember-me are all unchanged.
• RequestFilter now passes exceptions on instead of swallowing them. appointmentDao.findOne(id) → findById(id).orElse(null).
• application.properties: spring.main.allow-circular-references=true (UserServiceImpl ↔ AccountServiceImpl), and the MySQL5Dialect setting is dropped (Hibernate 7 detects the dialect).
• Test moved to JUnit 5.

Verification

• Snyk before/after: not run. The automation's network policy only allows git-manager.devin.ai, so api.snyk.io and Maven Central are unreachable (access was requested and is still pending). Expected result: this finding is cleared, since spring-webmvc resolves to 7.0.9 through spring-framework.version. Please confirm with a Snyk rescan or CI.
• Full mvn compile / mvn test: not run for the same reason: Spring 7.0.9 and Spring Security 7 jars aren't in the local cache.
• Offline stand-in run: Boot 4.0.1 parent with cached Spring 7.0.2, Hibernate 7.2.0, Thymeleaf 3.1, Tomcat 11, plus Security 6.3.3 classes.
  • Every main source except SecurityConfig compiles with javac on JDK 17.
  • The app starts against mysql:5.7: GET /index and GET /signup return 200. POST /signup returns 302 and creates the user, user_role, primary_account and savings_account rows.
  • This run had no security filter chain, so it does not check login or authorization.
• Hibernate 7 warns that MySQL 5.7 is below its supported minimum (8.0). Production should run MySQL 8 or later.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/ce2c917f336843a394444afad89da6e8
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/ce2c917f336843a394444afad89da6e8?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring