[devin-ai-integration]

Summary

Fixes code-scan finding sfind-94ba7933 (Snyk SNYK-JAVA-MYSQL-1766958, CVE-2021-2471, CWE-611). This is an XXE in MysqlSQLXML.getSource() in mysql:mysql-connector-java@5.1.42. UserFront gets the connector version from the Boot 1.5.4 parent's mysql.version property, so the fix is one property override in UserFront/pom.xml:

<java.version>1.8</java.version>
<mysql.version>8.0.27</mysql.version>   <!-- new; was 5.1.42 via spring-boot-dependencies 1.5.4 -->

• 8.0.27 is the smallest version that fixes the issue. It still uses the mysql:mysql-connector-java coordinates (the move to com.mysql:mysql-connector-j happened in 8.0.31), so the dependency block doesn't change. The Spring Boot and Java versions also stay the same, because Connector/J 8.0 supports Java 8.
• Major bump (5.1 -> 8.0), please review. Boot 1.5's DatabaseDriver.MYSQL still auto-selects com.mysql.jdbc.Driver. Connector/J 8.0 keeps that class as a deprecated alias of com.mysql.cj.jdbc.Driver, so it works but logs a deprecation warning at startup. application.properties (URL, MySQL5Dialect, validationQuery) needs no change, and serverTimezone has not been required since 8.0.23.
• 8.0.27 is still affected by CVE-2022-21363 (fixed in 8.0.28) and CVE-2023-22102 (fixed in 8.2.0). Those are separate upgrade units.

Duplicate: this is the same diff as open PR #209 (sfind-0f178d13, same CVE). It was opened because of the one-PR-per-finding rule. Only one of #209 / this PR should land.

Verification

• Not run: mvn test on the real pom, and the Snyk re-scan. Before/after Snyk issue counts are not available. This session can only reach git-manager.devin.ai. The Boot 1.5.4 parent POM and the 8.0.27 jar are not in ~/.m2, so mvn -o fails with UnresolvableModelException. snyk test fails with SNYK-CLI-0000 because api.snyk.io is blocked. Network access for Maven Central and api.snyk.io has been requested. Expected Snyk result: SNYK-JAVA-MYSQL-1766958 is no longer reported. Please run cd UserFront && mvn test && snyk test before merging (contextLoads needs MySQL with an onlinebanking DB).
• Stand-in check: a harness built UserFront's real com.userFront.domain entities with Hibernate 5.0.12 (the Boot 1.5.4 version) and ran them on Connector/J 8.0.33 (the closest cached 8.0.x jar, not 8.0.27). It used the same driver class, URL shape, dialect, and hbm2ddl=update as the app, against Docker mysql:5.7 (5.7.44). Steps:
  1. Schema creation, persisting a User + PrimaryAccount, and an HQL read-back all worked.
  2. An XXE payload stored in a column was read through ResultSet.getSQLXML().getSource(DOMSource.class). The parser rejected the DOCTYPE, so the entity was not expanded. This is the hardened behaviour introduced in 8.0.27.

  Driver: com.mysql.cj.jdbc.Driver 8.0
  JPA round-trip OK: user=xxeprobe1791812186220 primaryAccount=11223101 balance=0.00
  SQLXML.getSource(DOMSource) rejected DOCTYPE: DOCTYPE is disallowed when the feature "http://apache.org/xml/features/disallow-doctype-decl" set to true. (XXE blocked)
  

  The vulnerable 5.1.42 jar isn't cached, so there is no "before" run of the XXE probe.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/3a4c349483c245dfb3fca29ee8d11f77
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/3a4c349483c245dfb3fca29ee8d11f77?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring