[devin-ai-integration]

Summary

Fixes Snyk SNYK-JAVA-ORGSPRINGFRAMEWORK-2329097 / CVE-2021-22096 (spring-core log injection, medium) in UserFront/pom.xml, finding sfind-21bf41a4. spring-core 4.3.9 comes in through Boot 1.5.4. Nothing on the 4.3.x line fixes this CVE (affected: [,5.2.18) and [5.3.0,5.3.12)), so the fix is Snyk's upgrade path:

- spring-boot-starter-parent 1.5.4.RELEASE   (spring-core 4.3.9)
+ spring-boot-starter-parent 2.4.12          (spring-core 5.3.12)

This is a major bump (Boot 1.x -> 2.x). I picked 2.4.12 because it's the smallest Boot release whose managed Spring Framework clears the CVE. java.version stays 1.8.

Follow-up changes the Boot 2.4 line requires:

• AppointmentServiceImpl.findAppointment: appointmentDao.findOne(id) -> findById(id).orElse(null). Spring Data 2.x removed findOne(ID).
• spring.jpa.hibernate.use-new-id-generator-mappings = false. Boot 2 changes the default to true, which would send GenerationType.AUTO through a hibernate_sequence table. With the old default, existing AUTO_INCREMENT schemas keep working and there are no PK collisions.
• UserFrontApplicationTests moved to JUnit 5 (org.junit.jupiter.api.Test, no SpringRunner). Boot 2.4's spring-boot-starter-test no longer ships the vintage engine.
• mysql:mysql-connector-java coordinates are unchanged because Boot 2.4 still manages them.

Verification

• Boot 2.4.12 is not in the local Maven cache, and this session can't reach Maven Central or api.snyk.io (network policy; access was requested but not granted). So mvn test on the exact 2.4.12 parent did not run, and neither did the Snyk re-scan, so there are no before/after issue counts. The expected result is 1 -> 0 for SNYK-JAVA-ORGSPRINGFRAMEWORK-2329097, since Snyk's own upgrade path is spring-boot-starter-test@2.4.12 > spring-core@5.3.12. Reviewers/CI should confirm with snyk test --file=UserFront/pom.xml.
• Stand-in run on the nearest cached Boot 2.x (2.7.18 parent, spring-core 5.3.31, with com.mysql:mysql-connector-j and spring.main.allow-circular-references=true, which only Boot 2.6+ needs) against MySQL 5.7, JDK 17, PR sources unchanged:
  • mvn -o test-compile OK. UserFrontApplicationTests.contextLoads passed: 1 found, 1 successful, 0 failed.
  • Schema came up with AUTO_INCREMENT ids and no hibernate_sequence table.
  • Smoke-tested the app with curl: signup 302, login (POST /index) 302 -> /userFront 200, then POST /account/deposit 250 -> primary balance 250.00 plus a "Deposit to Primary Account" transaction row.

Duplicates

Older PR #200 (branch devin/1790739531-spring-core-cve-2021-22096, Boot 2.7.18) fixes the same CVE. #173 (Boot 2.7.10) also clears it. Only one of them should land. This PR was opened for the new finding per the one-ticket-one-PR rule.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/fed8f01c02e643a7aa820db97443a8dd
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/fed8f01c02e643a7aa820db97443a8dd?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)