[devin-ai-integration]

Summary

Fixes Snyk SNYK-JAVA-ORGAPACHETOMCATEMBED-15989808 / CVE-2026-29145 (CWE-287, high, CVSS 8.8): with OCSP soft-fail disabled, CLIENT_CERT OCSP checks in tomcat-embed-core can still soft-fail. UserFront pulls in tomcat-embed-core@8.5.15 through spring-boot-starter-web@1.5.4.RELEASE. Code-scan finding: sfind-91366bcec56c4945bcff9e4c5266e26c.

 <java.version>1.8</java.version>
+<tomcat.version>9.0.116</tomcat.version>

• Boot 1.5's spring-boot-dependencies sets every tomcat-embed-*, tomcat-jdbc and tomcat-annotations-api version from ${tomcat.version}. So this one property moves all of them to 9.0.116, the smallest fixed version. There's no 8.5.x fix, so the next options were 10.1.53 or 11.0.20, which need a jakarta/Boot 3 migration.
• New config/TomcatConfig sets setRegisterDefaultServlet(false). Boot 1.5 registers Tomcat's default servlet through Context.addServletMapping(String,String), and Tomcat 9 removed that method. Without this change the app dies at startup with NoSuchMethodError. Spring MVC already serves static resources, so the app doesn't need the default servlet.
• Java stays at 1.8 and the Boot parent stays at 1.5.4.

Flag: this is a major bump of the Tomcat line (8.5 → 9.0). Boot 1.5 doesn't officially support Tomcat 9. The default-servlet workaround above is the only incompatibility I found.

Duplicates / overlap (only one should land): #208 uses the same recipe with 9.0.118, which also clears this CVE. #229 and #230 (Boot 2.7.18 + Tomcat 9.0.117/9.0.118) and #33 (also moves to Java 17) clear it as well. #177 (9.0.106) and the 8.5.x pins (#87/#131/#132/#141/#238) do not clear it. I opened this PR anyway because each new finding gets its own PR.

Reachability: UserFront doesn't configure SSL or CLIENT_CERT auth (there are no server.ssl.* properties), so the vulnerable OCSP path isn't reachable in the current config. The bump is still the remediation the finding asks for.

Verification

I couldn't reach Maven Central or api.snyk.io from this session (network allowlist; access has been requested). That limits what I could check:

• Snyk before/after issue count: not measured. snyk test --file=UserFront/pom.xml fails with SNYK-CLI-0000 because it can't reach the Snyk API. Please re-run the Snyk scan on this branch to confirm the count drops.
• Full mvn compile / mvn test on this exact pom: not run. The 1.5.4 parent, tomcat 9.0.116 and the Security/Thymeleaf 1.5 starters aren't in the local Maven cache. The existing UserFrontApplicationTests also needs MySQL plus the full dependency set.
• Property drives the version: confirmed in the cached spring-boot-dependencies-1.5.8.RELEASE.pom, where every tomcat-embed-* artifact is ${tomcat.version}. The 1.5.x line uses the same BOM structure.
• Runtime compatibility (offline stand-in): a minimal Boot 1.5.8 spring-boot-starter-web app on the cached tomcat-embed-core 9.0.83 (JDK 11, --release 8):
  • without TomcatConfig: Unable to start embedded container; nested exception is java.lang.NoSuchMethodError: 'void org.apache.catalina.Context.addServletMapping(java.lang.String, java.lang.String)'
  • with this PR's TomcatConfig: Started MiniApp in 1.054 seconds, and GET /index returns 200 (ok 9.0.83.0)

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/aa10e6a2786347f89de2d7800892a694
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/aa10e6a2786347f89de2d7800892a694?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)