[devin-ai-integration]

Summary

Fixes Snyk SNYK-JAVA-ORGSPRINGFRAMEWORK-5422217 / CVE-2023-20863 (finding sfind-aa6c16b9): SpEL DoS via very long expressions in org.springframework:spring-expression@4.3.9.RELEASE, which comes in through spring-boot-starter-web on Boot 1.5.4.

Major bump (flagged): the CVE is fixed only in Spring 5.2.24 / 5.3.27 / 6.0.8. Boot 1.5.x is tied to Spring 4.3, so the parent has to move. This PR follows Snyk's upgrade path and uses the smallest Boot release that ships a fixed Spring: Boot 1.5.4.RELEASE -> 2.5.15 (Spring 5.3.27). java.version stays 1.8.

Changes Boot 2 requires:

• AppointmentServiceImpl.findAppointment: findOne(id) -> findById(id).orElse(null) (Spring Data 2.x API).
• application.properties: spring.jpa.hibernate.use-new-id-generator-mappings = false, so GenerationType.AUTO ids keep using MySQL AUTO_INCREMENT. Without it Hibernate 5.2+ switches to a hibernate_sequence table, which breaks the existing schema.
• UserFrontApplicationTests: moved to JUnit 5 (org.junit.jupiter.api.Test, @RunWith(SpringRunner) removed). Boot 2.4+ spring-boot-starter-test no longer includes the vintage engine.

mysql:mysql-connector-java is still managed by Boot 2.5.x, so the dependency is unchanged.

Verification

This session's network only allows git, so Maven Central and api.snyk.io are unreachable. Boot 2.5.15 artifacts aren't in the local ~/.m2. To work around that, I verified a copy of this branch built on the closest cached Boot 2.x parent (2.7.18, Spring 5.3.31). That copy also needed spring.main.allow-circular-references=true and com.mysql:mysql-connector-j, both 2.6+/2.7.8+ requirements that 2.5.15 doesn't have.

• mvn -o package (JDK 17, -source 1.8): BUILD SUCCESS. dependency:tree shows spring-expression:5.3.31.
• UserFrontApplicationTests.contextLoads against MySQL 5.7: 1 tests found, 1 successful, 0 failed.
• Booted the jar against MySQL 5.7 and ran a curl smoke test: GET /index 200, POST /signup 302, login POST /index 302 -> /userFront, POST /account/deposit (250) 302, GET /account/primaryAccount 200. DB shows balance 250.00 and a Deposit to Primary Account transaction.
• CVE probe (parse a 20,001-char SpEL expression): spring-expression 4.3.12 -> parsed 20001-char expression (no limit). spring-expression 5.3.31 -> EL1079E: SpEL expression is too long, exceeding the threshold of '10,000' characters.
• Snyk re-scan not run: snyk test --file=UserFront/pom.xml fails with SNYK-CLI-0000 because the API is unreachable, so I have no before/after issue counts. Expected: this issue (and the other spring-expression/spring-* issues fixed in 5.3.27) drops off. Please re-run Snyk in CI or locally before merging.

Overlap

• bug: upgrade Spring Boot parent to 2.7.10 to fix spring-expression SpEL DoS (CVE-2023-20861) #173 (CVE-2023-20861) moves to Boot 2.7.10. That ships Spring 5.3.26, which does not clear CVE-2023-20863.
• The Boot 2.7.18 PRs (e.g. fix(security): upgrade UserFront to Spring Boot 2.7.18 to clear critical CVEs #33, feature: harden UserFront security and upgrade to Spring Boot 2.7.18 #77; Spring 5.3.31) also clear this CVE, but fix(security): upgrade UserFront to Spring Boot 2.7.18 to clear critical CVEs #33 also changes the Java version.
• Only one Boot-upgrade PR should land.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/b0217d761d0643ec81afea117118f8a9
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/b0217d761d0643ec81afea117118f8a9?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)