[devin-ai-integration]

Summary

Fixes Snyk SNYK-JAVA-ORGSPRINGFRAMEWORK-15701756 / CVE-2026-22735 (spring-webmvc SSE plain-text injection, low) reported on UserFront/pom.xml:30 (code-scan finding sfind-fd3c4494).

spring-webmvc 4.3.9 comes in through spring-boot-starter-parent 1.5.4. The fix only exists in 6.2.17+ / 7.0.6+, so this uses Snyk's own upgrade path, the smallest Boot release that pulls in 6.2.17:

spring-boot-starter-parent 1.5.4.RELEASE -> 3.5.12   (spring-webmvc 4.3.9 -> 6.2.17)
java.version               1.8           -> 17

Warning

Flagged: this is a major bump and it changes the Java version. The remediation guidance says "do not change the Java version", but no Java 8 Spring line has this fix (4.3.x/5.3.x OSS are not patched, and Spring 6 needs Java 17). The only alternative is to leave the finding open. Reviewers should decide whether a Boot 3 migration is acceptable here.

Migration changes needed by Boot 3, the same diff as #274 / #71 with the parent pinned to the minimum 3.5.12:

• javax.persistence / javax.servlet -> jakarta.* (domain entities, RequestFilter)
• SecurityConfig: WebSecurityConfigurerAdapter -> SecurityFilterChain bean + DaoAuthenticationProvider bean, @EnableMethodSecurity. /error/**/* -> /error/** because PathPattern rejects ** in the middle. CSRF stays disabled, as on master.
• mysql:mysql-connector-java -> com.mysql:mysql-connector-j
• application.properties: spring.main.allow-circular-references=true (UserServiceImpl <-> AccountServiceImpl), and the hard-coded MySQL5Dialect is removed (Hibernate 6 detects the dialect itself)
• AppointmentServiceImpl.findOne -> findById(...).orElse(null), JUnit 5 test, Maven wrapper 3.9.9

Duplicates: #274 (3.5.16, same CVE, earlier finding), #71 / #62 (3.5.16) and #100-#116 (Boot 4.1.1) also clear this. Only one of them should land. This PR exists because each new finding gets its own PR.

Verification

• The automation network policy blocks Maven Central and api.snyk.io, and Boot 3.5.12 is not in the local ~/.m2. So mvn test against 3.5.12 and the Snyk before/after count could not be run: snyk test fails with SNYK-CLI-0000. Before = 1 issue for this ID (scan finding). After = expected 0, because 3.5.12 manages spring-webmvc 6.2.17, the version Snyk lists as fixed. This has not been confirmed by a rescan.
• Offline stand-in: a copy of this branch with parent 3.3.4 (cached, Spring 6.1.13 / Security 6.3) on Java 17. The only edit was swapping new DaoAuthenticationProvider(uds) for its setter form, because that constructor arrived in Security 6.4 (in 3.5.12, not in 3.3.4). Every source file compiles with javac. The app starts on H2 (MySQL mode). curl flow: POST /signup 302 -> POST /index (login) 302 to /userFront -> POST /account/deposit 302, and the dashboard shows 250.00. Anonymous /userFront 302s to /index.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/7e227f08e3084ac8a07c70b5a9ebb3ca
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/7e227f08e3084ac8a07c70b5a9ebb3ca?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.

1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)