[devin-ai-integration]

Summary

Fixes code scan finding sfind-9842fe06 (Snyk SNYK-JAVA-MYSQL-2386864, CVE-2022-21363, CWE-285, medium). UserFront was pulling mysql:mysql-connector-java@5.1.42 through the Boot 1.5.4 BOM. This PR overrides the BOM property with the smallest version that fixes it:

 <properties>
+  <mysql.version>8.0.28</mysql.version>
 </properties>
 <dependency>mysql:mysql-connector-java
+  <exclusions>com.google.protobuf:protobuf-java</exclusions>

 spring.datasource.url = jdbc:mysql://localhost:3306/onlinebanking
+spring.datasource.driver-class-name = com.mysql.cj.jdbc.Driver

• Major bump (5.1 -> 8.0), flagged on purpose. 8.0.28 is still published under the old mysql:mysql-connector-java coordinates, so only the version property changes. Java stays at 1.8, the Boot parent is unchanged, and there is no Snyk ignore.
• protobuf-java exclusion: Connector/J 8.0.28 pulls in protobuf-java 3.11.4, which only the X DevAPI uses. The app talks to MySQL over JDBC and Hibernate only. Excluding it avoids bringing in the protobuf CVEs that Snyk flags on 3.11.x.
• driver-class-name: Boot 1.5 infers the legacy class com.mysql.jdbc.Driver from the URL. In 8.x that class is a deprecated shim that logs a warning on every startup. No serverTimezone is needed on 8.0.23 and later.

Duplicate notice: this is the same change as open PR #294 (sfind-e088ed1a). It is opened as a separate PR because a new finding was raised. Only one of them should be merged.

Verification

The session's network is restricted to an allowlist, and Maven Central and api.snyk.io are not on it (access was requested but not granted). The Boot 1.5.4 artifacts and Connector/J 8.0.28 are not cached locally. As a result:

• Not done: the mvn clean compile / mvn test build against Boot 1.5.4 + 8.0.28, and the Snyk re-scan. snyk test fails because the API is unreachable, so there are no before/after issue counts from Snyk. The expected result is that SNYK-JAVA-MYSQL-2386864 drops out, and so do the other 5.1.42 issues (CVE-2021-2471, CVE-2019-2692, CVE-2018-3258…).
• Done instead, with the closest cached setup: a throwaway copy of UserFront with this PR's pom.xml/application.properties. The parent was moved to the cached Boot 2.7.18, giving com.mysql:mysql-connector-j:8.0.33, the same 8.x com.mysql.cj.jdbc.Driver code path. Run against a mysql:5.7.44 container (same dialect as the MySQL5Dialect config):
  • UserFrontApplicationTests.contextLoads: OK (1 test). Hikari pool started, and Hibernate created all 9 tables.
  • java -jar boot plus a curl run-through: signup 302 -> /, login POST /index 302 -> /userFront, deposit 250 to Primary 302 -> /userFront. The DB shows ada | 250.00 and a Deposit to Primary Account | 250 | Finished transaction.
  • The packaged jar contains mysql-connector-j-8.0.33.jar and no protobuf-java.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/63303a4858fa473d8783145caf175e8a
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/63303a4858fa473d8783145caf175e8a?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)