[devin-ai-integration]

Summary

Fixes code-scan finding sfind-9591c9e1 / SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-5950401 (CVE-2022-22976, BCrypt cost 31 integer overflow skips all rounds). spring-security-core 4.2.3 came in through spring-boot-starter-security from the Boot 1.5.4 parent. The vulnerable range is [3.1.0, 5.4.11), and Boot 1.x has no 5.x line, so the parent has to move to Boot 2.x.

Major bump (flagged): parent 1.5.4.RELEASE -> 2.7.18, which brings Spring Security 5.7.11 (above the 5.4.11/5.5.7/5.6.4 fixes). <java.version> stays 1.8. I picked 2.7.18 over the smallest Snyk path (2.5.0) because it's the last OSS 2.x release and the only 2.x parent available in the offline build cache, so it's the one I could build and run. It also clears the other 4.2.x/Boot 1.5 CVEs.

Code changes needed for Boot 2.7:

• mysql:mysql-connector-java -> com.mysql:mysql-connector-j (the 2.7 BOM no longer manages the old coordinates)
• SecurityConfig: @Autowired configureGlobal(...) -> @Override configure(AuthenticationManagerBuilder)
• AppointmentServiceImpl: findOne(id) -> findById(id).orElse(null) (Spring Data 2.x)
• application.properties: spring.main.allow-circular-references=true (UserServiceImpl and AccountServiceImpl depend on each other, and Boot 2.6+ rejects that by default)
• application.properties: spring.jpa.hibernate.use-new-id-generator-mappings=false. Boot 1.5 mapped GenerationType.AUTO to MySQL AUTO_INCREMENT; Boot 2.x defaults to a new hibernate_sequence table that starts at 1, so existing databases would get duplicate-key errors on the next insert. This keeps the old IDENTITY mapping.
• UserFrontApplicationTests: JUnit 4 @RunWith(SpringRunner) -> JUnit 5

The app itself never uses BCrypt cost 31 (new BCryptPasswordEncoder(12, ...)), so this is a dependency-hygiene fix, not a live exploit.

This duplicates the same Boot 2.7.18 recipe in open PRs #184 / #227 / #281, which were opened for other spring-security CVEs. It's a separate PR because each new finding gets its own PR. Only one of them should land.

Verification (JDK 17, mvn -o)

• mvn -o -DskipTests package builds.
• dependency:tree -Dincludes=org.springframework.security: before spring-security-core:4.2.3.RELEASE (from the finding / Boot 1.5.4 BOM), after spring-security-{config,core,crypto,web}:5.7.11.
• UserFrontApplicationTests.contextLoads passes against MySQL 5.7 (1/1 successful). I ran it through the JUnit Platform launcher 1.9.3 because the surefire junit-platform provider isn't in the offline cache.
• I ran the jar against MySQL 5.7 and drove the flows with curl: signup 302, bad password -> /index?error, login -> /userFront 200, deposit of 125 persisted (primary_account.account_balance=125.00), anonymous /userFront -> /index, and stored hashes are $2a$12$.
• ID generation with the mapping fix, on a fresh DB with a pre-seeded primary_account row id 500: no hibernate_sequence table is created, and signup + deposit assign primary_account id 501 (auto_increment continues after the existing rows).
• BCrypt PoC on 5.7.11: cost 4 = 19 ms, cost 14 = 1175 ms, cost 31 still hashing after 10 s. That means rounds are really being run; the vulnerable versions return immediately.

Snyk before/after

Not measured. snyk test fails with SNYK-CLI-0000 because api.snyk.io is blocked by this session's network policy. Going by the dependency tree, the finding count for this issue should drop from 1 to 0, since 5.7.11 is outside [3.1.0, 5.4.11). Please re-run the Snyk scan in CI to confirm.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/006860877b8f4d88b1d57b6d7584d9c3
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/006860877b8f4d88b1d57b6d7584d9c3?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.