[devin-ai-integration]

Summary

Fixes code-scan finding sfind-345dc31d / Snyk SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-16201011 (CVE-2026-40977, CWE-59). ApplicationPidFileWriter in spring-boot@1.5.4.RELEASE follows a symlink at the PID-file path. The fix is only available in Boot 3.5.14 / 4.0.6, so the parent moves 1.5.4.RELEASE -> 3.5.14, the smallest fixed version.

Warning

Major bump that also changes the Java version (java.version 1.8 -> 17). The remediation guidance says not to change Java, but no Java 8 Boot line contains this fix: Boot 3.x needs Java 17 as a minimum. A reviewer needs to accept this trade-off before merging.

Changes needed by the Boot 3 / jakarta migration (UserFront/ only):

• pom.xml: parent 3.5.14, java.version 17, mysql:mysql-connector-java -> com.mysql:mysql-connector-j. Maven wrapper 3.5.0 -> 3.9.9
• javax.persistence/servlet.* -> jakarta.* (domain entities, RequestFilter)
• SecurityConfig: WebSecurityConfigurerAdapter was removed, so it now uses a SecurityFilterChain bean plus a DaoAuthenticationProvider(userSecurityService) bean. Matchers, form login, logout and remember-me behave as before. /error/**/* becomes /error/** because PathPattern rejects ** in the middle of a pattern
• AppointmentServiceImpl: findOne(id) -> findById(id).orElse(null)
• application.properties: spring.main.allow-circular-references=true (UserServiceImpl <-> AccountServiceImpl), and the removed MySQL5Dialect is dropped (Hibernate 6 auto-detects the dialect)
• Test moves to JUnit 5 (@SpringBootTest only)

Duplicate notice: this change is the same as open PR #178, which was filed for an earlier finding with the same CVE. Only one of them should land. Boot 3.5.16 migration PRs #71/#62 also clear this CVE.

Verification

• Snyk before/after counts: not available. snyk test fails in this network-restricted session (SNYK-CLI-0000, api.snyk.io unreachable). Expected result: SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-16201011 goes from 1 to 0, because 3.5.14 is the fixed version. This needs a Snyk rescan in CI.
• Maven Central is blocked and the Boot 3.5.14 artifacts aren't cached here, so the checks ran on a stand-in copy using the cached Boot 3.3.4 parent. That copy also used the DaoAuthenticationProvider setter form, because the constructor only exists in Security 6.4+, which 3.5.14 ships. JDK 17 javac built main and test sources cleanly
• UserFrontApplicationTests.contextLoads passes (1/1) through the JUnit Platform launcher against mysql:5.7
• Booted the app against mysql:5.7 and ran a curl smoke test (results below). Not yet verified on 3.5.14 itself:
  • /index returns 200
  • signup: 302
  • login: 302 -> /userFront, which returns 200
  • deposit of 125 to Primary: 302, and the DB shows balance 125.00 with the transaction Finished
  • bad password: 302 -> /index?error
  • anonymous /userFront: 302 -> /index

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/aef8b79877b64763bd9c4ce450dde2a0
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/aef8b79877b64763bd9c4ce450dde2a0?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.

1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)