[devin-ai-integration]

Summary

Fixes code-scan finding sfind-5ab9fefa (SNYK-JAVA-ORGAPACHETOMCATEMBED-13733966 / CVE-2025-55752, CWE-23, high). UserFront pulls in tomcat-embed-core@8.5.15 through spring-boot-starter-web@1.5.4.RELEASE.

<!-- UserFront/pom.xml -->
<java.version>1.8</java.version>          <!-- unchanged -->
+<tomcat.version>9.0.109</tomcat.version>  <!-- core, el and websocket all follow this BOM property -->

This is a major bump (Tomcat 8.5 to 9.0), flagged on purpose. 8.5.x is EOL and has no fixed release. 9.0.109 is the smallest fixed version, and it still runs on Java 8. Spring Boot stays on 1.5.4 and Java stays on 1.8. Snyk's suggested path (Boot 3.4.10 / Tomcat 10.1.46) would need Java 17, which the remediation guidance forbids.

config/TomcatConfig is required. Boot 1.5's TomcatEmbeddedServletContainerFactory registers Tomcat's default servlet with Context.addServletMapping(String,String), and Tomcat 9 removed that method. Without this class, startup fails with NoSuchMethodError. TomcatConfig calls setRegisterDefaultServlet(false). Static assets under classpath:/static are still served by Spring MVC's resource handler. The class is the same one used in PR #177.

Caveat: Spring Boot 1.5 was never supported on Tomcat 9. server.compression.enabled=true would also break, but UserFront doesn't set it. The supported long-term fix is a Boot 2.x upgrade.

Overlap with other PRs (only one should land): #177 pins 9.0.106, which is below the fix for this CVE. #229 (9.0.117), #208 (9.0.118) and #230 (Boot 2.7.18 + 9.0.118) also clear this CVE. #87/#131/#132/#141 pin 8.5.x and will conflict on tomcat.version.

Verification

• Maven build/tests: not run. The session's network policy only allows the git proxy. Maven Central is unreachable and the Boot 1.5.4 parent isn't cached, so mvn -o compile fails with UnresolvableModelException. UserFrontApplicationTests also needs MySQL.
• Snyk re-scan: not run, so there are no before/after issue counts. snyk test --file=pom.xml fails with SNYK-CLI-0000 because the API isn't reachable. From the dependency tree, the only tomcat-embed-core moves from 8.5.15 (affected) to 9.0.109 (the first fixed 9.0.x release). Please re-run Snyk to confirm the issue clears.
• Offline smoke test: a standalone Boot app on cached jars (spring-boot 1.5.8, Spring 4.3.12, compiled --release 8, run on JDK 11). It imports this PR's TomcatConfig and serves UserFront's src/main/resources. 9.0.83 is the newest cached 9.0.x jar, so the exact 9.0.109 jar was not exercised.

Tomcat	TomcatConfig	Result
8.5.31	no	starts; /ping 200, /css/bootstrap.css 200 text/css, /WEB-INF/x 404
9.0.83	no	fails: NoSuchMethodError: Context.addServletMapping
9.0.83	yes	starts; /ping 200, /css/bootstrap.css 200 text/css, unknown path 404, /WEB-INF/x 404

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/e0bdd846d7614600bee291447603fd50
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/e0bdd846d7614600bee291447603fd50?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)