[devin-ai-integration]

Summary

Fixes Snyk SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828 / CVE-2022-22950 (spring-expression SpEL array-allocation DoS, medium) reported on UserFront/pom.xml:30 (finding sfind-b3724ad0).

spring-expression comes in through spring-boot-starter-web -> spring-webmvc, and its version is set by the Boot parent. Spring 4.3.x has no fix, so this follows Snyk's upgrade path: Boot parent 1.5.4.RELEASE -> 2.5.11, which brings Spring Framework 5.3.17 (spring-expression 5.3.17 clears the CVE).

Major version bump (flagged): Boot 1.5 -> 2.5 / Spring 4.3 -> 5.3. java.version stays 1.8. 2.5.11 is the smallest Boot line that clears the CVE (Boot 2.6.0–2.6.4 still ship Spring < 5.3.17). Code changes Boot 2 needs:

• AppointmentServiceImpl.findAppointment: appointmentDao.findOne(id) -> appointmentDao.findById(id).orElse(null) (Spring Data 2 CrudRepository).
• application.properties: spring.jpa.hibernate.use-new-id-generator-mappings = false. Without it, Boot 2 switches GenerationType.AUTO to a hibernate_sequence table, so existing MySQL AUTO_INCREMENT ids would collide.
• UserFrontApplicationTests: JUnit 4 @RunWith(SpringRunner) -> JUnit 5 org.junit.jupiter.api.Test (Boot 2.4+ spring-boot-starter-test doesn't include the vintage engine).
• mysql:mysql-connector-java is still managed by Boot 2.5 (8.0.28), so the coordinates stay the same. Boot 2.5 still allows circular references, so the UserServiceImpl <-> AccountServiceImpl cycle needs no new property.

Duplicate notice: open PR #186 (devin/1790739500-spring-expression-cve-2022-22950) fixes the same CVE with Boot 2.7.18 + mysql-connector-j. #173 (Boot 2.7.10) also clears it. Only one should land. This PR is the smaller Snyk-path bump, opened per the one-PR-per-finding rule.

Verification

• Not run on the exact 2.5.11 parent. This session's network allows only the git proxy. Maven Central and api.snyk.io are blocked, so neither mvn on the real pom nor snyk test could run (snyk test fails with SNYK-CLI-0000). Before/after Snyk issue counts were therefore not measured. Expected effect: this issue (SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828) goes away. A rescan once the network allows it should confirm.
• Stand-in build (fully cached): a copy of this branch with parent 2.7.18 (Spring 5.3.31), com.mysql:mysql-connector-j and allow-circular-references (both needed only on 2.6+). Results:
  • mvn -o package: BUILD SUCCESS. dependency:tree shows spring-webmvc 5.3.31 -> spring-expression 5.3.31.
  • UserFrontApplicationTests.contextLoads (JUnit 5, via the JUnit Platform launcher against MySQL 5.7): 1/1 passed.
  • java -jar against MySQL 5.7, then curl: /index 200, signup 302, login 302 -> /userFront, deposit 125.50 / withdraw 25.50 -> balance 100.00, with both primary_transaction rows written.
• CVE probe: new SpelExpressionParser().parseExpression("new int[200000000]").getValue()
  • spring-expression 4.3.12: ALLOCATED int[200000000]
  • spring-expression 5.3.31: SpelEvaluationException: EL1075E: Array declares too many elements, exceeding the threshold of '262,144'

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/8d16f16d624e406388baecae9f2d527f
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/8d16f16d624e406388baecae9f2d527f?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)