[vladimir-gavrilenko]

Which sample(s) or area?
Build (build.gradle), spring and hello samples

What changed?

• Replaced spring-boot-starter-web with spring-boot-starter.
• Bumped the Spring Boot plugin from 2.7.15 to 2.7.18.
• Removed commons-configuration.
• Declared commons-lang3 and jackson-annotations explicitly, since they were only on the classpath transitively. HelloSignal and HelloSignalAndResponse now import RandomStringUtils from lang3.

Why?
Most Snyk findings come from the transitive dependencies of spring-boot-starter-web (Tomcat, spring-web, spring-webmvc). The spring sample uses no web features.

How did you test it?

• ./gradlew build on JDK 11: BUILD SUCCESSFUL.
• Count unique Snyk issues per severity, on master and on this branch: snyk test --org=cadence --json | jq -r '[.vulnerabilities[]] | unique_by(.id) | group_by(.severity)[] | "\(.[0].severity) \(length)"'

Potential risks
Low. Code relying on embedded Tomcat or Spring MVC would break, but nothing in src does.

Release notes
N/A

Documentation Changes
N/A

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Replacing the web starter with the core starter may break sample behavior that depends on Spring MVC or embedded Tomcat.

Drops spring-boot-starter-web in favor of spring-boot-starter, removes the unused commons-configuration, bumps the Spring Boot plugin to 2.7.18, and declares commons-lang3 and jackson-annotations explicitly. No issues found.

Verification

Functional validation No results

Rules 1 not applicable

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}