Pin spring-framework.version to 6.2.19 (closes 1 critical + 11 high CVEs)

[devin-ai-integration]

Summary

Pins Spring Framework to 6.2.19 under the unchanged spring-boot-starter-parent:3.3.3, closing the 1 critical + 11 high Spring Framework CVEs from the Snyk SCA scan of DevOps. Boot 3.3.3 manages Spring Framework via the spring-framework.version property, so a one-line property override is enough — no dependency declarations, no parent bump.

 <properties>
     <java.version>17</java.version>
+    <spring-framework.version>6.2.19</spring-framework.version>
 </properties>

The 6.1 → 6.2 minor bump was flagged as the riskiest of the five parallel pins. It works here: compile, the contextLoads test against a real MySQL, and the full dependency resolution are all green — no fallback to 6.1.x was needed. All spring-framework modules (spring-core, spring-beans, spring-context, spring-web, spring-webmvc, spring-expression, spring-aop, spring-tx, spring-jdbc, spring-orm, spring-aspects, spring-jcl, spring-test) resolve to 6.2.19 instead of 6.1.12.

CVEs closed

All 12 were present at 6.1.12 and all are gone at 6.2.19:

Severity	CVSS	CVE	Module	Issue
Critical	9.2	CVE-2026-41855	spring-web	Deserialization of untrusted data
High	8.7	CVE-2024-38816	spring-webmvc	Path traversal
High	8.7	CVE-2024-38819	spring-webmvc	Path traversal
High	8.7	CVE-2025-41249	spring-core	Incorrect authorization
High	8.7	CVE-2026-41850	spring-expression	Inefficient algorithmic complexity
High	8.2	CVE-2026-22737	spring-webmvc	Directory traversal
High	8.2	CVE-2026-41843	spring-webmvc	Directory traversal
High	8.2	CVE-2026-41841	spring-webmvc	Forced browsing
High	8.2	CVE-2026-41842	spring-webmvc	Resource allocation without limits
High	8.2	CVE-2026-41851	spring-expression	Resource allocation without limits
High	8.2	CVE-2025-41242	spring-beans	Relative path traversal
High	7.1	CVE-2026-22740	spring-web	Incomplete cleanup

CVEs remaining open in Spring Framework after this pin: none. All 28 Snyk issues attributed to org.springframework:spring-* at 6.1.12 are resolved at 6.2.19.

Snyk before/after

snyk test --all-projects --dev --json on the same working copy, before and after the one-line change:

	Unique vulns	Critical	High	Medium	Low
Before (6.1.12)	114	20	41	42	11
After (6.2.19)	86	19	30	34	3

28 issues removed, 0 new issues introduced — the pin pulls in no new vulnerable transitive versions. The remaining 86 are the other components (tomcat, spring-security, thymeleaf, jackson, mysql-connector, …) covered by the sibling remediation PRs.

Verification commands

export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
chmod +x mvnw                     # local only; the mode change is NOT committed

./mvnw dependency:tree            # BUILD SUCCESS — all org.springframework:spring-* now 6.2.19
./mvnw clean compile              # BUILD SUCCESS
./mvnw clean test                 # Tests run: 1, Failures: 0, Errors: 0, Skipped: 0

SNYK_TOKEN=... snyk test --all-projects --dev --json > after.json

Tests ran against a real MySQL, not a compile-only check: docker start bankapp-mysql (mysql:8.0 on localhost:3306, db bankappdb, user root), and BankappApplicationTests.contextLoads started the full Spring context — Hikari connected, Hibernate 6.5.2 created the account/transaction tables, context started in 4.2s — under Spring Framework 6.2.19 on Boot 3.3.3. No compatibility errors, deprecation failures, or context-startup problems.

Scope

Minimal diff: one line in the <properties> block of pom.xml. No pom reformatting, no unrelated dependency changes, and spring-boot-starter-parent stays at 3.3.3. This is one of five parallel Snyk remediation PRs against the same <properties> block; the other four pin tomcat.version, spring-security.version, thymeleaf.version and jackson-bom.version.

Link to Devin session: https://app.devin.ai/sessions/1521b40a18314d0abc78e57ed84590e3
Requested by: @patrickbradley-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Runtime verification: Spring Framework 6.2.19 — full banking flow works end-to-end

Ran the app locally (./mvnw spring-boot:run, Java 17) against a real MySQL and exercised the full UI. Confirmed the runtime classpath actually resolves spring-*:6.2.19 (Boot 3.3.3, Security 6.3.3 unchanged), so these tests aren't vacuous. No fallback to 6.1.14 was needed — nothing broke.

All checks passed:

• Clean boot (3.18s, Tomcat on 8080), 0 ERROR lines, no 500s across the whole run.
• MVC static-asset serving + Thymeleaf render correctly (the CVE-relevant area). Logo served on authenticated pages, correct styling.
• Golden path with exact balances: register → login → deposit $500 → withdraw $200 → transfer $100 to a 2nd account (alice ends at $200.00, bob at $100.00). Insufficient-funds error path also works (balance held at $300.00).
• Transaction history correct for both accounts (incl. green/red coloring).
• Spring Security intact: logout → /login?logout, protected pages redirect when logged out, session re-established on re-login.

Full recording of the run:

Note: on /login and /register the logo appears as broken alt-text because /images/** is auth-gated by anyRequest().authenticated() — pre-existing, not a regression.

Tested by Devin — see session for full report & recording.