Fix: Build pinned to EOL Spring Boot 2.0.3.RELEASE with known CVEs

[WesternConcrete]

Summary

Vulnerability: Build pinned to EOL Spring Boot 2.0.3.RELEASE with known CVEs (gradle.properties)
Repo: COG-GTM/ftgo-monolith
Fix approach: Move the whole monolith off the 2018 stack onto Spring Boot 3.5.3 (Spring Framework 6.2 / Tomcat 10.1 / Jackson 2.19 / Hibernate 6.6), which closes CVE-2018-15756, CVE-2018-1258 and the embedded-Tomcat / jackson-databind advisories that shipped with 2.0.3.

Version pins (gradle.properties):

-springBootVersion=2.0.3.RELEASE
-restAssuredVersion=2.9.0
-springDependencyManagementPluginVersion=1.0.3.RELEASE
-eventuateUtilVersion=0.1.0.RELEASE
-micrometerVersion=1.0.4
+springBootVersion=3.5.3
+restAssuredVersion=5.5.5
+springDependencyManagementPluginVersion=1.1.7
+eventuateUtilVersion=0.18.0.RELEASE   # 0.1.0 only existed on the dead bintray repo
+springdocVersion=2.8.9
+micrometerVersion=1.15.1

What the bump dragged along (all required for Boot 3):

• Gradle 4.10.2 → 8.14.3, Java 8 → 17 (toolchain). compile/testCompile/runtime → api/testImplementation/runtimeOnly (java-library applied to every subproject so transitive project deps keep the old compile semantics). The Boot BOM is now imported in every subproject via dependencyManagement, so per-module jackson/junit/mysql pins are gone. IntegrationTestsPlugin rewritten for the new configuration names / testClassesDirs / outputLocation APIs. buildSrc uses the groovy plugin.
• javax.* → jakarta.* (persistence, servlet, annotation) across the 20 affected classes.
• springfox 2.8 → springdoc-openapi 2.8.9 – CommonSwaggerConfiguration now exposes a GroupedOpenApi bean. Swagger UI is still served at /swagger-ui.html (redirects to /swagger-ui/index.html).
• rest-assured com.jayway.restassured → io.restassured package rename.
• JUnit 4 tests kept as-is, run on the JUnit Platform via junit-vintage-engine; -parameters added to JavaCompile because Spring 6.1 no longer infers @PathVariable names from bytecode.
• Hibernate 6 compatibility, needed for the app to actually work against the existing Flyway schema:
  • spring.jpa.properties.hibernate.id.db_structure_naming_strategy=legacy so Consumer's @GeneratedValue (AUTO) keeps using the single hibernate_sequence table instead of a new per-entity consumers_seq.
  • DeliveryInformation gains @AttributeOverrides for latitude/longitude → delivery_address_latitude/delivery_address_longitude (the columns V2 migration created; without them Hibernate 6 tried to write to orders.latitude).
  • MoneyModule: ctxt.mappingException(..) (removed in Jackson 2.10+) → ctxt.handleUnexpectedToken(..).
• Flyway Gradle plugin 6 → 11 (with flyway-mysql + mysql-connector-j on its classpath); mysql-connector-java → com.mysql:mysql-connector-j; com.mysql.jdbc.Driver → com.mysql.cj.jdbc.Driver in WaitForMySql, docker-compose and test props; ftgo-application/Dockerfile base openjdk:8u171-jre-alpine → eclipse-temurin:17-jre-alpine.

Verification

Ran locally with Java 17 against the repo's MySQL container (docker compose up mysql → waitForMySql → :ftgo-flyway:flywayMigrate):

• ./gradlew build integrationTest – all unit tests, OrderControllerTest (MockMvc), and FtgoApplicationTest (boots the full monolith, creates/revises/cancels/delivers orders over HTTP) pass.
• Built the ftgo-application Docker image, brought it up via docker compose, /actuator/health = UP, /v3/api-docs and /swagger-ui/index.html serve, and ./gradlew :ftgo-end-to-end-tests:test passes against the container.

Not done / follow-ups

• No dependency-advisory scanning (OWASP dependency-check / Dependabot) was added; recommended as a follow-up so pins don't rot again.
• .circleci/config.yml uses machine: true; the image will need Java 17 available for CI to build this.
• mysql/Dockerfile still uses mysql:5.7.13; Hibernate 6 logs a warning that 5.7 is below its minimum supported version but everything worked in testing.

Link to Devin session: https://app.devin.ai/sessions/4847586dc422449a8d94a58e6fd56967
Open in Devin Desktop: https://app.devin.ai/desktop/session/4847586dc422449a8d94a58e6fd56967?variant=devin
Requested by: @WesternConcrete

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[devin-ai-integration]

Runtime verification – Spring Boot 3.5.3 / Java 17 / Gradle 8

Built the branch on Java 17, ran MySQL + Flyway + the app via docker compose, and exercised it through the springdoc Swagger UI.

Health UP	Swagger UI (springdoc, OAS 3.1)

POST /consumers → 200	GET /consumers/1 → 200

• ./gradlew waitForMySql :ftgo-flyway:flywayMigrate assemble on JDK 17; app container starts healthy
• /actuator/health → {"status":"UP"}
• /swagger-ui.html → springdoc UI listing restaurant/order/courier/consumer controllers
• POST /consumers {"name":{"firstName":"A","lastName":"B"}} → 200 {"consumerId":1}; GET /consumers/1 → 200 with the same name

Note (pre-existing, not from this PR)

`GET /consumers/{id}` returns `consumerId: 0` because `ConsumerController.get()` builds `GetConsumerResponse` from the name only — same on the base commit.

Recording: /home/ubuntu/screencasts/rec-7b0ea6cb-5622-48e2-bd3b-deef7023cb9d/rec-7b0ea6cb-5622-48e2-bd3b-deef7023cb9d-edited.mp4