Fix Snyk vulnerabilities: upgrade to Spring Boot 2.7.18 and patch managed dependencies

[devin-ai-integration]

Summary

Moves the dependency tree off end-of-life Spring Boot 2.6.3 to 2.7.18 and pins security patch releases of BOM-managed libraries that the 2.7.x BOM has frozen (2.7.x is itself EOL, so the BOM ships old Tomcat/Jackson/Spring Framework patch levels).

Snyk Open Source (unique issue/package pairs, snyk test --all-projects):

	critical	high	medium	low	total
before	16	79	74	24	193
after	4	28	24	13	69

(Snyk's UI counts vulnerable paths, which is where the 53 critical / 258 high in the ticket comes from; the ratio of the reduction is the same.)

Two non-obvious pieces in build.gradle:

// Boot 2.7's BOM manages graphql-java 18.5 for spring-graphql, which downgrades
// the version DGS 5.6.2 needs -> NoSuchMethodError on RuntimeWiring.transform at startup
ext['graphql-java.version'] = '19.11'

// jackson-module-kotlin 2.18.x requires kotlin-stdlib >= 1.8; the Boot BOM pins 1.6.21
// -> NoClassDefFoundError: KotlinFeature while building the ObjectMapper
ext['jackson-bom.version'] = '2.18.10'
ext['kotlin.version']      = '1.9.25'

DGS stays on the 5.x line (4.9.21 -> 5.6.2): DGS 6.x+ publishes Java-17-only variants and this project targets Java 11, so it is not resolvable here.

Vulnerabilities fixed (by package)

Fixed by the Boot 2.7.18 upgrade + pinned patch versions:

• org.apache.tomcat.embed:tomcat-embed-core 9.0.56 -> 9.0.121 — 26 vulns, all gone (incl. criticals SNYK-JAVA-ORGAPACHETOMCATEMBED-* RCE/request smuggling)
• org.apache.tomcat.embed:tomcat-embed-websocket 9.0.56 -> 9.0.121 — 1 high
• com.fasterxml.jackson.core:jackson-databind / jackson-core 2.13.1 -> 2.18.10 — 8 vulns, all gone
• org.springframework:spring-beans 5.3.15 -> 5.3.39 — critical RCE SNYK-JAVA-ORGSPRINGFRAMEWORK-2436751 (Spring4Shell-adjacent) fixed
• org.springframework:spring-webmvc / spring-web / spring-core / spring-expression 5.3.15 -> 5.3.39 — 11 of 19 fixed
• org.springframework.security:spring-security-web / -core / -config / -crypto 5.6.1 -> 5.8.16 — 6 of 10 fixed (incl. authorization-bypass SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-2833359, missing-authorization SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-8309135)
• org.springframework.boot:spring-boot-autoconfigure / spring-boot 2.6.3 -> 2.7.18 — 2 of 5 fixed
• org.yaml:snakeyaml 1.30 -> 2.4 — incl. critical deserialization SNYK-JAVA-ORGYAML-*
• ch.qos.logback:logback-core / -classic 1.2.10 -> 1.2.13 — 4 of 5 fixed
• io.projectreactor:reactor-core 3.4.14 -> 3.4.41, org.apache.commons:commons-lang3 3.12.0 -> 3.18.0, org.assertj:assertj-core 3.22.0 -> 3.27.7 (test only), org.jetbrains.kotlin:kotlin-stdlib 1.6.10 -> 1.9.25, com.google.guava (via DGS 5.6.2)
• org.xerial:sqlite-jdbc 3.36.0.3 -> 3.41.2.2 — arbitrary code execution SNYK-JAVA-ORGXERIAL-5596891
• com.google.protobuf:protobuf-java 3.9.0 -> 3.25.8 — stack overflow SNYK-JAVA-COMGOOGLEPROTOBUF-8055227 (added as a direct dependency because it only arrives transitively through Apollo federation support)

Snyk Code: CSRF protection disabled (CWE-352), WebSecurityConfig.java:38 — not changed, comment added

Left csrf().disable() in place; added a comment stating why. This API is stateless: SessionCreationPolicy.STATELESS, no session or auth cookie is ever issued, and JwtTokenFilter authenticates each request solely from the Authorization: Token <jwt> header. Browsers do not attach that header to cross-site requests, so there is no ambient credential for an attacker to ride on — the precondition for CSRF does not hold. CORS is also configured with setAllowCredentials(false). Enabling CSRF would require every client (including the RealWorld reference frontends) to fetch and echo a token, breaking the published API contract for no security gain.

Deliberately NOT fixed

• 4 critical / 28 high remaining, all in Spring Framework 5.3.x, Spring Security 5.8.x, Spring Boot 2.7.x, spring-hateoas 1.5.x, reactor-core 3.4.x. Snyk's fixedIn for every one of these is 6.x/7.x — i.e. they are only fixed on the Spring Boot 3.x / Framework 6.x line, which is unavailable to a Boot 2.7 app. Per the ticket, 3.x is left as a follow-up: it forces javax.* -> jakarta.*, replaces the removed WebSecurityConfigurerAdapter used by WebSecurityConfig, and requires Java 17 + DGS 9.x — far beyond a minimal security patch.
• ch.qos.logback:logback-core expression injection (SNYK-JAVA-CHQOSLOGBACK-17675439) — fixed only in 1.5.36, which requires SLF4J 2.x and is incompatible with Boot 2.7's SLF4J 1.7.
• org.antlr:antlr4, org.apache.logging.log4j:log4j-api — Snyk reports no upgrade or patch available.
• Snyk Code low-severity "hardcoded credentials" findings in src/test/** — test fixtures, not real credentials.
• No .snyk ignores or suppression comments were added.

Note on unrelated diff hunk

src/test/java/io/spring/infrastructure/service/DefaultJwtServiceTest.java has a 2-line reformat from ./gradlew spotlessApply. That spotlessCheck violation pre-exists on master (verified by stashing this branch's changes) and would otherwise make ./gradlew build fail on this branch.

Validation

• ./gradlew build — BUILD SUCCESSFUL (68 tests, spotlessCheck included)
• snyk test --all-projects — counts in the table above

Link to Devin session: https://app.devin.ai/sessions/1bdf2f6e71a54ff687cae6f9d7e1da0a
Open in Devin Desktop: https://app.devin.ai/desktop/session/1bdf2f6e71a54ff687cae6f9d7e1da0a?variant=devin
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 3 potential issues.

[devin-ai-integration]

📝 Info: Cross-BOM overrides remain compatible

The resolved Jackson, Kotlin, SnakeYAML, security, and GraphQL artifacts retain Java 11 bytecode. Startup and live REST and GraphQL requests succeed.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

📝 Info: SnakeYAML API remains compatible

Boot's OriginTrackedYamlLoader uses SnakeYAML 2.x's LoaderOptions constructor. The override therefore preserves configuration loading despite crossing a major version.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

📝 Info: GraphQL alignment is effective

Resolution selects GraphQL Java 19.11 consistently across DGS and federation support. Schema initialization and a live query succeed without linkage failures.

---

Was this helpful? React with 👍 or 👎 to provide feedback.