Upgrade Spring Boot to 2.7.18 for known CVEs; document CSRF-disable rationale

[devin-ai-integration]

Summary

Addresses the Snyk findings for this repo.

Dependency upgrades (the Snyk Gradle scan itself failed with Maven Central 429, so the runtime classpath was inspected manually via ./gradlew dependencies --configuration runtimeClasspath). The Spring Boot 2.6.3 BOM resolved several versions with well-known CVEs:

Artifact	Before	After	Notable CVEs fixed
spring-boot / spring-core / spring-web	2.6.3 / 5.3.15	2.7.18 / 5.3.31	CVE-2022-22965 (Spring4Shell), CVE-2022-22950, CVE-2022-22970, CVE-2022-22971, CVE-2023-20860/20861/20863, CVE-2024-22243/22259/22262
spring-security-core	5.6.1	5.7.11	CVE-2022-22978, CVE-2022-31692, CVE-2023-20862
tomcat-embed-core	9.0.56	9.0.83	CVE-2022-23181, CVE-2022-42252, CVE-2023-28708, CVE-2023-41080, CVE-2023-44487, CVE-2023-45648, CVE-2023-46589
jackson-databind	2.13.1	2.13.5	CVE-2022-42003, CVE-2022-42004
logback-classic	1.2.10	1.2.13 (via ext['logback.version'])	CVE-2023-6378
snakeyaml	1.29	1.33 (via ext['snakeyaml.version'])	CVE-2022-25857, CVE-2022-38749/38750/38751/38752, CVE-2022-41854
sqlite-jdbc (direct)	3.36.0.3	3.41.2.2	CVE-2023-32697
graphql-java (transitive)	17.3	18.5 (from Boot 2.7 BOM)	CVE-2022-37734, CVE-2023-28867

- id 'org.springframework.boot' version '2.6.3'
- id 'io.spring.dependency-management' version '1.0.11.RELEASE'
+ id 'org.springframework.boot' version '2.7.18'
+ id 'io.spring.dependency-management' version '1.1.4'
+ ext['logback.version'] = '1.2.13'
+ ext['snakeyaml.version'] = '1.33'

Not upgraded (would not be trivial): Spring Boot 3.x (requires Java 17 + Jakarta namespace + WebSecurityConfigurerAdapter removal), snakeyaml 2.x (SafeConstructor-only API change; CVE-2022-1471 does not apply to Boot's SafeConstructor usage), DGS 4.9.21 (kept; tests pass against graphql-java 18.5).

Snyk Code finding — [High] CSRF at WebSecurityConfig.java:38 (csrf().disable()): assessed as a false positive, no behavior change. The API is stateless (SessionCreationPolicy.STATELESS), authenticates only via a bearer JWT in the Authorization header and never issues a session cookie, so browsers cannot attach ambient credentials to a cross-site request; CSRF tokens would provide no protection. A comment documenting this rationale was added at the call site.

Also fixed a pre-existing spotlessCheck violation in DefaultJwtServiceTest so lint passes.

Verification: ./gradlew spotlessCheck test passes (68 tests, 0 failures). snyk test could not be run (no Snyk CLI / npx on the build machine).

Snyk issue IDs addressed: the task provided no numeric Snyk IDs; the single Snyk Code finding was "Cross-Site Request Forgery (CSRF) — WebSecurityConfig.java:38" (documented as accepted/false positive above). Dependency CVEs are listed in the table.

Link to Devin session: https://app.devin.ai/sessions/e18c05886e6047c890d4de6b744c2a96
Open in Devin Desktop: https://app.devin.ai/desktop/session/e18c05886e6047c890d4de6b744c2a96?variant=devin

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.