fix: resolve top 5 SonarQube issues (weekly sweep)

[choikh0423]

Summary

Weekly SonarQube sweep. SonarQube project key: choikh0423_demo-spring-boot-test-coverage (the only project in the org; its file paths match this repo). 265 open issues; ranked by severity → type → effort → recency. The top 5 are the 4 CRITICAL issues plus the only MAJOR-severity BUG.

#	Issue key	Severity / Type	Rule	Location	Issue	Fix
1	AZ1u3HBdEnUkF3fpjVtN	CRITICAL / CODE_SMELL	java:S1948	InvalidRequestException.java:7	Non-static field errors (org.springframework.validation.Errors) in a Serializable class is neither transient nor serializable	private final transient Errors errors;
2	AZ1u3HCaEnUkF3fpjVtj	CRITICAL / CODE_SMELL	java:S1452	ArticleApi.java:36	Generic wildcard ResponseEntity<?> in return type of article()	ResponseEntity<Map<String, Object>> (matches what articleResponse() returns)
3	AZ1u3HCaEnUkF3fpjVtk	CRITICAL / CODE_SMELL	java:S1452	ArticleApi.java:45	Generic wildcard in return type of updateArticle()	ResponseEntity<Map<String, Object>>
4	AZ1u3HBkEnUkF3fpjVtQ	CRITICAL / CODE_SMELL	java:S1452	CommentsApi.java:41	Generic wildcard in return type of createComment()	ResponseEntity<Map<String, Object>> (matches commentResponse())
5	AZ1u3HAmEnUkF3fpjVtC	MAJOR / BUG	java:S2885	DateTimeHandler.java:18	static final Calendar UTC_CALENDAR shared across threads; Calendar is not thread-safe and JDBC getTimestamp/setTimestamp(…, Calendar) mutate it	Keep only the immutable TimeZone as a static, and hand each JDBC call a fresh Calendar.getInstance(UTC) via utcCalendar(). (An instance field would still be shared because MyBatis holds one TypeHandler instance.)

Note: the SonarQube MCP response does not expose per-issue type/effort, so type was taken from show_rule and effort ordering was applied at the rule level.

Verification

• ./gradlew test: 68 tests, 0 failures.
• ./gradlew spotlessCheck: the 4 changed files are clean. The only violation reported is preexisting on master (DefaultJwtServiceTest.java:16, line too long) and is left untouched here.
• Running Spotless on JDK 17 needs -Dorg.gradle.jvmargs="--add-exports jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED …" (google-java-format 1.x); the repo has no build/test CI job, so this was verified locally.

Link to Devin session: https://app.devin.ai/sessions/bff8528aa3294c9ba9880b0811709a49
Open in Devin Desktop: https://app.devin.ai/desktop/session/bff8528aa3294c9ba9880b0811709a49?variant=devin
Requested by: @choikh0423

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.