fix: Remediate Snyk SAST high/critical vulnerabilities via dependency upgrades

[devin-ai-integration]

Summary

Upgrades project dependencies to remediate high and critical severity vulnerabilities identified by a Snyk SCA scan. The original scan found 200+ vulnerabilities across transitive dependencies. This PR reduces that to ~152 total and drops high/critical issues from 131 → 57, with the remaining ones requiring a Spring Boot 3.x migration (Spring 6.x+) to resolve.

Key dependency changes:

Dependency	Before	After	Key CVEs addressed
Spring Boot	2.6.3	2.7.18	Spring Framework RCE, Tomcat path traversal, Spring Security auth bypass
Spring Framework	5.3.25 (transitive)	5.3.33 (overridden)	Open redirect, incomplete cleanup
Spring Security	5.6.x (transitive)	5.7.13 (overridden)	Access control, missing authorization
Tomcat	9.0.56 (transitive)	9.0.117 (overridden)	Certificate validation, auth bypass, path traversal, DoS
Jackson BOM	2.13.x (transitive)	2.18.6 (overridden)	Resource allocation DoS, buffer overflow
Logback	1.2.x (transitive)	1.2.13 (overridden)	DoS, resource exhaustion
DGS Framework	4.9.21	5.5.1	graphql-java DoS/stack overflow
graphql-java	17.3 (transitive)	19.2 (forced)	DoS, stack-based buffer overflow
sqlite-jdbc	3.36.0.3	3.42.0.0	Arbitrary code execution
jjwt	0.11.2	0.11.5	Maintenance/security fixes
snakeyaml	1.29 (transitive)	2.0 (overridden)	DoS, arbitrary code execution
json-smart	2.4.7 (transitive)	2.4.9 (constrained)	DoS
commons-lang3	3.12.0 (transitive)	3.18.0 (overridden)	Uncontrolled recursion
Spotless	6.2.1	6.25.0	Java 17 build compatibility

Code changes: The DGS 5.5.1 upgrade required updating ArticleDatafetcher and CommentDatafetcher to use the DGS codegen-generated io.spring.graphql.types.PageInfo instead of graphql.relay.DefaultPageInfo, since the connection builder types changed between DGS 4.x and 5.x.

Remaining unfixable CVEs (require Spring Boot 3.x / Spring 6.x+ migration):

• spring-security-crypto@5.7.13 — CRITICAL: Authentication Bypass (fix: 6.3.8+)
• spring-security-web@5.7.13 — CRITICAL: Cache Sensitive Info (fix: 6.5.9+)
• spring-beans/core/web/webmvc@5.3.33 — HIGH: Path traversal, authorization, cleanup issues (fix: 6.x+)
• graphql-java@19.2 — HIGH: DoS/buffer overflow (fix: 19.4+, but incompatible with DGS 5.5.1)

Review & Testing Checklist for Human

• Jackson 2.18.6 compatibility: This is a significant jump from Spring Boot 2.7.18's managed 2.13.x. Verify JSON serialization/deserialization works correctly for all API endpoints — especially edge cases like dates, nested objects, and error responses. Unit tests may not cover all serialization paths.
• Tomcat 9.0.117 behavior: Much newer than Boot 2.7.18's managed 9.0.83. Verify the app starts correctly and handles HTTP requests normally under load. Watch for changes in header handling, connection management, or error responses.
• SnakeYAML 2.0 override: Has breaking API changes from 1.x (removed new Constructor(class) pattern). Verify the app starts correctly and YAML config parsing works — unit tests may not cover all runtime YAML paths.
• GraphQL pagination behavior: The PageInfo type was changed from graphql.relay.DefaultPageInfo to the DGS codegen-generated type. Verify that GraphQL queries with cursor-based pagination (first/after/last/before) return correct pageInfo fields.
• Recommended test plan: Run ./gradlew bootRun, hit curl http://localhost:8080/tags to verify startup, then exercise the GraphQL endpoint at /graphql with a paginated articles query. Also test article creation, user login, and favoriting to exercise Jackson serialization paths.

Notes

• All 68 existing tests pass after these changes.
• The DefaultJwtServiceTest.java change is purely a Spotless reformatting (line wrap).
• mybatis-spring-boot-starter was intentionally kept at 2.2.2 as it had no high/critical CVEs.
• The Snyk CI check still reports failures because the remaining CVEs require Spring 6.x+ and cannot be fixed within Spring Boot 2.7.x. A full Spring Boot 3.x migration is recommended as a follow-up to address those.
• graphql-java is pinned to 19.2 via both ext property and resolutionStrategy because the DGS 5.5.1 platform BOM was allowing a downgrade to 18.5 (which lacks RuntimeWiring.transform()). Versions 19.4+ break DGS 5.5.1 due to removal of that method.

Link to Devin session: https://app.devin.ai/sessions/dc88039c316841b3a091eb0d202113e6
Requested by: @abhay-codeium

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring