[Snyk] Fix for 1 vulnerabilities

[ryanmcmorrowsnyk]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551	125	com.fasterxml.jackson.core:jackson-databind: 2.9.9 -> 2.21.2 com.fasterxml.jackson.dataformat:jackson-dataformat-xml: 2.9.9 -> 2.21.2 com.fasterxml.jackson.dataformat:jackson-dataformat-yaml: 2.9.9 -> 2.21.2 Major version upgrade No Path Found No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Vulnerabilities that could not be fixed

• Upgrade:
  • Could not upgrade org.springframework.boot:spring-boot-starter-web@2.7.18 to org.springframework.boot:spring-boot-starter-web@3.5.13; Reason could not apply upgrade, dependency is managed externally ; Location: https://maven-central.storage-download.googleapis.com/maven2/org/springframework/boot/spring-boot-dependencies/2.7.18/spring-boot-dependencies-2.7.18.pom

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[ryanmcmorrowsnyk]

This upgrade includes a major version increase for Spring Boot from 2.x to 3.x, which introduces significant and mandatory breaking changes. The Jackson library upgrades, while minor versions, also contain notable behavioral changes and require attention.

1. org.springframework.boot:spring-boot-starter-web (2.7.18 → 3.5.13)

Risk: HIGH

This is a major upgrade that requires significant developer action. The migration from Spring Boot 2.x to 3.x is a substantial undertaking.

Key Breaking Changes:

• Java 17 Baseline: Spring Boot 3.0 requires Java 17 as the minimum version. Applications must be updated from any previous JDK version.
• Jakarta EE 9 Migration: This is one of the largest changes. All dependencies and code using the javax.* namespace must be migrated to the new jakarta.* namespace. This affects core APIs like Servlet, JPA, and Validation.
• Spring Security 6.0: Spring Boot 3.0 integrates with Spring Security 6.0, which has its own set of breaking changes. The recommended migration path is to first upgrade to Spring Security 5.8 while still on Spring Boot 2.7.
• Removed APIs and Properties: Numerous classes, methods, and configuration properties that were deprecated in Spring Boot 2.x have been removed. The spring-boot-properties-migrator module can be used to identify and temporarily migrate renamed properties.
• Core Framework Changes: Spring Framework 6.0 itself introduces breaking changes, such as HttpMethod now being a class instead of an enum, and stricter controller detection rules.

Recommendation:

This upgrade cannot be handled as a simple dependency bump. A dedicated migration effort is required. Developers must:

1. Upgrade the environment and build tools to use JDK 17.
2. Perform a codebase-wide migration from javax.* to jakarta.* package imports.
3. Review and update all dependencies to ensure they are compatible with Spring Boot 3 and Jakarta EE.
4. Address changes in Spring Security and other removed APIs.

Source: Spring Boot 3.0 Migration Guide, Spring Framework 6.0 Release Notes

2. Jackson Libraries (databind, dataformat-xml, dataformat-yaml) (2.9.9 → 2.21.2)

Risk: MEDIUM

While these are minor version upgrades, the wide version span introduces several behavioral changes and new defaults that could impact applications at runtime.

Key Changes:

• Jakarta EE Support: Starting with version 2.13, Jackson introduced new modules with the -jakarta suffix to support the jakarta.* namespace. When migrating to Spring Boot 3, ensure you are using the correct Jackson artifacts that align with the Jakarta EE ecosystem.
• Processing Limits: To mitigate potential DoS attacks, Jackson 2.15 introduced default limits on maximum document nesting depth (1000) and string value length. Applications processing very large or deeply nested JSON/XML/YAML may encounter StreamConstraintsException.
• Java 8 Baseline: The minimum JDK version for most Jackson modules was raised to Java 8 in version 2.13. This is covered by the move to Java 17 for Spring Boot.
• Behavioral Changes: Several versions introduced subtle changes that could affect specific use cases, such as stricter TypeReference handling (2.10), changes to @JsonIgnore precedence (2.14), and

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.