[Snyk] Fix for 3 vulnerabilities

[macroscope-cloud]

Snyk has created this PR to fix 3 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• examples/iOS-Hybrid-App-Java-Server/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Improperly Controlled Modification of Dynamically-Determined Object Attributes SNYK-JAVA-TOOLSJACKSONCORE-17457696	738	org.springframework.boot:spring-boot-starter-json: 4.0.4 -> 4.0.7 Proof of Concept
	Improper Authentication SNYK-JAVA-ORGAPACHETOMCATEMBED-17732890	726	org.apache.tomcat.embed:tomcat-embed-core: 11.0.10 -> 11.0.23 org.apache.tomcat.embed:tomcat-embed-websocket: 11.0.10 -> 11.0.23 org.springframework.boot:spring-boot-starter-tomcat: 3.5.5 -> 4.0.0 Major version upgrade No Known Exploit
	Detection of Error Condition Without Action SNYK-JAVA-ORGAPACHETOMCATEMBED-17733746	721	org.apache.tomcat.embed:tomcat-embed-core: 11.0.10 -> 11.0.23 org.apache.tomcat.embed:tomcat-embed-websocket: 11.0.10 -> 11.0.23 org.springframework.boot:spring-boot-starter-tomcat: 3.5.5 -> 4.0.0 Major version upgrade No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improper Authentication
🦉 Improperly Controlled Modification of Dynamically-Determined Object Attributes

[macroscope-cloud]

The upgrade of spring-boot-starter-tomcat from version 3.5.5 to 4.0.0 is a major platform migration with significant breaking changes. The other package updates are minor and carry low risk.

org.springframework.boot:spring-boot-starter-tomcat 3.5.5 → 4.0.0 (HIGH RISK)

This is not a routine version bump but a major evolution of the Spring ecosystem built on Spring Framework 7. It introduces numerous breaking changes that require careful planning and significant refactoring.

Key Breaking Changes:

• Java and Jakarta EE Baseline: Spring Boot 4.0 requires Java 17 or later and is built on Jakarta EE 11, which requires a Servlet 6.1 compatible container.
• Major Dependency Upgrades: The upgrade forces updates to several core dependencies, introducing their own breaking changes:
  • Jackson 3: Spring Boot 4.0 uses Jackson 3 as the default JSON library. This involves new package names (e.g., tools.jackson instead of com.fasterxml.jackson) and potential serialization/deserialization issues.
  • Spring Security 7 & Hibernate 7: These major versions bring their own API changes and updated default behaviors.
• Configuration Properties: Many configuration properties have been renamed or removed. You will need to update application.properties and application.yml files. The spring-boot-properties-migrator module can assist in identifying and temporarily migrating these properties.
• Removed Features: Support for the Undertow embedded server has been removed.

Other Upgrades:

• org.apache.tomcat.embed:tomcat-embed-core & websocket (11.0.10 → 11.0.23): This is a low-risk patch upgrade. The changes consist of bug fixes and minor improvements.
• org.springframework.boot:spring-boot-starter-json (4.0.4 → 4.0.7): This is a low-risk patch update within the 4.x line. The significant breaking change (Jackson 3) was introduced in 4.0.0.

Recommendation:

Do not proceed with this upgrade without a dedicated migration plan. Before attempting the upgrade to 4.0.0, you should first upgrade to the latest Spring Boot 3.5.x version and resolve all deprecation warnings. Create a separate branch to handle the significant code and configuration refactoring required for the move to Spring Boot 4.0.

Sources:

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.