[Snyk] Fix for 2 vulnerabilities

[macroscope-cloud]

Snyk has created this PR to fix 2 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• examples/iOS-Hybrid-App-Java-Server/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Improper Authentication SNYK-JAVA-ORGAPACHETOMCATEMBED-17732890	726	org.apache.tomcat.embed:tomcat-embed-core: 11.0.18 -> 11.0.23 org.apache.tomcat.embed:tomcat-embed-websocket: 11.0.12 -> 11.0.23 org.springframework.boot:spring-boot-starter-tomcat: 3.5.5 -> 4.0.0 Major version upgrade No Known Exploit
	Detection of Error Condition Without Action SNYK-JAVA-ORGAPACHETOMCATEMBED-17733746	721	org.apache.tomcat.embed:tomcat-embed-core: 11.0.18 -> 11.0.23 org.apache.tomcat.embed:tomcat-embed-websocket: 11.0.12 -> 11.0.23 org.springframework.boot:spring-boot-starter-tomcat: 3.5.5 -> 4.0.0 Major version upgrade No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improper Authentication

[macroscope-cloud]

This dependency update includes a major version upgrade of Spring Boot from 3.5.x to 4.0.0, which introduces significant breaking changes and requires a new platform baseline. The upgrades for the embedded Tomcat libraries are minor patch versions with no breaking changes.

High-Risk Upgrade: org.springframework.boot:spring-boot-starter-tomcat (3.5.5 → 4.0.0)

The upgrade to Spring Boot 4.0.0 is a major evolution of the framework and requires careful migration. It is built on Spring Framework 7 and Jakarta EE 11.

Key Breaking Changes:

• Java Version Requirement: Spring Boot 4.0 requires Java 17 or later. First-class support for Java 25 is also mentioned.
• Jakarta EE 11: This release is based on Jakarta EE 11, which requires a Servlet 6.1 compatible container like Tomcat 11.
• Dependency Upgrades: Major dependencies have been upgraded, which will require code and configuration changes:
  • Jackson 3.x: Support for Jackson 2.x has been removed. This involves a new package namespace (tools.jackson) and API changes (e.g., using the JsonMapper builder).
  • JUnit 6: The testing framework has moved to JUnit 6, and support for JUnit 4 is deprecated.
• Configuration Properties: Numerous configuration properties have been renamed or removed. It is recommended to use the spring-boot-properties-migrator module to help identify necessary changes.
• API Removals: All APIs deprecated in the Spring Boot 3.x line have been removed.
• Modularization: Spring Boot's codebase is now more modular. You may need to add new starters for specific features, such as spring-boot-starter-webclient if you use WebClient.

Recommendation:

This is a high-effort migration that cannot be merged without significant planning and refactoring. Before upgrading, you should first upgrade to the latest Spring Boot 3.5.x release and resolve all deprecation warnings. Create a dedicated branch for the migration and expect to address compilation errors, update configurations, and run comprehensive tests.

Sources: Spring Boot 4.0 Migration Guide

Low-Risk Upgrades

• org.apache.tomcat.embed:tomcat-embed-core (11.0.18 → 11.0.23)
• org.apache.tomcat.embed:tomcat-embed-websocket (11.0.12 → 11.0.23)

These are minor patch updates within the same major version. The changelogs indicate they consist of bug fixes, security patches, and minor improvements with no breaking API changes.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.