[Snyk] Fix for 3 vulnerabilities

[macroscope-cloud]

Snyk has created this PR to fix 3 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• examples/iOS-Hybrid-App-Java-Server/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Improperly Controlled Modification of Dynamically-Determined Object Attributes SNYK-JAVA-TOOLSJACKSONCORE-17457696	738	org.springframework.boot:spring-boot-starter-json: 4.0.4 -> 4.0.7 Proof of Concept
	Improper Authentication SNYK-JAVA-ORGAPACHETOMCATEMBED-17732890	726	org.apache.tomcat.embed:tomcat-embed-core: 11.0.14 -> 11.0.23 org.apache.tomcat.embed:tomcat-embed-websocket: 11.0.12 -> 11.0.23 org.springframework.boot:spring-boot-starter-tomcat: 3.5.5 -> 4.0.0 Major version upgrade No Known Exploit
	Detection of Error Condition Without Action SNYK-JAVA-ORGAPACHETOMCATEMBED-17733746	721	org.apache.tomcat.embed:tomcat-embed-core: 11.0.14 -> 11.0.23 org.apache.tomcat.embed:tomcat-embed-websocket: 11.0.12 -> 11.0.23 org.springframework.boot:spring-boot-starter-tomcat: 3.5.5 -> 4.0.0 Major version upgrade No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improper Authentication
🦉 Improperly Controlled Modification of Dynamically-Determined Object Attributes

[macroscope-cloud]

This upgrade includes a major version jump for Spring Boot from 3.5.5 to 4.0.0, which introduces significant breaking changes. The upgrade requires a Java 17 baseline (with Java 21+ recommended), and brings in major version updates for underlying dependencies like Spring Framework 7, Jakarta EE 11, and Jackson 3.

Key Breaking Changes in Spring Boot 4.0.0:

• Java Baseline: Spring Boot 4.0 requires Java 17 at a minimum, with first-class support for Java 25. Projects must be upgraded to at least Java 17, with Java 21 being a practical minimum to leverage key features.
• Dependency Upgrades: This release is built on Spring Framework 7 and aligns with Jakarta EE 11. It also cascades major upgrades to dependencies like Jackson 3, Hibernate 7, and Spring Security 7.
• Modularization: The spring-boot-autoconfigure JAR has been broken down into smaller, more focused modules. This may lead to compile-time failures if your code relied on transitive APIs from the previously monolithic JAR.
• Removed Undertow Support: Support for Undertow as an embedded server has been dropped because it is not compatible with the required Servlet 6.1 baseline. Projects using Undertow must migrate to another server like Tomcat or Jetty before upgrading.
• Jackson 3 Migration: Spring Boot 4.0 uses Jackson 3, which has a new group ID and package names (tools.jackson instead of com.fasterxml.jackson). This will require code changes for any custom ObjectMapper configurations or direct usage.
• Security Defaults: Spring Security 7 changes several defaults. For example, web applications are now secured by default, which may block endpoints that were previously accessible.

Other Package Upgrades:

• org.apache.tomcat.embed:tomcat-embed-core & websocket (11.0.14/12 → 11.0.23): This is a patch-level upgrade within the Tomcat 11.x line, which is compatible with Jakarta EE 11. The changelogs primarily indicate bug fixes, dependency updates, and security patches. No major breaking changes are noted for this patch span.
• org.springframework.boot:spring-boot-starter-json (4.0.4 → 4.0.7): This is a patch release within the new 4.0.x line, likely containing bug fixes and minor improvements related to the new Jackson 3 integration.

Recommendation:
This is a high-risk, high-effort migration. Do not merge without a dedicated migration plan. It is strongly recommended to first upgrade to the latest Spring Boot 3.5.x release and resolve all deprecation warnings before attempting the upgrade to 4.0.0. A detailed migration plan should be created to address the Java version update, dependency changes (especially Jackson 3), removal of Undertow, and new security defaults.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.