[Snyk] Security upgrade org.springframework.boot:spring-boot-starter-web from 2.7.3 to 3.5.15

[josephggd]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• examples/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598	773	org.springframework.boot:spring-boot-starter-web: 2.7.3 -> 3.5.15 Major version upgrade No Path Found Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[josephggd]

This is a major version upgrade from Spring Boot 2.7.3 to 3.5.15, which introduces significant and mandatory breaking changes. Direct dependency upgrade is not possible without a comprehensive migration effort.

Key Breaking Changes:

• Java 17 Baseline: Spring Boot 3.x requires Java 17 as the minimum JDK version. Applications running on Java 8 or 11 must be upgraded.
• Jakarta EE Migration: This is the most impactful change. Spring Boot 3.0 migrates from Java EE to Jakarta EE. All javax.* package imports must be replaced with their jakarta.* equivalents. This affects core functionalities like JPA (javax.persistence -> jakarta.persistence), Servlet API (javax.servlet -> jakarta.servlet), and Bean Validation (javax.validation -> jakarta.validation).
• Dependency Upgrades: This upgrade is built on Spring Framework 6.0 and requires updates to many third-party libraries to ensure they are compatible with Jakarta EE.
• Configuration Properties: Numerous configuration properties have been renamed or removed. For example, server.max.http.header.size is now server.max-http-request-header-size. While Spring provides a spring-boot-properties-migrator module to help identify and temporarily migrate these, they must be permanently updated.
• Spring Security 6.0: The upgrade includes a move to Spring Security 6.0, which has its own set of breaking changes, including changes to how security filters are applied.

Recommendation:
This is a high-effort migration. Do not merge without a dedicated plan. Developers must:

1. Upgrade the project's JDK to 17 or later.
2. Perform a project-wide refactoring to replace all javax.* imports with jakarta.*.
3. Review and update all third-party dependencies for Jakarta EE and Spring Boot 3 compatibility.
4. Update application.properties/application.yml files according to the new configuration property names.
5. Consult the official Spring Boot 3.0 Migration Guide for detailed instructions.

Source: Spring Boot 3.0 Migration Guide

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.