[Snyk] Security upgrade org.springframework.boot:spring-boot-starter-web from 3.2.4 to 3.5.15

[macroscope-cloud]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• examples/iOS-Hybrid-App-Java-Server/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-COMFASTERXMLJACKSONCORE-18517159	828	org.springframework.boot:spring-boot-starter-web: 3.2.4 -> 3.5.15 Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[macroscope-cloud]

Upgrading from Spring Boot 3.2.4 to 3.5.15 is a high-risk change that spans multiple feature releases (3.3, 3.4, and 3.5). It includes significant dependency upgrades, behavioral changes, and deprecations that require developer action.

Key Changes in Spring Boot 3.3:

• Prometheus Client 1.x: Upgrades to Prometheus Client 1.x, which includes breaking changes such as modified metric names. If you use the Prometheus Push Gateway, it is not supported with the 1.x client. You may need to adjust your Micrometer dependencies to continue using the 0.x client.
• Flyway 10: Upgrades to Flyway 10, which is more modular. You must now add database-specific dependencies if you use databases like PostgreSQL, DB2, Derby, HSQLDB, and others.
• Removed Dependency Management: Management for Dropwizard Metrics and OkHttp has been removed in subsequent versions. If you use these libraries, you must now manage their versions directly in your build configuration.

Key Changes in Spring Boot 3.4:

• @ConditionalOnBean Behavior: The behavior of @ConditionalOnBean and @ConditionalOnMissingBean has changed, which could affect how your conditional beans are registered.
• Configuration Properties Validation: Validation for @ConfigurationProperties now strictly requires an accompanying @Valid annotation to cascade to nested properties.

Key Changes in Spring Boot 3.5:

• TaskExecutor Bean Renamed: The auto-configured TaskExecutor bean named taskExecutor has been removed. Code should be updated to reference applicationTaskExecutor instead.
• Stricter Profile Naming: Validation rules for profile names are now more restrictive.

Recommendation:
Due to the number of breaking changes, a direct upgrade is not recommended. Review the official release notes for each version (3.3, 3.4, 3.5) thoroughly. Pay close attention to the dependency upgrades for Prometheus and Flyway, and audit your code for the use of the taskExecutor bean and @ConditionalOnBean annotations.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.