[Snyk] Fix for 3 vulnerabilities

[macroscope-cloud]

Snyk has created this PR to fix 3 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• examples/iOS-Hybrid-App-Java-Server/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Improperly Controlled Modification of Dynamically-Determined Object Attributes SNYK-JAVA-TOOLSJACKSONCORE-17457696	738	org.springframework.boot:spring-boot-starter-web: 4.0.0 -> 4.0.7 Proof of Concept
	Improper Authentication SNYK-JAVA-ORGAPACHETOMCATEMBED-17732890	726	org.apache.tomcat.embed:tomcat-embed-core: 11.0.22 -> 11.0.23 org.apache.tomcat.embed:tomcat-embed-websocket: 11.0.22 -> 11.0.23 No Known Exploit
	Detection of Error Condition Without Action SNYK-JAVA-ORGAPACHETOMCATEMBED-17733746	721	org.apache.tomcat.embed:tomcat-embed-core: 11.0.22 -> 11.0.23 org.apache.tomcat.embed:tomcat-embed-websocket: 11.0.22 -> 11.0.23 No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improper Authentication
🦉 Improperly Controlled Modification of Dynamically-Determined Object Attributes

[macroscope-cloud]

This set of upgrades includes patch releases for Apache Tomcat and Spring Boot. The overall risk is assessed as medium due to a specific breaking change in Tomcat.

org.apache.tomcat.embed:tomcat-embed-core & tomcat-embed-websocket (11.0.22 → 11.0.23)

• Risk: Medium
• This patch release introduces a specific breaking change in the EncryptInterceptor to add replay protection. While this enhances security, applications explicitly using this interceptor will be affected and may require configuration changes.
• Other changes are primarily bug fixes and minor improvements, such as aligning URL rewrite condition processing.

org.springframework.boot:spring-boot-starter-web (4.0.0 → 4.0.7)

• Risk: Low
• This is a patch release within the 4.0.x line. The release notes for 4.0.7 indicate it contains bug fixes, documentation improvements, and dependency upgrades.
• It addresses two security vulnerabilities (CVE-2026-40992 and CVE-2026-41001) but does not introduce breaking API changes for users already on Spring Boot 4.0.0.

Recommendation:
Verify if your application uses Tomcat's EncryptInterceptor. If it does not, this upgrade can be treated as low risk. No action is expected for the Spring Boot upgrade.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.