[Snyk] Fix for 3 vulnerabilities

[macroscope-cloud]

Snyk has created this PR to fix 3 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• examples/iOS-Hybrid-App-Java-Server/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Improperly Controlled Modification of Dynamically-Determined Object Attributes SNYK-JAVA-TOOLSJACKSONCORE-17457696	738	org.springframework.boot:spring-boot-starter-json: 4.0.0 -> 4.0.7 Proof of Concept
	Improper Authentication SNYK-JAVA-ORGAPACHETOMCATEMBED-17732890	726	org.apache.tomcat.embed:tomcat-embed-core: 11.0.10 -> 11.0.23 org.apache.tomcat.embed:tomcat-embed-websocket: 11.0.10 -> 11.0.23 org.springframework.boot:spring-boot-starter-tomcat: 3.5.5 -> 4.0.0 Major version upgrade No Known Exploit
	Detection of Error Condition Without Action SNYK-JAVA-ORGAPACHETOMCATEMBED-17733746	721	org.apache.tomcat.embed:tomcat-embed-core: 11.0.10 -> 11.0.23 org.apache.tomcat.embed:tomcat-embed-websocket: 11.0.10 -> 11.0.23 org.springframework.boot:spring-boot-starter-tomcat: 3.5.5 -> 4.0.0 Major version upgrade No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improper Authentication
🦉 Improperly Controlled Modification of Dynamically-Determined Object Attributes

[macroscope-cloud]

The upgrade of spring-boot-starter-tomcat from version 3.5.5 to 4.0.0 is a major version change with significant breaking changes. The other package upgrades are minor patch releases and are considered low risk.

spring-boot-starter-tomcat 3.5.5 → 4.0.0 (High Risk)

This upgrade is part of the larger Spring Boot 4.0 release, which is built on Spring Framework 7 and introduces numerous breaking changes.

Key Breaking Changes:

• Java Baseline: Spring Boot 4.0 requires a minimum of Java 21. Your build environment, CI/CD pipelines, and base Docker images must be updated.
• Jakarta EE 11: The framework now requires Jakarta EE 11 and a Servlet 6.1 baseline.
• Jackson 3 Upgrade: Spring Boot 4.0 migrates from Jackson 2 to Jackson 3. This includes new package names (e.g., com.fasterxml.jackson is now tools.jackson), which will require code refactoring for any direct usage of Jackson APIs. The upgrade of spring-boot-starter-json is tied to this change.
• Removed Undertow Support: Support for Undertow as an embedded server has been removed. While this project uses Tomcat, it highlights the significance of the changes in this release.
• Configuration Properties: Numerous configuration properties have been renamed or removed.
• Removed APIs: All APIs that were deprecated in the Spring Boot 3.x release cycle have been removed in version 4.0.

tomcat-embed-core & tomcat-embed-websocket 11.0.10 → 11.0.23 (Low Risk)
This is a patch-level upgrade containing bug fixes and minor improvements with no documented breaking changes.

spring-boot-starter-json 4.0.0 → 4.0.7 (Low Risk)
This patch release includes bug fixes, documentation improvements, and dependency upgrades, including fixes for two CVEs.

Recommendation:
This is a major refactoring effort that requires careful planning. Before upgrading to Spring Boot 4.0, it is strongly recommended to first upgrade to the latest 3.5.x release and resolve all deprecation warnings. Utilize the spring-boot-properties-migrator module to identify and manage changes to configuration properties.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.