[Snyk] Fix for 2 vulnerabilities

[macroscope-cloud]

Snyk has created this PR to fix 2 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• examples/iOS-Hybrid-App-Java-Server/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-TOOLSJACKSONCORE-18170128	828	org.springframework.boot:spring-boot-starter-json: 4.0.4 -> 4.0.7 Proof of Concept
	Deserialization of Untrusted Data SNYK-JAVA-ORGSPRINGFRAMEWORK-18326609	746	org.springframework:spring-web: 6.2.17 -> 6.2.19 No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Deserialization of Untrusted Data
🦉 Allocation of Resources Without Limits or Throttling

[macroscope-cloud]

This upgrade includes two patch-level updates for Spring components. The overall risk is assessed as medium due to a new security feature in spring-web that could introduce a behavioral change.

• org.springframework.boot:spring-boot-starter-json 4.0.4 → 4.0.7 (Low Risk): This is a patch release that includes bug fixes, documentation improvements, and dependency upgrades. [3] According to Spring's compatibility policy, patch releases are designed to be backward-compatible and should not contain breaking changes. [1, 8]

• org.springframework:spring-web 6.2.17 → 6.2.19 (Medium Risk): This is a critical security update that addresses numerous CVEs, including denial of service, path traversal, and cross-site scripting vulnerabilities. [12] While it is a patch release, it introduces a new default limit on the number of operations in Spring Expression Language (SpEL) evaluations to prevent denial-of-service attacks. [10] This is a behavioral change that could impact applications performing extremely complex SpEL evaluations.

Recommendation: After upgrading, verify that any application functionality relying on complex Spring Expression Language (SpEL) evaluations continues to function as expected. The new operation limit is configurable if needed. [10]

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.