A Snyk PR check flagged many vulnerabilities, and separately an AI PR reviewer warned that a JWT library had been downgraded — which could reintroduce fixed CVEs and conflict with the Spring Boot BOM-managed version.
02
Task
Remediate the real vulnerabilities without destabilizing dependency resolution.
03
Action
I read the SCA report and the pom.xml, reasoned about which findings were mature with known fixes, and wrote a remediation plan document — then implemented it strictly against the plan without editing it mid-flight.
A manual version pin can silently downgrade a transitive dependency below the BOM-managed, CVE-fixed version.Prefer BOM-managed versionsxml
<!-- A hard pin here can DOWN-grade a transitive dep and reintroduce a CVE -->
<!-- <dependency> ... <version>9.x-older</version> </dependency> -->
<!-- Instead: let the Spring Boot BOM manage the version, and only pin when
you have verified the pin does not undo a security fix. -->
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
</dependency>
04
Result
Closed the actionable vulnerabilities and resolved the version conflict deliberately, rather than reflexively bumping versions.
Kept a clear paper trail of why each change was made.
Reconciled the pinned version against the BOM so the transitive fix stayed in place.