feature: upgrade to Java 25 & Spring Boot 3.5.x (pom.xml)

[devin-ai-integration]

Summary

Upgrades the Maven build to Java 25 and Spring Boot 3.5.16 (latest stable 3.5.x on Maven Central, published 2026-06-25). Scoped to pom.xml only — no changes to Dockerfile, docker-compose, README, helm, or kubernetes files.

Chosen Spring Boot version: 3.5.16. The Spring Boot parent transitively manages Hibernate/Tomcat and the JDBC driver, so none of those are pinned manually.

Changes (pom.xml)

1. Bumped spring-boot-starter-parent 3.3.3 → 3.5.16.
2. Set <java.version>17</java.version> → <java.version>25</java.version>.
3. Removed the redundant maven-compiler-plugin block entirely (it hardcoded <source>1.8</source>/<target>1.8</target>); compilation is now managed by the Spring Boot parent via java.version=25.
4. Replaced the deprecated MySQL connector coordinate and dropped the explicit version so the Spring Boot BOM manages it:
   • mysql:mysql-connector-java:8.0.33 → com.mysql:mysql-connector-j (resolves to 9.7.0 via the BOM; kept <scope>runtime</scope>).

-<version>3.3.3</version>            (parent)
+<version>3.5.16</version>
-<java.version>17</java.version>
+<java.version>25</java.version>
-<groupId>mysql</groupId>
-<artifactId>mysql-connector-java</artifactId>
-<version>8.0.33</version>
+<groupId>com.mysql</groupId>
+<artifactId>mysql-connector-j</artifactId>
- <!-- maven-compiler-plugin 3.8.0 with source/target 1.8 override removed -->

Verification

Built and tested on Temurin JDK 25 (25.0.3+9-LTS) against a real MySQL 8 on localhost:3306.

./mvnw clean test:

[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
[INFO] BUILD SUCCESS

(The repo's suite is a single BankappApplicationTests.contextLoads() test — all green.)

App boots on JDK 25: ./mvnw spring-boot:run serves http://localhost:8080 with the login page at /login.

CI note — license/snyk check

security/snyk passes. license/snyk fails on 1 license issue: GPL-2.0 (copyleft) on com.mysql:mysql-connector-j.

This is not a new licensing risk. The base DevOps branch already ships the MySQL connector under the same license (mysql-connector-java:8.0.33 is also "GPL v2 with Universal FOSS Exception v1.0"). The old artifact declared its license only in a free-text POM comment that Snyk could not parse, whereas the new mysql-connector-j artifact declares GPL-2.0 in structured <licenses> metadata — so Snyk now detects the pre-existing copyleft license and the org policy flags it as "new".

The GPL license is inherent to Oracle's MySQL JDBC driver regardless of coordinate. Clearing this check would require either reverting the (explicitly requested) connector coordinate change, switching to a different driver (e.g. MariaDB Connector/J, LGPL — a behavioral change out of scope for this pom-only PR), or adding a Snyk license-policy exception. Flagging for reviewer decision rather than working around the policy.

Link to Devin session: https://app.devin.ai/sessions/c1fa2223d05545429a087eb4748850bc
Requested by: @Colhodm

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring