USPR-13799: pin org.springframework:spring-core minimum version to 7.0.8 (GHSA-659m-px2c-25wj)

[midnight-clue]

Context & Problem

GitHub Dependabot flagged a low-severity Denial of Service vulnerability (GHSA-659m-px2c-25wj) in
org.springframework:spring-core versions 7.0.0-7.0.7 (Dependabot alert #129). It's pulled in
transitively via Spring Boot 4.0.6 (spring-boot = "4.0.6" in gradle/libs.versions.toml), whose
dependency-management BOM pins spring-framework.version to 7.0.7. The fix is available in
spring-core 7.0.8.

USPR-13799

Solution

Added a resolutionStrategy.eachDependency override for org.springframework:spring-core >= 7.0.8
in the root build.gradle's existing security-pin block, following the same useVersion() +
because() pattern already used there for tools.jackson.core, jackson-databind, logback,
tomcat-embed-core, and io.netty.

That alone was not sufficient for the two example modules (examples/example-spring-boot-starter-web
and examples/example-spring-boot-starter-webflux), because they apply the
spring-dependency-management Gradle plugin, whose BOM-managed spring-framework.version property
takes precedence over resolutionStrategy.eachDependency in those subprojects — the same precedence
behavior already handled for netty/jackson/logback/tomcat via their own ext['<property>.version']
overrides in those files. Added ext['spring-framework.version'] = '7.0.8' to both example
build.gradle files to match.

Went with a targeted resolutionStrategy/ext pin rather than bumping the whole Spring Boot version,
since that isn't necessary for this narrow low-severity fix and could introduce unrelated changes.

Verification

• org.springframework:spring-core resolves to 7.0.8 in spring-boot-starter/spring-boot-starter-webflux (./gradlew :spring-boot-starter:spring-boot-starter-webflux:dependencies --configuration runtimeClasspath)
• org.springframework:spring-core resolves 7.0.7 -> 7.0.8 in examples/example-spring-boot-starter-web (./gradlew :examples:example-spring-boot-starter-web:dependencies --configuration runtimeClasspath)
• org.springframework:spring-core resolves 7.0.7 -> 7.0.8 in examples/example-spring-boot-starter-webflux (./gradlew :examples:example-spring-boot-starter-webflux:dependencies --configuration runtimeClasspath)
• Existing netty (4.2.16.Final) and jackson (3.1.5 floor) security pins unaffected after rebase onto latest main
• ./gradlew checkstyleMain checkstyleTest pmdMain pmdTest test passes

---

🔍 Braintrust trace