USPR-13800: enforce patched spring-expression version (GHSA-r5w3-xv2f-j59q)

[midnight-clue]

Context & Problem

Dependabot alert 128 flagged org.springframework:spring-expression as vulnerable to GHSA-r5w3-xv2f-j59q (CVE-2026-41850): applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service, where a specially crafted expression can trigger excessive resource consumption during evaluation. This affects Spring Framework 7.0.0 through 7.0.7 (among other lines), fixed in 7.0.8. See USPR-13800.

Solution

Added a new resolutionStrategy.eachDependency block to the root build.gradle, following the exact same pattern already used for jackson/logback/tomcat/netty security floors in this repo: if a resolved org.springframework:spring-expression version is below 7.0.8, force it to 7.0.8 via useVersion(...), with a because(...) comment citing GHSA-r5w3-xv2f-j59q.

The example subprojects (examples/example-spring-boot-starter-web, examples/example-spring-boot-starter-webflux) apply the spring-dependency-management Gradle plugin, whose BOM-managed spring-framework.version property otherwise wins over the root resolutionStrategy.eachDependency override in those modules (the same precedence issue already known for netty/jackson/logback/tomcat in this repo). Verified via ./gradlew :examples:...:dependencies that spring-expression stayed pinned at 7.0.7 in the examples with only the resolutionStrategy block in place. Fixed by adding ext['spring-framework.version'] = '7.0.8' to both example build.gradle files, alongside the existing ext[] BOM overrides for jackson/logback/netty/tomcat.

Also added a verifySpringExpressionVersion Gradle task, registered per-subproject and wired into check, that resolves each subproject's configurations and fails the build if any org.springframework:spring-expression artifact is below the enforced 7.0.8 floor — giving this change automated, repo-wide coverage rather than relying on manual dependency-tree inspection.

Verification

• org.springframework:spring-expression resolutionStrategy override added forcing >= 7.0.8 (build.gradle)
• Existing jackson/logback/tomcat/netty blocks left untouched
• ext['spring-framework.version'] = '7.0.8' added to both example subprojects to close the BOM-precedence gap
• ./gradlew :examples:example-spring-boot-starter-web:dependencies --configuration runtimeClasspath and the webflux equivalent confirm spring-expression now resolves to 7.0.8 (was 7.0.7)
• ./gradlew :spring-boot-starter:spring-boot-starter-web:dependencies --configuration compileClasspath confirms spring-expression resolves to 7.0.8 in the library modules
• New verifySpringExpressionVersion task added, wired into check for every subproject, and passes cleanly

🔍 Braintrust trace