USPR-13807: bump spring-boot to 4.0.7 to resolve spring-webmvc/spring-webflux information disclosure vulnerability

[midnight-clue]

Context & Problem

GitHub Dependabot flagged Information Disclosure vulnerability GHSA-mq64-j8f9-9gcj (Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux) as Dependabot alerts #117 (org.springframework:spring-webmvc) and #118 (org.springframework:spring-webflux), affecting Spring Framework 7.0.0-7.0.7. Both spring-webmvc and spring-webflux are transitive dependencies pulled in via the Spring Boot BOM in this repo. See USPR-13807.

Solution

spring-webmvc and spring-webflux are managed transitively by the Spring Boot BOM (org.springframework.boot plugin + io.spring.dependency-management), whose version is declared once in gradle/libs.versions.toml. Verified against the actual Maven Central POMs that spring-boot-dependencies 4.0.6 (previous) manages Spring Framework 7.0.7 (vulnerable), while 4.0.7 manages Spring Framework 7.0.8 (patched) — the earliest 4.0.x patch release with the fix. Bumped spring-boot = "4.0.6" → spring-boot = "4.0.7" in gradle/libs.versions.toml. No ext['spring-framework.version'] or resolutionStrategy override exists anywhere in the repo for Spring Framework, so this single-line BOM bump is the complete fix — no additional lockstep changes needed in the example modules.

Verification

• spring-webmvc resolves to >= 7.0.8 (Dependabot alert Bump com.atlassian.oai:swagger-request-validator-core from 2.40.0 to 2.41.0 #117 resolved) — verified via ./gradlew :spring-boot-starter:spring-boot-starter-web:dependencies --configuration compileClasspath and :examples:example-spring-boot-starter-web:dependencies --configuration runtimeClasspath, both showing 7.0.8
• spring-webflux resolves to >= 7.0.8 (Dependabot alert Bump org.springframework.boot from 3.3.0 to 3.3.1 #118 resolved) — verified via ./gradlew :spring-boot-starter:spring-boot-starter-webflux:dependencies --configuration compileClasspath and :examples:example-spring-boot-starter-webflux:dependencies --configuration runtimeClasspath, both showing 7.0.8
• No regressions — ./gradlew test passed (56 tasks, BUILD SUCCESSFUL)

---

🔍 Braintrust trace

[clue-gyg]

✅ Auto-approved as trivial change

Single-line version bump in gradle/libs.versions.toml (spring-boot 4.0.6 → 4.0.7), a version field update in a dependency manifest with no new dependencies added/removed, well within the size exception for such changes and addressing a known CVE.