USPR-13797: bump spring-boot to 4.0.7 to fix spring-webmvc XSS vulnerability

[midnight-clue]

Context & Problem

GitHub Dependabot alert #132 flagged the transitive org.springframework:spring-webmvc dependency (currently resolving to 7.0.7) as vulnerable to a moderate Cross-Site Scripting issue via JSP Form Tags (GHSA-957g-f97v-vppc / CVE-2026-41846), where Spring's JSP form tags emit cssClass, cssErrorClass, and cssStyle attributes without HTML escaping. The dependency is pulled in transitively via the Spring Boot Gradle plugin / dependency-management BOM. The patched version is Spring Framework 7.0.8. See USPR-13797.

Solution

Bumped the spring-boot version in gradle/libs.versions.toml from 4.0.6 to 4.0.7. Spring Boot 4.0.7's dependency-management BOM manages org.springframework:spring-webmvc (and the rest of Spring Framework) to 7.0.8, which contains the fix — confirmed by inspecting the spring-boot-dependencies:4.0.7 POM (spring-framework.version=7.0.8). This is a first-party version catalog bump rather than a resolutionStrategy.eachDependency override (the pattern used elsewhere in root build.gradle for genuinely transitive third-party CVEs like netty/jackson/logback/tomcat), since Spring Boot's own version is already the single source of truth for the managed Spring Framework version in this repo.

Verification

• org.springframework:spring-webmvc resolves to >= 7.0.8 (fixes GHSA-957g-f97v-vppc) (verified via ./gradlew :spring-boot-starter:spring-boot-starter-web:dependencyInsight --dependency spring-webmvc --configuration testRuntimeClasspath)
• No regressions from the version bump (./gradlew checkstyleMain checkstyleTest pmdMain pmdTest test)

---

🔍 Braintrust trace