USPR-13801: pin org.springframework:spring-expression to 7.0.8 (GHSA-9f52-rjqv-25qv)

[midnight-clue]

Context & Problem

GitHub Dependabot alert #127 on getyourguide/openapi-validation-java flags org.springframework:spring-expression versions >= 7.0.0, <= 7.0.7 as vulnerable to GHSA-9f52-rjqv-25qv (Spring Framework Arbitrary Method Invocation in SpEL Expressions). The alert lists settings.gradle as the manifest, but spring-expression is not a direct dependency anywhere in the repo — it's pulled in transitively via the Spring Boot 4.0.6 dependency management (Spring Framework BOM). USPR-13801

Solution

Added a new resolutionStrategy.eachDependency override for org.springframework:spring-expression in the root build.gradle's existing subprojects security-pinning block, forcing useVersion('7.0.8'), following the exact same pattern used for the existing jackson/logback/tomcat-embed-core/netty overrides in that block.

Additionally, because the example modules apply Spring's io.spring.dependency-management plugin, which re-asserts dependency versions from the Spring Boot BOM after the root resolutionStrategy rules execute, we also added ext['spring-framework.version'] = '7.0.8' to both examples/example-spring-boot-starter-web/build.gradle and examples/example-spring-boot-starter-webflux/build.gradle. This follows the existing pattern already used for netty and tomcat version overrides in those files, ensuring the Spring dependency-management plugin respects our pinned version.

settings.gradle was intentionally left untouched — it has nothing to do with this dependency despite being listed as the alert's manifest path. No changes were needed to any other files.

Verification

• org.springframework:spring-expression resolves to 7.0.8 on spring-boot-starter-web's runtimeClasspath (./gradlew :spring-boot-starter:spring-boot-starter-web:dependencyInsight --dependency spring-expression --configuration runtimeClasspath: was 7.0.7, now 7.0.8 with upgrade arrow)
• org.springframework:spring-expression resolves to 7.0.8 on example-spring-boot-starter-web's runtimeClasspath (./gradlew :examples:example-spring-boot-starter-web:dependencyInsight --dependency spring-expression --configuration runtimeClasspath: was 7.0.7, now 7.0.8)
• org.springframework:spring-expression resolves to 7.0.8 on example-spring-boot-starter-webflux's runtimeClasspath (./gradlew :examples:example-spring-boot-starter-webflux:dependencyInsight --dependency spring-expression --configuration runtimeClasspath: was 7.0.7, now 7.0.8)
• Compiled boot JAR example-spring-boot-starter-web includes spring-expression-7.0.8.jar (was 7.0.7)
• Compiled boot JAR example-spring-boot-starter-webflux includes spring-expression-7.0.8.jar (was 7.0.7)
• settings.gradle left untouched
• Gradle build parses cleanly (./gradlew help -q)

---

🔍 Braintrust trace