bump spring for CVE-2026-24734 (tomcat is already correct for this spring version)

[labkey-willm]

Rationale

bump spring for CVE-2026-24734 (tomcat is already correct for this spring version)

this PR is on hold until spring AI is updated to pull the patched version of spring framework, as 2.0.0-M2 is currently pulling 4.0.1 which pulls tomcat 11.0.15

org.apache.tomcat.embed:tomcat-embed-core:11.0.15
+--- org.apache.tomcat.embed:tomcat-embed-websocket:11.0.15
|    \--- org.springframework.boot:spring-boot-starter-tomcat-runtime:4.0.1
|         \--- org.springframework.boot:spring-boot-starter-tomcat:4.0.1
|              \--- org.springframework.boot:spring-boot-starter-web:4.0.1
|                   \--- org.springframework.ai:spring-ai-starter-mcp-server-webmvc:2.0.0-M2
|                        \--- external
+--- org.springframework.boot:spring-boot-starter-tomcat-runtime:4.0.1 (*)
\--- org.springframework.boot:spring-boot-tomcat:4.0.1
     +--- org.springframework.boot:spring-boot-starter-tomcat:4.0.1 (*)
     \--- org.springframework.boot:spring-boot-starter-tomcat-runtime:4.0.1 (*)

Related Pull Requests

• bump spring and tomcat for CVE-2026-24734 #1289

Changes