Fix: Apache Tomcat Improper Input Validation vulnerability

[WesternConcrete]

Summary

Finding: Apache Tomcat Improper Input Validation vulnerability (CVE-2023-46589, GHSA-fccv-jmmp-qg76)
Repo: COG-GTM/ftgo-monolith

Fix approach: override the Spring Boot 2.0.3 BOM's tomcat.version (8.5.31, affected range 8.5.0–8.5.95) in gradle.properties so the embedded Tomcat resolves to 8.5.98, which contains the request-smuggling fix.

tomcat.version=8.5.98

Why 8.5.98 and not the latest 8.5.100: Tomcat 8.5.99+ made StandardServer.findServices() synchronize on servicesLock, which Spring Boot 2.0.x's TomcatWebServer.removeServiceConnectors() calls from the localhost-startStop-1 context-start thread while the main thread holds the same lock in StandardServer.startInternal(). Verified locally: with 8.5.100 the app deadlocks during Tomcat startup (jstack shows the two threads blocked on each other); with 8.5.98 startup proceeds identically to master.

Verification: ./gradlew :ftgo-application:dependencies shows tomcat-embed-core/el/websocket:8.5.31 -> 8.5.98; bootJar builds; the runtime log reports Starting Servlet engine: [Apache Tomcat/8.5.98] and the dispatcher servlet is mapped.

Link to Devin session: https://app.devin.ai/sessions/b21209f466c34d0db5dd23c559c9f641
Open in Devin Desktop: https://app.devin.ai/desktop/session/b21209f466c34d0db5dd23c559c9f641?variant=devin
Requested by: @WesternConcrete

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.