Fix: Spring Framework range requests denial of service (CVE-2018-15756)

[WesternConcrete]

Summary

Finding: Spring Framework range requests denial of service (CVE-2018-15756)
Repository: COG-GTM/ftgo-monolith

Fix approach: force every org.springframework:*:5.0.x artifact to 5.0.20.RELEASE (last 5.0.x, fix landed in 5.0.10) via a resolutionStrategy.eachDependency rule applied to all subprojects, so the ResourceHttpRequestHandler that serves ftgo-application/src/main/resources/static/* no longer materialises unbounded overlapping Range regions.

• gradle.properties: new springFrameworkVersion=5.0.20.RELEASE (Spring Boot stays on 2.0.3.RELEASE, which is compatible with any 5.0.x).
• build.gradle subprojects {}: the rule is scoped to group org.springframework with a requested 5.0.* version, so org.springframework.boot / org.springframework.data and the modules that declare starters without the Boot plugin are all covered by Gradle conflict resolution.

Note: Maven Central returned HTTP 429 from the sandbox, so dependency resolution could not be verified locally; CircleCI runs ./gradlew testClasses and the full build.

Link to Devin session: https://app.devin.ai/sessions/8f50a29dd13b45e18ae3f3bbe096384e
Open in Devin Desktop: https://app.devin.ai/desktop/session/8f50a29dd13b45e18ae3f3bbe096384e?variant=devin
Requested by: @WesternConcrete

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.