USPR-13964: bump org.apache.tomcat.embed:tomcat-embed-core minimum version to 11.0.25

[midnight-clue]

Context & Problem

GitHub Dependabot flagged critical vulnerability GHSA-gcx9-497g-6cp6 (Improper Access Control/Incorrect Authorization) in org.apache.tomcat.embed:tomcat-embed-core affecting versions >= 11.0.0-M1, < 11.0.25. See USPR-13964.

The repository already uses a resolutionStrategy.eachDependency override to enforce a minimum version, so the fix is to raise that floor from 11.0.22 to 11.0.25.

Solution

Updated the enforced minimum version from 11.0.22 to 11.0.25 in three files:

• root build.gradle: Updated the resolutionStrategy.eachDependency rule for org.apache.tomcat.embed:tomcat-embed-core (lines 46-50) to enforce version 11.0.25 and appended GHSA-gcx9-497g-6cp6 to the advisory list in the 'because' comment.
• examples/example-spring-boot-starter-web/build.gradle and examples/example-spring-boot-starter-webflux/build.gradle: Updated ext['tomcat.version'] from 11.0.22 to 11.0.25 in lockstep. These overrides are mandatory (Mechanism B) because both example modules apply the spring.dependency.management plugin, which creates strict BOM version constraints that would otherwise override the root resolutionStrategy floor.

Verification

• resolutionStrategy in root build.gradle forces tomcat-embed-core to >= 11.0.25 (verified in diff)
• Both example modules' ext['tomcat.version'] updated to 11.0.25 (verified in diff)
• Full test suite passes (checkstyleMain, checkstyleTest, pmdMain, pmdTest, test: BUILD SUCCESSFUL)
• dependencyInsight in example-spring-boot-starter-web resolves tomcat-embed-core to 11.0.25 ✓
• No other files in the repo pin tomcat-embed-core to a lower version

---

🔍 Braintrust trace