upgrade spring.framework to latest 5.2.3 to avoid CVE-2020-5398/7