move spring to dependencyManagement section