Requirements

GATool needs Java 21 or newer, Spring Boot 4.1.x and Spring AI 2.0.x from 2.0.1. Spring AI 2.0.1 fixes CVE-2026-59279 and CVE-2026-59318. The auto-configuration is compiled against Spring Boot 4.1 and Spring AI 2.0 APIs, so Spring Boot 4.0.x and Spring AI 1.x are unsupported. Startup warns where the application runs a Spring Boot or Spring AI line this release did not test. The warning names the tested lines and the versions found. The Model Context Protocol (MCP) starter needs Spring MVC, which means a servlet web application. Every guard in front of the endpoint is a servlet filter. With both stacks present, Boot runs the servlet stack, and GATool serves MCP there. Startup warns and names the WebFilter, SecurityWebFilterChain and reactive RouterFunction beans that stay unserved. With spring.main.web-application-type=reactive set, startup stops. The message says so and points at the in-process starter. That starter's tools run without those filters. The endpoint reads JWT access tokens only. The build runs on Java 21 and Java 25, and the release build runs on Java 21.

This release runs on the JVM. GATool has yet to be run in a GraalVM native image. The starters ship without runtime hints for the operation folders. With gatool.dev.experimental.generate-tools set to dynamic-three-step, which generates the dynamic tools, startup stops inside a native image and names the property. Spring Boot documents a faster start on the JVM under AOT Cache and CDS. That page covers the AOT cache on Java 25 and class data sharing on Java 21.

Tomcat's version comes from your build. The MCP starter brings Tomcat through Spring AI's WebMVC server starter. It leaves the Tomcat version to the Spring Boot release your application builds on. An application on Spring Boot 4.1.1 therefore runs Tomcat 11.0.24. Three advisories affect that version: GHSA-9xv2-5v5q-p794 in the DIGEST authenticator, GHSA-h3x4-894j-xpx5 in the FORM authenticator, and GHSA-gcx9-497g-6cp6 in access control. Tomcat 11.0.25 fixes all three. GATool's own build and tests run on Tomcat 11.0.26. The SBOM of a release lists 11.0.26, because it records what GATool was built with. Your application's dependency tree shows the version it runs:

./mvnw dependency:tree -Dincludes=org.apache.tomcat.embed

Until a Spring Boot release manages Tomcat 11.0.25 or later, set the version in your own build. With spring-boot-starter-parent as the parent, one property sets it:

<properties>
    <tomcat.version>11.0.26</tomcat.version>
</properties>

With spring-boot-dependencies imported as a BOM, manage tomcat-embed-core, tomcat-embed-el and tomcat-embed-websocket at 11.0.26 ahead of the import. Maven resolves an imported POM's properties against that POM. A property in your build does not reach it. With Gradle and Spring's dependency management plugin, ext['tomcat.version'] = '11.0.26' sets it.