This is a minor bug but...

The HttpServletStreamableServerTransportProvider class claim to support the old protocol version 2024-11-05 (in the protocolVersions() method) but it does not. The doGet method does not allow to initialize a sessions without a previous POST initialization (as state in the 2024 transport sequence diagram...).

(By the way the latest protocol version is ambiguous about how the sessions can be initialized... see modelcontextprotocol/modelcontextprotocol#1997 )