It is not possible to update the runtime, web_config, and db plugin without restarting Spamato.
Runtime + web_config: both are still running when handling the update-call from the web_config itself. It would be necessary to call the update mechanism "asynchronously" somehow, maybe via a special (AJAX?) html update page.
db: derby has its own plugin/classloading mechanism. This doesn't allow to wrap the jar file into the plugin. Additionally, restarting the db plugin is not possible as the EmbeddedDriver is not released (although we call System.gc() as stated on the Derby pages).