diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/mtx/sidecar/package.json b/app/multi-tenant/central-space/cloud-cap-samples-java/mtx/sidecar/package.json
index 55d89b3a..e1bff480 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/mtx/sidecar/package.json
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/mtx/sidecar/package.json
@@ -21,5 +21,8 @@
   "scripts": {
     "start": "cds-serve",
     "build": "cds build ../.. --for mtx-sidecar --production && cd gen && npm install"
+  },
+  "overrides": {
+    "commander": "2.20.3"
   }
 }
\ No newline at end of file
diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
index 125460c5..c2736dd1 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>3.2.6</version>
+		<version>3.5.16</version>
 		<relativePath/> <!-- lookup parent from repository -->
 	</parent>
 
@@ -28,6 +28,20 @@
 		<xsuaa.version>3.5.0</xsuaa.version>
 		<cf-java-logging-support.version>3.8.3</cf-java-logging-support.version>
 		<cds.install-cdsdk.version>9.8.0</cds.install-cdsdk.version>
+
+		<!-- SECURITY OVERRIDES (Black Duck) -->
+		<netty.version>4.2.17.Final</netty.version>
+		<bouncycastle.version>1.85</bouncycastle.version>
+		<nimbus-jose-jwt.version>9.48</nimbus-jose-jwt.version>
+		<jackson-bom.version>2.22.2</jackson-bom.version>
+		<micrometer.version>1.17.1</micrometer.version>
+		<opentelemetry.version>1.65.0</opentelemetry.version>
+		<logback.version>1.6.3</logback.version>
+		<tomcat.version>10.1.59</tomcat.version>
+		<httpclient5.version>5.6.4</httpclient5.version>
+		<httpcore5.version>5.4.3</httpcore5.version>
+		<kotlin.version>2.4.20</kotlin.version>
+		<ngdbc.version>2.29.7</ngdbc.version>
 	</properties>
 
 	<modules>
@@ -37,6 +51,98 @@
 
 	<dependencyManagement>
 		<dependencies>
+			<!-- SECURITY OVERRIDES (Black Duck): declared first so these versions win -->
+			<dependency>
+				<groupId>io.netty</groupId>
+				<artifactId>netty-bom</artifactId>
+				<version>${netty.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>com.fasterxml.jackson</groupId>
+				<artifactId>jackson-bom</artifactId>
+				<version>${jackson-bom.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>io.micrometer</groupId>
+				<artifactId>micrometer-bom</artifactId>
+				<version>${micrometer.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-bom</artifactId>
+				<version>${opentelemetry.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>org.jetbrains.kotlin</groupId>
+				<artifactId>kotlin-bom</artifactId>
+				<version>${kotlin.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-classic</artifactId>
+				<version>${logback.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-core</artifactId>
+				<version>${logback.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-core</artifactId>
+				<version>${tomcat.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-el</artifactId>
+				<version>${tomcat.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-websocket</artifactId>
+				<version>${tomcat.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.client5</groupId>
+				<artifactId>httpclient5</artifactId>
+				<version>${httpclient5.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5</artifactId>
+				<version>${httpcore5.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5-h2</artifactId>
+				<version>${httpcore5.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>${bouncycastle.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>${bouncycastle.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>com.nimbusds</groupId>
+				<artifactId>nimbus-jose-jwt</artifactId>
+				<version>${nimbus-jose-jwt.version}</version>
+			</dependency>
+
 			<!-- CDS SERVICES -->
 			<dependency>
 				<groupId>com.sap.cds</groupId>
@@ -72,6 +178,13 @@
 				<version>4.0.0</version>
 			</dependency>
 
+			<!-- HANA JDBC Driver (Black Duck license fix) -->
+			<dependency>
+				<groupId>com.sap.cloud.db.jdbc</groupId>
+				<artifactId>ngdbc</artifactId>
+				<version>${ngdbc.version}</version>
+			</dependency>
+
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/mtx/sidecar/package.json b/app/multi-tenant/personal-space/cloud-cap-samples-java/mtx/sidecar/package.json
index bc443138..f45fd29e 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/mtx/sidecar/package.json
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/mtx/sidecar/package.json
@@ -21,5 +21,8 @@
   "scripts": {
     "start": "cds-serve",
     "build": "cds build ../.. --for mtx-sidecar --production && cd gen && npm install"
+  },
+  "overrides": {
+    "commander": "2.20.3"
   }
 }
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
index c2c6df6a..47b49431 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>3.2.6</version>
+		<version>3.5.16</version>
 		<relativePath/> <!-- lookup parent from repository -->
 	</parent>
 
@@ -28,6 +28,20 @@
 		<xsuaa.version>3.5.0</xsuaa.version>
 		<cf-java-logging-support.version>3.8.3</cf-java-logging-support.version>
 		<cds.install-cdsdk.version>9.3.1</cds.install-cdsdk.version>
+
+		<!-- SECURITY OVERRIDES (Black Duck) -->
+		<netty.version>4.2.17.Final</netty.version>
+		<bouncycastle.version>1.85</bouncycastle.version>
+		<nimbus-jose-jwt.version>9.48</nimbus-jose-jwt.version>
+		<jackson-bom.version>2.22.2</jackson-bom.version>
+		<micrometer.version>1.17.1</micrometer.version>
+		<opentelemetry.version>1.65.0</opentelemetry.version>
+		<logback.version>1.6.3</logback.version>
+		<tomcat.version>10.1.59</tomcat.version>
+		<httpclient5.version>5.6.4</httpclient5.version>
+		<httpcore5.version>5.4.3</httpcore5.version>
+		<kotlin.version>2.4.20</kotlin.version>
+		<ngdbc.version>2.29.7</ngdbc.version>
 	</properties>
 
 	<modules>
@@ -37,6 +51,98 @@
 
 	<dependencyManagement>
 		<dependencies>
+			<!-- SECURITY OVERRIDES (Black Duck): declared first so these versions win -->
+			<dependency>
+				<groupId>io.netty</groupId>
+				<artifactId>netty-bom</artifactId>
+				<version>${netty.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>com.fasterxml.jackson</groupId>
+				<artifactId>jackson-bom</artifactId>
+				<version>${jackson-bom.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>io.micrometer</groupId>
+				<artifactId>micrometer-bom</artifactId>
+				<version>${micrometer.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-bom</artifactId>
+				<version>${opentelemetry.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>org.jetbrains.kotlin</groupId>
+				<artifactId>kotlin-bom</artifactId>
+				<version>${kotlin.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-classic</artifactId>
+				<version>${logback.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-core</artifactId>
+				<version>${logback.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-core</artifactId>
+				<version>${tomcat.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-el</artifactId>
+				<version>${tomcat.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-websocket</artifactId>
+				<version>${tomcat.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.client5</groupId>
+				<artifactId>httpclient5</artifactId>
+				<version>${httpclient5.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5</artifactId>
+				<version>${httpcore5.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5-h2</artifactId>
+				<version>${httpcore5.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>${bouncycastle.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>${bouncycastle.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>com.nimbusds</groupId>
+				<artifactId>nimbus-jose-jwt</artifactId>
+				<version>${nimbus-jose-jwt.version}</version>
+			</dependency>
+
 			<!-- CDS SERVICES -->
 			<dependency>
 				<groupId>com.sap.cds</groupId>
@@ -72,6 +178,13 @@
 				<version>4.0.0</version>
 			</dependency>
 
+			<!-- HANA JDBC Driver (Black Duck license fix) -->
+			<dependency>
+				<groupId>com.sap.cloud.db.jdbc</groupId>
+				<artifactId>ngdbc</artifactId>
+				<version>${ngdbc.version}</version>
+			</dependency>
+
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml
index 272527e3..c88da442 100644
--- a/app/single-tenant/central-space/demoapp/pom.xml
+++ b/app/single-tenant/central-space/demoapp/pom.xml
@@ -18,9 +18,22 @@
 		<!-- DEPENDENCIES VERSION -->
 		<jdk.version>21</jdk.version>
 		<cds.services.version>4.1.1</cds.services.version>
-		<spring.boot.version>3.3.1</spring.boot.version>
+		<spring.boot.version>3.5.16</spring.boot.version>
 		<cds.install-cdsdk.version>8.0.2</cds.install-cdsdk.version>
 
+		<!-- SECURITY OVERRIDES (Black Duck) -->
+		<netty.version>4.2.17.Final</netty.version>
+		<bouncycastle.version>1.85</bouncycastle.version>
+		<nimbus-jose-jwt.version>9.48</nimbus-jose-jwt.version>
+		<jackson-bom.version>2.22.2</jackson-bom.version>
+		<micrometer.version>1.17.1</micrometer.version>
+		<opentelemetry.version>1.65.0</opentelemetry.version>
+		<logback.version>1.6.3</logback.version>
+		<tomcat.version>10.1.59</tomcat.version>
+		<httpclient5.version>5.6.4</httpclient5.version>
+		<httpcore5.version>5.4.3</httpcore5.version>
+		<kotlin.version>2.4.20</kotlin.version>
+
 		<cds.install-node.downloadUrl>https://nodejs.org/dist/</cds.install-node.downloadUrl>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 	</properties>
@@ -31,6 +44,98 @@
 
 	<dependencyManagement>
 		<dependencies>
+			<!-- SECURITY OVERRIDES (Black Duck): declared FIRST so these versions win over the Spring Boot / CDS BOMs -->
+			<dependency>
+				<groupId>io.netty</groupId>
+				<artifactId>netty-bom</artifactId>
+				<version>${netty.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>com.fasterxml.jackson</groupId>
+				<artifactId>jackson-bom</artifactId>
+				<version>${jackson-bom.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>io.micrometer</groupId>
+				<artifactId>micrometer-bom</artifactId>
+				<version>${micrometer.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-bom</artifactId>
+				<version>${opentelemetry.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>org.jetbrains.kotlin</groupId>
+				<artifactId>kotlin-bom</artifactId>
+				<version>${kotlin.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-classic</artifactId>
+				<version>${logback.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-core</artifactId>
+				<version>${logback.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-core</artifactId>
+				<version>${tomcat.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-el</artifactId>
+				<version>${tomcat.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-websocket</artifactId>
+				<version>${tomcat.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.client5</groupId>
+				<artifactId>httpclient5</artifactId>
+				<version>${httpclient5.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5</artifactId>
+				<version>${httpcore5.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5-h2</artifactId>
+				<version>${httpcore5.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>${bouncycastle.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>${bouncycastle.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>com.nimbusds</groupId>
+				<artifactId>nimbus-jose-jwt</artifactId>
+				<version>${nimbus-jose-jwt.version}</version>
+			</dependency>
+
 			<!-- CDS SERVICES -->
 			<dependency>
 				<groupId>com.sap.cds</groupId>
diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml
index 272527e3..c88da442 100644
--- a/app/single-tenant/personal-space/demoapp/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/pom.xml
@@ -18,9 +18,22 @@
 		<!-- DEPENDENCIES VERSION -->
 		<jdk.version>21</jdk.version>
 		<cds.services.version>4.1.1</cds.services.version>
-		<spring.boot.version>3.3.1</spring.boot.version>
+		<spring.boot.version>3.5.16</spring.boot.version>
 		<cds.install-cdsdk.version>8.0.2</cds.install-cdsdk.version>
 
+		<!-- SECURITY OVERRIDES (Black Duck) -->
+		<netty.version>4.2.17.Final</netty.version>
+		<bouncycastle.version>1.85</bouncycastle.version>
+		<nimbus-jose-jwt.version>9.48</nimbus-jose-jwt.version>
+		<jackson-bom.version>2.22.2</jackson-bom.version>
+		<micrometer.version>1.17.1</micrometer.version>
+		<opentelemetry.version>1.65.0</opentelemetry.version>
+		<logback.version>1.6.3</logback.version>
+		<tomcat.version>10.1.59</tomcat.version>
+		<httpclient5.version>5.6.4</httpclient5.version>
+		<httpcore5.version>5.4.3</httpcore5.version>
+		<kotlin.version>2.4.20</kotlin.version>
+
 		<cds.install-node.downloadUrl>https://nodejs.org/dist/</cds.install-node.downloadUrl>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 	</properties>
@@ -31,6 +44,98 @@
 
 	<dependencyManagement>
 		<dependencies>
+			<!-- SECURITY OVERRIDES (Black Duck): declared FIRST so these versions win over the Spring Boot / CDS BOMs -->
+			<dependency>
+				<groupId>io.netty</groupId>
+				<artifactId>netty-bom</artifactId>
+				<version>${netty.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>com.fasterxml.jackson</groupId>
+				<artifactId>jackson-bom</artifactId>
+				<version>${jackson-bom.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>io.micrometer</groupId>
+				<artifactId>micrometer-bom</artifactId>
+				<version>${micrometer.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-bom</artifactId>
+				<version>${opentelemetry.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>org.jetbrains.kotlin</groupId>
+				<artifactId>kotlin-bom</artifactId>
+				<version>${kotlin.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-classic</artifactId>
+				<version>${logback.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-core</artifactId>
+				<version>${logback.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-core</artifactId>
+				<version>${tomcat.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-el</artifactId>
+				<version>${tomcat.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-websocket</artifactId>
+				<version>${tomcat.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.client5</groupId>
+				<artifactId>httpclient5</artifactId>
+				<version>${httpclient5.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5</artifactId>
+				<version>${httpcore5.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5-h2</artifactId>
+				<version>${httpcore5.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>${bouncycastle.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>${bouncycastle.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>com.nimbusds</groupId>
+				<artifactId>nimbus-jose-jwt</artifactId>
+				<version>${nimbus-jose-jwt.version}</version>
+			</dependency>
+
 			<!-- CDS SERVICES -->
 			<dependency>
 				<groupId>com.sap.cds</groupId>
diff --git a/pom.xml b/pom.xml
index c188cfe7..eaed4de9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -39,6 +39,11 @@
         <mockito-bom-version>5.15.2</mockito-bom-version>
         <assertj-core-version>3.27.7</assertj-core-version>
         <mockito-core-version>5.15.2</mockito-core-version>
+
+        <!-- SECURITY OVERRIDES (Black Duck): pin clean transitive versions -->
+        <netty.version>4.1.121.Final</netty.version>
+        <bouncycastle.version>1.85</bouncycastle.version>
+        <nimbus-jose-jwt.version>9.48</nimbus-jose-jwt.version>
     </properties>
 
     <groupId>com.sap.cds</groupId>
@@ -56,6 +61,31 @@
 
     <dependencyManagement>
         <dependencies>
+            <!-- SECURITY OVERRIDES (Black Duck): pin clean transitive versions.
+                 Imported/declared before other BOMs so these versions win. -->
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-bom</artifactId>
+                <version>${netty.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.bouncycastle</groupId>
+                <artifactId>bcprov-jdk18on</artifactId>
+                <version>${bouncycastle.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.bouncycastle</groupId>
+                <artifactId>bcpkix-jdk18on</artifactId>
+                <version>${bouncycastle.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>com.nimbusds</groupId>
+                <artifactId>nimbus-jose-jwt</artifactId>
+                <version>${nimbus-jose-jwt.version}</version>
+            </dependency>
+
             <dependency>
                 <groupId>com.sap.cds</groupId>
                 <artifactId>cds-services-bom</artifactId>
diff --git a/sdm/pom.xml b/sdm/pom.xml
index fb5a2d34..c7815f30 100644
--- a/sdm/pom.xml
+++ b/sdm/pom.xml
@@ -44,7 +44,7 @@
         <commons-codec-version>1.18.0</commons-codec-version>
         <jackson-core-version>2.18.6</jackson-core-version>
         <mockito-junit-jupiter-version>5.15.2</mockito-junit-jupiter-version>
-        <httpclient5-version>5.4.4</httpclient5-version>
+        <httpclient5-version>5.6.4</httpclient5-version>
         <httpcore5-version>5.4.3</httpcore5-version>
         <httpasyncclient-version>4.1.5</httpasyncclient-version>
         <httpcore-nio-version>4.4.16</httpcore-nio-version>