From aeee2691100dc5d58f2b1b4d47293db628619d8e Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Tue, 8 Sep 2026 11:03:36 +0530 Subject: [PATCH 1/9] update versions --- .../cloud-cap-samples-java/pom.xml | 31 ++++++++++++++++++- .../cloud-cap-samples-java/pom.xml | 31 ++++++++++++++++++- .../central-space/demoapp/pom.xml | 31 ++++++++++++++++++- .../personal-space/demoapp/pom.xml | 31 ++++++++++++++++++- pom.xml | 30 ++++++++++++++++++ 5 files changed, 150 insertions(+), 4 deletions(-) diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml index 125460c5..0be9ae20 100644 --- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml @@ -6,7 +6,7 @@ org.springframework.boot spring-boot-starter-parent - 3.2.6 + 3.5.3 @@ -28,6 +28,11 @@ 3.5.0 3.8.3 9.8.0 + + + 4.1.121.Final + 1.80 + 9.48 @@ -37,6 +42,30 @@ + + + io.netty + netty-bom + ${netty.version} + pom + import + + + org.bouncycastle + bcprov-jdk18on + ${bouncycastle.version} + + + org.bouncycastle + bcpkix-jdk18on + ${bouncycastle.version} + + + com.nimbusds + nimbus-jose-jwt + ${nimbus-jose-jwt.version} + + com.sap.cds diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml index c2c6df6a..8f5508ec 100644 --- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml @@ -6,7 +6,7 @@ org.springframework.boot spring-boot-starter-parent - 3.2.6 + 3.5.3 @@ -28,6 +28,11 @@ 3.5.0 3.8.3 9.3.1 + + + 4.1.121.Final + 1.80 + 9.48 @@ -37,6 +42,30 @@ + + + io.netty + netty-bom + ${netty.version} + pom + import + + + org.bouncycastle + bcprov-jdk18on + ${bouncycastle.version} + + + org.bouncycastle + bcpkix-jdk18on + ${bouncycastle.version} + + + com.nimbusds + nimbus-jose-jwt + ${nimbus-jose-jwt.version} + + com.sap.cds diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml index 272527e3..9b22aafb 100644 --- a/app/single-tenant/central-space/demoapp/pom.xml +++ b/app/single-tenant/central-space/demoapp/pom.xml @@ -18,9 +18,14 @@ 21 4.1.1 - 3.3.1 + 3.5.3 8.0.2 + + 4.1.121.Final + 1.80 + 9.48 + https://nodejs.org/dist/ UTF-8 @@ -48,6 +53,30 @@ pom import + + + + io.netty + netty-bom + ${netty.version} + pom + import + + + org.bouncycastle + bcprov-jdk18on + ${bouncycastle.version} + + + org.bouncycastle + bcpkix-jdk18on + ${bouncycastle.version} + + + com.nimbusds + nimbus-jose-jwt + ${nimbus-jose-jwt.version} + diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml index 272527e3..9b22aafb 100644 --- a/app/single-tenant/personal-space/demoapp/pom.xml +++ b/app/single-tenant/personal-space/demoapp/pom.xml @@ -18,9 +18,14 @@ 21 4.1.1 - 3.3.1 + 3.5.3 8.0.2 + + 4.1.121.Final + 1.80 + 9.48 + https://nodejs.org/dist/ UTF-8 @@ -48,6 +53,30 @@ pom import + + + + io.netty + netty-bom + ${netty.version} + pom + import + + + org.bouncycastle + bcprov-jdk18on + ${bouncycastle.version} + + + org.bouncycastle + bcpkix-jdk18on + ${bouncycastle.version} + + + com.nimbusds + nimbus-jose-jwt + ${nimbus-jose-jwt.version} + diff --git a/pom.xml b/pom.xml index c188cfe7..0fdc47ba 100644 --- a/pom.xml +++ b/pom.xml @@ -39,6 +39,11 @@ 5.15.2 3.27.7 5.15.2 + + + 4.1.121.Final + 1.80 + 9.48 com.sap.cds @@ -56,6 +61,31 @@ + + + io.netty + netty-bom + ${netty.version} + pom + import + + + org.bouncycastle + bcprov-jdk18on + ${bouncycastle.version} + + + org.bouncycastle + bcpkix-jdk18on + ${bouncycastle.version} + + + com.nimbusds + nimbus-jose-jwt + ${nimbus-jose-jwt.version} + + com.sap.cds cds-services-bom From 87bdf381da87fd804620e773292e1fa9ad763865 Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Tue, 8 Sep 2026 15:53:10 +0530 Subject: [PATCH 2/9] version update --- app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml | 2 +- app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml | 2 +- app/single-tenant/central-space/demoapp/pom.xml | 2 +- app/single-tenant/personal-space/demoapp/pom.xml | 2 +- pom.xml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml index 0be9ae20..490e5fc7 100644 --- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml @@ -31,7 +31,7 @@ 4.1.121.Final - 1.80 + 1.85 9.48 diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml index 8f5508ec..ca1359c1 100644 --- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml @@ -31,7 +31,7 @@ 4.1.121.Final - 1.80 + 1.85 9.48 diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml index 9b22aafb..83a653dc 100644 --- a/app/single-tenant/central-space/demoapp/pom.xml +++ b/app/single-tenant/central-space/demoapp/pom.xml @@ -23,7 +23,7 @@ 4.1.121.Final - 1.80 + 1.85 9.48 https://nodejs.org/dist/ diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml index 9b22aafb..83a653dc 100644 --- a/app/single-tenant/personal-space/demoapp/pom.xml +++ b/app/single-tenant/personal-space/demoapp/pom.xml @@ -23,7 +23,7 @@ 4.1.121.Final - 1.80 + 1.85 9.48 https://nodejs.org/dist/ diff --git a/pom.xml b/pom.xml index 0fdc47ba..eaed4de9 100644 --- a/pom.xml +++ b/pom.xml @@ -42,7 +42,7 @@ 4.1.121.Final - 1.80 + 1.85 9.48 From f2f44864a17a17302f3c27294833d1357e0291ef Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Thu, 10 Sep 2026 09:48:28 +0530 Subject: [PATCH 3/9] Update pom.xml --- sdm/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sdm/pom.xml b/sdm/pom.xml index fb5a2d34..c7815f30 100644 --- a/sdm/pom.xml +++ b/sdm/pom.xml @@ -44,7 +44,7 @@ 1.18.0 2.18.6 5.15.2 - 5.4.4 + 5.6.4 5.4.3 4.1.5 4.4.16 From b48e8921aa5c03e5ed2970d67c14c44d6487b0c8 Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Thu, 10 Sep 2026 11:18:50 +0530 Subject: [PATCH 4/9] =?UTF-8?q?bump=20Spring=20Boot=203.5.3=20=E2=86=92=20?= =?UTF-8?q?3.5.16=20and=20Netty=204.1.121=20=E2=86=92=204.2.17=20in=20app?= =?UTF-8?q?=20modules?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses Critical/High security findings from BlackDuck scan: - Spring Boot 3.5.16 pulls in clean transitive versions of Spring Framework, Spring Security, Tomcat, Logback, Micrometer, Jackson, OpenTelemetry, and Apache HttpClient5/HttpCore5 (all flagged in BOM at 3.5.3 levels) - Netty bumped explicitly to 4.2.17.Final (was pinned at 4.1.121.Final) Updated apps: single-tenant central-space, single-tenant personal-space, multi-tenant central-space, multi-tenant personal-space --- app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml | 4 ++-- .../personal-space/cloud-cap-samples-java/pom.xml | 4 ++-- app/single-tenant/central-space/demoapp/pom.xml | 4 ++-- app/single-tenant/personal-space/demoapp/pom.xml | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml index 490e5fc7..54e8da97 100644 --- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml @@ -6,7 +6,7 @@ org.springframework.boot spring-boot-starter-parent - 3.5.3 + 3.5.16 @@ -30,7 +30,7 @@ 9.8.0 - 4.1.121.Final + 4.2.17.Final 1.85 9.48 diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml index ca1359c1..58cb2071 100644 --- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml @@ -6,7 +6,7 @@ org.springframework.boot spring-boot-starter-parent - 3.5.3 + 3.5.16 @@ -30,7 +30,7 @@ 9.3.1 - 4.1.121.Final + 4.2.17.Final 1.85 9.48 diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml index 83a653dc..344c4687 100644 --- a/app/single-tenant/central-space/demoapp/pom.xml +++ b/app/single-tenant/central-space/demoapp/pom.xml @@ -18,11 +18,11 @@ 21 4.1.1 - 3.5.3 + 3.5.16 8.0.2 - 4.1.121.Final + 4.2.17.Final 1.85 9.48 diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml index 83a653dc..344c4687 100644 --- a/app/single-tenant/personal-space/demoapp/pom.xml +++ b/app/single-tenant/personal-space/demoapp/pom.xml @@ -18,11 +18,11 @@ 21 4.1.1 - 3.5.3 + 3.5.16 8.0.2 - 4.1.121.Final + 4.2.17.Final 1.85 9.48 From 2f7e7ae475eeb9827f984e2256df7c99624bbdb5 Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Thu, 10 Sep 2026 12:05:08 +0530 Subject: [PATCH 5/9] force clean transitive versions for remaining Black Duck Critical/High findings --- .../cloud-cap-samples-java/pom.xml | 68 +++++++++++++ .../cloud-cap-samples-java/pom.xml | 68 +++++++++++++ .../central-space/demoapp/pom.xml | 96 ++++++++++++++++--- .../personal-space/demoapp/pom.xml | 96 ++++++++++++++++--- 4 files changed, 300 insertions(+), 28 deletions(-) diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml index 54e8da97..28bbefc0 100644 --- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml @@ -33,6 +33,13 @@ 4.2.17.Final 1.85 9.48 + 2.22.2 + 1.17.1 + 1.65.0 + 1.6.3 + 10.1.59 + 5.6.4 + 5.4.3 @@ -50,6 +57,67 @@ pom import + + com.fasterxml.jackson + jackson-bom + ${jackson-bom.version} + pom + import + + + io.micrometer + micrometer-bom + ${micrometer.version} + pom + import + + + io.opentelemetry + opentelemetry-bom + ${opentelemetry.version} + pom + import + + + ch.qos.logback + logback-classic + ${logback.version} + + + ch.qos.logback + logback-core + ${logback.version} + + + org.apache.tomcat.embed + tomcat-embed-core + ${tomcat.version} + + + org.apache.tomcat.embed + tomcat-embed-el + ${tomcat.version} + + + org.apache.tomcat.embed + tomcat-embed-websocket + ${tomcat.version} + + + org.apache.httpcomponents.client5 + httpclient5 + ${httpclient5.version} + + + org.apache.httpcomponents.core5 + httpcore5 + ${httpcore5.version} + + + org.apache.httpcomponents.core5 + httpcore5-h2 + ${httpcore5.version} + org.bouncycastle bcprov-jdk18on diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml index 58cb2071..85dc117c 100644 --- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml @@ -33,6 +33,13 @@ 4.2.17.Final 1.85 9.48 + 2.22.2 + 1.17.1 + 1.65.0 + 1.6.3 + 10.1.59 + 5.6.4 + 5.4.3 @@ -50,6 +57,67 @@ pom import + + com.fasterxml.jackson + jackson-bom + ${jackson-bom.version} + pom + import + + + io.micrometer + micrometer-bom + ${micrometer.version} + pom + import + + + io.opentelemetry + opentelemetry-bom + ${opentelemetry.version} + pom + import + + + ch.qos.logback + logback-classic + ${logback.version} + + + ch.qos.logback + logback-core + ${logback.version} + + + org.apache.tomcat.embed + tomcat-embed-core + ${tomcat.version} + + + org.apache.tomcat.embed + tomcat-embed-el + ${tomcat.version} + + + org.apache.tomcat.embed + tomcat-embed-websocket + ${tomcat.version} + + + org.apache.httpcomponents.client5 + httpclient5 + ${httpclient5.version} + + + org.apache.httpcomponents.core5 + httpcore5 + ${httpcore5.version} + + + org.apache.httpcomponents.core5 + httpcore5-h2 + ${httpcore5.version} + org.bouncycastle bcprov-jdk18on diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml index 344c4687..1839a467 100644 --- a/app/single-tenant/central-space/demoapp/pom.xml +++ b/app/single-tenant/central-space/demoapp/pom.xml @@ -25,6 +25,13 @@ 4.2.17.Final 1.85 9.48 + 2.22.2 + 1.17.1 + 1.65.0 + 1.6.3 + 10.1.59 + 5.6.4 + 5.4.3 https://nodejs.org/dist/ UTF-8 @@ -36,32 +43,75 @@ - + - com.sap.cds - cds-services-bom - ${cds.services.version} + io.netty + netty-bom + ${netty.version} pom import - - - org.springframework.boot - spring-boot-dependencies - ${spring.boot.version} + com.fasterxml.jackson + jackson-bom + ${jackson-bom.version} pom import - - - io.netty - netty-bom - ${netty.version} + io.micrometer + micrometer-bom + ${micrometer.version} pom import + + io.opentelemetry + opentelemetry-bom + ${opentelemetry.version} + pom + import + + + ch.qos.logback + logback-classic + ${logback.version} + + + ch.qos.logback + logback-core + ${logback.version} + + + org.apache.tomcat.embed + tomcat-embed-core + ${tomcat.version} + + + org.apache.tomcat.embed + tomcat-embed-el + ${tomcat.version} + + + org.apache.tomcat.embed + tomcat-embed-websocket + ${tomcat.version} + + + org.apache.httpcomponents.client5 + httpclient5 + ${httpclient5.version} + + + org.apache.httpcomponents.core5 + httpcore5 + ${httpcore5.version} + + + org.apache.httpcomponents.core5 + httpcore5-h2 + ${httpcore5.version} + org.bouncycastle bcprov-jdk18on @@ -77,6 +127,24 @@ nimbus-jose-jwt ${nimbus-jose-jwt.version} + + + + com.sap.cds + cds-services-bom + ${cds.services.version} + pom + import + + + + + org.springframework.boot + spring-boot-dependencies + ${spring.boot.version} + pom + import + diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml index 344c4687..1839a467 100644 --- a/app/single-tenant/personal-space/demoapp/pom.xml +++ b/app/single-tenant/personal-space/demoapp/pom.xml @@ -25,6 +25,13 @@ 4.2.17.Final 1.85 9.48 + 2.22.2 + 1.17.1 + 1.65.0 + 1.6.3 + 10.1.59 + 5.6.4 + 5.4.3 https://nodejs.org/dist/ UTF-8 @@ -36,32 +43,75 @@ - + - com.sap.cds - cds-services-bom - ${cds.services.version} + io.netty + netty-bom + ${netty.version} pom import - - - org.springframework.boot - spring-boot-dependencies - ${spring.boot.version} + com.fasterxml.jackson + jackson-bom + ${jackson-bom.version} pom import - - - io.netty - netty-bom - ${netty.version} + io.micrometer + micrometer-bom + ${micrometer.version} pom import + + io.opentelemetry + opentelemetry-bom + ${opentelemetry.version} + pom + import + + + ch.qos.logback + logback-classic + ${logback.version} + + + ch.qos.logback + logback-core + ${logback.version} + + + org.apache.tomcat.embed + tomcat-embed-core + ${tomcat.version} + + + org.apache.tomcat.embed + tomcat-embed-el + ${tomcat.version} + + + org.apache.tomcat.embed + tomcat-embed-websocket + ${tomcat.version} + + + org.apache.httpcomponents.client5 + httpclient5 + ${httpclient5.version} + + + org.apache.httpcomponents.core5 + httpcore5 + ${httpcore5.version} + + + org.apache.httpcomponents.core5 + httpcore5-h2 + ${httpcore5.version} + org.bouncycastle bcprov-jdk18on @@ -77,6 +127,24 @@ nimbus-jose-jwt ${nimbus-jose-jwt.version} + + + + com.sap.cds + cds-services-bom + ${cds.services.version} + pom + import + + + + + org.springframework.boot + spring-boot-dependencies + ${spring.boot.version} + pom + import + From c5c6066138a028d31d3bc87f2172f6996435c72d Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Thu, 10 Sep 2026 12:38:31 +0530 Subject: [PATCH 6/9] bump Kotlin 1.9.25 -> 2.4.10 to clear remaining Black Duck High finding MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Black Duck's only fix for the flagged Kotlin (1.9.25) is a major-version jump; 2.4.10 is the current stable long-term recommendation. Applied via a kotlin-bom import (declared first) plus the kotlin.version property across all four app modules. Kotlin is transitive-only here (Java/CAP app, no Kotlin sources), and kotlin-stdlib keeps runtime backward compatibility for consumers. Note: httpcore5 stays at 5.4.3 — the newest stable release; its residual High has no stable fix (only 5.5 pre-releases exist). --- .../central-space/cloud-cap-samples-java/pom.xml | 8 ++++++++ .../personal-space/cloud-cap-samples-java/pom.xml | 8 ++++++++ app/single-tenant/central-space/demoapp/pom.xml | 8 ++++++++ app/single-tenant/personal-space/demoapp/pom.xml | 8 ++++++++ 4 files changed, 32 insertions(+) diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml index 28bbefc0..da5359e0 100644 --- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml @@ -40,6 +40,7 @@ 10.1.59 5.6.4 5.4.3 + 2.4.10 @@ -78,6 +79,13 @@ pom import + + org.jetbrains.kotlin + kotlin-bom + ${kotlin.version} + pom + import + ch.qos.logback logback-classic diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml index 85dc117c..a5826373 100644 --- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml @@ -40,6 +40,7 @@ 10.1.59 5.6.4 5.4.3 + 2.4.10 @@ -78,6 +79,13 @@ pom import + + org.jetbrains.kotlin + kotlin-bom + ${kotlin.version} + pom + import + ch.qos.logback logback-classic diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml index 1839a467..cd870672 100644 --- a/app/single-tenant/central-space/demoapp/pom.xml +++ b/app/single-tenant/central-space/demoapp/pom.xml @@ -32,6 +32,7 @@ 10.1.59 5.6.4 5.4.3 + 2.4.10 https://nodejs.org/dist/ UTF-8 @@ -72,6 +73,13 @@ pom import + + org.jetbrains.kotlin + kotlin-bom + ${kotlin.version} + pom + import + ch.qos.logback logback-classic diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml index 1839a467..cd870672 100644 --- a/app/single-tenant/personal-space/demoapp/pom.xml +++ b/app/single-tenant/personal-space/demoapp/pom.xml @@ -32,6 +32,7 @@ 10.1.59 5.6.4 5.4.3 + 2.4.10 https://nodejs.org/dist/ UTF-8 @@ -72,6 +73,13 @@ pom import + + org.jetbrains.kotlin + kotlin-bom + ${kotlin.version} + pom + import + ch.qos.logback logback-classic From 14df9064245fc49a85495d2ea1ad4e3bb79c5957 Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Thu, 10 Sep 2026 13:28:09 +0530 Subject: [PATCH 7/9] fix Black Duck license risk: override commander 2.0.0 -> 2.20.3 in sidecar Add npm overrides block to both mtx/sidecar package.json files to pin the transitive commander dependency from 2.0.0 (Unknown License / HIGH risk) to 2.20.3 (MIT / known-clean). commander is pulled in transitively; npm overrides is the correct mechanism without touching direct dependencies. --- .../cloud-cap-samples-java/mtx/sidecar/package.json | 3 +++ .../cloud-cap-samples-java/mtx/sidecar/package.json | 3 +++ 2 files changed, 6 insertions(+) diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/mtx/sidecar/package.json b/app/multi-tenant/central-space/cloud-cap-samples-java/mtx/sidecar/package.json index 55d89b3a..e1bff480 100644 --- a/app/multi-tenant/central-space/cloud-cap-samples-java/mtx/sidecar/package.json +++ b/app/multi-tenant/central-space/cloud-cap-samples-java/mtx/sidecar/package.json @@ -21,5 +21,8 @@ "scripts": { "start": "cds-serve", "build": "cds build ../.. --for mtx-sidecar --production && cd gen && npm install" + }, + "overrides": { + "commander": "2.20.3" } } \ No newline at end of file diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/mtx/sidecar/package.json b/app/multi-tenant/personal-space/cloud-cap-samples-java/mtx/sidecar/package.json index bc443138..f45fd29e 100644 --- a/app/multi-tenant/personal-space/cloud-cap-samples-java/mtx/sidecar/package.json +++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/mtx/sidecar/package.json @@ -21,5 +21,8 @@ "scripts": { "start": "cds-serve", "build": "cds build ../.. --for mtx-sidecar --production && cd gen && npm install" + }, + "overrides": { + "commander": "2.20.3" } } From 1be7950fc5fdcc0cb657381e0209a158cc71a3d2 Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Thu, 10 Sep 2026 13:35:25 +0530 Subject: [PATCH 8/9] bump Kotlin 2.4.10 -> 2.4.20 to clear CVE-2026-53914 (Critical) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit kotlin-stdlib 2.4.20 is a stable GA release on Maven Central that patches CVE-2026-53914 (CVSS 9.8 Critical). Applied via kotlin-bom override across all 4 app poms. Residual findings with no stable fix in current Spring Boot 3.x ecosystem: Spring Framework 6.2.19 — CVE-2026-59313/59283/47892/47891/47890 (Critical) fix requires Spring 7.0.9 / Spring Boot 4.x (not yet GA) Spring Security 6.5.11 — CVE-2026-59270 (Critical) fix requires Spring Security 7.1.1 / Spring Boot 4.x (not yet GA) httpcore5 5.4.3 — BDSA-2026-29026 (High), no stable patch released These three marked REVIEWED in BlackDuck portal. --- app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml | 2 +- app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml | 2 +- app/single-tenant/central-space/demoapp/pom.xml | 2 +- app/single-tenant/personal-space/demoapp/pom.xml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml index da5359e0..e491929f 100644 --- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml @@ -40,7 +40,7 @@ 10.1.59 5.6.4 5.4.3 - 2.4.10 + 2.4.20 diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml index a5826373..29987a2c 100644 --- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml @@ -40,7 +40,7 @@ 10.1.59 5.6.4 5.4.3 - 2.4.10 + 2.4.20 diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml index cd870672..c88da442 100644 --- a/app/single-tenant/central-space/demoapp/pom.xml +++ b/app/single-tenant/central-space/demoapp/pom.xml @@ -32,7 +32,7 @@ 10.1.59 5.6.4 5.4.3 - 2.4.10 + 2.4.20 https://nodejs.org/dist/ UTF-8 diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml index cd870672..c88da442 100644 --- a/app/single-tenant/personal-space/demoapp/pom.xml +++ b/app/single-tenant/personal-space/demoapp/pom.xml @@ -32,7 +32,7 @@ 10.1.59 5.6.4 5.4.3 - 2.4.10 + 2.4.20 https://nodejs.org/dist/ UTF-8 From 95ffba3341566946720b0d5bce98ff2abe8d0f4c Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Thu, 10 Sep 2026 14:10:53 +0530 Subject: [PATCH 9/9] upgrade SAP HANA JDBC Driver 2.25.13 -> 2.29.7 to clear Black Duck license finding MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ngdbc 2.29.7 exists on Maven Central and clears the "Basic Proprietary Commercial License" HIGH risk on the HANA JDBC driver. Added ngdbc.version property and explicit dependencyManagement override in both multi-tenant poms. Remaining license/security findings with no code fix (marked REVIEWED in portal): Security: Spring Framework 6.2.19 / Spring Security 6.5.11 (no 6.x patch, need SB 4.x) httpcore5 5.4.3 (no standard Apache patch) reactor-core 3.7.19 (3.8.x incompatible with Spring Boot 3.x reactor train) nimbus-jose-jwt 9.48 (10.x breaks Spring Security 6.x JOSE internals) HdrHistogram 2.2.2 (2.5.0 not on Maven Central) License: Logback LGPL, emjapi/xssec/egon-cola/H2/Jakarta/Galasa/SonarXoo (known licenses, no version fix available — reviewed in BlackDuck portal) --- .../central-space/cloud-cap-samples-java/pom.xml | 8 ++++++++ .../personal-space/cloud-cap-samples-java/pom.xml | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml index e491929f..c2736dd1 100644 --- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml @@ -41,6 +41,7 @@ 5.6.4 5.4.3 2.4.20 + 2.29.7 @@ -177,6 +178,13 @@ 4.0.0 + + + com.sap.cloud.db.jdbc + ngdbc + ${ngdbc.version} + + diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml index 29987a2c..47b49431 100644 --- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml @@ -41,6 +41,7 @@ 5.6.4 5.4.3 2.4.20 + 2.29.7 @@ -177,6 +178,13 @@ 4.0.0 + + + com.sap.cloud.db.jdbc + ngdbc + ${ngdbc.version} + +