From 5df72682419e720e33f406f787b223d0dfe051d7 Mon Sep 17 00:00:00 2001
From: "Yashmeet ." <yashmeet@sap.com>
Date: Tue, 30 Jun 2026 17:21:13 +0530
Subject: [PATCH 1/3] Blackduck scan fixes

---
 .../cloud-cap-samples-java/pom.xml            | 24 ++++-
 .../cloud-cap-samples-java/srv/pom.xml        | 97 +++++++++++++++++++
 .../cloud-cap-samples-java/pom.xml            | 23 ++++-
 .../cloud-cap-samples-java/srv/pom.xml        | 97 +++++++++++++++++++
 .../central-space/demoapp/pom.xml             | 23 ++++-
 .../central-space/demoapp/srv/pom.xml         |  1 +
 .../personal-space/demoapp/pom.xml            | 23 ++++-
 .../personal-space/demoapp/srv/pom.xml        |  1 +
 sdm/pom.xml                                   |  4 +-
 9 files changed, 287 insertions(+), 6 deletions(-)

diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
index 125460c56..f06a2bb9f 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>3.2.6</version>
+		<version>3.5.16</version>
 		<relativePath/> <!-- lookup parent from repository -->
 	</parent>
 
@@ -72,6 +72,28 @@
 				<version>4.0.0</version>
 			</dependency>
 
+			<!-- Security: fix Netty CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>io.netty</groupId>
+				<artifactId>netty-bom</artifactId>
+				<version>4.2.15.Final</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+
+			<!-- Security: fix Bouncy Castle CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
+
+
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
index 9035fbe85..739796f15 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
@@ -14,6 +14,102 @@
 
 	<name>bookshop</name>
 
+	<dependencyManagement>
+		<dependencies>
+			<!-- Security fixes: force safe transitive versions -->
+			<dependency>
+				<groupId>org.jetbrains.kotlin</groupId>
+				<artifactId>kotlin-stdlib</artifactId>
+				<version>2.4.0</version>
+			</dependency>
+			<dependency>
+				<groupId>org.jetbrains.kotlin</groupId>
+				<artifactId>kotlin-stdlib-jdk8</artifactId>
+				<version>2.4.0</version>
+			</dependency>
+			<dependency>
+				<groupId>org.jetbrains.kotlin</groupId>
+				<artifactId>kotlin-stdlib-jdk7</artifactId>
+				<version>2.4.0</version>
+			</dependency>
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-api</artifactId>
+				<version>1.63.0</version>
+			</dependency>
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-context</artifactId>
+				<version>1.63.0</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.security</groupId>
+				<artifactId>spring-security-core</artifactId>
+				<version>6.5.11</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.security</groupId>
+				<artifactId>spring-security-web</artifactId>
+				<version>6.5.11</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.security</groupId>
+				<artifactId>spring-security-config</artifactId>
+				<version>6.5.11</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.security</groupId>
+				<artifactId>spring-security-oauth2-core</artifactId>
+				<version>6.5.11</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.security</groupId>
+				<artifactId>spring-security-oauth2-jose</artifactId>
+				<version>6.5.11</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.security</groupId>
+				<artifactId>spring-security-oauth2-resource-server</artifactId>
+				<version>6.5.11</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.security</groupId>
+				<artifactId>spring-security-crypto</artifactId>
+				<version>6.5.11</version>
+			</dependency>
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>2.22.0</version>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-classic</artifactId>
+				<version>1.5.35</version>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-core</artifactId>
+				<version>1.5.35</version>
+			</dependency>
+			<dependency>
+				<groupId>com.nimbusds</groupId>
+				<artifactId>nimbus-jose-jwt</artifactId>
+				<version>10.9.1</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.boot</groupId>
+				<artifactId>spring-boot</artifactId>
+				<version>3.5.15</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.boot</groupId>
+				<artifactId>spring-boot-autoconfigure</artifactId>
+				<version>3.5.15</version>
+			</dependency>
+		</dependencies>
+ 	</dependencyManagement>
+
 	<!-- ACTUAL DEPENDENCIES -->
 	<dependencies>
 		<!-- CDS DEPENDENCIES -->
@@ -112,6 +208,7 @@
 		<dependency>
 			<groupId>com.h2database</groupId>
 			<artifactId>h2</artifactId>
+			<version>2.4.240</version>
 			<scope>runtime</scope>
 		</dependency>
 
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
index c2c6df6ae..096fbcbc1 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>3.2.6</version>
+		<version>3.5.16</version>
 		<relativePath/> <!-- lookup parent from repository -->
 	</parent>
 
@@ -72,6 +72,27 @@
 				<version>4.0.0</version>
 			</dependency>
 
+			<!-- Security: fix Netty CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>io.netty</groupId>
+				<artifactId>netty-bom</artifactId>
+				<version>4.2.15.Final</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+
+			<!-- Security: fix Bouncy Castle CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
+
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml
index 8ff375092..3b362720f 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml
@@ -14,6 +14,102 @@
 
 	<name>bookshop</name>
 
+	<dependencyManagement>
+		<dependencies>
+			<!-- Security fixes: force safe transitive versions -->
+			<dependency>
+				<groupId>org.jetbrains.kotlin</groupId>
+				<artifactId>kotlin-stdlib</artifactId>
+				<version>2.4.0</version>
+			</dependency>
+			<dependency>
+				<groupId>org.jetbrains.kotlin</groupId>
+				<artifactId>kotlin-stdlib-jdk8</artifactId>
+				<version>2.4.0</version>
+			</dependency>
+			<dependency>
+				<groupId>org.jetbrains.kotlin</groupId>
+				<artifactId>kotlin-stdlib-jdk7</artifactId>
+				<version>2.4.0</version>
+			</dependency>
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-api</artifactId>
+				<version>1.63.0</version>
+			</dependency>
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-context</artifactId>
+				<version>1.63.0</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.security</groupId>
+				<artifactId>spring-security-core</artifactId>
+				<version>6.5.11</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.security</groupId>
+				<artifactId>spring-security-web</artifactId>
+				<version>6.5.11</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.security</groupId>
+				<artifactId>spring-security-config</artifactId>
+				<version>6.5.11</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.security</groupId>
+				<artifactId>spring-security-oauth2-core</artifactId>
+				<version>6.5.11</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.security</groupId>
+				<artifactId>spring-security-oauth2-jose</artifactId>
+				<version>6.5.11</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.security</groupId>
+				<artifactId>spring-security-oauth2-resource-server</artifactId>
+				<version>6.5.11</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.security</groupId>
+				<artifactId>spring-security-crypto</artifactId>
+				<version>6.5.11</version>
+			</dependency>
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>2.22.0</version>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-classic</artifactId>
+				<version>1.5.35</version>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-core</artifactId>
+				<version>1.5.35</version>
+			</dependency>
+			<dependency>
+				<groupId>com.nimbusds</groupId>
+				<artifactId>nimbus-jose-jwt</artifactId>
+				<version>10.9.1</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.boot</groupId>
+				<artifactId>spring-boot</artifactId>
+				<version>3.5.15</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework.boot</groupId>
+				<artifactId>spring-boot-autoconfigure</artifactId>
+				<version>3.5.15</version>
+			</dependency>
+		</dependencies>
+ 	</dependencyManagement>
+
 	<!-- ACTUAL DEPENDENCIES -->
 	<dependencies>
 		<!-- CDS DEPENDENCIES -->
@@ -112,6 +208,7 @@
 		<dependency>
 			<groupId>com.h2database</groupId>
 			<artifactId>h2</artifactId>
+			<version>2.4.240</version>
 			<scope>runtime</scope>
 		</dependency>
 
diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml
index 272527e30..78e4008cb 100644
--- a/app/single-tenant/central-space/demoapp/pom.xml
+++ b/app/single-tenant/central-space/demoapp/pom.xml
@@ -18,7 +18,7 @@
 		<!-- DEPENDENCIES VERSION -->
 		<jdk.version>21</jdk.version>
 		<cds.services.version>4.1.1</cds.services.version>
-		<spring.boot.version>3.3.1</spring.boot.version>
+		<spring.boot.version>3.5.16</spring.boot.version>
 		<cds.install-cdsdk.version>8.0.2</cds.install-cdsdk.version>
 
 		<cds.install-node.downloadUrl>https://nodejs.org/dist/</cds.install-node.downloadUrl>
@@ -48,6 +48,27 @@
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
+
+			<!-- Security: fix Netty CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>io.netty</groupId>
+				<artifactId>netty-bom</artifactId>
+				<version>4.2.15.Final</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+
+			<!-- Security: fix Bouncy Castle CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/single-tenant/central-space/demoapp/srv/pom.xml b/app/single-tenant/central-space/demoapp/srv/pom.xml
index cc49287e1..95bbc0c05 100644
--- a/app/single-tenant/central-space/demoapp/srv/pom.xml
+++ b/app/single-tenant/central-space/demoapp/srv/pom.xml
@@ -50,6 +50,7 @@
 		<dependency>
 			<groupId>com.h2database</groupId>
 			<artifactId>h2</artifactId>
+			<version>2.4.240</version>
 			<scope>runtime</scope>
 		</dependency>
 
diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml
index 272527e30..78e4008cb 100644
--- a/app/single-tenant/personal-space/demoapp/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/pom.xml
@@ -18,7 +18,7 @@
 		<!-- DEPENDENCIES VERSION -->
 		<jdk.version>21</jdk.version>
 		<cds.services.version>4.1.1</cds.services.version>
-		<spring.boot.version>3.3.1</spring.boot.version>
+		<spring.boot.version>3.5.16</spring.boot.version>
 		<cds.install-cdsdk.version>8.0.2</cds.install-cdsdk.version>
 
 		<cds.install-node.downloadUrl>https://nodejs.org/dist/</cds.install-node.downloadUrl>
@@ -48,6 +48,27 @@
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
+
+			<!-- Security: fix Netty CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>io.netty</groupId>
+				<artifactId>netty-bom</artifactId>
+				<version>4.2.15.Final</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+
+			<!-- Security: fix Bouncy Castle CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/single-tenant/personal-space/demoapp/srv/pom.xml b/app/single-tenant/personal-space/demoapp/srv/pom.xml
index 1a18bebd8..1dfe97175 100644
--- a/app/single-tenant/personal-space/demoapp/srv/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/srv/pom.xml
@@ -50,6 +50,7 @@
 		<dependency>
 			<groupId>com.h2database</groupId>
 			<artifactId>h2</artifactId>
+			<version>2.4.240</version>
 			<scope>runtime</scope>
 		</dependency>
 
diff --git a/sdm/pom.xml b/sdm/pom.xml
index 118c066e3..6281a56d3 100644
--- a/sdm/pom.xml
+++ b/sdm/pom.xml
@@ -39,10 +39,10 @@
         <jacoco.version>0.8.7</jacoco.version>
         <ehcache-version>3.10.8</ehcache-version>
         <token-client-version>3.5.7</token-client-version>
-        <jackson-databind-version>2.18.6</jackson-databind-version>
+        <jackson-databind-version>2.22.0</jackson-databind-version>
         <json-version>20250107</json-version>
         <commons-codec-version>1.18.0</commons-codec-version>
-        <jackson-core-version>2.18.6</jackson-core-version>
+        <jackson-core-version>2.22.0</jackson-core-version>
         <mockito-junit-jupiter-version>5.15.2</mockito-junit-jupiter-version>
         <httpclient5-version>5.4.4</httpclient5-version>
         <httpcore5-version>5.3.3</httpcore5-version>

From e1a137f9426b339dd2f56a1cb00b726de0140806 Mon Sep 17 00:00:00 2001
From: "Yashmeet ." <yashmeet@sap.com>
Date: Wed, 1 Jul 2026 11:36:08 +0530
Subject: [PATCH 2/3] fixes

---
 sdm/pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sdm/pom.xml b/sdm/pom.xml
index 6281a56d3..118c066e3 100644
--- a/sdm/pom.xml
+++ b/sdm/pom.xml
@@ -39,10 +39,10 @@
         <jacoco.version>0.8.7</jacoco.version>
         <ehcache-version>3.10.8</ehcache-version>
         <token-client-version>3.5.7</token-client-version>
-        <jackson-databind-version>2.22.0</jackson-databind-version>
+        <jackson-databind-version>2.18.6</jackson-databind-version>
         <json-version>20250107</json-version>
         <commons-codec-version>1.18.0</commons-codec-version>
-        <jackson-core-version>2.22.0</jackson-core-version>
+        <jackson-core-version>2.18.6</jackson-core-version>
         <mockito-junit-jupiter-version>5.15.2</mockito-junit-jupiter-version>
         <httpclient5-version>5.4.4</httpclient5-version>
         <httpcore5-version>5.3.3</httpcore5-version>

From 2782979d7b405ef9d4d6bba6a5528a8e04d3695c Mon Sep 17 00:00:00 2001
From: PujaDeshmukh17 <126158971+PujaDeshmukh17@users.noreply.github.com>
Date: Wed, 1 Jul 2026 11:56:03 +0530
Subject: [PATCH 3/3] Update pom.xml

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 8db2566c0..993d1f24f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -23,7 +23,7 @@
     </developers>
 
     <properties>
-        <revision>1.8.1-SNAPSHOT</revision>
+        <revision>1.0.0-RC1</revision>
         <java.version>21</java.version>
         <maven.compiler.source>${java.version}</maven.compiler.source>
         <maven.compiler.target>${java.version}</maven.compiler.target>