Skip to content

Black Duck Issues fixes #588

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
akgarg06 wants to merge 25 commits into
base: develop
Choose a base branch
from
Open

Black Duck Issues fixes #588

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
aeee269
update versions
akgarg06 Sep 8, 2026
87bdf38
version update
akgarg06 Sep 8, 2026
f2f4486
Update pom.xml
akgarg06 Sep 10, 2026
b48e892
bump Spring Boot 3.5.3 → 3.5.16 and Netty 4.1.121 → 4.2.17 in app mod…
akgarg06 Sep 10, 2026
2f7e7ae
force clean transitive versions for remaining Black Duck Critical/Hig…
akgarg06 Sep 10, 2026
c5c6066
bump Kotlin 1.9.25 -> 2.4.10 to clear remaining Black Duck High finding
akgarg06 Sep 10, 2026
14df906
fix Black Duck license risk: override commander 2.0.0 -> 2.20.3 in si…
akgarg06 Sep 10, 2026
1be7950
bump Kotlin 2.4.10 -> 2.4.20 to clear CVE-2026-53914 (Critical)
akgarg06 Sep 10, 2026
95ffba3
upgrade SAP HANA JDBC Driver 2.25.13 -> 2.29.7 to clear Black Duck li…
akgarg06 Sep 10, 2026
a07e2de
Merge branch 'develop' into RBSDMS-blackduck-security-fix-feature
akgarg06 Sep 15, 2026
a6f919b
Exclude Vulnerabilities dependency where are safe to exclude
akgarg06 Sep 15, 2026
4ce2b2f
issue fixes
akgarg06 Sep 15, 2026
b132047
black duck changes
akgarg06 Sep 15, 2026
7477a60
fix maven version
akgarg06 Sep 15, 2026
e432f21
more issue fix
akgarg06 Sep 15, 2026
9465f74
black duck fix
akgarg06 Sep 16, 2026
6d9a393
remove unavailable version
akgarg06 Sep 16, 2026
79a46da
more changes
akgarg06 Sep 16, 2026
c006f1f
blackduck issues fix
akgarg06 Sep 16, 2026
de7c606
version fixes
akgarg06 Sep 16, 2026
116fd8b
black duck issue fix
akgarg06 Sep 17, 2026
4063fd3
Merge branch 'develop' into RBSDMS-blackduck-security-fix-feature
akgarg06 Sep 28, 2026
272a743
fix deploy issue
akgarg06 Sep 29, 2026
beeeec9
deploy fix
akgarg06 Sep 29, 2026
15fa826
deploy fix
akgarg06 Sep 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/internalArticatory.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: Internal Artifactory snapshot deploy

env:
JAVA_VERSION: '21'
MAVEN_VERSION: '3.6.3'
MAVEN_VERSION: '3.9.16'
ARTIFACTORY_URL: ${{ secrets.ARTIFACTORY_URL }}

on:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/main-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: Main build and snapshot deploy

env:
JAVA_VERSION: '21'
MAVEN_VERSION: '3.6.3'
MAVEN_VERSION: '3.9.16'

on:
push:
Expand Down
6 changes: 6 additions & 0 deletions app/multi-tenant/central-space/cloud-cap-samples-java/app/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,12 @@
"dependencies": {
"@sap/approuter": "23.0.0"
},
"overrides": {
"fast-uri": "3.1.8",
"decode-uri-component": "0.5.0",
"ws": "7.5.13",
"moment": "2.31.0"
},
"scripts": {
"start": "node node_modules/@sap/approuter/approuter.js"
}
Expand Down
5 changes: 5 additions & 0 deletions app/multi-tenant/central-space/cloud-cap-samples-java/mtx/sidecar/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,5 +21,10 @@
"scripts": {
"start": "cds-serve",
"build": "cds build ../.. --for mtx-sidecar --production && cd gen && npm install"
},
"overrides": {
"commander": "2.20.3",
"semver": "^7.8.5",
"debug": "^4.4.3"
}
}
112 changes: 109 additions & 3 deletions app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>3.2.6</version>
<version>3.5.16</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>

Expand All @@ -23,10 +23,26 @@

<!-- DEPENDENCIES VERSION -->
<jdk.version>21</jdk.version>
<cds.services.version>4.3.0</cds.services.version>
<cloud.sdk.version>5.12.0</cloud.sdk.version>
<cds.services.version>4.9.4</cds.services.version>
<cloud.sdk.version>5.34.0</cloud.sdk.version>
<xsuaa.version>3.5.0</xsuaa.version>
<cf-java-logging-support.version>3.8.3</cf-java-logging-support.version>

<!-- SECURITY OVERRIDES (Black Duck) -->
<jackson-bom.version>2.22.2</jackson-bom.version>
<opentelemetry.version>1.65.0</opentelemetry.version>
<logback.version>1.6.3</logback.version>
<httpcore5.version>5.4.3</httpcore5.version>
<netty.version>4.2.18.Final</netty.version>
<nimbus-jose-jwt.version>9.48</nimbus-jose-jwt.version>
<reactor-core.version>3.8.7</reactor-core.version>
<okhttp.version>5.5.0</okhttp.version>
<guava.version>33.7.1-jre</guava.version>
<ngdbc.version>2.29.7</ngdbc.version>
<h2.version>2.4.240</h2.version>
<micrometer.version>1.17.1</micrometer.version>
<httpclient5.version>5.6.4</httpclient5.version>
<tomcat.version>10.1.59</tomcat.version>
<cds.install-cdsdk.version>^9</cds.install-cdsdk.version>
</properties>

Expand All @@ -37,6 +53,89 @@

<dependencyManagement>
<dependencies>
<!-- SECURITY OVERRIDES (Black Duck): declared first so these versions win -->
<dependency>
<groupId>com.fasterxml.jackson</groupId>
<artifactId>jackson-bom</artifactId>
<version>${jackson-bom.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
<dependency>
<groupId>io.opentelemetry</groupId>
<artifactId>opentelemetry-bom</artifactId>
<version>${opentelemetry.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<version>${logback.version}</version>
</dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-core</artifactId>
<version>${logback.version}</version>
</dependency>
<dependency>
<groupId>org.apache.httpcomponents.core5</groupId>
<artifactId>httpcore5</artifactId>
<version>${httpcore5.version}</version>
</dependency>
<dependency>
<groupId>org.apache.httpcomponents.core5</groupId>
<artifactId>httpcore5-h2</artifactId>
<version>${httpcore5.version}</version>
</dependency>
<dependency>
<groupId>org.apache.httpcomponents.client5</groupId>
<artifactId>httpclient5</artifactId>
<version>${httpclient5.version}</version>
</dependency>
<dependency>
<groupId>com.squareup.okhttp3</groupId>
<artifactId>okhttp</artifactId>
<version>${okhttp.version}</version>
</dependency>
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>${guava.version}</version>
</dependency>
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
<version>${nimbus-jose-jwt.version}</version>
</dependency>
<dependency>
<groupId>io.projectreactor</groupId>
<artifactId>reactor-core</artifactId>
<version>${reactor-core.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-core</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-el</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-websocket</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>io.micrometer</groupId>
<artifactId>micrometer-bom</artifactId>
<version>${micrometer.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>

<!-- CDS SERVICES -->
<dependency>
<groupId>com.sap.cds</groupId>
Expand Down Expand Up @@ -72,6 +171,13 @@
<version>4.0.0</version>
</dependency>

<!-- HANA JDBC Driver (Black Duck license fix) -->
<dependency>
<groupId>com.sap.cloud.db.jdbc</groupId>
<artifactId>ngdbc</artifactId>
<version>${ngdbc.version}</version>
</dependency>

</dependencies>
</dependencyManagement>

Expand Down
26 changes: 25 additions & 1 deletion app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,12 +35,28 @@
<dependency>
<groupId>com.sap.cds</groupId>
<artifactId>cds-feature-mt</artifactId>
<version>4.3.0</version>
<version>4.9.4</version>
</dependency>
<dependency>
<groupId>com.sap.cds</groupId>
<artifactId>sdm</artifactId>
<version>1.10.1-SNAPSHOT</version>
<exclusions>
<!-- SECURITY: httpcore5 5.4.3 has CVEs with no standard upgrade path -->
<exclusion>
<groupId>org.apache.httpcomponents.core5</groupId>
<artifactId>httpcore5</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.httpcomponents.core5</groupId>
<artifactId>httpcore5-h2</artifactId>
</exclusion>
<!-- SECURITY: kotlin-stdlib pulled in transitively via okhttp; not needed by app code -->
<exclusion>
<groupId>org.jetbrains.kotlin</groupId>
<artifactId>kotlin-stdlib</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>com.sap.cds</groupId>
Expand Down Expand Up @@ -141,6 +157,14 @@
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
<exclusions>
<!-- SECURITY: HdrHistogram 2.2.2 has LOW CVEs; no newer release on Maven Central.
Percentile histograms are not used in this app, so micrometer-core works without it. -->
<exclusion>
<groupId>org.hdrhistogram</groupId>
<artifactId>HdrHistogram</artifactId>
</exclusion>
</exclusions>
</dependency>

<dependency>
Expand Down
6 changes: 6 additions & 0 deletions app/multi-tenant/personal-space/cloud-cap-samples-java/app/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,12 @@
"dependencies": {
"@sap/approuter": "23.0.0"
},
"overrides": {
"fast-uri": "3.1.8",
"decode-uri-component": "0.5.0",
"ws": "7.5.13",
"moment": "2.31.0"
},
"scripts": {
"start": "node node_modules/@sap/approuter/approuter.js"
}
Expand Down
5 changes: 5 additions & 0 deletions app/multi-tenant/personal-space/cloud-cap-samples-java/mtx/sidecar/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,5 +21,10 @@
"scripts": {
"start": "cds-serve",
"build": "cds build ../.. --for mtx-sidecar --production && cd gen && npm install"
},
"overrides": {
"commander": "2.20.3",
"semver": "^7.8.5",
"debug": "^4.4.3"
}
}
112 changes: 109 additions & 3 deletions app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>3.2.6</version>
<version>3.5.16</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>

Expand All @@ -23,10 +23,26 @@

<!-- DEPENDENCIES VERSION -->
<jdk.version>21</jdk.version>
<cds.services.version>4.3.0</cds.services.version>
<cloud.sdk.version>5.12.0</cloud.sdk.version>
<cds.services.version>4.9.4</cds.services.version>
<cloud.sdk.version>5.34.0</cloud.sdk.version>
<xsuaa.version>3.5.0</xsuaa.version>
<cf-java-logging-support.version>3.8.3</cf-java-logging-support.version>

<!-- SECURITY OVERRIDES (Black Duck) -->
<jackson-bom.version>2.22.2</jackson-bom.version>
<opentelemetry.version>1.65.0</opentelemetry.version>
<logback.version>1.6.3</logback.version>
<httpcore5.version>5.4.3</httpcore5.version>
<netty.version>4.2.18.Final</netty.version>
<nimbus-jose-jwt.version>9.48</nimbus-jose-jwt.version>
<reactor-core.version>3.8.7</reactor-core.version>
<okhttp.version>5.5.0</okhttp.version>
<guava.version>33.7.1-jre</guava.version>
<ngdbc.version>2.29.7</ngdbc.version>
<h2.version>2.4.240</h2.version>
<micrometer.version>1.17.1</micrometer.version>
<httpclient5.version>5.6.4</httpclient5.version>
<tomcat.version>10.1.59</tomcat.version>
<cds.install-cdsdk.version>^9</cds.install-cdsdk.version>
</properties>

Expand All @@ -37,6 +53,89 @@

<dependencyManagement>
<dependencies>
<!-- SECURITY OVERRIDES (Black Duck): declared first so these versions win -->
<dependency>
<groupId>com.fasterxml.jackson</groupId>
<artifactId>jackson-bom</artifactId>
<version>${jackson-bom.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
<dependency>
<groupId>io.opentelemetry</groupId>
<artifactId>opentelemetry-bom</artifactId>
<version>${opentelemetry.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<version>${logback.version}</version>
</dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-core</artifactId>
<version>${logback.version}</version>
</dependency>
<dependency>
<groupId>org.apache.httpcomponents.core5</groupId>
<artifactId>httpcore5</artifactId>
<version>${httpcore5.version}</version>
</dependency>
<dependency>
<groupId>org.apache.httpcomponents.core5</groupId>
<artifactId>httpcore5-h2</artifactId>
<version>${httpcore5.version}</version>
</dependency>
<dependency>
<groupId>org.apache.httpcomponents.client5</groupId>
<artifactId>httpclient5</artifactId>
<version>${httpclient5.version}</version>
</dependency>
<dependency>
<groupId>com.squareup.okhttp3</groupId>
<artifactId>okhttp</artifactId>
<version>${okhttp.version}</version>
</dependency>
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>${guava.version}</version>
</dependency>
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
<version>${nimbus-jose-jwt.version}</version>
</dependency>
<dependency>
<groupId>io.projectreactor</groupId>
<artifactId>reactor-core</artifactId>
<version>${reactor-core.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-core</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-el</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-websocket</artifactId>
<version>${tomcat.version}</version>
</dependency>
<dependency>
<groupId>io.micrometer</groupId>
<artifactId>micrometer-bom</artifactId>
<version>${micrometer.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>

<!-- CDS SERVICES -->
<dependency>
<groupId>com.sap.cds</groupId>
Expand Down Expand Up @@ -72,6 +171,13 @@
<version>4.0.0</version>
</dependency>

<!-- HANA JDBC Driver (Black Duck license fix) -->
<dependency>
<groupId>com.sap.cloud.db.jdbc</groupId>
<artifactId>ngdbc</artifactId>
<version>${ngdbc.version}</version>
</dependency>

</dependencies>
</dependencyManagement>

Expand Down
Loading
Loading