From ab92b715c610972fcd6a846277ec2142e8839630 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Fri, 10 Jul 2026 17:00:14 +0530
Subject: [PATCH 01/27] update pom

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index b8e376a2..993d1f24 100644
--- a/pom.xml
+++ b/pom.xml
@@ -23,7 +23,7 @@
     </developers>
 
     <properties>
-        <revision>1.10.1-SNAPSHOT</revision>
+        <revision>1.0.0-RC1</revision>
         <java.version>21</java.version>
         <maven.compiler.source>${java.version}</maven.compiler.source>
         <maven.compiler.target>${java.version}</maven.compiler.target>

From 87f943ae760df637c6cc2aff6af72539bd3f8bc8 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Fri, 10 Jul 2026 17:13:06 +0530
Subject: [PATCH 02/27] Update pom.xml

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 993d1f24..b8e376a2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -23,7 +23,7 @@
     </developers>
 
     <properties>
-        <revision>1.0.0-RC1</revision>
+        <revision>1.10.1-SNAPSHOT</revision>
         <java.version>21</java.version>
         <maven.compiler.source>${java.version}</maven.compiler.source>
         <maven.compiler.target>${java.version}</maven.compiler.target>

From 6f7213f1d2d9a156d1883e3f2e6280bfa7bafe79 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Fri, 10 Jul 2026 18:09:06 +0530
Subject: [PATCH 03/27] blackduck-scan-fix

---
 .../cloud-cap-samples-java/pom.xml            | 70 ++++++++++++++++++-
 .../cloud-cap-samples-java/srv/pom.xml        | 24 +++++++
 .../cloud-cap-samples-java/pom.xml            | 70 ++++++++++++++++++-
 .../cloud-cap-samples-java/srv/pom.xml        | 24 +++++++
 .../central-space/demoapp/pom.xml             | 35 +++++++++-
 .../personal-space/demoapp/pom.xml            | 35 +++++++++-
 pom.xml                                       |  2 +-
 sdm/pom.xml                                   | 23 ++++++
 8 files changed, 278 insertions(+), 5 deletions(-)

diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
index 125460c5..bb90fd07 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>3.2.6</version>
+		<version>3.5.16</version>
 		<relativePath/> <!-- lookup parent from repository -->
 	</parent>
 
@@ -72,6 +72,74 @@
 				<version>4.0.0</version>
 			</dependency>
 
+			<!-- Security: fix Bouncy Castle (HIGH) -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.84.0</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.84.0</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcutil-jdk18on</artifactId>
+				<version>1.84.0</version>
+			</dependency>
+
+			<!-- Security: fix jackson-databind (HIGH) -->
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>2.18.9</version>
+			</dependency>
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-core</artifactId>
+				<version>2.18.6</version>
+			</dependency>
+
+			<!-- Security: fix OpenTelemetry (HIGH) -->
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-bom</artifactId>
+				<version>1.50.0</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+
+			<!-- Security: fix Nimbus-JOSE-JWT (MEDIUM) -->
+			<dependency>
+				<groupId>com.nimbusds</groupId>
+				<artifactId>nimbus-jose-jwt</artifactId>
+				<version>10.9.1</version>
+			</dependency>
+
+			<!-- Security: fix Netty (CRITICAL) -->
+			<dependency>
+				<groupId>io.netty</groupId>
+				<artifactId>netty-bom</artifactId>
+				<version>4.1.135.Final</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+
+			<!-- Security: fix Apache Commons Lang (MEDIUM) -->
+			<dependency>
+				<groupId>org.apache.commons</groupId>
+				<artifactId>commons-lang3</artifactId>
+				<version>3.17.0</version>
+			</dependency>
+
+			<!-- Security: fix Apache HTTPComponents Core (MEDIUM) -->
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
index e170c32a..ece14d00 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
@@ -131,6 +131,12 @@
 			<groupId>com.sap.hcp.cf.logging</groupId>
 			<artifactId>cf-java-logging-support-logback</artifactId>
 			<version>${cf-java-logging-support.version}</version>
+			<exclusions>
+				<exclusion>
+					<groupId>org.hdrhistogram</groupId>
+					<artifactId>HdrHistogram</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 
 		<dependency>
@@ -159,6 +165,24 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-webflux</artifactId>
 			<scope>test</scope>
+			<exclusions>
+				<exclusion>
+					<groupId>org.jetbrains.kotlin</groupId>
+					<artifactId>kotlin-stdlib</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>org.jetbrains.kotlin</groupId>
+					<artifactId>kotlin-stdlib-jdk8</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>org.jetbrains.kotlin</groupId>
+					<artifactId>kotlin-stdlib-jdk7</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>org.jetbrains.kotlin</groupId>
+					<artifactId>kotlin-stdlib-common</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 
 		<!-- DEV TOOLS -->
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
index c2c6df6a..cbb9090c 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>3.2.6</version>
+		<version>3.5.16</version>
 		<relativePath/> <!-- lookup parent from repository -->
 	</parent>
 
@@ -72,6 +72,74 @@
 				<version>4.0.0</version>
 			</dependency>
 
+			<!-- Security: fix Bouncy Castle (HIGH) -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.84.0</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.84.0</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcutil-jdk18on</artifactId>
+				<version>1.84.0</version>
+			</dependency>
+
+			<!-- Security: fix jackson-databind (HIGH) -->
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>2.18.9</version>
+			</dependency>
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-core</artifactId>
+				<version>2.18.6</version>
+			</dependency>
+
+			<!-- Security: fix OpenTelemetry (HIGH) -->
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-bom</artifactId>
+				<version>1.50.0</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+
+			<!-- Security: fix Nimbus-JOSE-JWT (MEDIUM) -->
+			<dependency>
+				<groupId>com.nimbusds</groupId>
+				<artifactId>nimbus-jose-jwt</artifactId>
+				<version>10.9.1</version>
+			</dependency>
+
+			<!-- Security: fix Netty (CRITICAL) -->
+			<dependency>
+				<groupId>io.netty</groupId>
+				<artifactId>netty-bom</artifactId>
+				<version>4.1.135.Final</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+
+			<!-- Security: fix Apache Commons Lang (MEDIUM) -->
+			<dependency>
+				<groupId>org.apache.commons</groupId>
+				<artifactId>commons-lang3</artifactId>
+				<version>3.17.0</version>
+			</dependency>
+
+			<!-- Security: fix Apache HTTPComponents Core (MEDIUM) -->
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml
index 8ff37509..dfc8e262 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml
@@ -131,6 +131,12 @@
 			<groupId>com.sap.hcp.cf.logging</groupId>
 			<artifactId>cf-java-logging-support-logback</artifactId>
 			<version>${cf-java-logging-support.version}</version>
+			<exclusions>
+				<exclusion>
+					<groupId>org.hdrhistogram</groupId>
+					<artifactId>HdrHistogram</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 
 		<dependency>
@@ -159,6 +165,24 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-webflux</artifactId>
 			<scope>test</scope>
+			<exclusions>
+				<exclusion>
+					<groupId>org.jetbrains.kotlin</groupId>
+					<artifactId>kotlin-stdlib</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>org.jetbrains.kotlin</groupId>
+					<artifactId>kotlin-stdlib-jdk8</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>org.jetbrains.kotlin</groupId>
+					<artifactId>kotlin-stdlib-jdk7</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>org.jetbrains.kotlin</groupId>
+					<artifactId>kotlin-stdlib-common</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 
 		<!-- DEV TOOLS -->
diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml
index 272527e3..0ba6ca31 100644
--- a/app/single-tenant/central-space/demoapp/pom.xml
+++ b/app/single-tenant/central-space/demoapp/pom.xml
@@ -18,7 +18,7 @@
 		<!-- DEPENDENCIES VERSION -->
 		<jdk.version>21</jdk.version>
 		<cds.services.version>4.1.1</cds.services.version>
-		<spring.boot.version>3.3.1</spring.boot.version>
+		<spring.boot.version>3.5.16</spring.boot.version>
 		<cds.install-cdsdk.version>8.0.2</cds.install-cdsdk.version>
 
 		<cds.install-node.downloadUrl>https://nodejs.org/dist/</cds.install-node.downloadUrl>
@@ -48,6 +48,39 @@
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
+
+			<!-- Security: fix Bouncy Castle (HIGH) -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.84.0</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.84.0</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcutil-jdk18on</artifactId>
+				<version>1.84.0</version>
+			</dependency>
+
+			<!-- Security: fix OpenTelemetry (HIGH) -->
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-bom</artifactId>
+				<version>1.50.0</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+
+			<!-- Security: fix Nimbus-JOSE-JWT (MEDIUM) -->
+			<dependency>
+				<groupId>com.nimbusds</groupId>
+				<artifactId>nimbus-jose-jwt</artifactId>
+				<version>10.9.1</version>
+			</dependency>
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml
index 272527e3..0ba6ca31 100644
--- a/app/single-tenant/personal-space/demoapp/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/pom.xml
@@ -18,7 +18,7 @@
 		<!-- DEPENDENCIES VERSION -->
 		<jdk.version>21</jdk.version>
 		<cds.services.version>4.1.1</cds.services.version>
-		<spring.boot.version>3.3.1</spring.boot.version>
+		<spring.boot.version>3.5.16</spring.boot.version>
 		<cds.install-cdsdk.version>8.0.2</cds.install-cdsdk.version>
 
 		<cds.install-node.downloadUrl>https://nodejs.org/dist/</cds.install-node.downloadUrl>
@@ -48,6 +48,39 @@
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
+
+			<!-- Security: fix Bouncy Castle (HIGH) -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.84.0</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.84.0</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcutil-jdk18on</artifactId>
+				<version>1.84.0</version>
+			</dependency>
+
+			<!-- Security: fix OpenTelemetry (HIGH) -->
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-bom</artifactId>
+				<version>1.50.0</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+
+			<!-- Security: fix Nimbus-JOSE-JWT (MEDIUM) -->
+			<dependency>
+				<groupId>com.nimbusds</groupId>
+				<artifactId>nimbus-jose-jwt</artifactId>
+				<version>10.9.1</version>
+			</dependency>
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/pom.xml b/pom.xml
index b8e376a2..e1b3ac37 100644
--- a/pom.xml
+++ b/pom.xml
@@ -34,7 +34,7 @@
 
         <generation-folder>src/gen</generation-folder>
 
-        <test-spring-boot-version>3.2.5</test-spring-boot-version>
+        <test-spring-boot-version>3.5.16</test-spring-boot-version>
         <sdk-bom-version>5.21.0</sdk-bom-version>
         <mockito-bom-version>5.15.2</mockito-bom-version>
         <assertj-core-version>3.27.7</assertj-core-version>
diff --git a/sdm/pom.xml b/sdm/pom.xml
index 90f0b4f8..2c5d7eb7 100644
--- a/sdm/pom.xml
+++ b/sdm/pom.xml
@@ -288,6 +288,29 @@
             <groupId>com.squareup.okhttp3</groupId>
             <artifactId>okhttp</artifactId>
             <version>5.0.0-alpha.14</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.jetbrains.kotlin</groupId>
+                    <artifactId>kotlin-stdlib</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.jetbrains.kotlin</groupId>
+                    <artifactId>kotlin-stdlib-jdk8</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.jetbrains.kotlin</groupId>
+                    <artifactId>kotlin-stdlib-jdk7</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.jetbrains.kotlin</groupId>
+                    <artifactId>kotlin-stdlib-common</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.jetbrains</groupId>
+            <artifactId>annotations</artifactId>
+            <version>13.0</version>
         </dependency>
         <dependency>
             <groupId>com.squareup.okhttp3</groupId>

From 2903c81c8149f22311136c637ab9bbb5dbe9ce38 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Fri, 10 Jul 2026 18:22:38 +0530
Subject: [PATCH 04/27] blackduck-scan-fix

---
 app/single-tenant/central-space/demoapp/pom.xml  | 2 +-
 app/single-tenant/personal-space/demoapp/pom.xml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml
index 0ba6ca31..c5a7b719 100644
--- a/app/single-tenant/central-space/demoapp/pom.xml
+++ b/app/single-tenant/central-space/demoapp/pom.xml
@@ -89,7 +89,7 @@
                 <id>github-snapshot</id>
                 <url>https://maven.pkg.github.com/cap-java/sdm</url>
                 <releases>
-                    <enabled>true</enabled>
+                    <enabled>false</enabled>
                 </releases>
                 <snapshots>
                     <enabled>true</enabled>
diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml
index 0ba6ca31..c5a7b719 100644
--- a/app/single-tenant/personal-space/demoapp/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/pom.xml
@@ -89,7 +89,7 @@
                 <id>github-snapshot</id>
                 <url>https://maven.pkg.github.com/cap-java/sdm</url>
                 <releases>
-                    <enabled>true</enabled>
+                    <enabled>false</enabled>
                 </releases>
                 <snapshots>
                     <enabled>true</enabled>

From bbee5c3e143d7569ea5effb6bdf63568766724c5 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Fri, 10 Jul 2026 18:29:27 +0530
Subject: [PATCH 05/27] blackduck-scan-fix

---
 .../central-space/cloud-cap-samples-java/pom.xml            | 6 +++---
 .../personal-space/cloud-cap-samples-java/pom.xml           | 6 +++---
 app/single-tenant/central-space/demoapp/pom.xml             | 6 +++---
 app/single-tenant/personal-space/demoapp/pom.xml            | 6 +++---
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
index bb90fd07..c0c09d1b 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
@@ -76,17 +76,17 @@
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcprov-jdk18on</artifactId>
-				<version>1.84.0</version>
+				<version>1.84</version>
 			</dependency>
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcpkix-jdk18on</artifactId>
-				<version>1.84.0</version>
+				<version>1.84</version>
 			</dependency>
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcutil-jdk18on</artifactId>
-				<version>1.84.0</version>
+				<version>1.84</version>
 			</dependency>
 
 			<!-- Security: fix jackson-databind (HIGH) -->
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
index cbb9090c..cdc672be 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
@@ -76,17 +76,17 @@
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcprov-jdk18on</artifactId>
-				<version>1.84.0</version>
+				<version>1.84</version>
 			</dependency>
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcpkix-jdk18on</artifactId>
-				<version>1.84.0</version>
+				<version>1.84</version>
 			</dependency>
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcutil-jdk18on</artifactId>
-				<version>1.84.0</version>
+				<version>1.84</version>
 			</dependency>
 
 			<!-- Security: fix jackson-databind (HIGH) -->
diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml
index c5a7b719..05f66645 100644
--- a/app/single-tenant/central-space/demoapp/pom.xml
+++ b/app/single-tenant/central-space/demoapp/pom.xml
@@ -53,17 +53,17 @@
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcprov-jdk18on</artifactId>
-				<version>1.84.0</version>
+				<version>1.84</version>
 			</dependency>
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcpkix-jdk18on</artifactId>
-				<version>1.84.0</version>
+				<version>1.84</version>
 			</dependency>
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcutil-jdk18on</artifactId>
-				<version>1.84.0</version>
+				<version>1.84</version>
 			</dependency>
 
 			<!-- Security: fix OpenTelemetry (HIGH) -->
diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml
index c5a7b719..05f66645 100644
--- a/app/single-tenant/personal-space/demoapp/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/pom.xml
@@ -53,17 +53,17 @@
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcprov-jdk18on</artifactId>
-				<version>1.84.0</version>
+				<version>1.84</version>
 			</dependency>
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcpkix-jdk18on</artifactId>
-				<version>1.84.0</version>
+				<version>1.84</version>
 			</dependency>
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcutil-jdk18on</artifactId>
-				<version>1.84.0</version>
+				<version>1.84</version>
 			</dependency>
 
 			<!-- Security: fix OpenTelemetry (HIGH) -->

From 1fe9e8f6b3d6b052b83b9174b4410f8a550ca314 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 13:54:20 +0530
Subject: [PATCH 06/27] blackduck-scan-fix

---
 .../cloud-cap-samples-java/pom.xml            | 44 ++++++++++++----
 .../cloud-cap-samples-java/srv/pom.xml        | 18 ++++++-
 .../cloud-cap-samples-java/pom.xml            | 44 ++++++++++++----
 .../cloud-cap-samples-java/srv/pom.xml        | 18 ++++++-
 .../central-space/demoapp/pom.xml             | 52 ++++++++++++++++---
 .../central-space/demoapp/srv/pom.xml         | 18 +++++++
 .../personal-space/demoapp/pom.xml            | 52 ++++++++++++++++---
 .../personal-space/demoapp/srv/pom.xml        | 18 +++++++
 sdm/pom.xml                                   |  8 +--
 9 files changed, 228 insertions(+), 44 deletions(-)

diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
index c0c09d1b..4be1c8f1 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
@@ -93,22 +93,15 @@
 			<dependency>
 				<groupId>com.fasterxml.jackson.core</groupId>
 				<artifactId>jackson-databind</artifactId>
-				<version>2.18.9</version>
+				<version>2.19.2</version>
 			</dependency>
 			<dependency>
 				<groupId>com.fasterxml.jackson.core</groupId>
 				<artifactId>jackson-core</artifactId>
-				<version>2.18.6</version>
+				<version>2.19.2</version>
 			</dependency>
 
-			<!-- Security: fix OpenTelemetry (HIGH) -->
-			<dependency>
-				<groupId>io.opentelemetry</groupId>
-				<artifactId>opentelemetry-bom</artifactId>
-				<version>1.50.0</version>
-				<type>pom</type>
-				<scope>import</scope>
-			</dependency>
+			<!-- Security: fix OpenTelemetry (HIGH) — excluded in srv/pom.xml -->
 
 			<!-- Security: fix Nimbus-JOSE-JWT (MEDIUM) -->
 			<dependency>
@@ -139,6 +132,37 @@
 				<artifactId>httpcore5</artifactId>
 				<version>5.4.3</version>
 			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5-h2</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+
+			<!-- Security: fix Apache Tomcat (CRITICAL) -->
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-core</artifactId>
+				<version>10.1.56</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-el</artifactId>
+				<version>10.1.56</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-websocket</artifactId>
+				<version>10.1.56</version>
+			</dependency>
+
+			<!-- Security: fix Logback (MEDIUM) — excluded in srv/pom.xml -->
+
+			<!-- Security: fix HdrHistogram (MEDIUM) -->
+			<dependency>
+				<groupId>org.hdrhistogram</groupId>
+				<artifactId>HdrHistogram</artifactId>
+				<version>2.5.0</version>
+			</dependency>
 
 		</dependencies>
 	</dependencyManagement>
diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
index ece14d00..d88aeea7 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
@@ -20,6 +20,16 @@
 		<dependency>
 			<groupId>com.sap.cds</groupId>
 			<artifactId>cds-starter-spring-boot</artifactId>
+			<exclusions>
+				<exclusion>
+					<groupId>io.opentelemetry</groupId>
+					<artifactId>opentelemetry-api</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>io.opentelemetry</groupId>
+					<artifactId>opentelemetry-context</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 
 		<dependency>
@@ -133,8 +143,12 @@
 			<version>${cf-java-logging-support.version}</version>
 			<exclusions>
 				<exclusion>
-					<groupId>org.hdrhistogram</groupId>
-					<artifactId>HdrHistogram</artifactId>
+					<groupId>ch.qos.logback</groupId>
+					<artifactId>logback-classic</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>ch.qos.logback</groupId>
+					<artifactId>logback-core</artifactId>
 				</exclusion>
 			</exclusions>
 		</dependency>
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
index cdc672be..d3d468cf 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
@@ -93,22 +93,15 @@
 			<dependency>
 				<groupId>com.fasterxml.jackson.core</groupId>
 				<artifactId>jackson-databind</artifactId>
-				<version>2.18.9</version>
+				<version>2.19.2</version>
 			</dependency>
 			<dependency>
 				<groupId>com.fasterxml.jackson.core</groupId>
 				<artifactId>jackson-core</artifactId>
-				<version>2.18.6</version>
+				<version>2.19.2</version>
 			</dependency>
 
-			<!-- Security: fix OpenTelemetry (HIGH) -->
-			<dependency>
-				<groupId>io.opentelemetry</groupId>
-				<artifactId>opentelemetry-bom</artifactId>
-				<version>1.50.0</version>
-				<type>pom</type>
-				<scope>import</scope>
-			</dependency>
+			<!-- Security: fix OpenTelemetry (HIGH) — excluded in srv/pom.xml -->
 
 			<!-- Security: fix Nimbus-JOSE-JWT (MEDIUM) -->
 			<dependency>
@@ -139,6 +132,37 @@
 				<artifactId>httpcore5</artifactId>
 				<version>5.4.3</version>
 			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5-h2</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+
+			<!-- Security: fix Apache Tomcat (CRITICAL) -->
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-core</artifactId>
+				<version>10.1.56</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-el</artifactId>
+				<version>10.1.56</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-websocket</artifactId>
+				<version>10.1.56</version>
+			</dependency>
+
+			<!-- Security: fix Logback (MEDIUM) — excluded in srv/pom.xml -->
+
+			<!-- Security: fix HdrHistogram (MEDIUM) -->
+			<dependency>
+				<groupId>org.hdrhistogram</groupId>
+				<artifactId>HdrHistogram</artifactId>
+				<version>2.5.0</version>
+			</dependency>
 
 		</dependencies>
 	</dependencyManagement>
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml
index dfc8e262..8925a1a9 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml
@@ -20,6 +20,16 @@
 		<dependency>
 			<groupId>com.sap.cds</groupId>
 			<artifactId>cds-starter-spring-boot</artifactId>
+			<exclusions>
+				<exclusion>
+					<groupId>io.opentelemetry</groupId>
+					<artifactId>opentelemetry-api</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>io.opentelemetry</groupId>
+					<artifactId>opentelemetry-context</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 
 		<dependency>
@@ -133,8 +143,12 @@
 			<version>${cf-java-logging-support.version}</version>
 			<exclusions>
 				<exclusion>
-					<groupId>org.hdrhistogram</groupId>
-					<artifactId>HdrHistogram</artifactId>
+					<groupId>ch.qos.logback</groupId>
+					<artifactId>logback-classic</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>ch.qos.logback</groupId>
+					<artifactId>logback-core</artifactId>
 				</exclusion>
 			</exclusions>
 		</dependency>
diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml
index 05f66645..4626c992 100644
--- a/app/single-tenant/central-space/demoapp/pom.xml
+++ b/app/single-tenant/central-space/demoapp/pom.xml
@@ -66,14 +66,7 @@
 				<version>1.84</version>
 			</dependency>
 
-			<!-- Security: fix OpenTelemetry (HIGH) -->
-			<dependency>
-				<groupId>io.opentelemetry</groupId>
-				<artifactId>opentelemetry-bom</artifactId>
-				<version>1.50.0</version>
-				<type>pom</type>
-				<scope>import</scope>
-			</dependency>
+			<!-- Security: fix OpenTelemetry (HIGH) — excluded in srv/pom.xml -->
 
 			<!-- Security: fix Nimbus-JOSE-JWT (MEDIUM) -->
 			<dependency>
@@ -81,6 +74,49 @@
 				<artifactId>nimbus-jose-jwt</artifactId>
 				<version>10.9.1</version>
 			</dependency>
+
+			<!-- Security: fix jackson-databind (MEDIUM) -->
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>2.19.2</version>
+			</dependency>
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-core</artifactId>
+				<version>2.19.2</version>
+			</dependency>
+
+			<!-- Security: fix Apache HTTPComponents Core (MEDIUM) -->
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5-h2</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+
+			<!-- Security: fix Apache Tomcat (CRITICAL) -->
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-core</artifactId>
+				<version>10.1.56</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-el</artifactId>
+				<version>10.1.56</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-websocket</artifactId>
+				<version>10.1.56</version>
+			</dependency>
+
+			<!-- Security: fix Logback (MEDIUM) — excluded in srv/pom.xml -->
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/single-tenant/central-space/demoapp/srv/pom.xml b/app/single-tenant/central-space/demoapp/srv/pom.xml
index 2a91cb15..ff3dce7d 100644
--- a/app/single-tenant/central-space/demoapp/srv/pom.xml
+++ b/app/single-tenant/central-space/demoapp/srv/pom.xml
@@ -26,6 +26,24 @@
 		<dependency>
 			<groupId>com.sap.cds</groupId>
 			<artifactId>cds-starter-spring-boot</artifactId>
+			<exclusions>
+				<exclusion>
+					<groupId>io.opentelemetry</groupId>
+					<artifactId>opentelemetry-api</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>io.opentelemetry</groupId>
+					<artifactId>opentelemetry-context</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>ch.qos.logback</groupId>
+					<artifactId>logback-classic</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>ch.qos.logback</groupId>
+					<artifactId>logback-core</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 
 		<!-- ODATA PROTOCOL ADAPTER -->
diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml
index 05f66645..4626c992 100644
--- a/app/single-tenant/personal-space/demoapp/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/pom.xml
@@ -66,14 +66,7 @@
 				<version>1.84</version>
 			</dependency>
 
-			<!-- Security: fix OpenTelemetry (HIGH) -->
-			<dependency>
-				<groupId>io.opentelemetry</groupId>
-				<artifactId>opentelemetry-bom</artifactId>
-				<version>1.50.0</version>
-				<type>pom</type>
-				<scope>import</scope>
-			</dependency>
+			<!-- Security: fix OpenTelemetry (HIGH) — excluded in srv/pom.xml -->
 
 			<!-- Security: fix Nimbus-JOSE-JWT (MEDIUM) -->
 			<dependency>
@@ -81,6 +74,49 @@
 				<artifactId>nimbus-jose-jwt</artifactId>
 				<version>10.9.1</version>
 			</dependency>
+
+			<!-- Security: fix jackson-databind (MEDIUM) -->
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>2.19.2</version>
+			</dependency>
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-core</artifactId>
+				<version>2.19.2</version>
+			</dependency>
+
+			<!-- Security: fix Apache HTTPComponents Core (MEDIUM) -->
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5-h2</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+
+			<!-- Security: fix Apache Tomcat (CRITICAL) -->
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-core</artifactId>
+				<version>10.1.56</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-el</artifactId>
+				<version>10.1.56</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-websocket</artifactId>
+				<version>10.1.56</version>
+			</dependency>
+
+			<!-- Security: fix Logback (MEDIUM) — excluded in srv/pom.xml -->
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/single-tenant/personal-space/demoapp/srv/pom.xml b/app/single-tenant/personal-space/demoapp/srv/pom.xml
index 1a18bebd..bb5b4d3b 100644
--- a/app/single-tenant/personal-space/demoapp/srv/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/srv/pom.xml
@@ -26,6 +26,24 @@
 		<dependency>
 			<groupId>com.sap.cds</groupId>
 			<artifactId>cds-starter-spring-boot</artifactId>
+			<exclusions>
+				<exclusion>
+					<groupId>io.opentelemetry</groupId>
+					<artifactId>opentelemetry-api</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>io.opentelemetry</groupId>
+					<artifactId>opentelemetry-context</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>ch.qos.logback</groupId>
+					<artifactId>logback-classic</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>ch.qos.logback</groupId>
+					<artifactId>logback-core</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 
 		<!-- ODATA PROTOCOL ADAPTER -->
diff --git a/sdm/pom.xml b/sdm/pom.xml
index 2c5d7eb7..8339b561 100644
--- a/sdm/pom.xml
+++ b/sdm/pom.xml
@@ -39,10 +39,10 @@
         <jacoco.version>0.8.7</jacoco.version>
         <ehcache-version>3.10.8</ehcache-version>
         <token-client-version>3.5.7</token-client-version>
-        <jackson-databind-version>2.18.9</jackson-databind-version>
+        <jackson-databind-version>2.19.2</jackson-databind-version>
         <json-version>20250107</json-version>
         <commons-codec-version>1.18.0</commons-codec-version>
-        <jackson-core-version>2.18.6</jackson-core-version>
+        <jackson-core-version>2.19.2</jackson-core-version>
         <mockito-junit-jupiter-version>5.15.2</mockito-junit-jupiter-version>
         <httpclient5-version>5.4.4</httpclient5-version>
         <httpcore5-version>5.4.3</httpcore5-version>
@@ -108,12 +108,12 @@
         </dependency>
     <dependency>
         <groupId>org.apache.httpcomponents.core5</groupId>
-        <artifactId>httpcore5</artifactId>
+        <artifactId>httpcore5-h2</artifactId>
         <version>${httpcore5-version}</version>
     </dependency>
     <dependency>
         <groupId>org.apache.httpcomponents.core5</groupId>
-        <artifactId>httpcore5-h2</artifactId>
+        <artifactId>httpcore5</artifactId>
         <version>${httpcore5-version}</version>
     </dependency>
 

From 952de5d9f936dc4825f1c4b1c1dcf50ea465697b Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 14:01:02 +0530
Subject: [PATCH 07/27] blackduck-scan-fix

---
 .../central-space/cloud-cap-samples-java/pom.xml           | 7 -------
 .../central-space/cloud-cap-samples-java/srv/pom.xml       | 6 ++++++
 .../personal-space/cloud-cap-samples-java/pom.xml          | 7 -------
 .../personal-space/cloud-cap-samples-java/srv/pom.xml      | 6 ++++++
 4 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
index 4be1c8f1..9d8ee10d 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
@@ -157,13 +157,6 @@
 
 			<!-- Security: fix Logback (MEDIUM) — excluded in srv/pom.xml -->
 
-			<!-- Security: fix HdrHistogram (MEDIUM) -->
-			<dependency>
-				<groupId>org.hdrhistogram</groupId>
-				<artifactId>HdrHistogram</artifactId>
-				<version>2.5.0</version>
-			</dependency>
-
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
index d88aeea7..64ccb5be 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
@@ -161,6 +161,12 @@
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-actuator</artifactId>
+			<exclusions>
+				<exclusion>
+					<groupId>org.hdrhistogram</groupId>
+					<artifactId>HdrHistogram</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 
 		<dependency>
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
index d3d468cf..1ff6ae88 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
@@ -157,13 +157,6 @@
 
 			<!-- Security: fix Logback (MEDIUM) — excluded in srv/pom.xml -->
 
-			<!-- Security: fix HdrHistogram (MEDIUM) -->
-			<dependency>
-				<groupId>org.hdrhistogram</groupId>
-				<artifactId>HdrHistogram</artifactId>
-				<version>2.5.0</version>
-			</dependency>
-
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml
index 8925a1a9..d3124846 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml
@@ -161,6 +161,12 @@
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-actuator</artifactId>
+			<exclusions>
+				<exclusion>
+					<groupId>org.hdrhistogram</groupId>
+					<artifactId>HdrHistogram</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 
 		<dependency>

From 575e5712bc8a32ea41fcea9be8739ab764c72bc1 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 14:54:30 +0530
Subject: [PATCH 08/27] Update pom.xml

---
 .../central-space/cloud-cap-samples-java/pom.xml   | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
index 9d8ee10d..79b76835 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
@@ -89,19 +89,7 @@
 				<version>1.84</version>
 			</dependency>
 
-			<!-- Security: fix jackson-databind (HIGH) -->
-			<dependency>
-				<groupId>com.fasterxml.jackson.core</groupId>
-				<artifactId>jackson-databind</artifactId>
-				<version>2.19.2</version>
-			</dependency>
-			<dependency>
-				<groupId>com.fasterxml.jackson.core</groupId>
-				<artifactId>jackson-core</artifactId>
-				<version>2.19.2</version>
-			</dependency>
-
-			<!-- Security: fix OpenTelemetry (HIGH) — excluded in srv/pom.xml -->
+			
 
 			<!-- Security: fix Nimbus-JOSE-JWT (MEDIUM) -->
 			<dependency>

From 385c26c9ea01f1c43fa6d0cee037a076ace170ac Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 14:55:07 +0530
Subject: [PATCH 09/27] Update pom.xml

---
 .../personal-space/cloud-cap-samples-java/pom.xml   | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
index 1ff6ae88..338301fe 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
@@ -89,19 +89,6 @@
 				<version>1.84</version>
 			</dependency>
 
-			<!-- Security: fix jackson-databind (HIGH) -->
-			<dependency>
-				<groupId>com.fasterxml.jackson.core</groupId>
-				<artifactId>jackson-databind</artifactId>
-				<version>2.19.2</version>
-			</dependency>
-			<dependency>
-				<groupId>com.fasterxml.jackson.core</groupId>
-				<artifactId>jackson-core</artifactId>
-				<version>2.19.2</version>
-			</dependency>
-
-			<!-- Security: fix OpenTelemetry (HIGH) — excluded in srv/pom.xml -->
 
 			<!-- Security: fix Nimbus-JOSE-JWT (MEDIUM) -->
 			<dependency>

From 232138bec38c79619490c3fbe7320f128991358b Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 14:55:39 +0530
Subject: [PATCH 10/27] Update pom.xml

---
 app/single-tenant/central-space/demoapp/pom.xml | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml
index 4626c992..21fbe902 100644
--- a/app/single-tenant/central-space/demoapp/pom.xml
+++ b/app/single-tenant/central-space/demoapp/pom.xml
@@ -75,19 +75,6 @@
 				<version>10.9.1</version>
 			</dependency>
 
-			<!-- Security: fix jackson-databind (MEDIUM) -->
-			<dependency>
-				<groupId>com.fasterxml.jackson.core</groupId>
-				<artifactId>jackson-databind</artifactId>
-				<version>2.19.2</version>
-			</dependency>
-			<dependency>
-				<groupId>com.fasterxml.jackson.core</groupId>
-				<artifactId>jackson-core</artifactId>
-				<version>2.19.2</version>
-			</dependency>
-
-			<!-- Security: fix Apache HTTPComponents Core (MEDIUM) -->
 			<dependency>
 				<groupId>org.apache.httpcomponents.core5</groupId>
 				<artifactId>httpcore5</artifactId>

From 38cfa26931230b0b541769c21e4055c66fdef145 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 14:56:16 +0530
Subject: [PATCH 11/27] Update pom.xml

---
 app/single-tenant/personal-space/demoapp/pom.xml | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml
index 4626c992..929c4dae 100644
--- a/app/single-tenant/personal-space/demoapp/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/pom.xml
@@ -75,19 +75,7 @@
 				<version>10.9.1</version>
 			</dependency>
 
-			<!-- Security: fix jackson-databind (MEDIUM) -->
-			<dependency>
-				<groupId>com.fasterxml.jackson.core</groupId>
-				<artifactId>jackson-databind</artifactId>
-				<version>2.19.2</version>
-			</dependency>
-			<dependency>
-				<groupId>com.fasterxml.jackson.core</groupId>
-				<artifactId>jackson-core</artifactId>
-				<version>2.19.2</version>
-			</dependency>
-
-			<!-- Security: fix Apache HTTPComponents Core (MEDIUM) -->
+			
 			<dependency>
 				<groupId>org.apache.httpcomponents.core5</groupId>
 				<artifactId>httpcore5</artifactId>

From 7ae68cc8d87cc2f0292b235efa479a0744a87432 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 14:57:28 +0530
Subject: [PATCH 12/27] Update pom.xml

---
 sdm/pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sdm/pom.xml b/sdm/pom.xml
index 8339b561..c08299b7 100644
--- a/sdm/pom.xml
+++ b/sdm/pom.xml
@@ -39,10 +39,10 @@
         <jacoco.version>0.8.7</jacoco.version>
         <ehcache-version>3.10.8</ehcache-version>
         <token-client-version>3.5.7</token-client-version>
-        <jackson-databind-version>2.19.2</jackson-databind-version>
+        <jackson-databind-version>2.18.9</jackson-databind-version>
         <json-version>20250107</json-version>
         <commons-codec-version>1.18.0</commons-codec-version>
-        <jackson-core-version>2.19.2</jackson-core-version>
+        <jackson-core-version>2.18.6</jackson-core-version>
         <mockito-junit-jupiter-version>5.15.2</mockito-junit-jupiter-version>
         <httpclient5-version>5.4.4</httpclient5-version>
         <httpcore5-version>5.4.3</httpcore5-version>

From 01ac5a58bae5e5da64265fb758472a8cb8764756 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 16:14:36 +0530
Subject: [PATCH 13/27] update pom

---
 .../cloud-cap-samples-java/srv/pom.xml        | 20 -------------------
 .../cloud-cap-samples-java/srv/pom.xml        | 20 -------------------
 .../central-space/demoapp/srv/pom.xml         | 18 -----------------
 .../personal-space/demoapp/srv/pom.xml        | 18 -----------------
 4 files changed, 76 deletions(-)

diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
index 64ccb5be..7235e8cd 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/srv/pom.xml
@@ -20,16 +20,6 @@
 		<dependency>
 			<groupId>com.sap.cds</groupId>
 			<artifactId>cds-starter-spring-boot</artifactId>
-			<exclusions>
-				<exclusion>
-					<groupId>io.opentelemetry</groupId>
-					<artifactId>opentelemetry-api</artifactId>
-				</exclusion>
-				<exclusion>
-					<groupId>io.opentelemetry</groupId>
-					<artifactId>opentelemetry-context</artifactId>
-				</exclusion>
-			</exclusions>
 		</dependency>
 
 		<dependency>
@@ -141,16 +131,6 @@
 			<groupId>com.sap.hcp.cf.logging</groupId>
 			<artifactId>cf-java-logging-support-logback</artifactId>
 			<version>${cf-java-logging-support.version}</version>
-			<exclusions>
-				<exclusion>
-					<groupId>ch.qos.logback</groupId>
-					<artifactId>logback-classic</artifactId>
-				</exclusion>
-				<exclusion>
-					<groupId>ch.qos.logback</groupId>
-					<artifactId>logback-core</artifactId>
-				</exclusion>
-			</exclusions>
 		</dependency>
 
 		<dependency>
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml
index d3124846..9873b698 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/srv/pom.xml
@@ -20,16 +20,6 @@
 		<dependency>
 			<groupId>com.sap.cds</groupId>
 			<artifactId>cds-starter-spring-boot</artifactId>
-			<exclusions>
-				<exclusion>
-					<groupId>io.opentelemetry</groupId>
-					<artifactId>opentelemetry-api</artifactId>
-				</exclusion>
-				<exclusion>
-					<groupId>io.opentelemetry</groupId>
-					<artifactId>opentelemetry-context</artifactId>
-				</exclusion>
-			</exclusions>
 		</dependency>
 
 		<dependency>
@@ -141,16 +131,6 @@
 			<groupId>com.sap.hcp.cf.logging</groupId>
 			<artifactId>cf-java-logging-support-logback</artifactId>
 			<version>${cf-java-logging-support.version}</version>
-			<exclusions>
-				<exclusion>
-					<groupId>ch.qos.logback</groupId>
-					<artifactId>logback-classic</artifactId>
-				</exclusion>
-				<exclusion>
-					<groupId>ch.qos.logback</groupId>
-					<artifactId>logback-core</artifactId>
-				</exclusion>
-			</exclusions>
 		</dependency>
 
 		<dependency>
diff --git a/app/single-tenant/central-space/demoapp/srv/pom.xml b/app/single-tenant/central-space/demoapp/srv/pom.xml
index ff3dce7d..2a91cb15 100644
--- a/app/single-tenant/central-space/demoapp/srv/pom.xml
+++ b/app/single-tenant/central-space/demoapp/srv/pom.xml
@@ -26,24 +26,6 @@
 		<dependency>
 			<groupId>com.sap.cds</groupId>
 			<artifactId>cds-starter-spring-boot</artifactId>
-			<exclusions>
-				<exclusion>
-					<groupId>io.opentelemetry</groupId>
-					<artifactId>opentelemetry-api</artifactId>
-				</exclusion>
-				<exclusion>
-					<groupId>io.opentelemetry</groupId>
-					<artifactId>opentelemetry-context</artifactId>
-				</exclusion>
-				<exclusion>
-					<groupId>ch.qos.logback</groupId>
-					<artifactId>logback-classic</artifactId>
-				</exclusion>
-				<exclusion>
-					<groupId>ch.qos.logback</groupId>
-					<artifactId>logback-core</artifactId>
-				</exclusion>
-			</exclusions>
 		</dependency>
 
 		<!-- ODATA PROTOCOL ADAPTER -->
diff --git a/app/single-tenant/personal-space/demoapp/srv/pom.xml b/app/single-tenant/personal-space/demoapp/srv/pom.xml
index bb5b4d3b..1a18bebd 100644
--- a/app/single-tenant/personal-space/demoapp/srv/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/srv/pom.xml
@@ -26,24 +26,6 @@
 		<dependency>
 			<groupId>com.sap.cds</groupId>
 			<artifactId>cds-starter-spring-boot</artifactId>
-			<exclusions>
-				<exclusion>
-					<groupId>io.opentelemetry</groupId>
-					<artifactId>opentelemetry-api</artifactId>
-				</exclusion>
-				<exclusion>
-					<groupId>io.opentelemetry</groupId>
-					<artifactId>opentelemetry-context</artifactId>
-				</exclusion>
-				<exclusion>
-					<groupId>ch.qos.logback</groupId>
-					<artifactId>logback-classic</artifactId>
-				</exclusion>
-				<exclusion>
-					<groupId>ch.qos.logback</groupId>
-					<artifactId>logback-core</artifactId>
-				</exclusion>
-			</exclusions>
 		</dependency>
 
 		<!-- ODATA PROTOCOL ADAPTER -->

From 6fe6475fab375c56261bee2c05167c6d76ef6d99 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 16:31:12 +0530
Subject: [PATCH 14/27] Remove httpcore5 and Tomcat dependencyManagement
 overrides from app pom files

These entries are managed by spring-boot-dependencies BOM which already pins
safe versions; explicit overrides are redundant and no longer needed.
---
 .../cloud-cap-samples-java/pom.xml            | 30 -------------------
 .../cloud-cap-samples-java/pom.xml            | 30 -------------------
 .../central-space/demoapp/pom.xml             | 29 ------------------
 .../personal-space/demoapp/pom.xml            | 30 -------------------
 4 files changed, 119 deletions(-)

diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
index 79b76835..71912363 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
@@ -114,36 +114,6 @@
 				<version>3.17.0</version>
 			</dependency>
 
-			<!-- Security: fix Apache HTTPComponents Core (MEDIUM) -->
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5-h2</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-
-			<!-- Security: fix Apache Tomcat (CRITICAL) -->
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-core</artifactId>
-				<version>10.1.56</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-el</artifactId>
-				<version>10.1.56</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-websocket</artifactId>
-				<version>10.1.56</version>
-			</dependency>
-
-			<!-- Security: fix Logback (MEDIUM) — excluded in srv/pom.xml -->
 
 		</dependencies>
 	</dependencyManagement>
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
index 338301fe..d47bdb74 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
@@ -113,36 +113,6 @@
 				<version>3.17.0</version>
 			</dependency>
 
-			<!-- Security: fix Apache HTTPComponents Core (MEDIUM) -->
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5-h2</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-
-			<!-- Security: fix Apache Tomcat (CRITICAL) -->
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-core</artifactId>
-				<version>10.1.56</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-el</artifactId>
-				<version>10.1.56</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-websocket</artifactId>
-				<version>10.1.56</version>
-			</dependency>
-
-			<!-- Security: fix Logback (MEDIUM) — excluded in srv/pom.xml -->
 
 		</dependencies>
 	</dependencyManagement>
diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml
index 21fbe902..a980affe 100644
--- a/app/single-tenant/central-space/demoapp/pom.xml
+++ b/app/single-tenant/central-space/demoapp/pom.xml
@@ -75,35 +75,6 @@
 				<version>10.9.1</version>
 			</dependency>
 
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5-h2</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-
-			<!-- Security: fix Apache Tomcat (CRITICAL) -->
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-core</artifactId>
-				<version>10.1.56</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-el</artifactId>
-				<version>10.1.56</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-websocket</artifactId>
-				<version>10.1.56</version>
-			</dependency>
-
-			<!-- Security: fix Logback (MEDIUM) — excluded in srv/pom.xml -->
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml
index 929c4dae..a980affe 100644
--- a/app/single-tenant/personal-space/demoapp/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/pom.xml
@@ -75,36 +75,6 @@
 				<version>10.9.1</version>
 			</dependency>
 
-			
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5-h2</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-
-			<!-- Security: fix Apache Tomcat (CRITICAL) -->
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-core</artifactId>
-				<version>10.1.56</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-el</artifactId>
-				<version>10.1.56</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-websocket</artifactId>
-				<version>10.1.56</version>
-			</dependency>
-
-			<!-- Security: fix Logback (MEDIUM) — excluded in srv/pom.xml -->
 		</dependencies>
 	</dependencyManagement>
 

From c21b85127f9cedd2f4f2a96047c2b0fc15d5b6bc Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 20:47:16 +0530
Subject: [PATCH 15/27] Update pom.xml

---
 sdm/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdm/pom.xml b/sdm/pom.xml
index c08299b7..4d215819 100644
--- a/sdm/pom.xml
+++ b/sdm/pom.xml
@@ -39,7 +39,7 @@
         <jacoco.version>0.8.7</jacoco.version>
         <ehcache-version>3.10.8</ehcache-version>
         <token-client-version>3.5.7</token-client-version>
-        <jackson-databind-version>2.18.9</jackson-databind-version>
+        <jackson-databind-version>2.22.1</jackson-databind-version>
         <json-version>20250107</json-version>
         <commons-codec-version>1.18.0</commons-codec-version>
         <jackson-core-version>2.18.6</jackson-core-version>

From eb2a87cb12466470d360607511da8e12f063c397 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 20:51:59 +0530
Subject: [PATCH 16/27] Update pom.xml

---
 sdm/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdm/pom.xml b/sdm/pom.xml
index 4d215819..c08299b7 100644
--- a/sdm/pom.xml
+++ b/sdm/pom.xml
@@ -39,7 +39,7 @@
         <jacoco.version>0.8.7</jacoco.version>
         <ehcache-version>3.10.8</ehcache-version>
         <token-client-version>3.5.7</token-client-version>
-        <jackson-databind-version>2.22.1</jackson-databind-version>
+        <jackson-databind-version>2.18.9</jackson-databind-version>
         <json-version>20250107</json-version>
         <commons-codec-version>1.18.0</commons-codec-version>
         <jackson-core-version>2.18.6</jackson-core-version>

From 1c7176b9c5edb61bde08b60cf89d4031dd9a3e01 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 21:05:44 +0530
Subject: [PATCH 17/27] adding dependency for apache tomcat ,logback,jackson
 databind,httpcore,opentelementary

---
 .../cloud-cap-samples-java/pom.xml            | 59 +++++++++++++++++++
 .../cloud-cap-samples-java/pom.xml            | 59 +++++++++++++++++++
 .../central-space/demoapp/pom.xml             | 29 +++++++++
 .../personal-space/demoapp/pom.xml            | 29 +++++++++
 4 files changed, 176 insertions(+)

diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
index 71912363..3142372f 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
@@ -114,6 +114,65 @@
 				<version>3.17.0</version>
 			</dependency>
 
+			<!-- Security: fix Apache Tomcat (CRITICAL/HIGH/MEDIUM) -->
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-core</artifactId>
+				<version>10.1.57</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-el</artifactId>
+				<version>10.1.57</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-websocket</artifactId>
+				<version>10.1.57</version>
+			</dependency>
+
+			<!-- Security: fix Apache HTTPComponents Core 5 (MEDIUM) -->
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5-h2</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+
+			<!-- Security: fix jackson-databind (MEDIUM) -->
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>2.22.1</version>
+			</dependency>
+
+			<!-- Security: fix Logback (MEDIUM) -->
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-core</artifactId>
+				<version>1.5.37</version>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-classic</artifactId>
+				<version>1.5.37</version>
+			</dependency>
+
+			<!-- Security: fix OpenTelemetry (HIGH) -->
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-api</artifactId>
+				<version>1.63.0</version>
+			</dependency>
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-context</artifactId>
+				<version>1.63.0</version>
+			</dependency>
 
 		</dependencies>
 	</dependencyManagement>
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
index d47bdb74..6089d8d2 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
@@ -113,6 +113,65 @@
 				<version>3.17.0</version>
 			</dependency>
 
+			<!-- Security: fix Apache Tomcat (CRITICAL/HIGH/MEDIUM) -->
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-core</artifactId>
+				<version>10.1.57</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-el</artifactId>
+				<version>10.1.57</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-websocket</artifactId>
+				<version>10.1.57</version>
+			</dependency>
+
+			<!-- Security: fix Apache HTTPComponents Core 5 (MEDIUM) -->
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5-h2</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+
+			<!-- Security: fix jackson-databind (MEDIUM) -->
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>2.22.1</version>
+			</dependency>
+
+			<!-- Security: fix Logback (MEDIUM) -->
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-core</artifactId>
+				<version>1.5.37</version>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-classic</artifactId>
+				<version>1.5.37</version>
+			</dependency>
+
+			<!-- Security: fix OpenTelemetry (HIGH) -->
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-api</artifactId>
+				<version>1.63.0</version>
+			</dependency>
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-context</artifactId>
+				<version>1.63.0</version>
+			</dependency>
 
 		</dependencies>
 	</dependencyManagement>
diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml
index a980affe..481b0145 100644
--- a/app/single-tenant/central-space/demoapp/pom.xml
+++ b/app/single-tenant/central-space/demoapp/pom.xml
@@ -75,6 +75,35 @@
 				<version>10.9.1</version>
 			</dependency>
 
+			<!-- Security: fix Apache Tomcat (CRITICAL/HIGH/MEDIUM) -->
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-core</artifactId>
+				<version>10.1.57</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-el</artifactId>
+				<version>10.1.57</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-websocket</artifactId>
+				<version>10.1.57</version>
+			</dependency>
+
+			<!-- Security: fix OpenTelemetry (HIGH) -->
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-api</artifactId>
+				<version>1.63.0</version>
+			</dependency>
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-context</artifactId>
+				<version>1.63.0</version>
+			</dependency>
+
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml
index a980affe..481b0145 100644
--- a/app/single-tenant/personal-space/demoapp/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/pom.xml
@@ -75,6 +75,35 @@
 				<version>10.9.1</version>
 			</dependency>
 
+			<!-- Security: fix Apache Tomcat (CRITICAL/HIGH/MEDIUM) -->
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-core</artifactId>
+				<version>10.1.57</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-el</artifactId>
+				<version>10.1.57</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-websocket</artifactId>
+				<version>10.1.57</version>
+			</dependency>
+
+			<!-- Security: fix OpenTelemetry (HIGH) -->
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-api</artifactId>
+				<version>1.63.0</version>
+			</dependency>
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-context</artifactId>
+				<version>1.63.0</version>
+			</dependency>
+
 		</dependencies>
 	</dependencyManagement>
 

From 6be6e8dfac92597f829bf0f44ce4885cf7171dfc Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 21:34:46 +0530
Subject: [PATCH 18/27] update pom

---
 .../cloud-cap-samples-java/pom.xml            | 41 +++----------------
 .../cloud-cap-samples-java/pom.xml            | 41 +++----------------
 .../central-space/demoapp/pom.xml             | 19 +++++++++
 .../personal-space/demoapp/pom.xml            | 19 +++++++++
 4 files changed, 48 insertions(+), 72 deletions(-)

diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
index 3142372f..40a27c29 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
@@ -28,6 +28,11 @@
 		<xsuaa.version>3.5.0</xsuaa.version>
 		<cf-java-logging-support.version>3.8.3</cf-java-logging-support.version>
 		<cds.install-cdsdk.version>9.8.0</cds.install-cdsdk.version>
+
+		<!-- Security: fix Spring Boot managed transitive versions -->
+		<tomcat.version>10.1.57</tomcat.version>
+		<logback.version>1.5.37</logback.version>
+		<jackson-bom.version>2.22.1</jackson-bom.version>
 	</properties>
 
 	<modules>
@@ -114,23 +119,6 @@
 				<version>3.17.0</version>
 			</dependency>
 
-			<!-- Security: fix Apache Tomcat (CRITICAL/HIGH/MEDIUM) -->
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-core</artifactId>
-				<version>10.1.57</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-el</artifactId>
-				<version>10.1.57</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-websocket</artifactId>
-				<version>10.1.57</version>
-			</dependency>
-
 			<!-- Security: fix Apache HTTPComponents Core 5 (MEDIUM) -->
 			<dependency>
 				<groupId>org.apache.httpcomponents.core5</groupId>
@@ -143,25 +131,6 @@
 				<version>5.4.3</version>
 			</dependency>
 
-			<!-- Security: fix jackson-databind (MEDIUM) -->
-			<dependency>
-				<groupId>com.fasterxml.jackson.core</groupId>
-				<artifactId>jackson-databind</artifactId>
-				<version>2.22.1</version>
-			</dependency>
-
-			<!-- Security: fix Logback (MEDIUM) -->
-			<dependency>
-				<groupId>ch.qos.logback</groupId>
-				<artifactId>logback-core</artifactId>
-				<version>1.5.37</version>
-			</dependency>
-			<dependency>
-				<groupId>ch.qos.logback</groupId>
-				<artifactId>logback-classic</artifactId>
-				<version>1.5.37</version>
-			</dependency>
-
 			<!-- Security: fix OpenTelemetry (HIGH) -->
 			<dependency>
 				<groupId>io.opentelemetry</groupId>
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
index 6089d8d2..8990e247 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
@@ -28,6 +28,11 @@
 		<xsuaa.version>3.5.0</xsuaa.version>
 		<cf-java-logging-support.version>3.8.3</cf-java-logging-support.version>
 		<cds.install-cdsdk.version>9.3.1</cds.install-cdsdk.version>
+
+		<!-- Security: fix Spring Boot managed transitive versions -->
+		<tomcat.version>10.1.57</tomcat.version>
+		<logback.version>1.5.37</logback.version>
+		<jackson-bom.version>2.22.1</jackson-bom.version>
 	</properties>
 
 	<modules>
@@ -113,23 +118,6 @@
 				<version>3.17.0</version>
 			</dependency>
 
-			<!-- Security: fix Apache Tomcat (CRITICAL/HIGH/MEDIUM) -->
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-core</artifactId>
-				<version>10.1.57</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-el</artifactId>
-				<version>10.1.57</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-websocket</artifactId>
-				<version>10.1.57</version>
-			</dependency>
-
 			<!-- Security: fix Apache HTTPComponents Core 5 (MEDIUM) -->
 			<dependency>
 				<groupId>org.apache.httpcomponents.core5</groupId>
@@ -142,25 +130,6 @@
 				<version>5.4.3</version>
 			</dependency>
 
-			<!-- Security: fix jackson-databind (MEDIUM) -->
-			<dependency>
-				<groupId>com.fasterxml.jackson.core</groupId>
-				<artifactId>jackson-databind</artifactId>
-				<version>2.22.1</version>
-			</dependency>
-
-			<!-- Security: fix Logback (MEDIUM) -->
-			<dependency>
-				<groupId>ch.qos.logback</groupId>
-				<artifactId>logback-core</artifactId>
-				<version>1.5.37</version>
-			</dependency>
-			<dependency>
-				<groupId>ch.qos.logback</groupId>
-				<artifactId>logback-classic</artifactId>
-				<version>1.5.37</version>
-			</dependency>
-
 			<!-- Security: fix OpenTelemetry (HIGH) -->
 			<dependency>
 				<groupId>io.opentelemetry</groupId>
diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml
index 481b0145..0de9c625 100644
--- a/app/single-tenant/central-space/demoapp/pom.xml
+++ b/app/single-tenant/central-space/demoapp/pom.xml
@@ -92,6 +92,25 @@
 				<version>10.1.57</version>
 			</dependency>
 
+			<!-- Security: fix jackson-databind (MEDIUM) -->
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>2.22.1</version>
+			</dependency>
+
+			<!-- Security: fix Logback (MEDIUM) -->
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-core</artifactId>
+				<version>1.5.37</version>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-classic</artifactId>
+				<version>1.5.37</version>
+			</dependency>
+
 			<!-- Security: fix OpenTelemetry (HIGH) -->
 			<dependency>
 				<groupId>io.opentelemetry</groupId>
diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml
index 481b0145..0de9c625 100644
--- a/app/single-tenant/personal-space/demoapp/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/pom.xml
@@ -92,6 +92,25 @@
 				<version>10.1.57</version>
 			</dependency>
 
+			<!-- Security: fix jackson-databind (MEDIUM) -->
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>2.22.1</version>
+			</dependency>
+
+			<!-- Security: fix Logback (MEDIUM) -->
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-core</artifactId>
+				<version>1.5.37</version>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-classic</artifactId>
+				<version>1.5.37</version>
+			</dependency>
+
 			<!-- Security: fix OpenTelemetry (HIGH) -->
 			<dependency>
 				<groupId>io.opentelemetry</groupId>

From ec1200e39e5d169c6f6e03560790f7df00b86c2e Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 21:53:41 +0530
Subject: [PATCH 19/27] update pom

---
 .../cloud-cap-samples-java/pom.xml            | 14 ---------
 .../cloud-cap-samples-java/pom.xml            | 14 ---------
 .../central-space/demoapp/pom.xml             | 29 -------------------
 .../personal-space/demoapp/pom.xml            | 29 -------------------
 4 files changed, 86 deletions(-)

diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
index 40a27c29..42c1c3be 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
@@ -30,8 +30,6 @@
 		<cds.install-cdsdk.version>9.8.0</cds.install-cdsdk.version>
 
 		<!-- Security: fix Spring Boot managed transitive versions -->
-		<tomcat.version>10.1.57</tomcat.version>
-		<logback.version>1.5.37</logback.version>
 		<jackson-bom.version>2.22.1</jackson-bom.version>
 	</properties>
 
@@ -119,18 +117,6 @@
 				<version>3.17.0</version>
 			</dependency>
 
-			<!-- Security: fix Apache HTTPComponents Core 5 (MEDIUM) -->
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5-h2</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-
 			<!-- Security: fix OpenTelemetry (HIGH) -->
 			<dependency>
 				<groupId>io.opentelemetry</groupId>
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
index 8990e247..83a95b04 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
@@ -30,8 +30,6 @@
 		<cds.install-cdsdk.version>9.3.1</cds.install-cdsdk.version>
 
 		<!-- Security: fix Spring Boot managed transitive versions -->
-		<tomcat.version>10.1.57</tomcat.version>
-		<logback.version>1.5.37</logback.version>
 		<jackson-bom.version>2.22.1</jackson-bom.version>
 	</properties>
 
@@ -118,18 +116,6 @@
 				<version>3.17.0</version>
 			</dependency>
 
-			<!-- Security: fix Apache HTTPComponents Core 5 (MEDIUM) -->
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5-h2</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-
 			<!-- Security: fix OpenTelemetry (HIGH) -->
 			<dependency>
 				<groupId>io.opentelemetry</groupId>
diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml
index 0de9c625..af2a454e 100644
--- a/app/single-tenant/central-space/demoapp/pom.xml
+++ b/app/single-tenant/central-space/demoapp/pom.xml
@@ -75,23 +75,6 @@
 				<version>10.9.1</version>
 			</dependency>
 
-			<!-- Security: fix Apache Tomcat (CRITICAL/HIGH/MEDIUM) -->
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-core</artifactId>
-				<version>10.1.57</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-el</artifactId>
-				<version>10.1.57</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-websocket</artifactId>
-				<version>10.1.57</version>
-			</dependency>
-
 			<!-- Security: fix jackson-databind (MEDIUM) -->
 			<dependency>
 				<groupId>com.fasterxml.jackson.core</groupId>
@@ -99,18 +82,6 @@
 				<version>2.22.1</version>
 			</dependency>
 
-			<!-- Security: fix Logback (MEDIUM) -->
-			<dependency>
-				<groupId>ch.qos.logback</groupId>
-				<artifactId>logback-core</artifactId>
-				<version>1.5.37</version>
-			</dependency>
-			<dependency>
-				<groupId>ch.qos.logback</groupId>
-				<artifactId>logback-classic</artifactId>
-				<version>1.5.37</version>
-			</dependency>
-
 			<!-- Security: fix OpenTelemetry (HIGH) -->
 			<dependency>
 				<groupId>io.opentelemetry</groupId>
diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml
index 0de9c625..af2a454e 100644
--- a/app/single-tenant/personal-space/demoapp/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/pom.xml
@@ -75,23 +75,6 @@
 				<version>10.9.1</version>
 			</dependency>
 
-			<!-- Security: fix Apache Tomcat (CRITICAL/HIGH/MEDIUM) -->
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-core</artifactId>
-				<version>10.1.57</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-el</artifactId>
-				<version>10.1.57</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-websocket</artifactId>
-				<version>10.1.57</version>
-			</dependency>
-
 			<!-- Security: fix jackson-databind (MEDIUM) -->
 			<dependency>
 				<groupId>com.fasterxml.jackson.core</groupId>
@@ -99,18 +82,6 @@
 				<version>2.22.1</version>
 			</dependency>
 
-			<!-- Security: fix Logback (MEDIUM) -->
-			<dependency>
-				<groupId>ch.qos.logback</groupId>
-				<artifactId>logback-core</artifactId>
-				<version>1.5.37</version>
-			</dependency>
-			<dependency>
-				<groupId>ch.qos.logback</groupId>
-				<artifactId>logback-classic</artifactId>
-				<version>1.5.37</version>
-			</dependency>
-
 			<!-- Security: fix OpenTelemetry (HIGH) -->
 			<dependency>
 				<groupId>io.opentelemetry</groupId>

From 0fea393df382a6fca6257551066483c6b1275239 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 22:32:42 +0530
Subject: [PATCH 20/27] update pom

---
 .../cloud-cap-samples-java/pom.xml            | 17 ++++++++
 .../central-space/demoapp/pom.xml             | 41 +++++++++++++++++++
 2 files changed, 58 insertions(+)

diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
index 42c1c3be..a1fc1cd5 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
@@ -31,6 +31,11 @@
 
 		<!-- Security: fix Spring Boot managed transitive versions -->
 		<jackson-bom.version>2.22.1</jackson-bom.version>
+
+		<!-- Security: fix Tomcat (Critical/High) -->
+		<tomcat.version>10.1.57</tomcat.version>
+		<!-- Security: fix Logback (Medium) -->
+		<logback.version>1.5.37</logback.version>
 	</properties>
 
 	<modules>
@@ -129,6 +134,18 @@
 				<version>1.63.0</version>
 			</dependency>
 
+			<!-- Security: fix Apache HTTPComponents Core (Medium) -->
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5-h2</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml
index af2a454e..da1fd071 100644
--- a/app/single-tenant/central-space/demoapp/pom.xml
+++ b/app/single-tenant/central-space/demoapp/pom.xml
@@ -94,6 +94,47 @@
 				<version>1.63.0</version>
 			</dependency>
 
+			<!-- Security: fix Apache HTTPComponents Core (Medium) -->
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.httpcomponents.core5</groupId>
+				<artifactId>httpcore5-h2</artifactId>
+				<version>5.4.3</version>
+			</dependency>
+
+			<!-- Security: fix Tomcat (Critical/High) -->
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-core</artifactId>
+				<version>10.1.57</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-el</artifactId>
+				<version>10.1.57</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-websocket</artifactId>
+				<version>10.1.57</version>
+			</dependency>
+
+			<!-- Security: fix Logback (Medium) -->
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-classic</artifactId>
+				<version>1.5.37</version>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-core</artifactId>
+				<version>1.5.37</version>
+			</dependency>
+
 		</dependencies>
 	</dependencyManagement>
 

From 429ec554203e47042f6b778b7b7ea123f1356a46 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sat, 11 Jul 2026 22:45:16 +0530
Subject: [PATCH 21/27] Revert "update pom"

This reverts commit 0fea393df382a6fca6257551066483c6b1275239.
---
 .../cloud-cap-samples-java/pom.xml            | 17 --------
 .../central-space/demoapp/pom.xml             | 41 -------------------
 2 files changed, 58 deletions(-)

diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
index a1fc1cd5..42c1c3be 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
@@ -31,11 +31,6 @@
 
 		<!-- Security: fix Spring Boot managed transitive versions -->
 		<jackson-bom.version>2.22.1</jackson-bom.version>
-
-		<!-- Security: fix Tomcat (Critical/High) -->
-		<tomcat.version>10.1.57</tomcat.version>
-		<!-- Security: fix Logback (Medium) -->
-		<logback.version>1.5.37</logback.version>
 	</properties>
 
 	<modules>
@@ -134,18 +129,6 @@
 				<version>1.63.0</version>
 			</dependency>
 
-			<!-- Security: fix Apache HTTPComponents Core (Medium) -->
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5-h2</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml
index da1fd071..af2a454e 100644
--- a/app/single-tenant/central-space/demoapp/pom.xml
+++ b/app/single-tenant/central-space/demoapp/pom.xml
@@ -94,47 +94,6 @@
 				<version>1.63.0</version>
 			</dependency>
 
-			<!-- Security: fix Apache HTTPComponents Core (Medium) -->
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.httpcomponents.core5</groupId>
-				<artifactId>httpcore5-h2</artifactId>
-				<version>5.4.3</version>
-			</dependency>
-
-			<!-- Security: fix Tomcat (Critical/High) -->
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-core</artifactId>
-				<version>10.1.57</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-el</artifactId>
-				<version>10.1.57</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.tomcat.embed</groupId>
-				<artifactId>tomcat-embed-websocket</artifactId>
-				<version>10.1.57</version>
-			</dependency>
-
-			<!-- Security: fix Logback (Medium) -->
-			<dependency>
-				<groupId>ch.qos.logback</groupId>
-				<artifactId>logback-classic</artifactId>
-				<version>1.5.37</version>
-			</dependency>
-			<dependency>
-				<groupId>ch.qos.logback</groupId>
-				<artifactId>logback-core</artifactId>
-				<version>1.5.37</version>
-			</dependency>
-
 		</dependencies>
 	</dependencyManagement>
 

From aaa31eb9c0cb42a0c43dd7c0cb7c296f428cc290 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sun, 12 Jul 2026 10:02:35 +0530
Subject: [PATCH 22/27] Update pom.xml

---
 sdm/pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sdm/pom.xml b/sdm/pom.xml
index c08299b7..2c5d7eb7 100644
--- a/sdm/pom.xml
+++ b/sdm/pom.xml
@@ -108,12 +108,12 @@
         </dependency>
     <dependency>
         <groupId>org.apache.httpcomponents.core5</groupId>
-        <artifactId>httpcore5-h2</artifactId>
+        <artifactId>httpcore5</artifactId>
         <version>${httpcore5-version}</version>
     </dependency>
     <dependency>
         <groupId>org.apache.httpcomponents.core5</groupId>
-        <artifactId>httpcore5</artifactId>
+        <artifactId>httpcore5-h2</artifactId>
         <version>${httpcore5-version}</version>
     </dependency>
 

From bcf4b048b551daf53dca8ba0540348ab360adb2e Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sun, 12 Jul 2026 10:09:26 +0530
Subject: [PATCH 23/27] Update pom.xml

---
 app/single-tenant/central-space/demoapp/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml
index af2a454e..37c47e52 100644
--- a/app/single-tenant/central-space/demoapp/pom.xml
+++ b/app/single-tenant/central-space/demoapp/pom.xml
@@ -102,7 +102,7 @@
                 <id>github-snapshot</id>
                 <url>https://maven.pkg.github.com/cap-java/sdm</url>
                 <releases>
-                    <enabled>false</enabled>
+                    <enabled>true</enabled>
                 </releases>
                 <snapshots>
                     <enabled>true</enabled>

From 65727a4f530c7925652dbd971e230b9de5b0ae76 Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sun, 12 Jul 2026 10:10:02 +0530
Subject: [PATCH 24/27] Update pom.xml

---
 app/single-tenant/personal-space/demoapp/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml
index af2a454e..37c47e52 100644
--- a/app/single-tenant/personal-space/demoapp/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/pom.xml
@@ -102,7 +102,7 @@
                 <id>github-snapshot</id>
                 <url>https://maven.pkg.github.com/cap-java/sdm</url>
                 <releases>
-                    <enabled>false</enabled>
+                    <enabled>true</enabled>
                 </releases>
                 <snapshots>
                     <enabled>true</enabled>

From dfab42b9a346a673a159706e2007a8b447d2654a Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sun, 12 Jul 2026 11:29:16 +0530
Subject: [PATCH 25/27] Update SNAPSHOT to RC1

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index e1b3ac37..107959db 100644
--- a/pom.xml
+++ b/pom.xml
@@ -23,7 +23,7 @@
     </developers>
 
     <properties>
-        <revision>1.10.1-SNAPSHOT</revision>
+        <revision>1.0.0-RC1</revision>
         <java.version>21</java.version>
         <maven.compiler.source>${java.version}</maven.compiler.source>
         <maven.compiler.target>${java.version}</maven.compiler.target>

From 73bd9b77950c47d04446dcc31b16552ade7fcd9d Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sun, 12 Jul 2026 12:38:39 +0530
Subject: [PATCH 26/27] revert jackson-bom

---
 app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
index 42c1c3be..77997d8c 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
@@ -29,8 +29,6 @@
 		<cf-java-logging-support.version>3.8.3</cf-java-logging-support.version>
 		<cds.install-cdsdk.version>9.8.0</cds.install-cdsdk.version>
 
-		<!-- Security: fix Spring Boot managed transitive versions -->
-		<jackson-bom.version>2.22.1</jackson-bom.version>
 	</properties>
 
 	<modules>

From 6f494f1ab6dbb4373d58e3fb296be4be79ea4bcf Mon Sep 17 00:00:00 2001
From: Myna855-sap <myna.p.m@sap.com>
Date: Sun, 12 Jul 2026 12:39:58 +0530
Subject: [PATCH 27/27] revert jackson-bom

---
 app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
index 83a95b04..8317f2ca 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
@@ -28,9 +28,6 @@
 		<xsuaa.version>3.5.0</xsuaa.version>
 		<cf-java-logging-support.version>3.8.3</cf-java-logging-support.version>
 		<cds.install-cdsdk.version>9.3.1</cds.install-cdsdk.version>
-
-		<!-- Security: fix Spring Boot managed transitive versions -->
-		<jackson-bom.version>2.22.1</jackson-bom.version>
 	</properties>
 
 	<modules>