From 40f3766fa0d77bc9fc8681996abcaf31494a5004 Mon Sep 17 00:00:00 2001
From: Rishi Kunnath <rishikunnath2002@gmail.com>
Date: Tue, 30 Jun 2026 09:56:49 +0530
Subject: [PATCH] fix BlackDuck security risks: bump Spring Boot and override
 Netty/Bouncy Castle

- Upgrade spring-boot-starter-parent from 3.2.6 to 3.5.16 in multi-tenant apps
  (resolves transitive CVEs in Tomcat 10.1.x, Spring Framework 6.1.x,
   Spring Security 6.2/6.3, jackson-databind 2.15/2.17)
- Upgrade spring.boot.version from 3.3.1 to 3.5.16 in single-tenant apps
  (resolves Spring Boot 3.3.1 CVEs and above transitive dependencies)
- Add dependencyManagement overrides for Netty 4.2.15.Final (was 4.1.110.Final)
- Add dependencyManagement overrides for Bouncy Castle 1.84 (was 1.78.1)
---
 .../cloud-cap-samples-java/pom.xml            | 23 ++++++++++++++++++-
 .../cloud-cap-samples-java/pom.xml            | 23 ++++++++++++++++++-
 .../central-space/demoapp/pom.xml             | 23 ++++++++++++++++++-
 .../personal-space/demoapp/pom.xml            | 23 ++++++++++++++++++-
 4 files changed, 88 insertions(+), 4 deletions(-)

diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
index 125460c5..27560642 100644
--- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml
@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>3.2.6</version>
+		<version>3.5.16</version>
 		<relativePath/> <!-- lookup parent from repository -->
 	</parent>
 
@@ -72,6 +72,27 @@
 				<version>4.0.0</version>
 			</dependency>
 
+			<!-- Security: fix Netty CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>io.netty</groupId>
+				<artifactId>netty-bom</artifactId>
+				<version>4.2.15.Final</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+
+			<!-- Security: fix Bouncy Castle CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
+
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
index c2c6df6a..096fbcbc 100644
--- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
+++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml
@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>3.2.6</version>
+		<version>3.5.16</version>
 		<relativePath/> <!-- lookup parent from repository -->
 	</parent>
 
@@ -72,6 +72,27 @@
 				<version>4.0.0</version>
 			</dependency>
 
+			<!-- Security: fix Netty CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>io.netty</groupId>
+				<artifactId>netty-bom</artifactId>
+				<version>4.2.15.Final</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+
+			<!-- Security: fix Bouncy Castle CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
+
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml
index 272527e3..78e4008c 100644
--- a/app/single-tenant/central-space/demoapp/pom.xml
+++ b/app/single-tenant/central-space/demoapp/pom.xml
@@ -18,7 +18,7 @@
 		<!-- DEPENDENCIES VERSION -->
 		<jdk.version>21</jdk.version>
 		<cds.services.version>4.1.1</cds.services.version>
-		<spring.boot.version>3.3.1</spring.boot.version>
+		<spring.boot.version>3.5.16</spring.boot.version>
 		<cds.install-cdsdk.version>8.0.2</cds.install-cdsdk.version>
 
 		<cds.install-node.downloadUrl>https://nodejs.org/dist/</cds.install-node.downloadUrl>
@@ -48,6 +48,27 @@
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
+
+			<!-- Security: fix Netty CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>io.netty</groupId>
+				<artifactId>netty-bom</artifactId>
+				<version>4.2.15.Final</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+
+			<!-- Security: fix Bouncy Castle CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml
index 272527e3..78e4008c 100644
--- a/app/single-tenant/personal-space/demoapp/pom.xml
+++ b/app/single-tenant/personal-space/demoapp/pom.xml
@@ -18,7 +18,7 @@
 		<!-- DEPENDENCIES VERSION -->
 		<jdk.version>21</jdk.version>
 		<cds.services.version>4.1.1</cds.services.version>
-		<spring.boot.version>3.3.1</spring.boot.version>
+		<spring.boot.version>3.5.16</spring.boot.version>
 		<cds.install-cdsdk.version>8.0.2</cds.install-cdsdk.version>
 
 		<cds.install-node.downloadUrl>https://nodejs.org/dist/</cds.install-node.downloadUrl>
@@ -48,6 +48,27 @@
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
+
+			<!-- Security: fix Netty CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>io.netty</groupId>
+				<artifactId>netty-bom</artifactId>
+				<version>4.2.15.Final</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+
+			<!-- Security: fix Bouncy Castle CVEs (BlackDuck) -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.84</version>
+			</dependency>
 		</dependencies>
 	</dependencyManagement>