Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

Bump the all-maven-dependencies group across 2 directories with 4 updates

Open
Number: #534
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: Contributor
Comments: 0
Created: September 02, 2025 at 12:12 AM UTC
(10 months ago)
Updated: September 02, 2025 at 05:30 AM UTC
(10 months ago)
Labels:
dependencies java
Description:

Bumps the all-maven-dependencies group with 4 updates in the / directory: org.springframework.boot:spring-boot-starter-parent, com.sap.cloud.sdk:sdk-modules-bom, com.sap.cloud.security:java-bom and com.sap.cds:cds-feature-attachments.
Bumps the all-maven-dependencies group with 4 updates in the /srv directory: org.springframework.boot:spring-boot-starter-parent, com.sap.cloud.sdk:sdk-modules-bom, com.sap.cloud.security:java-bom and com.sap.cds:cds-feature-attachments.

Updates org.springframework.boot:spring-boot-starter-parent from 3.5.4 to 3.5.5

Release notes

Sourced from org.springframework.boot:spring-boot-starter-parent's releases.

v3.5.5

:lady_beetle: Bug Fixes

  • Hazelcast health indicator reports the wrong status when Hazelcast has shut down due to an out-of-memory error #46909
  • Performance critical tracing code has high overhead due to the use of the Stream API #46844
  • SpringLiquibaseCustomizer is exposed outside its defined visibility scope #46758
  • Race condition in OutputCapture can result in stale data #46721
  • Auto-configured WebClient no longer uses context's ReactorResourceFactory #46673
  • Default value not detected for a field annoted with @Name #46666
  • Missing metadata when using @Name with a constructor-bound property #46663
  • Missing property for Spring Authorization Server's PAR endpoint #46641
  • Property name is incorrect when reporting a mis-configured OAuth 2 Resource Server JWT public key location #46636
  • Memory not freed on context restart in JpaMetamodel#CACHE with spring.main.lazy-initialization=true #46634
  • Auto-configured MockMvc ignores @FilterRegistration annotation #46605
  • Failure to discover default value for a primitive should not lead to document its default value #46561

:notebook_with_decorative_cover: Documentation

  • Kotlin samples for configuration metadata are in the wrong package #46857
  • Observability examples in the reference guide are missing the Kotlin version #46798
  • Align method descriptions for SslOptions getCiphers and getEnabledProtocols with @returns #46769
  • Tracing samples in the reference guide are missing the Kotlin version #46767
  • Improve Virtual Threads section to mention the changes in Java 24 #46610
  • spring.test.webtestclient.timeout is not documented #46588
  • spring-boot-test-autoconfigure should use the configuration properties annotation processor like other modules #46585
  • Adapt deprecation level for management.health.influxdb.enabled #46580
  • spring.test.mockmvc properties are not documented #46578

:hammer: Dependency Upgrades

  • Upgrade to Angus Mail 2.0.4 #46725
  • Upgrade to AssertJ 3.27.4 #46726
  • Upgrade to Byte Buddy 1.17.7 #46883
  • Upgrade to Couchbase Client 3.8.3 #46794
  • Upgrade to Elasticsearch Client 8.18.5 #46830
  • Upgrade to Hibernate 6.6.26.Final #46884
  • Upgrade to Hibernate Validator 8.0.3.Final #46728
  • Upgrade to HikariCP 6.3.2 #46729
  • Upgrade to Jersey 3.1.11 #46730
  • Upgrade to Jetty 12.0.25 #46831
  • Upgrade to Jetty Reactive HTTPClient 4.0.11 #46885
  • Upgrade to jOOQ 3.19.25 #46808
  • Upgrade to MariaDB 3.5.5 #46779
  • Upgrade to Maven Javadoc Plugin 3.11.3 #46886
  • Upgrade to Micrometer 1.15.3 #46701
  • Upgrade to Micrometer Tracing 1.5.3 #46702
  • Upgrade to MySQL 9.4.0 #46732
  • Upgrade to Netty 4.1.124.Final #46832
  • Upgrade to Pulsar 4.0.6 #46733
  • Upgrade to Reactor Bom 2024.0.9 #46703

... (truncated)

Commits
  • 3537d25 Release v3.5.5
  • a22e28e Merge branch '3.4.x' into 3.5.x
  • 4cb8c8a Next development version (v3.4.10-SNAPSHOT)
  • 9d205e2 Merge branch '3.4.x' into 3.5.x
  • 47b0632 Merge pull request #46927 from izeye
  • 8b71458 Adapt checkstyle rules for 3.4.x
  • fb99bad Remove redundant suppressions from Checkstyle configuration
  • 8af836a Upgrade to Spring RESTDocs 3.0.5
  • ae6c6a5 Merge branch '3.4.x' into 3.5.x
  • b6bae9f Upgrade to Spring RESTDocs 3.0.5
  • Additional commits viewable in compare view

Updates com.sap.cloud.sdk:sdk-modules-bom from 5.21.0 to 5.22.0

Release notes

Sourced from com.sap.cloud.sdk:sdk-modules-bom's releases.

Release 5.22.0

What's Changed

New Contributors

Full Changelog: https://github.com/SAP/cloud-sdk-java/commits/rel/5.22.0

Commits
  • bc82f92 Update to version 5.22.0
  • 896880d fix: Revert Javadoc Plugin back to 3.11.2 (#915)
  • b82d470 fix: Fix release notes (#912)
  • 6c84b1a [Destinations] Custom Destination Service Parameters and Chaining (#895)
  • b023be3 chore: [DevOps] bump the production-minor-patch group with 2 updates (#908)
  • 05011f8 fix: (OData v4) Use correct ETag / If-Match header for entity bound actions (...
  • 3939e82 chore: [DevOps] bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.3.2 t...
  • 053385a fix: [openapi-generator-plugin] Resolve Jackson Dependency Convergence (#906)
  • 9963244 [IAS] Improve Test Coverage for Named User OAuth Token Caching (#815)
  • 731ac0b chore: Update security lib to 3.6.3 (#896)
  • Additional commits viewable in compare view

Updates com.sap.cloud.security:java-bom from 3.6.2 to 3.6.3

Release notes

Sourced from com.sap.cloud.security:java-bom's releases.

3.6.3

  • Updated license informations in POM files back to original value

Dependency upgrades

  • Bump com.github.spotbugs:spotbugs-annotations from 4.9.3 to 4.9.4
  • Bump org.assertj:assertj-core from 3.27.3 to 3.27.4
Changelog

Sourced from com.sap.cloud.security:java-bom's changelog.

3.6.3

  • Updated license informations in POM files back to original value

Dependency upgrades

  • Bump com.github.spotbugs:spotbugs-annotations from 4.9.3 to 4.9.4
  • Bump org.assertj:assertj-core from 3.27.3 to 3.27.4
Commits

Updates com.sap.cds:cds-feature-attachments from 1.1.0 to 1.2.0

Release notes

Sourced from com.sap.cds:cds-feature-attachments's releases.

1.2.0

Version 1.2.0 - 2025-08-26

Added

  • Support for Object Stores (AWS, Azure and Google) (#481)

Changed

  • Rename folder 'examples' to 'storage-targets' and add section about this in the README.md (#519)
  • Use spotless plugin to ensure correct license header (#515)
  • Several version bumps

Full Changelog: https://github.com/cap-java/cds-feature-attachments/compare/1.1.0...1.1.1

Changelog

Sourced from com.sap.cds:cds-feature-attachments's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

The format is based on Keep a Changelog.

Version 1.1.1 - tbd

Added

Changed

Fixed

Commits
  • fc98d46 Update version to 1.2.0-SNAPSHOT (#545)
  • 006ddb0 Add pluginManagement section for storage-targets/cds-feature-attachments-oss ...
  • 9a2fe17 Update version to 1.2.0
  • 4e45ee1 Remove call to ensure-license.sh since we now use spotless for this (#539)
  • ba4364f Dependabot PRs (#538)
  • 8fc5748 Bump actions/checkout from 4 to 5 (#516)
  • 734c2a9 Use spotless plugin to ensure correct license header (#515)
  • 8dedd3a Connection to AWS, Azure and Google object store (#481)
  • dcf00a9 Rename folder 'examples' to 'storage-targets' and add section about this in t...
  • fd815dc Bump org.assertj:assertj-core from 3.27.3 to 3.27.4 (#514)
  • Additional commits viewable in compare view

Updates com.sap.cds:cds-feature-attachments from 1.1.0 to 1.2.0

Release notes

Sourced from com.sap.cds:cds-feature-attachments's releases.

1.2.0

Version 1.2.0 - 2025-08-26

Added

  • Support for Object Stores (AWS, Azure and Google) (#481)

Changed

  • Rename folder 'examples' to 'storage-targets' and add section about this in the README.md (#519)
  • Use spotless plugin to ensure correct license header (#515)
  • Several version bumps

Full Changelog: https://github.com/cap-java/cds-feature-attachments/compare/1.1.0...1.1.1

Changelog

Sourced from com.sap.cds:cds-feature-attachments's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

The format is based on Keep a Changelog.

Version 1.1.1 - tbd

Added

Changed

Fixed

Commits
  • fc98d46 Update version to 1.2.0-SNAPSHOT (#545)
  • 006ddb0 Add pluginManagement section for storage-targets/cds-feature-attachments-oss ...
  • 9a2fe17 Update version to 1.2.0
  • 4e45ee1 Remove call to ensure-license.sh since we now use spotless for this (#539)
  • ba4364f Dependabot PRs (#538)
  • 8fc5748 Bump actions/checkout from 4 to 5 (#516)
  • 734c2a9 Use spotless plugin to ensure correct license header (#515)
  • 8dedd3a Connection to AWS, Azure and Google object store (#481)
  • dcf00a9 Rename folder 'examples' to 'storage-targets' and add section about this in t...
  • fd815dc Bump org.assertj:assertj-core from 3.27.3 to 3.27.4 (#514)
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-starter-parent from 3.5.4 to 3.5.5

Release notes

Sourced from org.springframework.boot:spring-boot-starter-parent's releases.

v3.5.5

:lady_beetle: Bug Fixes

  • Hazelcast health indicator reports the wrong status when Hazelcast has shut down due to an out-of-memory error #46909
  • Performance critical tracing code has high overhead due to the use of the Stream API #46844
  • SpringLiquibaseCustomizer is exposed outside its defined visibility scope #46758
  • Race condition in OutputCapture can result in stale data #46721
  • Auto-configured WebClient no longer uses context's ReactorResourceFactory #46673
  • Default value not detected for a field annoted with @Name #46666
  • Missing metadata when using @Name with a constructor-bound property #46663
  • Missing property for Spring Authorization Server's PAR endpoint #46641
  • Property name is incorrect when reporting a mis-configured OAuth 2 Resource Server JWT public key location #46636
  • Memory not freed on context restart in JpaMetamodel#CACHE with spring.main.lazy-initialization=true #46634
  • Auto-configured MockMvc ignores @FilterRegistration annotation #46605
  • Failure to discover default value for a primitive should not lead to document its default value #46561

:notebook_with_decorative_cover: Documentation

  • Kotlin samples for configuration metadata are in the wrong package #46857
  • Observability examples in the reference guide are missing the Kotlin version #46798
  • Align method descriptions for SslOptions getCiphers and getEnabledProtocols with @returns #46769
  • Tracing samples in the reference guide are missing the Kotlin version #46767
  • Improve Virtual Threads section to mention the changes in Java 24 #46610
  • spring.test.webtestclient.timeout is not documented #46588
  • spring-boot-test-autoconfigure should use the configuration properties annotation processor like other modules #46585
  • Adapt deprecation level for management.health.influxdb.enabled #46580
  • spring.test.mockmvc properties are not documented #46578

:hammer: Dependency Upgrades

  • Upgrade to Angus Mail 2.0.4 #46725
  • Upgrade to AssertJ 3.27.4 #46726
  • Upgrade to Byte Buddy 1.17.7 #46883
  • Upgrade to Couchbase Client 3.8.3 #46794
  • Upgrade to Elasticsearch Client 8.18.5 #46830
  • Upgrade to Hibernate 6.6.26.Final #46884
  • Upgrade to Hibernate Validator 8.0.3.Final #46728
  • Upgrade to HikariCP 6.3.2 #46729
  • Upgrade to Jersey 3.1.11 #46730
  • Upgrade to Jetty 12.0.25 #46831
  • Upgrade to Jetty Reactive HTTPClient 4.0.11 #46885
  • Upgrade to jOOQ 3.19.25 #46808
  • Upgrade to MariaDB 3.5.5 #46779
  • Upgrade to Maven Javadoc Plugin 3.11.3 #46886
  • Upgrade to Micrometer 1.15.3 #46701
  • Upgrade to Micrometer Tracing 1.5.3 #46702
  • Upgrade to MySQL 9.4.0 #46732
  • Upgrade to Netty 4.1.124.Final #46832
  • Upgrade to Pulsar 4.0.6 #46733
  • Upgrade to Reactor Bom 2024.0.9 #46703

... (truncated)

Commits
  • 3537d25 Release v3.5.5
  • a22e28e Merge branch '3.4.x' into 3.5.x
  • 4cb8c8a Next development version (v3.4.10-SNAPSHOT)
  • 9d205e2 Merge branch '3.4.x' into 3.5.x
  • 47b0632 Merge pull request #46927 from izeye
  • 8b71458 Adapt checkstyle rules for 3.4.x
  • fb99bad Remove redundant suppressions from Checkstyle configuration
  • 8af836a Upgrade to Spring RESTDocs 3.0.5
  • ae6c6a5 Merge branch '3.4.x' into 3.5.x
  • b6bae9f Upgrade to Spring RESTDocs 3.0.5
  • Additional commits viewable in compare view

Updates com.sap.cloud.sdk:sdk-modules-bom from 5.21.0 to 5.22.0

Release notes

Sourced from com.sap.cloud.sdk:sdk-modules-bom's releases.

Release 5.22.0

What's Changed

New Contributors

Full Changelog: https://github.com/SAP/cloud-sdk-java/commits/rel/5.22.0

Commits
  • bc82f92 Update to version 5.22.0
  • 896880d fix: Revert Javadoc Plugin back to 3.11.2 (#915)
  • b82d470 fix: Fix release notes (#912)
  • 6c84b1a [Destinations] Custom Destination Service Parameters and Chaining (#895)
  • b023be3 chore: [DevOps] bump the production-minor-patch group with 2 updates (#908)
  • 05011f8 fix: (OData v4) Use correct ETag / If-Match header for entity bound actions (...
  • 3939e82 chore: [DevOps] bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.3.2 t...
  • 053385a fix: [openapi-generator-plugin] Resolve Jackson Dependency Convergence (#906)
  • 9963244 [IAS] Improve Test Coverage for Named User OAuth Token Caching (#815)
  • 731ac0b chore: Update security lib to 3.6.3 (#896)
  • Additional commits viewable in compare view

Updates com.sap.cloud.security:java-bom from 3.6.2 to 3.6.3

Release notes

Sourced from com.sap.cloud.security:java-bom's releases.

3.6.3

  • Updated license informations in POM files back to original value

Dependency upgrades

  • Bump com.github.spotbugs:spotbugs-annotations from 4.9.3 to 4.9.4
  • Bump org.assertj:assertj-core from 3.27.3 to 3.27.4
Changelog

Sourced from com.sap.cloud.security:java-bom's changelog.

3.6.3

  • Updated license informations in POM files back to original value

Dependency upgrades

  • Bump com.github.spotbugs:spotbugs-annotations from 4.9.3 to 4.9.4
  • Bump org.assertj:assertj-core from 3.27.3 to 3.27.4
Commits

Updates org.springframework.boot:spring-boot-starter-parent from 3.5.4 to 3.5.5

Release notes

Sourced from org.springframework.boot:spring-boot-starter-parent's releases.

v3.5.5

:lady_beetle: Bug Fixes

  • Hazelcast health indicator reports the wrong status when Hazelcast has shut down due to an out-of-memory error #46909
  • Performance critical tracing code has high overhead due to the use of the Stream API #46844
  • SpringLiquibaseCustomizer is exposed outside its defined visibility scope #46758
  • Race condition in OutputCapture can result in stale data #46721
  • Auto-configured WebClient no longer uses context's ReactorResourceFactory #46673
  • Default value not detected for a field annoted with @Name #46666
  • Missing metadata when using @Name with a constructor-bound property #46663
  • Missing property for Spring Authorization Server's PAR endpoint #46641
  • Property name is incorrect when reporting a mis-configured OAuth 2 Resource Server JWT public key location #46636
  • Memory not freed on context restart in JpaMetamodel#CACHE with spring.main.lazy-initialization=true #46634
  • Auto-configured MockMvc ignores @FilterRegistration annotation #46605
  • Failure to discover default value for a primitive should not lead to document its default value #46561

:notebook_with_decorative_cover: Documentation

  • Kotlin samples for configuration metadata are in the wrong package #46857
  • Observability examples in the reference guide are missing the Kotlin version #46798
  • Align method descriptions for SslOptions getCiphers and getEnabledProtocols with @returns #46769
  • Tracing samples in the reference guide are missing the Kotlin version #46767
  • Improve Virtual Threads section to mention the changes in Java 24 #46610
  • spring.test.webtestclient.timeout is not documented #46588
  • spring-boot-test-autoconfigure should use the configuration properties annotation processor like other modules #46585
  • Adapt deprecation level for management.health.influxdb.enabled #46580
  • spring.test.mockmvc properties are not documented #46578

:hammer: Dependency Upgrades

  • Upgrade to Angus Mail 2.0.4 #46725
  • Upgrade to AssertJ 3.27.4 #46726
  • Upgrade to Byte Buddy 1.17.7 #46883
  • Upgrade to Couchbase Client 3.8.3 #46794
  • Upgrade to Elasticsearch Client 8.18.5 #46830
  • Upgrade to Hibernate 6.6.26.Final #46884
  • Upgrade to Hibernate Validator 8.0.3.Final #46728
  • Upgrade to HikariCP 6.3.2 #46729
  • Upgrade to Jersey 3.1.11 #46730
  • Upgrade to Jetty 12.0.25 #46831
  • Upgrade to Jetty Reactive HTTPClient 4.0.11 #46885
  • Upgrade to jOOQ 3.19.25 #46808
  • Upgrade to MariaDB 3.5.5 #46779
  • Upgrade to Maven Javadoc Plugin 3.11.3 #46886
  • Upgrade to Micrometer 1.15.3 #46701
  • Upgrade to Micrometer Tracing 1.5.3 #46702
  • Upgrade to MySQL 9.4.0 #46732
  • Upgrade to Netty 4.1.124.Final #46832
  • Upgrade to Pulsar 4.0.6 #46733
  • Upgrade to Reactor Bom 2024.0.9 #46703

... (truncated)

Commits
Package Dependencies
Package:
 org.springframework.boot:spring-boot-starter-parent
Ecosystem:
maven
Version Change:
3.5.4 → 3.5.5
Update Type:
Patch
Package:
com.sap.cloud.sdk:sdk-modules-bom
Ecosystem:
maven
Version Change:
5.21.0 → 5.22.0
Update Type:
Minor
Package:
com.sap.cds:cds-feature-attachments
Ecosystem:
maven
Version Change:
1.1.0 → 1.2.0
Update Type:
Minor
Package:
com.sap.cloud.security:java-bom
Ecosystem:
maven
Version Change:
3.6.2 → 3.6.3
Update Type:
Patch
Security Advisories
protobuf-java has potential Denial of Service issue
GHSA-735f-pc8j-v9w8 CVE-2024-7254 HIGH
### Summary When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash. Reporter: Alexis Chal...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 6621065
UUID: 2790931990
Node ID: PR_kwDOD4OiKs6mWj4W
Host: GitHub
Repository: SAP-samples/cloud-cap-samples-java