From e35c03748ee3670a721385aac1e42fd94b529832 Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Fri, 11 Sep 2026 14:50:06 +0530 Subject: [PATCH 1/6] Vulnerabilities fix by updating app router version Upgrades @sap/approuter from 16.8.2 to 23.0.0 across all four app spaces (multi-tenant central/personal, single-tenant central/personal) to address security vulnerabilities. --- .../central-space/cloud-cap-samples-java/app/package.json | 2 +- .../personal-space/cloud-cap-samples-java/app/package.json | 2 +- app/single-tenant/central-space/demoapp/app/package.json | 2 +- app/single-tenant/personal-space/demoapp/app/package.json | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/app/package.json b/app/multi-tenant/central-space/cloud-cap-samples-java/app/package.json index fa9d34967..1c66f05ba 100644 --- a/app/multi-tenant/central-space/cloud-cap-samples-java/app/package.json +++ b/app/multi-tenant/central-space/cloud-cap-samples-java/app/package.json @@ -1,7 +1,7 @@ { "name": "approuter", "dependencies": { - "@sap/approuter": "16.8.2" + "@sap/approuter": "23.0.0" }, "scripts": { "start": "node node_modules/@sap/approuter/approuter.js" diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/app/package.json b/app/multi-tenant/personal-space/cloud-cap-samples-java/app/package.json index fa9d34967..1c66f05ba 100644 --- a/app/multi-tenant/personal-space/cloud-cap-samples-java/app/package.json +++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/app/package.json @@ -1,7 +1,7 @@ { "name": "approuter", "dependencies": { - "@sap/approuter": "16.8.2" + "@sap/approuter": "23.0.0" }, "scripts": { "start": "node node_modules/@sap/approuter/approuter.js" diff --git a/app/single-tenant/central-space/demoapp/app/package.json b/app/single-tenant/central-space/demoapp/app/package.json index fa9d34967..1c66f05ba 100644 --- a/app/single-tenant/central-space/demoapp/app/package.json +++ b/app/single-tenant/central-space/demoapp/app/package.json @@ -1,7 +1,7 @@ { "name": "approuter", "dependencies": { - "@sap/approuter": "16.8.2" + "@sap/approuter": "23.0.0" }, "scripts": { "start": "node node_modules/@sap/approuter/approuter.js" diff --git a/app/single-tenant/personal-space/demoapp/app/package.json b/app/single-tenant/personal-space/demoapp/app/package.json index fa9d34967..1c66f05ba 100644 --- a/app/single-tenant/personal-space/demoapp/app/package.json +++ b/app/single-tenant/personal-space/demoapp/app/package.json @@ -1,7 +1,7 @@ { "name": "approuter", "dependencies": { - "@sap/approuter": "16.8.2" + "@sap/approuter": "23.0.0" }, "scripts": { "start": "node node_modules/@sap/approuter/approuter.js" From d3318482531e69221a115fd1a96badee12beb72e Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Fri, 11 Sep 2026 14:50:26 +0530 Subject: [PATCH 2/6] Fix BlackDuck security vulnerabilities: upgrade jackson-databind and jackson-core - Bumps jackson-databind from 2.18.9 to 2.22.2 - Bumps jackson-core from 2.18.6 to 2.22.2 - Adds jackson-annotations 2.22 as an explicit dependency - Bumps httpclient5 from 5.4.4 to 5.6.4 --- sdm/pom.xml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/sdm/pom.xml b/sdm/pom.xml index fb5a2d344..42d4fc8c4 100644 --- a/sdm/pom.xml +++ b/sdm/pom.xml @@ -39,12 +39,13 @@ 0.8.7 3.10.8 3.5.7 - 2.18.9 + 2.22.2 20250107 1.18.0 - 2.18.6 + 2.22.2 + 2.22 5.15.2 - 5.4.4 + 5.6.4 5.4.3 4.1.5 4.4.16 @@ -196,6 +197,11 @@ jackson-databind ${jackson-databind-version} + + com.fasterxml.jackson.core + jackson-annotations + ${jackson-annotations-version} + org.json json From 23ef275ae2d5cadd7df359c989f79c2bbeedf7c6 Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Fri, 11 Sep 2026 14:50:51 +0530 Subject: [PATCH 3/6] =?UTF-8?q?Remove=20Commons=20Repo=20Workaround=20?= =?UTF-8?q?=E2=80=94=20Use=20Public=20npm=20for=20@sap/cds-dk=20and=20@sap?= =?UTF-8?q?/cds-mtxs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @sap/cds-mtxs@3.9.7 and @sap/cds-dk@9.9.5 are now available on public npm, so the CI workaround that injected SAP Artifactory tarball URLs via secrets (SAP_CDS_MTXS_TARBALL, SAP_CDS_DK_TARBALL, NPM_AUTH_TOKEN) is no longer needed. - Removes the "Setup npm registry and pin SAP tarballs" step from all five workflows - Replaces complex tarball-inject+install in blackduck.yml with plain npm install --legacy-peer-deps - Updates cds.install-cdsdk.version to ^9 in all four pom.xml files --- .github/workflows/blackduck.yml | 30 +--------- .github/workflows/cfdeploy.yml | 60 ------------------- .github/workflows/multiTenancyDeployLocal.yml | 29 --------- ...ultiTenant_deploy_and_Integration_test.yml | 29 --------- ...loy_and_Integration_test_LatestVersion.yml | 29 --------- .../cloud-cap-samples-java/pom.xml | 2 +- .../cloud-cap-samples-java/pom.xml | 2 +- .../central-space/demoapp/pom.xml | 2 +- .../personal-space/demoapp/pom.xml | 2 +- 9 files changed, 6 insertions(+), 179 deletions(-) diff --git a/.github/workflows/blackduck.yml b/.github/workflows/blackduck.yml index 7514912f0..2d5007208 100644 --- a/.github/workflows/blackduck.yml +++ b/.github/workflows/blackduck.yml @@ -42,40 +42,14 @@ jobs: mvn clean install -f app/single-tenant/central-space/demoapp/pom.xml -DskipTests mvn clean install -f app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml -DskipTests - - name: Setup npm registries and install SAP packages - env: - NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }} - SAP_CDS_MTXS_TARBALL: ${{ secrets.SAP_CDS_MTXS_TARBALL }} - SAP_CDS_DK_TARBALL: ${{ secrets.SAP_CDS_DK_TARBALL }} + - name: Install npm dependencies run: | - set +x - echo "::add-mask::$NPM_AUTH_TOKEN" - echo "::add-mask::$SAP_CDS_MTXS_TARBALL" - echo "::add-mask::$SAP_CDS_DK_TARBALL" - - MTXS="$SAP_CDS_MTXS_TARBALL" - DK="$SAP_CDS_DK_TARBALL" - TARBALL_HOST=$(printf '%s' "$MTXS" | sed -E 's#^https?://([^/]+)/.*#\1#') - for dir in \ "app/multi-tenant/central-space/cloud-cap-samples-java" \ "app/multi-tenant/central-space/cloud-cap-samples-java/mtx/sidecar" \ "app/multi-tenant/personal-space/cloud-cap-samples-java" \ "app/multi-tenant/personal-space/cloud-cap-samples-java/mtx/sidecar"; do - - printf '@sap:registry=https://registry.npmjs.org/\n//%s/:_authToken=%s\nlegacy-peer-deps=true\n' \ - "$TARBALL_HOST" "$NPM_AUTH_TOKEN" > "$dir/.npmrc" - - tmp=$(mktemp) - jq --arg mtxs "$MTXS" --arg dk "$DK" ' - (if .dependencies["@sap/cds-mtxs"] then .dependencies["@sap/cds-mtxs"] = $mtxs else . end) - | (if .dependencies["@sap/cds-dk"] then .dependencies["@sap/cds-dk"] = $dk else . end) - | .overrides["@sap/cds-mtxs"] = $mtxs - ' "$dir/package.json" > "$tmp" && mv "$tmp" "$dir/package.json" - - npm install --prefix "$dir" - - git checkout "$dir/package.json" + npm install --prefix "$dir" --legacy-peer-deps done # - name: Download Synopsys Detect Script diff --git a/.github/workflows/cfdeploy.yml b/.github/workflows/cfdeploy.yml index 637f9e57a..d8c83d700 100644 --- a/.github/workflows/cfdeploy.yml +++ b/.github/workflows/cfdeploy.yml @@ -76,36 +76,6 @@ jobs: fi fi - - name: Setup npm registry and pin SAP tarballs 📦 - env: - NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }} - SAP_CDS_MTXS_TARBALL: ${{ secrets.SAP_CDS_MTXS_TARBALL }} - SAP_CDS_DK_TARBALL: ${{ secrets.SAP_CDS_DK_TARBALL }} - run: | - set +x - echo "::add-mask::$NPM_AUTH_TOKEN" - echo "::add-mask::$SAP_CDS_MTXS_TARBALL" - echo "::add-mask::$SAP_CDS_DK_TARBALL" - - MTXS="$SAP_CDS_MTXS_TARBALL" - DK="$SAP_CDS_DK_TARBALL" - TARBALL_HOST=$(printf '%s' "$MTXS" | sed -E 's#^https?://([^/]+)/.*#\1#') - - for dir in \ - "app/single-tenant/personal-space/demoapp" \ - "app/single-tenant/personal-space/demoapp/db" \ - "app/single-tenant/personal-space/demoapp/app"; do - - printf '@sap:registry=https://registry.npmjs.org/\n//%s/:_authToken=%s\nlegacy-peer-deps=true\n' \ - "$TARBALL_HOST" "$NPM_AUTH_TOKEN" > "$dir/.npmrc" - - tmp=$(mktemp) - jq --arg mtxs "$MTXS" --arg dk "$DK" ' - (if .dependencies["@sap/cds-mtxs"] then .dependencies["@sap/cds-mtxs"] = $mtxs else . end) - | (if .dependencies["@sap/cds-dk"] then .dependencies["@sap/cds-dk"] = $dk else . end) - ' "$dir/package.json" > "$tmp" && mv "$tmp" "$dir/package.json" - done - - name: Prepare and Deploy to Cloud Foundry ☁️ run: | set +x @@ -244,36 +214,6 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Setup npm registry and pin SAP tarballs 📦 - env: - NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }} - SAP_CDS_MTXS_TARBALL: ${{ secrets.SAP_CDS_MTXS_TARBALL }} - SAP_CDS_DK_TARBALL: ${{ secrets.SAP_CDS_DK_TARBALL }} - run: | - set +x - echo "::add-mask::$NPM_AUTH_TOKEN" - echo "::add-mask::$SAP_CDS_MTXS_TARBALL" - echo "::add-mask::$SAP_CDS_DK_TARBALL" - - MTXS="$SAP_CDS_MTXS_TARBALL" - DK="$SAP_CDS_DK_TARBALL" - TARBALL_HOST=$(printf '%s' "$MTXS" | sed -E 's#^https?://([^/]+)/.*#\1#') - - for dir in \ - "app/single-tenant/central-space/demoapp" \ - "app/single-tenant/central-space/demoapp/db" \ - "app/single-tenant/central-space/demoapp/app"; do - - printf '@sap:registry=https://registry.npmjs.org/\n//%s/:_authToken=%s\nlegacy-peer-deps=true\n' \ - "$TARBALL_HOST" "$NPM_AUTH_TOKEN" > "$dir/.npmrc" - - tmp=$(mktemp) - jq --arg mtxs "$MTXS" --arg dk "$DK" ' - (if .dependencies["@sap/cds-mtxs"] then .dependencies["@sap/cds-mtxs"] = $mtxs else . end) - | (if .dependencies["@sap/cds-dk"] then .dependencies["@sap/cds-dk"] = $dk else . end) - ' "$dir/package.json" > "$tmp" && mv "$tmp" "$dir/package.json" - done - - name: Prepare and Deploy to Cloud Foundry ☁️ run: | set +x diff --git a/.github/workflows/multiTenancyDeployLocal.yml b/.github/workflows/multiTenancyDeployLocal.yml index dd5d767fb..b9379e382 100644 --- a/.github/workflows/multiTenancyDeployLocal.yml +++ b/.github/workflows/multiTenancyDeployLocal.yml @@ -52,35 +52,6 @@ jobs: with: node-version: '20' # Ensure to use at least version 18 - - name: Setup npm registry and pin SAP tarballs 📦 - env: - NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }} - SAP_CDS_MTXS_TARBALL: ${{ secrets.SAP_CDS_MTXS_TARBALL }} - SAP_CDS_DK_TARBALL: ${{ secrets.SAP_CDS_DK_TARBALL }} - run: | - set +x - echo "::add-mask::$NPM_AUTH_TOKEN" - echo "::add-mask::$SAP_CDS_MTXS_TARBALL" - echo "::add-mask::$SAP_CDS_DK_TARBALL" - - MTXS="$SAP_CDS_MTXS_TARBALL" - DK="$SAP_CDS_DK_TARBALL" - TARBALL_HOST=$(printf '%s' "$MTXS" | sed -E 's#^https?://([^/]+)/.*#\1#') - - for dir in \ - "app/multi-tenant/personal-space/cloud-cap-samples-java" \ - "app/multi-tenant/personal-space/cloud-cap-samples-java/mtx/sidecar"; do - - printf '@sap:registry=https://registry.npmjs.org/\n//%s/:_authToken=%s\nlegacy-peer-deps=true\n' \ - "$TARBALL_HOST" "$NPM_AUTH_TOKEN" > "$dir/.npmrc" - - tmp=$(mktemp) - jq --arg mtxs "$MTXS" --arg dk "$DK" ' - (if .dependencies["@sap/cds-mtxs"] then .dependencies["@sap/cds-mtxs"] = $mtxs else . end) - | (if .dependencies["@sap/cds-dk"] then .dependencies["@sap/cds-dk"] = $dk else . end) - ' "$dir/package.json" > "$tmp" && mv "$tmp" "$dir/package.json" - done - - name: Install MBT ⚙️ run: | echo "🔧 Installing MBT..." diff --git a/.github/workflows/multiTenant_deploy_and_Integration_test.yml b/.github/workflows/multiTenant_deploy_and_Integration_test.yml index 59c3f65b4..1aac12e51 100644 --- a/.github/workflows/multiTenant_deploy_and_Integration_test.yml +++ b/.github/workflows/multiTenant_deploy_and_Integration_test.yml @@ -43,35 +43,6 @@ jobs: with: node-version: '20' # Ensure to use at least version 18 - - name: Setup npm registry and pin SAP tarballs 📦 - env: - NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }} - SAP_CDS_MTXS_TARBALL: ${{ secrets.SAP_CDS_MTXS_TARBALL }} - SAP_CDS_DK_TARBALL: ${{ secrets.SAP_CDS_DK_TARBALL }} - run: | - set +x - echo "::add-mask::$NPM_AUTH_TOKEN" - echo "::add-mask::$SAP_CDS_MTXS_TARBALL" - echo "::add-mask::$SAP_CDS_DK_TARBALL" - - MTXS="$SAP_CDS_MTXS_TARBALL" - DK="$SAP_CDS_DK_TARBALL" - TARBALL_HOST=$(printf '%s' "$MTXS" | sed -E 's#^https?://([^/]+)/.*#\1#') - - for dir in \ - "app/multi-tenant/central-space/cloud-cap-samples-java" \ - "app/multi-tenant/central-space/cloud-cap-samples-java/mtx/sidecar"; do - - printf '@sap:registry=https://registry.npmjs.org/\n//%s/:_authToken=%s\nlegacy-peer-deps=true\n' \ - "$TARBALL_HOST" "$NPM_AUTH_TOKEN" > "$dir/.npmrc" - - tmp=$(mktemp) - jq --arg mtxs "$MTXS" --arg dk "$DK" ' - (if .dependencies["@sap/cds-mtxs"] then .dependencies["@sap/cds-mtxs"] = $mtxs else . end) - | (if .dependencies["@sap/cds-dk"] then .dependencies["@sap/cds-dk"] = $dk else . end) - ' "$dir/package.json" > "$tmp" && mv "$tmp" "$dir/package.json" - done - - name: Install MBT ⚙️ run: | echo "🔧 Installing MBT..." diff --git a/.github/workflows/multiTenant_deploy_and_Integration_test_LatestVersion.yml b/.github/workflows/multiTenant_deploy_and_Integration_test_LatestVersion.yml index 180d14c01..a4742b635 100644 --- a/.github/workflows/multiTenant_deploy_and_Integration_test_LatestVersion.yml +++ b/.github/workflows/multiTenant_deploy_and_Integration_test_LatestVersion.yml @@ -43,35 +43,6 @@ jobs: with: node-version: '20' # Ensure to use at least version 18 - - name: Setup npm registry and pin SAP tarballs 📦 - env: - NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }} - SAP_CDS_MTXS_TARBALL: ${{ secrets.SAP_CDS_MTXS_TARBALL }} - SAP_CDS_DK_TARBALL: ${{ secrets.SAP_CDS_DK_TARBALL }} - run: | - set +x - echo "::add-mask::$NPM_AUTH_TOKEN" - echo "::add-mask::$SAP_CDS_MTXS_TARBALL" - echo "::add-mask::$SAP_CDS_DK_TARBALL" - - MTXS="$SAP_CDS_MTXS_TARBALL" - DK="$SAP_CDS_DK_TARBALL" - TARBALL_HOST=$(printf '%s' "$MTXS" | sed -E 's#^https?://([^/]+)/.*#\1#') - - for dir in \ - "app/multi-tenant/central-space/cloud-cap-samples-java" \ - "app/multi-tenant/central-space/cloud-cap-samples-java/mtx/sidecar"; do - - printf '@sap:registry=https://registry.npmjs.org/\n//%s/:_authToken=%s\nlegacy-peer-deps=true\n' \ - "$TARBALL_HOST" "$NPM_AUTH_TOKEN" > "$dir/.npmrc" - - tmp=$(mktemp) - jq --arg mtxs "$MTXS" --arg dk "$DK" ' - (if .dependencies["@sap/cds-mtxs"] then .dependencies["@sap/cds-mtxs"] = $mtxs else . end) - | (if .dependencies["@sap/cds-dk"] then .dependencies["@sap/cds-dk"] = $dk else . end) - ' "$dir/package.json" > "$tmp" && mv "$tmp" "$dir/package.json" - done - - name: Install MBT ⚙️ run: | echo "🔧 Installing MBT..." diff --git a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml index 125460c56..6fdfffbae 100644 --- a/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml @@ -27,7 +27,7 @@ 5.12.0 3.5.0 3.8.3 - 9.8.0 + ^9 diff --git a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml index c2c6df6ae..6fdfffbae 100644 --- a/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml +++ b/app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml @@ -27,7 +27,7 @@ 5.12.0 3.5.0 3.8.3 - 9.3.1 + ^9 diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml index 272527e30..e84476d12 100644 --- a/app/single-tenant/central-space/demoapp/pom.xml +++ b/app/single-tenant/central-space/demoapp/pom.xml @@ -19,7 +19,7 @@ 21 4.1.1 3.3.1 - 8.0.2 + ^9 https://nodejs.org/dist/ UTF-8 diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml index 272527e30..e84476d12 100644 --- a/app/single-tenant/personal-space/demoapp/pom.xml +++ b/app/single-tenant/personal-space/demoapp/pom.xml @@ -19,7 +19,7 @@ 21 4.1.1 3.3.1 - 8.0.2 + ^9 https://nodejs.org/dist/ UTF-8 From 47f7882d8e275f5e14f207fdde3ba7b5a5db6e8c Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Fri, 11 Sep 2026 15:01:44 +0530 Subject: [PATCH 4/6] for deployment --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index c188cfe7d..4a3bbe258 100644 --- a/pom.xml +++ b/pom.xml @@ -23,7 +23,7 @@ - 1.10.1-SNAPSHOT + 1.0.0-RC1 21 ${java.version} ${java.version} From 9e316d6d11cad10edf94ea4aec8288a740cf15ab Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Fri, 11 Sep 2026 17:07:28 +0530 Subject: [PATCH 5/6] cds-service change for cds-dk version 9.x --- app/single-tenant/central-space/demoapp/pom.xml | 2 +- app/single-tenant/personal-space/demoapp/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/app/single-tenant/central-space/demoapp/pom.xml b/app/single-tenant/central-space/demoapp/pom.xml index e84476d12..7a6b443a7 100644 --- a/app/single-tenant/central-space/demoapp/pom.xml +++ b/app/single-tenant/central-space/demoapp/pom.xml @@ -17,7 +17,7 @@ 21 - 4.1.1 + 4.3.0 3.3.1 ^9 diff --git a/app/single-tenant/personal-space/demoapp/pom.xml b/app/single-tenant/personal-space/demoapp/pom.xml index e84476d12..7a6b443a7 100644 --- a/app/single-tenant/personal-space/demoapp/pom.xml +++ b/app/single-tenant/personal-space/demoapp/pom.xml @@ -17,7 +17,7 @@ 21 - 4.1.1 + 4.3.0 3.3.1 ^9 From ba51a63ff7e03d708ab39d5051e3436abf72b6d1 Mon Sep 17 00:00:00 2001 From: Ankush Kumar Garg Date: Fri, 11 Sep 2026 17:40:32 +0530 Subject: [PATCH 6/6] Update pom.xml --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 4a3bbe258..c188cfe7d 100644 --- a/pom.xml +++ b/pom.xml @@ -23,7 +23,7 @@ - 1.0.0-RC1 + 1.10.1-SNAPSHOT 21 ${java.version} ${java.version}