Skip to content

Bump the minor-patch group across 1 directory with 5 updates - #112

Merged
finkmanAtSap merged 1 commit into
mainfrom
dependabot/maven/ams-spring-boot-shopping/minor-patch-78314ede30
Sep 14, 2026
Merged

Bump the minor-patch group across 1 directory with 5 updates#112
finkmanAtSap merged 1 commit into
mainfrom
dependabot/maven/ams-spring-boot-shopping/minor-patch-78314ede30

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-patch group with 5 updates in the /ams-spring-boot-shopping directory:

Package From To
com.sap.cloud.security:java-bom 4.1.0 4.1.2
com.sap.cloud.security.ams:ams-bom 4.5.0 4.5.1
com.sap.cloud.sdk:sdk-bom 5.33.0 5.34.0
org.apache.maven.plugins:maven-compiler-plugin 3.15.0 3.16.0
org.apache.maven.plugins:maven-surefire-plugin 3.5.6 3.6.0

Updates com.sap.cloud.security:java-bom from 4.1.0 to 4.1.2

Release notes

Sourced from com.sap.cloud.security:java-bom's releases.

4.1.2

  • Enforce constructor-supplied service configurations in HybridTokenAuthenticator
    • The IAS and XSUAA delegate authenticators were constructed without the configurations explicitly passed to HybridTokenAuthenticator, causing them to fall back to Environments.getCurrent() at request time. The supplied SecurityHttpClient was similarly ignored by the delegates
    • The constructor now forwards iasConfig, xsuaaConfig, and httpClient to both delegates via withServiceConfiguration / withHttpClient. Applications that follow the documented pattern of loading configurations from Environments.getCurrent() are unaffected
    • Adds HybridTokenAuthenticatorConfigurationTest with real delegates (no reflection-based mock replacement) to guard against regressions on both the IAS and XSUAA validation paths
  • Update dependencies:
    • Spring Boot: 4.1.0 → 4.1.1
    • Spring Framework: 7.0.8 → 7.0.9
    • Spring Security: 7.1.0 → 7.1.1
    • Jetty: 12.1.11 → 12.1.12
    • Reactor (core & test): 3.8.6 → 3.8.7
    • JUnit Jupiter: 6.1.2 → 6.1.3
    • SpotBugs annotations: 4.10.3 → 4.10.4
    • SpotBugs Maven Plugin: 4.10.3.0 → 4.10.4.0
    • logcaptor (test scope): 2.12.6 → 2.12.7
    • Legacy Spring Boot 3.x / Spring Framework 6.x compatibility versions for the spring-security-3 module: Spring Boot 3.5.14 → 3.5.16, Spring Framework 6.2.18 → 6.2.19, Spring Security 6.5.10 → 6.5.11, Reactor 3.8.2 → 3.8.7

4.1.1

  • Fix null X-App-Tid request header sent to IAS JWKS endpoint when token lacks app_tid claim
    • SapIdJwtSignatureValidator unconditionally placed the app_tid claim value as the X-App-Tid request header. When the claim is absent, token.getAppTid() returns null, causing a NullPointerException or a literal "null" header value on the outgoing JWKS request
    • The header is now only added when app_tid is present in the token; tokens without the claim omit the header entirely, which is the correct behaviour for provider-tenant requests
Changelog

Sourced from com.sap.cloud.security:java-bom's changelog.

4.1.2

  • Enforce constructor-supplied service configurations in HybridTokenAuthenticator
    • The IAS and XSUAA delegate authenticators were constructed without the configurations explicitly passed to HybridTokenAuthenticator, causing them to fall back to Environments.getCurrent() at request time. The supplied SecurityHttpClient was similarly ignored by the delegates
    • The constructor now forwards iasConfig, xsuaaConfig, and httpClient to both delegates via withServiceConfiguration / withHttpClient. Applications that follow the documented pattern of loading configurations from Environments.getCurrent() are unaffected
    • Adds HybridTokenAuthenticatorConfigurationTest with real delegates (no reflection-based mock replacement) to guard against regressions on both the IAS and XSUAA validation paths
  • Update dependencies:
    • Spring Boot: 4.1.0 → 4.1.1
    • Spring Framework: 7.0.8 → 7.0.9
    • Spring Security: 7.1.0 → 7.1.1
    • Jetty: 12.1.11 → 12.1.12
    • Reactor (core & test): 3.8.6 → 3.8.7
    • JUnit Jupiter: 6.1.2 → 6.1.3
    • SpotBugs annotations: 4.10.3 → 4.10.4
    • SpotBugs Maven Plugin: 4.10.3.0 → 4.10.4.0
    • logcaptor (test scope): 2.12.6 → 2.12.7
    • Legacy Spring Boot 3.x / Spring Framework 6.x compatibility versions for the spring-security-3 module: Spring Boot 3.5.14 → 3.5.16, Spring Framework 6.2.18 → 6.2.19, Spring Security 6.5.10 → 6.5.11, Reactor 3.8.2 → 3.8.7

4.1.1

  • Fix null X-App-Tid request header sent to IAS JWKS endpoint when token lacks app_tid claim
    • SapIdJwtSignatureValidator unconditionally placed the app_tid claim value as the X-App-Tid request header. When the claim is absent, token.getAppTid() returns null, causing a NullPointerException or a literal "null" header value on the outgoing JWKS request
    • The header is now only added when app_tid is present in the token; tokens without the claim omit the header entirely, which is the correct behaviour for provider-tenant requests
Commits

Updates com.sap.cloud.security.ams:ams-bom from 4.5.0 to 4.5.1

Commits

Updates com.sap.cloud.sdk:sdk-bom from 5.33.0 to 5.34.0

Release notes

Sourced from com.sap.cloud.sdk:sdk-bom's releases.

Release 5.34.0

5.34.0 - August 26, 2026

🔧 Compatibility Notes

  • [Connectivity] Destination objects with different header providers are now considered not equal.

✨ New Functionality

  • [OData Client] Introduced a new module datamodel/odata-client-apache-httpclient5 to enable the use of the OData Client with Apache's Http Client 5.

📈 Improvements

  • [Connectivity] Fixed Connection pool shut down edge-case when closing a client with a destination that has a custom header provider.

🐛 Fixed Issues

  • [OpenAPI Generator] String properties with contentMediaType: application/json are not mistakenly generated as File anymore

What's Changed

Full Changelog: https://github.com/SAP/cloud-sdk-java/commits/rel/5.34.0

Commits
  • 8280c0e Update to version 5.34.0
  • 7bfd928 fix: [DevOps] Improve release guideline (#1262)
  • 1446d6e chore: [DevOps] bump the test group with 2 updates (#1258)
  • f78bd2b fix: [OpenAPI] String properties are not mistakenly generated as File anymore...
  • 70f6e0e fix: Fix archetype tests in CI (#1259)
  • 73c1277 chore: [DevOps] bump org.json:json from 20260719 to 20260814 in the productio...
  • 56d8070 chore: [DevOps] bump the production-minor-patch group with 10 updates (#1255)
  • d2dafc4 chore: [DevOps] bump com.github.spotbugs:spotbugs-maven-plugin from 4.10.3.0 ...
  • 360ce7c feat: Add ODataClient for Apache HttpClient5 (#1169)
  • 8a05730 chore: [DevOps] bump the production-minor-patch group with 2 updates (#1253)
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0

Release notes

Sourced from org.apache.maven.plugins:maven-compiler-plugin's releases.

3.16.0

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

📦 Dependency updates

Commits
  • e7bba6e [maven-release-plugin] prepare release maven-compiler-plugin-3.16.0
  • c906809 Avoid using deprecated method CompilerConfiguration.setCompilerVersion
  • ad74fee Replace adopt-openj9 by semeru JDK distribution on GH
  • beb0eda Recompile when dependencies change (#1102)
  • a0b689e [MCOMPILER-578] Track outputs across compiler executions (#1091)
  • 2e81228 Fix incremental detection of empty sources, 3.x (#1075)
  • 2132f5b configure ATR project
  • 5992b77 Build fails when annotation processor list is empty (but present) (#1077)
  • acccef7 Bump plexusCompilerVersion from 2.16.2 to 2.17.0
  • 72bc445 Bump org.codehaus.plexus:plexus-java from 1.5.2 to 1.6.0
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0

Release notes

Sourced from org.apache.maven.plugins:maven-surefire-plugin's releases.

3.6.0

Please refer to the main page for what's new https://maven.apache.org/surefire/ And the migration page https://maven.apache.org/surefire/maven-surefire-plugin/whats-new-3-6-0.html

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

... (truncated)

Commits
  • 0ff622b [maven-release-plugin] prepare release surefire-3.6.0
  • bb3932a Let's go for 3.6.0 release
  • 3002a16 Bump mavenVersion from 3.9.14 to 3.9.16
  • 61a531d Bump Maven parent version from 47 to 49 (#3449)
  • e52ead4 [SUREFIRE-523] Link all reported tests to source XRef (#3445)
  • 45102fa [SUREFIRE-3446] Fix direct selection of JUnit Jupiter @​Nested classes (#3447)
  • b2e1f70 Fix #3303: distinguish JUnit 6 ParameterizedClass invocations (#3432)
  • c051938 Discover tests in a fork when a toolchain JDK is used (#3444)
  • db75df8 Bump org.codehaus.plexus:plexus-java from 1.5.2 to 1.6.0 (#3441)
  • 77f2759 Bump org.codehaus.plexus:plexus-interpolation from 1.29 to 1.30.0
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the minor-patch group across 1 directory with 5 updates
f1f8615 
Bumps the minor-patch group with 5 updates in the /ams-spring-boot-shopping directory:

| Package | From | To |
| --- | --- | --- |
| [com.sap.cloud.security:java-bom](https://github.com/SAP/cloud-security-xsuaa-integration) | `4.1.0` | `4.1.2` |
| [com.sap.cloud.security.ams:ams-bom](https://github.com/SAP/cloud-identity-developer-guide) | `4.5.0` | `4.5.1` |
| [com.sap.cloud.sdk:sdk-bom](https://github.com/SAP/cloud-sdk-java) | `5.33.0` | `5.34.0` |
| [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) | `3.15.0` | `3.16.0` |
| [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.5.6` | `3.6.0` |



Updates `com.sap.cloud.security:java-bom` from 4.1.0 to 4.1.2
- [Release notes](https://github.com/SAP/cloud-security-xsuaa-integration/releases)
- [Changelog](https://github.com/SAP/cloud-security-services-integration-library/blob/main/CHANGELOG.md)
- [Commits](SAP/cloud-security-services-integration-library@4.1.0...4.1.2)

Updates `com.sap.cloud.security.ams:ams-bom` from 4.5.0 to 4.5.1
- [Commits](https://github.com/SAP/cloud-identity-developer-guide/commits)

Updates `com.sap.cloud.sdk:sdk-bom` from 5.33.0 to 5.34.0
- [Release notes](https://github.com/SAP/cloud-sdk-java/releases)
- [Changelog](https://github.com/SAP/cloud-sdk-java/blob/main/release_notes.md)
- [Commits](SAP/cloud-sdk-java@rel/5.33.0...rel/5.34.0)

Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.15.0 to 3.16.0
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.15.0...maven-compiler-plugin-3.16.0)

Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.5.6 to 3.6.0
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.6...surefire-3.6.0)

---
updated-dependencies:
- dependency-name: com.sap.cloud.security:java-bom
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: com.sap.cloud.security.ams:ams-bom
  dependency-version: 4.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: com.sap.cloud.sdk:sdk-bom
  dependency-version: 5.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Sep 14, 2026
@finkmanAtSap
finkmanAtSap merged commit a496fd2 into main Sep 14, 2026
11 checks passed
@finkmanAtSap
finkmanAtSap deleted the dependabot/maven/ams-spring-boot-shopping/minor-patch-78314ede30 branch September 14, 2026 07:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@finkmanAtSap finkmanAtSap finkmanAtSap approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@finkmanAtSap