From 58513f3282d25d97f1a20cd09b7ae3f1f8afb532 Mon Sep 17 00:00:00 2001
From: Lisa Julia Nebel <lisa.nebel@sap.com>
Date: Fri, 9 Oct 2026 12:45:17 +0200
Subject: [PATCH 1/3] Bump jackson-databind to 2.22.3 and bcprov-jdk18on to
 1.86

---
 pom.xml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/pom.xml b/pom.xml
index 0f7448ac..ebea9730 100644
--- a/pom.xml
+++ b/pom.xml
@@ -118,6 +118,22 @@
         <scope>import</scope>
       </dependency>
 
+      <dependency>
+        <groupId>com.fasterxml.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>2.22.3</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+
+      <dependency>
+        <groupId>org.bouncycastle</groupId>
+        <artifactId>bc-bom</artifactId>
+        <version>1.86</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+
       <dependency>
         <groupId>org.awaitility</groupId>
         <artifactId>awaitility</artifactId>

From 2fa7cd72a819722a9c880b8e57610001688d099b Mon Sep 17 00:00:00 2001
From: "Holger Partsch (D057760)" <holger.partsch@sap.com>
Date: Mon, 12 Oct 2026 16:15:02 +0200
Subject: [PATCH 2/3] fix: use correct artifact names

---
 pom.xml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index ebea9730..d1cbaee8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -118,6 +118,8 @@
         <scope>import</scope>
       </dependency>
 
+      <!-- Override jackson dependency version because of high vulnerability.
+      TODO: remove once direct dependencies are updated.-->
       <dependency>
         <groupId>com.fasterxml.jackson</groupId>
         <artifactId>jackson-bom</artifactId>
@@ -126,9 +128,11 @@
         <scope>import</scope>
       </dependency>
 
+      <!-- Override bouncycaste dependency version because of high vulnerability
+      TODO: remove once direct dependencies are updated.-->
       <dependency>
         <groupId>org.bouncycastle</groupId>
-        <artifactId>bc-bom</artifactId>
+        <artifactId>bc-jdk18on-bom</artifactId>
         <version>1.86</version>
         <type>pom</type>
         <scope>import</scope>

From 0ea5993021d444513c610aa49109e143bfdc6594 Mon Sep 17 00:00:00 2001
From: Thomas Kraetschmer <thomas.kraetschmer@sap.com>
Date: Tue, 13 Oct 2026 12:11:33 +0200
Subject: [PATCH 3/3] fix: insert before cds-services-bom (which imports its
 own jackson-bom)

---
 pom.xml | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/pom.xml b/pom.xml
index d1cbaee8..72aa6faa 100644
--- a/pom.xml
+++ b/pom.xml
@@ -78,6 +78,17 @@
 
   <dependencyManagement>
     <dependencies>
+
+      <!-- Override jackson dependency version because of high vulnerability.
+      TODO: remove once direct dependencies are updated.-->
+      <dependency>
+        <groupId>com.fasterxml.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>2.22.3</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+
       <dependency>
         <groupId>com.sap.cds</groupId>
         <artifactId>cds-services-bom</artifactId>
@@ -118,16 +129,6 @@
         <scope>import</scope>
       </dependency>
 
-      <!-- Override jackson dependency version because of high vulnerability.
-      TODO: remove once direct dependencies are updated.-->
-      <dependency>
-        <groupId>com.fasterxml.jackson</groupId>
-        <artifactId>jackson-bom</artifactId>
-        <version>2.22.3</version>
-        <type>pom</type>
-        <scope>import</scope>
-      </dependency>
-
       <!-- Override bouncycaste dependency version because of high vulnerability
       TODO: remove once direct dependencies are updated.-->
       <dependency>