From b6305dc553873810c72b63165dd832ffa1a205c1 Mon Sep 17 00:00:00 2001
From: Jonas Israel <jonas.israel@sap.com>
Date: Thu, 23 Jul 2026 11:07:20 +0200
Subject: [PATCH 1/5] resolve cve and align versions

---
 pom.xml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/pom.xml b/pom.xml
index 0d10a82e5..587874364 100644
--- a/pom.xml
+++ b/pom.xml
@@ -123,6 +123,8 @@
 		<jakarta-activation.version>2.1.0</jakarta-activation.version>
 		<qdox.version>2.2.0</qdox.version>
 		<wiremock.version>3.13.2</wiremock.version>
+		<handlebars.version>4.5.3</handlebars.version>
+		<commons-text.version>1.15.0</commons-text.version>
 		<checkstyle.version>12.3.1</checkstyle.version>
 		<byte-buddy.version>1.18.11</byte-buddy.version>
 		<snakeyaml.version>2.6</snakeyaml.version>
@@ -327,6 +329,19 @@
 				<artifactId>commons-beanutils</artifactId>
 				<version>${commons-beanutils.version}</version>
 			</dependency>
+			<!-- resolve vulnerability CVE-2026-55760 (handlebars is used transitively via wiremock) -->
+			<dependency>
+				<groupId>com.github.jknack</groupId>
+				<artifactId>handlebars</artifactId>
+				<version>${handlebars.version}</version>
+				<scope>test</scope>
+			</dependency>
+			<!-- align commons-text version pulled transitively by handlebars and openapi-generator -->
+			<dependency>
+				<groupId>org.apache.commons</groupId>
+				<artifactId>commons-text</artifactId>
+				<version>${commons-text.version}</version>
+			</dependency>
 			<!--Dependencies with test scope-->
 			<dependency>
 				<groupId>com.sap.cloud.sdk</groupId>
@@ -787,6 +802,7 @@
 						<ignoredUnusedDeclaredDependency>org.junit.jupiter:junit-jupiter-engine</ignoredUnusedDeclaredDependency>
 						<!-- Transitive dependencies explicitly declared to fic CVEs-->
 						<ignoredUnusedDeclaredDependency>commons-beanutils:commons-beanutils</ignoredUnusedDeclaredDependency>
+						<ignoredUnusedDeclaredDependency>com.github.jknack:handlebars</ignoredUnusedDeclaredDependency>
 					</ignoredUnusedDeclaredDependencies>
 				</configuration>
 				<executions>

From cbb530b09dc1ab95072ebb2e4984394d5172e553 Mon Sep 17 00:00:00 2001
From: Jonas Israel <jonas.israel@sap.com>
Date: Thu, 23 Jul 2026 11:07:40 +0200
Subject: [PATCH 2/5] enable blackduck testing

---
 .github/workflows/blackduck.yaml | 18 ++----------------
 1 file changed, 2 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/blackduck.yaml b/.github/workflows/blackduck.yaml
index b690c9cd1..226618bb4 100644
--- a/.github/workflows/blackduck.yaml
+++ b/.github/workflows/blackduck.yaml
@@ -16,24 +16,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: cve-fixing
       - name: "Scan With Black Duck"
         uses: ./.github/actions/scan-with-blackduck
         with:
           token: ${{ secrets.BLACKDUCK_TOKEN }}
 
-  notify-job:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    needs: [ scan ]
-    if: ${{ failure() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-      - name: Notify
-        run: python .pipeline/scripts/notify.py
-        env:
-          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
-          WORKFLOW: ${{ github.workflow }}
-          WORKFLOW_RUN_URL: https://github.com/SAP/cloud-sdk-java/actions/runs/${{ github.run_id }}
-          BRANCH_NAME: ${{ github.ref_name }}

From 8cac3cbd2230f14247f33952bcba1786de94280c Mon Sep 17 00:00:00 2001
From: Jonas Israel <jonas.israel@sap.com>
Date: Thu, 23 Jul 2026 11:42:02 +0200
Subject: [PATCH 3/5] revert changes to blackduck.yaml

---
 .github/workflows/blackduck.yaml | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/blackduck.yaml b/.github/workflows/blackduck.yaml
index 226618bb4..b690c9cd1 100644
--- a/.github/workflows/blackduck.yaml
+++ b/.github/workflows/blackduck.yaml
@@ -16,10 +16,24 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
-        with:
-          ref: cve-fixing
       - name: "Scan With Black Duck"
         uses: ./.github/actions/scan-with-blackduck
         with:
           token: ${{ secrets.BLACKDUCK_TOKEN }}
 
+  notify-job:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    needs: [ scan ]
+    if: ${{ failure() && github.ref == 'refs/heads/main' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Notify
+        run: python .pipeline/scripts/notify.py
+        env:
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
+          WORKFLOW: ${{ github.workflow }}
+          WORKFLOW_RUN_URL: https://github.com/SAP/cloud-sdk-java/actions/runs/${{ github.run_id }}
+          BRANCH_NAME: ${{ github.ref_name }}

From 3674dd00fe6eabbd0f7070cf153c324acb7cee63 Mon Sep 17 00:00:00 2001
From: Jonas Israel <jonas.israel@sap.com>
Date: Fri, 24 Jul 2026 16:22:28 +0200
Subject: [PATCH 4/5] small fixes

---
 pom.xml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index 587874364..3adea375e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -334,7 +334,6 @@
 				<groupId>com.github.jknack</groupId>
 				<artifactId>handlebars</artifactId>
 				<version>${handlebars.version}</version>
-				<scope>test</scope>
 			</dependency>
 			<!-- align commons-text version pulled transitively by handlebars and openapi-generator -->
 			<dependency>
@@ -802,7 +801,6 @@
 						<ignoredUnusedDeclaredDependency>org.junit.jupiter:junit-jupiter-engine</ignoredUnusedDeclaredDependency>
 						<!-- Transitive dependencies explicitly declared to fic CVEs-->
 						<ignoredUnusedDeclaredDependency>commons-beanutils:commons-beanutils</ignoredUnusedDeclaredDependency>
-						<ignoredUnusedDeclaredDependency>com.github.jknack:handlebars</ignoredUnusedDeclaredDependency>
 					</ignoredUnusedDeclaredDependencies>
 				</configuration>
 				<executions>

From 036ac12c5596e5d738ac441a3ed1deaf8d573fc7 Mon Sep 17 00:00:00 2001
From: Jonas Israel <jonas.israel@sap.com>
Date: Fri, 24 Jul 2026 16:23:13 +0200
Subject: [PATCH 5/5] enable testing

---
 .github/workflows/blackduck.yaml | 18 ++----------------
 1 file changed, 2 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/blackduck.yaml b/.github/workflows/blackduck.yaml
index b690c9cd1..226618bb4 100644
--- a/.github/workflows/blackduck.yaml
+++ b/.github/workflows/blackduck.yaml
@@ -16,24 +16,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: cve-fixing
       - name: "Scan With Black Duck"
         uses: ./.github/actions/scan-with-blackduck
         with:
           token: ${{ secrets.BLACKDUCK_TOKEN }}
 
-  notify-job:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    needs: [ scan ]
-    if: ${{ failure() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-      - name: Notify
-        run: python .pipeline/scripts/notify.py
-        env:
-          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
-          WORKFLOW: ${{ github.workflow }}
-          WORKFLOW_RUN_URL: https://github.com/SAP/cloud-sdk-java/actions/runs/${{ github.run_id }}
-          BRANCH_NAME: ${{ github.ref_name }}