Bump the minor-patch group in /ams-cap-bookshop with 3 updates

[dependabot]

Bumps the minor-patch group in /ams-cap-bookshop with 3 updates: com.sap.cds:cds-services-bom, com.sap.cds:cds-maven-plugin and com.sap.cloud.security:java-bom.

Updates com.sap.cds:cds-services-bom from 5.0.1 to 5.0.2

Updates com.sap.cds:cds-maven-plugin from 5.0.1 to 5.0.2

Updates com.sap.cloud.security:java-bom from 4.0.8 to 4.1.0

Release notes

Sourced from com.sap.cloud.security:java-bom's releases.

4.1.0

• Skip IAS proof-token validation for tokens with a single audience or no audience claim
  • SapIdJwtSignatureValidator previously gated the proof-token / forwarded-client-cert check on the presence of the ias_apis claim. It now gates on token.getAudiences().size() > 1, so the check only runs for genuine app-to-app tokens (multiple audiences) and is skipped for app-to-service tokens (single audience) and tokens with a missing/empty aud claim
  • Eliminates spurious "client certificate could not be read" failures on requests where no x-forwarded-client-cert header is expected
• Support additional JWT signature algorithms in JwtSignatureValidator. In addition to the previously supported RS256, tokens signed with the following algorithms (RFC 7518 §3.3 / §3.4 / §3.5) can now be validated:
  • RS384, RS512 (RSASSA-PKCS1-v1_5 with SHA-384 / SHA-512)
  • PS256, PS384, PS512 (RSASSA-PSS with SHA-256 / SHA-384 / SHA-512). The corresponding PSSParameterSpec is set automatically before signature verification.
  • ES256, ES384, ES512 (ECDSA on P-256 / P-384 / P-521 with SHA-256 / SHA-384 / SHA-512). The JCA name SHA*withECDSAinP1363Format is used so the raw R||S signature format mandated by RFC 7518 §3.4 is accepted directly. EC JWKs are constructed from crv/x/y with strict curve and coordinate-length validation per RFC 7518 §6.2.1.
  • Selection is driven by the JWT header alg value. Unknown values continue to be rejected with the existing "is not supported" error.
• Expose the sap_id_type claim on SapIdToken
  • New SapIdToken#getIdType() returning a typed SapIdType enum (USER, APP); resolves to null if the claim is absent or carries an unknown value
  • New TokenClaims.SAP_ID_TYPE constant
  • DefaultIdTokenExtension#isTechnicalUser now prefers the sap_id_type claim and falls back to the sub == azp heuristic for tokens issued before the claim was introduced
• Tolerate unsupported or malformed entries in a JWKS response
  • JsonWebKeySetFactory previously aborted the whole parse when a single entry resolved to an algorithm the library does not recognise (or was otherwise malformed), so an IdP adding a key for a new algorithm family broke token validation for every tenant sharing the endpoint — including tokens signed with algorithms this library DOES support
  • Each entry is now parsed in isolation: unsupported alg/kty is skipped with an INFO log, a malformed entry is skipped with a WARN, and both carry sanitized kid/kty/alg for diagnostics
  • When a caller later requests a kid that was silently dropped at parse time, the pre-throw WARN in OAuth2TokenKeyServiceWithCache now points at the earlier Skipping JWK entry log lines so the root cause is discoverable. The existing Key with kid <kid> not found in JWKS. exception message is unchanged for downstream log-based alerts
• Update dependencies:
  • Jetty: 12.1.10 → 12.1.11
  • JUnit Jupiter: 6.1.0 → 6.1.2
  • log4j2: 2.26.0 → 2.26.1
  • org.json: 20260522 → 20260719
  • SpotBugs annotations: 4.10.2 → 4.10.3
  • SpotBugs Maven Plugin: 4.10.2.0 → 4.10.3.0
  • logback-core (test scope, token-client / token-client-spring / token-client-spring-3): 1.5.25 → 1.5.34

Changelog

Sourced from com.sap.cloud.security:java-bom's changelog.

4.1.0

• Skip IAS proof-token validation for tokens with a single audience or no audience claim
  • SapIdJwtSignatureValidator previously gated the proof-token / forwarded-client-cert check on the presence of the ias_apis claim. It now gates on token.getAudiences().size() > 1, so the check only runs for genuine app-to-app tokens (multiple audiences) and is skipped for app-to-service tokens (single audience) and tokens with a missing/empty aud claim
  • Eliminates spurious "client certificate could not be read" failures on requests where no x-forwarded-client-cert header is expected
• Support additional JWT signature algorithms in JwtSignatureValidator. In addition to the previously supported RS256, tokens signed with the following algorithms (RFC 7518 §3.3 / §3.4 / §3.5) can now be validated:
  • RS384, RS512 (RSASSA-PKCS1-v1_5 with SHA-384 / SHA-512)
  • PS256, PS384, PS512 (RSASSA-PSS with SHA-256 / SHA-384 / SHA-512). The corresponding PSSParameterSpec is set automatically before signature verification.
  • ES256, ES384, ES512 (ECDSA on P-256 / P-384 / P-521 with SHA-256 / SHA-384 / SHA-512). The JCA name SHA*withECDSAinP1363Format is used so the raw R||S signature format mandated by RFC 7518 §3.4 is accepted directly. EC JWKs are constructed from crv/x/y with strict curve and coordinate-length validation per RFC 7518 §6.2.1.
  • Selection is driven by the JWT header alg value. Unknown values continue to be rejected with the existing "is not supported" error.
• Expose the sap_id_type claim on SapIdToken
  • New SapIdToken#getIdType() returning a typed SapIdType enum (USER, APP); resolves to null if the claim is absent or carries an unknown value
  • New TokenClaims.SAP_ID_TYPE constant
  • DefaultIdTokenExtension#isTechnicalUser now prefers the sap_id_type claim and falls back to the sub == azp heuristic for tokens issued before the claim was introduced
• Tolerate unsupported or malformed entries in a JWKS response
  • JsonWebKeySetFactory previously aborted the whole parse when a single entry resolved to an algorithm the library does not recognise (or was otherwise malformed), so an IdP adding a key for a new algorithm family broke token validation for every tenant sharing the endpoint — including tokens signed with algorithms this library DOES support
  • Each entry is now parsed in isolation: unsupported alg/kty is skipped with an INFO log, a malformed entry is skipped with a WARN, and both carry sanitized kid/kty/alg for diagnostics
  • When a caller later requests a kid that was silently dropped at parse time, the pre-throw WARN in OAuth2TokenKeyServiceWithCache now points at the earlier Skipping JWK entry log lines so the root cause is discoverable. The existing Key with kid <kid> not found in JWKS. exception message is unchanged for downstream log-based alerts
• Update dependencies:
  • Jetty: 12.1.10 → 12.1.11
  • JUnit Jupiter: 6.1.0 → 6.1.2
  • log4j2: 2.26.0 → 2.26.1
  • org.json: 20260522 → 20260719
  • SpotBugs annotations: 4.10.2 → 4.10.3
  • SpotBugs Maven Plugin: 4.10.2.0 → 4.10.3.0
  • logback-core (test scope, token-client / token-client-spring / token-client-spring-3): 1.5.25 → 1.5.34

Commits

• e61fd6b Release 4.1.0 (#2011)
• See full diff in compare view

Updates com.sap.cds:cds-maven-plugin from 5.0.1 to 5.0.2

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions