chore: [DevOps] bump com.sap.cloud.security:java-bom from 3.6.8 to 4.0.0 in the production-major group

[dependabot]

Bumps the production-major group with 1 update: com.sap.cloud.security:java-bom.

Updates com.sap.cloud.security:java-bom from 3.6.8 to 4.0.0

Release notes

Sourced from com.sap.cloud.security:java-bom's releases.

4.0.0

Major release upgrading to Spring Boot 4.x and Jakarta EE 10. Spring Boot 3.x compatibility modules provided.

Breaking Changes

Framework Upgrades:

• Spring Boot 3.x → 4.0.3
• Spring Framework 6.x → 7.0.5
• Spring Security 6.x → 7.0.3
• Jakarta Servlet API 6.0.0 → 6.1.0

Token Client HTTP Change:

• Now uses Java 11 HttpClient by default (no Apache HttpClient dependency)
• Apache HttpClient 4 constructors deprecated (removed in 5.0.0)
• Custom HTTP clients supported via SecurityHttpClientFactory

Removed Modules:

• spring-xsuaa* → use spring-security or spring-security-3
• spring-security-compatibility → use spring-security-3

Token Client Spring Classes:

• Spring-dependent classes moved to new token-client-spring module

New Features

Spring Boot 3.x Compatibility:

• spring-security-3 - Core module for Spring Boot 3.5.9
• resourceserver-security-spring-boot-3-starter - Starter for Spring Boot 3.x

Pluggable HTTP Client:

• Support for Apache HttpClient 4.x/5.x, OkHttp, SAP Cloud SDK, custom implementations

Documentation

• https://github.com/SAP/cloud-security-services-integration-library/blob/main/MIGRATION_4.0.md

https://github.com/SAP/cloud-security-services-integration-library/blob/main/token-client/APACHE_HTTPCLIENT_MIGRATION.md

• https://github.com/SAP/cloud-security-services-integration-library/blob/main/CHANGELOG.md#400---major-release

3.6.9

• Fix token exchange logic in DefaultIdTokenExtension to correctly identify App2App tokens that require exchange (where aud contains a single audience different from azp)

Changelog

Sourced from com.sap.cloud.security:java-bom's changelog.

4.0.0 - Major Release

This is a major release with breaking changes. The library has been upgraded to Spring Boot 4.x and Jakarta EE 10. For applications still on Spring Boot 3.x, compatibility modules are provided. Please check the 4.0 Migration Guide for comprehensive upgrade instructions

⚠️ BREAKING CHANGES

Spring Boot and Jakarta EE Version Upgrades

• Spring Boot: Upgraded from 3.x to 4.0.3
• Spring Framework: Upgraded from 6.x to 7.0.5
• Spring Security: Upgraded from 6.x to 7.0.3
• Jakarta Servlet API: Upgraded from 6.0.0 to 6.1.0
• Java: Minimum version remains Java 17
• JUnit Jupiter: Upgraded from 5.12.2 to 6.0.3

HTTP Client Default Changed

Token-client module now uses Java 11's HttpClient as the default implementation. Apache HttpClient 4 remains available as a dependency for backward compatibility.

Impact:

• ✅ No code changes required if you use the default (parameterless) constructors
• ⚠️ Deprecated constructors added for backward compatibility with Apache HttpClient 4
• ❌ Will be removed in version 5.0.0 - Plan to migrate to Java HttpClient or custom implementation

Deprecated in 4.0.0 (Removed in 5.0.0):

• DefaultOAuth2TokenKeyService(CloseableHttpClient)
• DefaultOAuth2TokenService(CloseableHttpClient)
• DefaultOAuth2TokenService(CloseableHttpClient, TokenCacheConfiguration)
• DefaultOidcConfigurationService(CloseableHttpClient)
• HttpClientFactory interface and DefaultHttpClientFactory implementation

Migration Path:

• Option 1 (Recommended): Use default constructors - Java 11 HttpClient is used automatically
• Option 2 (Temporary): Continue using deprecated constructors with Apache HttpClient 4
• Option 3 (Custom): Implement SecurityHttpClientFactory interface for custom HTTP clients (see CUSTOM_HTTPCLIENT.md)

See the comprehensive Apache HttpClient Migration Guide for detailed migration instructions.

Removed Modules

The following deprecated modules have been removed from the repository:

Removed Module	Replacement	Migration Guide
spring-xsuaa	spring-security (Spring Boot 4.x) or spring-security-3 (Spring Boot 3.x)	Migration Guide
spring-xsuaa-starter	spring-security-starter (Spring Boot 4.x) or spring-security-3-starter (Spring Boot 3.x)	Migration Guide
spring-xsuaa-test	java-security-test	Use JwtGenerator from java-security-test
spring-security-compatibility	spring-security-3	No changes needed, just switch artifact

✨ New Features

... (truncated)

Commits

• 5e226d8 Major release 4 (#1924)
• 2c6f46b fix: Correct token exchange logic for App2App flows in DefaultIdTokenExtensio...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[CharlesDuboisSAP]

BLI: Security library v4 update