CAP Java uses various dependencies that are also used by the applications themselves. If the applications decide to manage the versions of these dependencies, it's helpful to know the minimum versions of these dependencies that CAP Java requires. The following table lists these minimum versions for various common dependencies, based on the latest release:

Some SDKs such as CAP Java or Cloud SDK provide a bunch of artifacts with a common version. Mixing different versions of SDK artifacts often results in compiler errors or unpredictable runtime issues.

To help keeping the client configuration consistent, SDKs usually provide bill of material (BOM) poms as an optional maven dependency. We strongly recommended to import available BOM poms.

Following example shows how BOM poms of com.sap.cds, com.sap.cloud.sdk, and com.sap.cloud.security can be added to the project's parent pom.xml. For concrete version numbers, please refer to the version overviews above.

::: code-group

<properties>
	<!-- ... -->
	<cds.services.version>CAP Java version here</cds.services.version>
	<cloud.sdk.version>Cloud SDK version here</cloud.sdk.version>
	<xsuaa.version>XSUAA version here</xsuaa.version>
</properties>
<dependencyManagement>
	<dependencies>
		<!-- CDS SERVICES -->
		<dependency>
			<groupId>com.sap.cds</groupId>
			<artifactId>cds-services-bom</artifactId>
			<version>${cds.services.version}</version>
			<type>pom</type>
			<scope>import</scope>
		</dependency>

		<!-- CLOUD SDK -->
		<dependency>
			<groupId>com.sap.cloud.sdk</groupId>
			<artifactId>sdk-modules-bom</artifactId>
			<version>${cloud.sdk.version}</version>
			<type>pom</type>
			<scope>import</scope>
		</dependency>

		<!-- SAP SECURITY -->
		<dependency>
			<groupId>com.sap.cloud.security</groupId>
			<artifactId>java-bom</artifactId>
			<version>${xsuaa.version}</version>
			<type>pom</type>
			<scope>import</scope>
		</dependency>
	</dependencies>
</dependencyManagement>

:::

Regular updates and patches of CAP Java keeps your project in sync with the most recent Free and Open Source Software (FOSS) dependency versions.

However, a security vulnerability could be published, by one of your dependencies, in between CAP Java releases and in turn prevent your application from being released due to failing security scans. In this case, applications have the following options:

• Wait for the next monthly CAP Java release with fixed dependencies.
• Specify a secure version of the vulnerable dependency explicitly. Do that at the beginning of the dependencyManagement section of the top-level pom.xml file of your application:

::: code-group

<dependencyManagement>
   […]
   <dependency>
       <groupId>…</groupId>
       <artifactId>…</artifactId>
       <version>…</version>
   </dependency>
</dependencyManagement>

:::

Make sure that the updated version is compatible. When consuming a new CAP Java version, this extra dependency can be removed again.