SAP Cloud Application Programming Model for Java 4.9

Last reviewed Oct 12, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 21124 lines · 3.9K tokens
  2. SAP Cloud Application Programming Model for Java 4.9162 lines · 8.5K tokens
Total286 lines · 12.4K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 95
  • 117
  • 190
  • 197
  • 201
  • 208
  • 209
  • 295
  • 297
  • 306
  • 307
  • 319
  • 323
  • 327
  • 338
  • 347
  • 352
  • 362
  • 367
  • 378
  • 427
  • 434
  • 470
  • 471
  • 488
  • 489
  • 494
  • 502
  • 524
  • 525
  • 532
  • 601
  • 611
  • 613
  • 614
  • 638
  • 639
  • 653
  • 674
  • 732
  • 759
  • 770
  • 772
  • 776
  • 778
  • 807
  • 829
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1021
  • 1333

Prompt Preview

Apply the Java 21 prompt first. These rules cover the SAP Cloud Application Programming Model for Java SDK 4.9 maintenance line, including Spring Boot 3, CDS models, generated protocols, handlers, persistence, messaging, remotes, multitenancy, and the Application Router when it serves the browser UI. Apply Java settings and APIs; similarly named CAP Node.js settings do not configure this runtime.

Version and dependency boundary

  • Import com.sap.cds:cds-services-bom and keep every com.sap.cds runtime, adapter, starter, feature, recipe, and Maven-plugin artifact on the release it manages, moving them together.
  • Use the Java 21 runtime these rules target and SAP recommends; Java 17 is the minimum for this maintenance line.
  • Keep CAP Java 4.9 on Spring Boot 3.x, Spring Security 6.x, and SAP BTP Security Library 3.x; do not mix in CAP Java 5, Spring Boot 4, Spring Security 7, or BTP Security Library 4 artifacts without completing the 5.x migration.
  • Inspect the resolved Maven graph and keep each library family converged with the CAP BOM; test compatible security overrides for transitive dependencies instead of assuming the BOM proves the deployed graph is safe.
  • Pin the compatible model toolchain—Node.js 22, @sap/cds-dk 9.x, and @sap/cds-compiler 6.x—and review the generated CSN, SQL, Java accessors, roles, and deployment descriptors whenever it changes.
  • Treat the Application Router and the MTX sidecar as separate Node.js deployments: run each on a security-supported Node.js release within its package's declared engine range, and also apply the Node.js prompt