From db140d39e9f42cf56c647f4f3921da23f2ab2a1d Mon Sep 17 00:00:00 2001
From: Javier Aliaga <javier@diagrid.io>
Date: Fri, 10 Apr 2026 12:27:02 +0200
Subject: [PATCH 1/5] feat: add dapr-sdk-bom module for dependency version
 management (#1720)

Standalone BOM (no parent inheritance) so consumers only get Dapr SDK
artifact versions and security-critical transitive dependency overrides
without inheriting the parent's 1500+ internal managed dependencies.

Includes all published io.dapr and io.dapr.spring modules, plus
security overrides for netty-bom (CVE-2026-33870/33871),
jackson-bom, commons-compress, and commons-codec.

Closes #1720

Signed-off-by: Javier Aliaga <javier@aliaga.dev>
Signed-off-by: Javier Aliaga <javier@diagrid.io>
---
 pom.xml         |   1 +
 sdk-bom/pom.xml | 182 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 183 insertions(+)
 create mode 100644 sdk-bom/pom.xml

diff --git a/pom.xml b/pom.xml
index f4484aa3f..262d0ffdd 100644
--- a/pom.xml
+++ b/pom.xml
@@ -727,6 +727,7 @@
   </scm>
 
   <modules>
+    <module>sdk-bom</module>
     <module>sdk-autogen</module>
     <module>sdk</module>
     <module>sdk-actors</module>
diff --git a/sdk-bom/pom.xml b/sdk-bom/pom.xml
new file mode 100644
index 000000000..b80126438
--- /dev/null
+++ b/sdk-bom/pom.xml
@@ -0,0 +1,182 @@
+<project
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xmlns="http://maven.apache.org/POM/4.0.0"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>io.dapr</groupId>
+  <artifactId>dapr-sdk-bom</artifactId>
+  <version>1.18.0-SNAPSHOT</version>
+  <packaging>pom</packaging>
+  <name>dapr-sdk-bom</name>
+  <description>Dapr SDK Bill of Materials (BOM). Import this POM to manage versions
+    of all Dapr SDK modules and their security-critical transitive dependencies.</description>
+  <url>https://dapr.io</url>
+
+  <licenses>
+    <license>
+      <name>Apache License Version 2.0</name>
+      <url>https://opensource.org/licenses/Apache-2.0</url>
+    </license>
+  </licenses>
+
+  <developers>
+    <developer>
+      <name>Dapr</name>
+      <email>daprweb@microsoft.com</email>
+      <organization>Dapr</organization>
+      <organizationUrl>https://dapr.io</organizationUrl>
+    </developer>
+  </developers>
+
+  <scm>
+    <url>https://github.com/dapr/java-sdk</url>
+    <connection>scm:git:https://github.com/dapr/java-sdk.git</connection>
+    <tag>HEAD</tag>
+  </scm>
+
+  <properties>
+    <dapr.sdk.version>1.18.0-SNAPSHOT</dapr.sdk.version>
+    <!-- TODO: Remove netty-bom override once gRPC ships with Netty >= 4.1.132 (CVE-2026-33871, CVE-2026-33870) -->
+    <netty.version>4.1.132.Final</netty.version>
+    <jackson.version>2.21.2</jackson.version>
+    <!-- TODO: Remove commons-compress override once testcontainers ships with >= 1.26.0 -->
+    <commons-compress.version>1.26.0</commons-compress.version>
+  </properties>
+
+  <dependencyManagement>
+    <dependencies>
+      <!-- ====================================================================== -->
+      <!-- Dapr SDK modules                                                       -->
+      <!-- ====================================================================== -->
+      <dependency>
+        <groupId>io.dapr</groupId>
+        <artifactId>dapr-sdk-autogen</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr</groupId>
+        <artifactId>dapr-sdk</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr</groupId>
+        <artifactId>dapr-sdk-actors</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr</groupId>
+        <artifactId>dapr-sdk-workflows</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr</groupId>
+        <artifactId>dapr-sdk-springboot</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr</groupId>
+        <artifactId>testcontainers-dapr</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr</groupId>
+        <artifactId>durabletask-client</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+
+      <!-- ====================================================================== -->
+      <!-- Dapr Spring modules                                                    -->
+      <!-- ====================================================================== -->
+      <dependency>
+        <groupId>io.dapr.spring</groupId>
+        <artifactId>dapr-spring-data</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr.spring</groupId>
+        <artifactId>dapr-spring-6-data</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr.spring</groupId>
+        <artifactId>dapr-spring-messaging</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr.spring</groupId>
+        <artifactId>dapr-spring-workflows</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr.spring</groupId>
+        <artifactId>dapr-spring-boot-properties</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr.spring</groupId>
+        <artifactId>dapr-spring-boot-autoconfigure</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr.spring</groupId>
+        <artifactId>dapr-spring-boot-4-autoconfigure</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr.spring</groupId>
+        <artifactId>dapr-spring-boot-tests</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr.spring</groupId>
+        <artifactId>dapr-spring-boot-starter</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr.spring</groupId>
+        <artifactId>dapr-spring-boot-4-starter</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr.spring</groupId>
+        <artifactId>dapr-spring-boot-starter-test</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.dapr.spring</groupId>
+        <artifactId>dapr-spring-boot-4-starter-test</artifactId>
+        <version>${dapr.sdk.version}</version>
+      </dependency>
+
+      <!-- ====================================================================== -->
+      <!-- Security overrides - Transitive dependency version fixes for CVEs      -->
+      <!-- ====================================================================== -->
+      <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-bom</artifactId>
+        <version>${netty.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>com.fasterxml.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>${jackson.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-compress</artifactId>
+        <version>${commons-compress.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>commons-codec</groupId>
+        <artifactId>commons-codec</artifactId>
+        <version>1.17.2</version>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
+</project>

From 7128835c421a39891774de510c44f8d55ef5d4fb Mon Sep 17 00:00:00 2001
From: Javier Aliaga <javier@diagrid.io>
Date: Fri, 10 Apr 2026 12:51:45 +0200
Subject: [PATCH 2/5] docs: add BOM usage instructions to README (#1720)

Document dapr-sdk-bom as the recommended way to import the SDK,
with version-free dependency declarations for both Maven and Gradle.
Keep the manual version approach as an alternative.

Signed-off-by: Javier Aliaga <javier@aliaga.dev>
Signed-off-by: Javier Aliaga <javier@diagrid.io>
---
 README.md | 74 ++++++++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 63 insertions(+), 11 deletions(-)

diff --git a/README.md b/README.md
index 1916cf5d4..ff83b1124 100644
--- a/README.md
+++ b/README.md
@@ -59,31 +59,43 @@ For the full list of available APIs, see the [Dapr API reference](https://docs.d
 If using [SDKMAN!](https://sdkman.io), execute `sdk env install` to install the required JDK.
 
 ### Importing Dapr's Java SDK
+
+#### Using the BOM (recommended)
+
+Import `dapr-sdk-bom` to manage all Dapr SDK versions and security-patched transitive dependencies in one place. This ensures your project inherits fixes for CVEs in transitive dependencies like Netty and Jackson.
+
 For a Maven project, add the following to your `pom.xml` file:
 ```xml
 <project>
   ...
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>io.dapr</groupId>
+        <artifactId>dapr-sdk-bom</artifactId>
+        <version>1.18.0</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
   <dependencies>
-    ...
-     <!-- Dapr's core SDK with all features, except Actors. -->
+    <!-- Dapr's core SDK with all features, except Actors. -->
     <dependency>
       <groupId>io.dapr</groupId>
       <artifactId>dapr-sdk</artifactId>
-      <version>1.17.2</version>
     </dependency>
     <!-- Dapr's SDK for Actors (optional). -->
     <dependency>
       <groupId>io.dapr</groupId>
       <artifactId>dapr-sdk-actors</artifactId>
-      <version>1.17.2</version>
     </dependency>
     <!-- Dapr's SDK integration with SpringBoot (optional). -->
     <dependency>
       <groupId>io.dapr</groupId>
       <artifactId>dapr-sdk-springboot</artifactId>
-      <version>1.17.2</version>
     </dependency>
-    ...
   </dependencies>
   ...
 </project>
@@ -91,15 +103,55 @@ For a Maven project, add the following to your `pom.xml` file:
 
 For a Gradle project, add the following to your `build.gradle` file:
 
-```
+```groovy
 dependencies {
-...
+    // Import the BOM
+    implementation platform('io.dapr:dapr-sdk-bom:1.18.0')
+
     // Dapr's core SDK with all features, except Actors.
-    compile('io.dapr:dapr-sdk:1.17.2')
+    implementation 'io.dapr:dapr-sdk'
     // Dapr's SDK for Actors (optional).
-    compile('io.dapr:dapr-sdk-actors:1.17.2')
+    implementation 'io.dapr:dapr-sdk-actors'
     // Dapr's SDK integration with SpringBoot (optional).
-    compile('io.dapr:dapr-sdk-springboot:1.17.2')
+    implementation 'io.dapr:dapr-sdk-springboot'
+}
+```
+
+#### Without the BOM
+
+If you prefer to manage versions manually, specify the version on each dependency:
+
+For Maven:
+```xml
+<project>
+  ...
+  <dependencies>
+    <dependency>
+      <groupId>io.dapr</groupId>
+      <artifactId>dapr-sdk</artifactId>
+      <version>1.17.2</version>
+    </dependency>
+    <dependency>
+      <groupId>io.dapr</groupId>
+      <artifactId>dapr-sdk-actors</artifactId>
+      <version>1.17.2</version>
+    </dependency>
+    <dependency>
+      <groupId>io.dapr</groupId>
+      <artifactId>dapr-sdk-springboot</artifactId>
+      <version>1.17.2</version>
+    </dependency>
+  </dependencies>
+  ...
+</project>
+```
+
+For Gradle:
+```groovy
+dependencies {
+    implementation 'io.dapr:dapr-sdk:1.17.2'
+    implementation 'io.dapr:dapr-sdk-actors:1.17.2'
+    implementation 'io.dapr:dapr-sdk-springboot:1.17.2'
 }
 ```
 

From 3fafe114855c7394c2d9ae0185759812324a584c Mon Sep 17 00:00:00 2001
From: Javier Aliaga <javier@diagrid.io>
Date: Fri, 10 Apr 2026 13:09:16 +0200
Subject: [PATCH 3/5] fix: update version script to handle standalone BOM
 (#1720)

The BOM has no parent, so mvn versions:set skips it during the
reactor walk. Add explicit -f sdk-bom/pom.xml calls to update
both the artifact version and dapr.sdk.version property.

Signed-off-by: Javier Aliaga <javier@aliaga.dev>
Signed-off-by: Javier Aliaga <javier@diagrid.io>
---
 .github/scripts/update_sdk_version.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/scripts/update_sdk_version.sh b/.github/scripts/update_sdk_version.sh
index 0e5726ecc..909973b10 100755
--- a/.github/scripts/update_sdk_version.sh
+++ b/.github/scripts/update_sdk_version.sh
@@ -12,6 +12,9 @@ mvn versions:set -DnewVersion=$DAPR_JAVA_SDK_VERSION -DprocessDependencies=true
 mvn versions:set-property -Dproperty=dapr.sdk.alpha.version -DnewVersion=$DAPR_JAVA_SDK_ALPHA_VERSION
 mvn versions:set-property -Dproperty=dapr.sdk.version -DnewVersion=$DAPR_JAVA_SDK_VERSION
 mvn versions:set-property -Dproperty=dapr.sdk.version -DnewVersion=$DAPR_JAVA_SDK_VERSION -f sdk-tests/pom.xml
+# BOM is standalone (no parent), so versions:set skips it — update it explicitly.
+mvn versions:set -DnewVersion=$DAPR_JAVA_SDK_VERSION -f sdk-bom/pom.xml
+mvn versions:set-property -Dproperty=dapr.sdk.version -DnewVersion=$DAPR_JAVA_SDK_VERSION -f sdk-bom/pom.xml
 mvn versions:set-property -Dproperty=dapr.sdk.alpha.version -DnewVersion=$DAPR_JAVA_SDK_ALPHA_VERSION -f sdk-tests/pom.xml
 
 

From 9ab1afa9e5de69f2b07c106207e1d64bbcb823cc Mon Sep 17 00:00:00 2001
From: Javier Aliaga <javier@diagrid.io>
Date: Fri, 10 Apr 2026 13:25:41 +0200
Subject: [PATCH 4/5] fix: add deploy and signing config to standalone BOM
 (#1720)

The BOM has no parent so it doesn't inherit distributionManagement,
nexus-staging-maven-plugin, or maven-gpg-plugin from the root POM.
Without these the publish step would fail to stage and sign the
artifact for Maven Central.

Signed-off-by: Javier Aliaga <javier@aliaga.dev>
Signed-off-by: Javier Aliaga <javier@diagrid.io>
---
 sdk-bom/pom.xml | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/sdk-bom/pom.xml b/sdk-bom/pom.xml
index b80126438..a6230c64a 100644
--- a/sdk-bom/pom.xml
+++ b/sdk-bom/pom.xml
@@ -35,7 +35,15 @@
     <tag>HEAD</tag>
   </scm>
 
+  <distributionManagement>
+    <snapshotRepository>
+      <id>ossrh</id>
+      <url>https://central.sonatype.com/repository/maven-snapshots/</url>
+    </snapshotRepository>
+  </distributionManagement>
+
   <properties>
+    <gpg.skip>true</gpg.skip>
     <dapr.sdk.version>1.18.0-SNAPSHOT</dapr.sdk.version>
     <!-- TODO: Remove netty-bom override once gRPC ships with Netty >= 4.1.132 (CVE-2026-33871, CVE-2026-33870) -->
     <netty.version>4.1.132.Final</netty.version>
@@ -44,6 +52,43 @@
     <commons-compress.version>1.26.0</commons-compress.version>
   </properties>
 
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.sonatype.plugins</groupId>
+        <artifactId>nexus-staging-maven-plugin</artifactId>
+        <version>1.7.0</version>
+        <extensions>true</extensions>
+        <configuration>
+          <serverId>ossrh</serverId>
+          <nexusUrl>https://ossrh-staging-api.central.sonatype.com</nexusUrl>
+          <autoReleaseAfterClose>true</autoReleaseAfterClose>
+        </configuration>
+      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-gpg-plugin</artifactId>
+        <version>3.1.0</version>
+        <executions>
+          <execution>
+            <id>sign-artifacts</id>
+            <phase>verify</phase>
+            <goals>
+              <goal>sign</goal>
+            </goals>
+            <configuration>
+              <gpgArguments>
+                <arg>--batch</arg>
+                <arg>--pinentry-mode</arg>
+                <arg>loopback</arg>
+              </gpgArguments>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
+
   <dependencyManagement>
     <dependencies>
       <!-- ====================================================================== -->

From c5962938d7b260185389b44938894a779ad6ae41 Mon Sep 17 00:00:00 2001
From: Javier Aliaga <javier@diagrid.io>
Date: Fri, 10 Apr 2026 13:59:38 +0200
Subject: [PATCH 5/5] fix: skip site generation for standalone BOM (#1720)

The BOM has no parent, so it picks up maven-site-plugin 3.3 from
Maven's defaults instead of 3.12.1 from pluginManagement. Pin the
version and skip site since a POM-only BOM has no content to render.

Signed-off-by: Javier Aliaga <javier@aliaga.dev>
Signed-off-by: Javier Aliaga <javier@diagrid.io>
---
 sdk-bom/pom.xml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sdk-bom/pom.xml b/sdk-bom/pom.xml
index a6230c64a..03e44a0b5 100644
--- a/sdk-bom/pom.xml
+++ b/sdk-bom/pom.xml
@@ -54,6 +54,14 @@
 
   <build>
     <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-site-plugin</artifactId>
+        <version>3.12.1</version>
+        <configuration>
+          <skip>true</skip>
+        </configuration>
+      </plugin>
       <plugin>
         <groupId>org.sonatype.plugins</groupId>
         <artifactId>nexus-staging-maven-plugin</artifactId>