Bump the prod-deps-ver group with 9 updates (#1902)

* Bump the prod-deps-ver group with 9 updates

Bumps the prod-deps-ver group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| org.apache.logging.log4j:log4j-to-slf4j | `2.25.2` | `2.25.3` |
| org.apache.logging.log4j:log4j-api | `2.25.2` | `2.25.3` |
| [io.projectreactor:reactor-core](https://github.com/reactor/reactor-core) | `3.8.0` | `3.8.2` |
| [io.projectreactor:reactor-test](https://github.com/reactor/reactor-core) | `3.7.11` | `3.8.2` |
| [commons-io:commons-io](https://github.com/apache/commons-io) | `2.20.0` | `2.21.0` |
| [org.mockito:mockito-core](https://github.com/mockito/mockito) | `5.20.0` | `5.21.0` |
| [org.apache.maven.plugins:maven-source-plugin](https://github.com/apache/maven-source-plugin) | `3.3.1` | `3.4.0` |
| org.eclipse.jetty.ee10:jetty-ee10-servlet | `12.0.27` | `12.1.5` |
| org.eclipse.jetty.ee10:jetty-ee10-webapp | `12.0.27` | `12.1.5` |


Updates `org.apache.logging.log4j:log4j-to-slf4j` from 2.25.2 to 2.25.3

Updates `org.apache.logging.log4j:log4j-api` from 2.25.2 to 2.25.3

Updates `org.apache.logging.log4j:log4j-api` from 2.25.2 to 2.25.3

Updates `io.projectreactor:reactor-core` from 3.8.0 to 3.8.2
- [Release notes](https://github.com/reactor/reactor-core/releases)
- [Commits](reactor/reactor-core@v3.8.0...v3.8.2)

Updates `io.projectreactor:reactor-test` from 3.7.11 to 3.8.2
- [Release notes](https://github.com/reactor/reactor-core/releases)
- [Commits](reactor/reactor-core@v3.7.11...v3.8.2)

Updates `commons-io:commons-io` from 2.20.0 to 2.21.0
- [Changelog](https://github.com/apache/commons-io/blob/master/RELEASE-NOTES.txt)
- [Commits](apache/commons-io@rel/commons-io-2.20.0...rel/commons-io-2.21.0)

Updates `org.mockito:mockito-core` from 5.20.0 to 5.21.0
- [Release notes](https://github.com/mockito/mockito/releases)
- [Commits](mockito/mockito@v5.20.0...v5.21.0)

Updates `io.projectreactor:reactor-test` from 3.7.11 to 3.8.2
- [Release notes](https://github.com/reactor/reactor-core/releases)
- [Commits](reactor/reactor-core@v3.7.11...v3.8.2)

Updates `org.apache.maven.plugins:maven-source-plugin` from 3.3.1 to 3.4.0
- [Release notes](https://github.com/apache/maven-source-plugin/releases)
- [Commits](apache/maven-source-plugin@maven-source-plugin-3.3.1...maven-source-plugin-3.4.0)

Updates `org.eclipse.jetty.ee10:jetty-ee10-servlet` from 12.0.27 to 12.1.5

Updates `org.eclipse.jetty.ee10:jetty-ee10-webapp` from 12.0.27 to 12.1.5

Updates `org.eclipse.jetty.ee10:jetty-ee10-webapp` from 12.0.27 to 12.1.5

---
updated-dependencies:
- dependency-name: org.apache.logging.log4j:log4j-to-slf4j
  dependency-version: 2.25.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.apache.logging.log4j:log4j-api
  dependency-version: 2.25.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.apache.logging.log4j:log4j-api
  dependency-version: 2.25.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: io.projectreactor:reactor-core
  dependency-version: 3.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: io.projectreactor:reactor-test
  dependency-version: 3.8.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: commons-io:commons-io
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: org.mockito:mockito-core
  dependency-version: 5.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: io.projectreactor:reactor-test
  dependency-version: 3.8.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: org.apache.maven.plugins:maven-source-plugin
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-servlet
  dependency-version: 12.1.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-webapp
  dependency-version: 12.1.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-webapp
  dependency-version: 12.1.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
...

Signed-off-by: dependabot[bot] <[email protected]>

* introduce dependency management for jetty

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Daniel Kuntze <[email protected]>

Author: dependabot[bot]

bom/pom.xml

@@ -41,7 +41,7 @@
         <maven.compiler.source>17</maven.compiler.source>
         <maven.compiler.target>17</maven.compiler.target>
         <xsuaa-groupId>com.sap.cloud.security.xsuaa</xsuaa-groupId>
-        <maven.source.plugin.version>3.3.1</maven.source.plugin.version>
+        <maven.source.plugin.version>3.4.0</maven.source.plugin.version>
     </properties>
 
     <dependencyManagement>

pom.xml

@@ -44,29 +44,29 @@
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 		<maven.compiler.target>17</maven.compiler.target>
 		<maven.compiler.source>17</maven.compiler.source>
-		<maven.source.plugin.version>3.3.1</maven.source.plugin.version>
+		<maven.source.plugin.version>3.4.0</maven.source.plugin.version>
 		<!-- make sure that spring core and spring boot versions are compatible-->
 		<spring.boot.version>3.5.6</spring.boot.version>
 		<spring.core.version>6.2.12</spring.core.version>
 		<spring.security.version>6.5.6</spring.security.version>
 		<spring.security.oauth2.version>6.5.6</spring.security.oauth2.version>
 		<spring.security.jwt.version>1.1.1.RELEASE</spring.security.jwt.version>
-		<org.eclipse.jetty.version>12.0.27</org.eclipse.jetty.version>
-		<reactor.version>3.8.0</reactor.version>
-		<log4j2.version>2.25.2</log4j2.version>
+		<org.eclipse.jetty.version>12.1.5</org.eclipse.jetty.version>
+		<reactor.version>3.8.2</reactor.version>
+		<log4j2.version>2.25.3</log4j2.version>
 		<slf4j.api.version>2.0.17</slf4j.api.version> <!--see also here http://www.slf4j.org/faq.html#changesInVersion18 -->
 		<org.json.version>20251224</org.json.version>
 		<sap.cloud.env.servicebinding.version>0.21.0</sap.cloud.env.servicebinding.version>
 		<apache.httpclient5.version>5.6</apache.httpclient5.version>
 		<apache.httpclient.version>4.5.14</apache.httpclient.version>
 		<caffeine.version>3.2.0</caffeine.version>
-		<commons.io.version>2.20.0</commons.io.version>
+		<commons.io.version>2.21.0</commons.io.version>
 		<jakarta.servlet.api.version>6.1.0</jakarta.servlet.api.version>
 		<junit.version>4.13.2</junit.version>
 		<junit-jupiter.version>5.12.2</junit-jupiter.version>
 		<maven-surefire-plugin>3.5.4</maven-surefire-plugin>
 		<hamcrest.version>1.3</hamcrest.version>
-		<mockito.version>5.20.0</mockito.version>
+		<mockito.version>5.21.0</mockito.version>
 		<assertj.version>3.27.6</assertj.version>
 		<wiremock.version>3.13.2</wiremock.version>
 		<reactor.test.version>3.8.2</reactor.test.version>
@@ -104,6 +104,14 @@
 			</dependency>
 			<!-- spring -->
 			<!-- BOMs -->
+			<!-- Align all Jetty artifacts FIRST so its versions win over Spring Boot's -->
+			<dependency>
+				<groupId>org.eclipse.jetty</groupId>
+				<artifactId>jetty-bom</artifactId>
+				<version>${org.eclipse.jetty.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
 			<dependency>
 				<groupId>org.springframework.security</groupId>
 				<artifactId>spring-security-bom</artifactId>