ref #9590: fix test
[cdmlib.git] / pom.xml
diff --git a/pom.xml b/pom.xml
index 3eb8aca6cd62d669c366805422690cd2aa4bac43..3e9e1a475dc248cb50bb76a909839991b2768a6c 100644 (file)
--- a/pom.xml
+++ b/pom.xml
@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>eu.etaxonomy</groupId>
   <artifactId>cdmlib-parent</artifactId>
-  <version>5.12.0</version>
+  <version>5.23.0-SNAPSHOT</version>
   <name>CDM Library</name>
   <description>The Java implementation of the Common Data Model (CDM), the data model for EDIT's internet platform for cybertaxonomy.</description>
   <url>http://cybertaxonomy.eu/cdmlib/</url>
   </modules>
   <properties>    
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
     <java.codelevel>1.8</java.codelevel>
-    <spring.version>4.2.4.RELEASE</spring.version>
-    <spring-security.version>4.0.3.RELEASE</spring-security.version>
-    <spring-security-oauth2.version>2.0.11.RELEASE</spring-security-oauth2.version>
+    <spring.version>4.3.28.RELEASE</spring.version>                                 <!-- checked 2020-08, further upgrade possible -->
+    <spring-security.version>4.2.18.RELEASE</spring-security.version>               <!-- checked 2020-08, further upgrade possible -->
+    <spring-security-oauth2.version>2.5.0.RELEASE</spring-security-oauth2.version>  <!-- checked 2020-08 -->
     <spring-cloud.version>1.1.3.RELEASE</spring-cloud.version>
-       <hibernate.version>5.0.7.Final</hibernate.version>
-       <hibernate-validator.version>5.2.2.Final</hibernate-validator.version>
+       <hibernate.version>5.1.17.Final</hibernate.version>
+       <hibernate-validator.version>6.1.5.Final</hibernate-validator.version>          <!-- checked 2020-08 -->
     <hibernate-search.version>5.5.2.Final</hibernate-search.version>
     <lucene.version>5.4.1</lucene.version>
-       <unitils.version>3.4.2</unitils.version>
-    <hsqldb.version>2.3.3</hsqldb.version>
-       <!-- <hsqldb.version>1.8.0.10</hsqldb.version>  -->
-       <!-- 1.8.0.10, 1.9.0-rc6 (manually build only for debugging) -->
-    <httpcomponents.version>4.5.1</httpcomponents.version>
-    <doxia.version>1.6</doxia.version>
-    <poi.version>3.13</poi.version>
-    <jackson.version>2.6.5</jackson.version>
-       <commons-logging.version>1.2</commons-logging.version>
-       <slf4j.version>1.7.13</slf4j.version>
-       <jaxb.version>2.2.11</jaxb.version>
-       <cglib.version>3.2.0</cglib.version>
-       <aspectj.version>1.8.8</aspectj.version>
-    <javadoc.opts>-Xdoclint:none</javadoc.opts>
+       <unitils.version>3.4.6</unitils.version>
+    <hsqldb.version>2.5.1</hsqldb.version>
+    <httpcomponents.version>4.5.12</httpcomponents.version>
+    <doxia.version>1.9.1</doxia.version>                <!-- checked 2020-08 -->
+    <poi.version>4.1.2</poi.version>                    <!-- checked 2020-08 -->
+    <jackson.version>2.11.2</jackson.version>           <!-- checked 2020-08 -->
+       <commons-logging.version>1.2</commons-logging.version> <!-- checked 2020-08 -->
+       <slf4j.version>1.7.30</slf4j.version>               <!-- checked 2020-08 -->
+       <jaxb.version>2.3.3</jaxb.version>                 <!-- checked 2020-08, there is a newer version 3.0.0-MX, not checked if compatible -->
+       <cglib.version>3.3.0</cglib.version>
+       <aspectj.version>1.9.6</aspectj.version>            <!-- checked 2020-08 -->
+       <geotools.version>23.2</geotools.version>           <!-- checked 2020-08 -->
+    <dozer.version>6.5.0</dozer.version>                <!-- checked 2021-02 -->
+    <javadoc.opts>-Xdoclint:none</javadoc.opts>         
   </properties>
   
   <scm>
@@ -57,7 +58,7 @@
   </scm>
   
   <prerequisites>
-    <maven>3.0.5</maven>
+    <maven>3.2.3</maven>
   </prerequisites>
   
     <mailingLists>
   <!--contributors> <contributor> <name>Test-Contributor</name> </contributor> 
     </contributors -->
   <issueManagement>
-    <system>Trac</system>
+    <system>Redmine</system>
     <url>https://dev.e-taxonomy.eu/redmine/projects/edit</url>
   </issueManagement>
   <ciManagement>
       </snapshots>   -->
       <id>jboss-repository</id>
       <name>JBoss Repository</name>
-      <url>http://repository.jboss.com</url>
+      <url>https://repository.jboss.org</url>
     </repository>
-    <!-- codehaus mule repository needed for yourkit -->
- <!--   <repository>
-      <id>CodehausMuleRepository</id>
-      <url>http://dist.codehaus.org/mule/dependencies/maven2/</url>
-    </repository>    -->
-    <!-- current spring source repositories -->
- <!--   <repository>
-      <id>SpringSource Enterprise Bundle Repository - External Bundle Milestones</id>
-      <url>http://repository.springsource.com/maven/bundles/milestone</url>
-    </repository> 
     <repository>
-      <id>SpringSource Enterprise Bundle Repository - SpringSource Bundle Releases</id>
-      <url>http://repository.springsource.com/maven/bundles/release</url>
+       <id>OSGeo Repository</id>
+       <url>https://repo.osgeo.org/repository/release/</url>
     </repository>
-    <repository>
-      <id>SpringSource Enterprise Bundle Repository - External Bundle Releases</id>
-      <url>http://repository.springsource.com/maven/bundles/external</url>
-    </repository>   -->
-    <!-- for ikey-plus -->
- <!--   <repository>
-      <id>itextpdf.com</id>
-      <name>Maven Repository for iText</name>
-      <url>http://maven.itextpdf.com/</url>
-    </repository>  -->
-    <!-- for jena snapshot -->
- <!--   <repository>
-      <id>apache</id>
-      <name>Apache Repository for Snapshots</name>
-      <url>https://repository.apache.org/content/repositories/snapshots/</url>
-    </repository> -->
-
-
   </repositories>
   <!-- **** PLUGINS **** -->
   <build>
         <configuration>
           <source>${java.codelevel}</source>
           <target>${java.codelevel}</target>
-          <encoding>UTF-8</encoding>  <!-- necessary? should be covered by project. properties source encoding -->
+          <encoding>${project.build.sourceEncoding}</encoding>  <!-- necessary? should be covered by project. properties source encoding -->
                  <!-- to increase stacksize see #6404 -->
         </configuration>
       </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>
-        <version>2.12</version>
+        <version>3.0.0-M5</version>  <!-- updated 2020-09 -->
         <configuration>
-          <argLine>-Xmx512M</argLine>
+          <argLine>-Xmx512M -Dfile.encoding=${project.build.sourceEncoding}</argLine>
           <runOrder>alphabetical</runOrder>
           <includes>
             <include>**/*Test.java</include>
           </includes>
         </configuration>
       </plugin>
+      <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-resources-plugin</artifactId>
+          <version>3.0.2</version>
+          <configuration>
+              <encoding>${project.build.sourceEncoding}</encoding>
+          </configuration>
+      </plugin>
       <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>buildnumber-maven-plugin</artifactId>
         <version>3.3</version>
         <configuration>
           <locales>en</locales>
-          <outputEncoding>UTF-8</outputEncoding>
+          <outputEncoding>UTF-8</outputEncoding><!-- necessary? should be covered by project. properties output encoding -->
           <!-- chmod: not not use chmod, rather adapt the umask of the user 
             at the server to which the site is deployed -->
           <chmod>false</chmod>
           </dependency>
         </dependencies>
       </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-enforcer-plugin</artifactId>
+        <version>3.0.0-M2</version>
+        <executions>
+          <execution>
+            <id>enforce</id>
+            <configuration>
+              <fail>true</fail>
+              <skip>false</skip>
+              <rules>
+                <dependencyConvergence />                
+                               <requireMavenVersion>
+                  <version>[3.6.0,)</version>
+                </requireMavenVersion>
+              </rules>
+            </configuration>
+            <goals>
+              <goal>enforce</goal>
+              <!-- Binds by default to the lifecycle phase: validate -->
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
     </plugins>
-    <!-- -->
     <extensions>
       <extension>
         <groupId>org.apache.maven.wagon</groupId>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-antrun-plugin</artifactId>
-          <version>1.7</version>
+          <version>3.0.0</version>
         </plugin>
       </plugins>  
     </pluginManagement>
           </reportSet>
         </reportSets>
       </plugin>
-      <!-- <plugin> <artifactId>maven-surefire-plugin</artifactId> </plugin> -->
       <!-- The changelog plug-in generates a nice report describing which 
         files have been changed and by whom -->
       <!-- <plugin> <groupId>org.codehaus.mojo</groupId> <artifactId>changelog-maven-plugin</artifactId> 
   <!-- **** DEPENDENCIES **** -->
   <dependencies>
     <dependency>
+      <!-- junit is required for all module tests, also those not depending on cdmlib-test, so it is added here on parent level with test scope -->
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>log4j</groupId>
-      <artifactId>log4j</artifactId>
+      <scope>test</scope>
     </dependency>
   </dependencies>
   <dependencyManagement>
         <artifactId>cdmlib-print</artifactId>
         <version>${project.version}</version>
       </dependency>
+      
       <!--*********** JAXB********* -->
       <dependency>
-        <groupId>javax.xml.bind</groupId>
-        <artifactId>jaxb-api</artifactId>
-        <version>2.2.12</version>
-      </dependency>
-      <dependency>
-        <groupId>xml-resolver</groupId>
-        <artifactId>xml-resolver</artifactId>
-        <version>1.2</version>
+        <groupId>jakarta.xml.bind</groupId>
+        <artifactId>jakarta.xml.bind-api</artifactId>
+        <version>${jaxb.version}</version>  <!-- not sure if jaxb.version is always the same -->
       </dependency>
+<!--       <dependency> -->
+<!--         replaced by jakarta.xml.bind-api -->
+<!--         <groupId>javax.xml.bind</groupId> -->
+<!--         <artifactId>jaxb-api</artifactId> -->
+<!--         <version>2.3.1</version> -->
+<!--         checked 2020-08 -->
+<!--       </dependency> -->
       <dependency>
-        <groupId>javax.activation</groupId>
-        <artifactId>activation</artifactId>
-        <version>1.1.1</version>
+         <!-- dependency for jaxb-api -->
+         <groupId>javax.activation</groupId>
+         <artifactId>javax.activation-api</artifactId>
+         <version>1.2.0</version>
+         <!-- checked 2020-08 -->
       </dependency>
          <dependency>
                <groupId>org.glassfish.jaxb</groupId>
          </dependency>
          <dependency>
                <groupId>org.glassfish.jaxb</groupId>
-               <artifactId>jaxb-core</artifactId>
+               <artifactId>jaxb-jxc</artifactId>
                <version>${jaxb.version}</version>
          </dependency>
+      <dependency>
+          <!-- currently required as xsom references older version -->
+          <groupId>com.sun.xml.bind.external</groupId>
+          <artifactId>relaxng-datatype</artifactId>
+          <version>${jaxb.version}</version>
+      </dependency>
+      <dependency>
+          <!-- jaxb-runtime dependency -->
+          <groupId>jakarta.activation</groupId>
+          <artifactId>jakarta.activation-api</artifactId>
+          <version>1.2.2</version>
+      </dependency>
+      <!--  JAB END -->
+      
          <dependency>
-               <groupId>org.glassfish.jaxb</groupId>
-               <artifactId>jaxb-jxc</artifactId>
-               <version>${jaxb.version}</version>
+           <!-- only for version management org.apache.ant:ant depends in different versions from 
+             org.unitils:unitils-easymock:3.4.2 and org.glassfish.jaxb:jaxb-jxc:2.2.11 -->
+           <groupId>org.apache.ant</groupId>
+           <artifactId>ant</artifactId>
+           <version>1.10.8</version>
          </dependency>
       <!-- ******* hibernate uses slf4j ******* -->
       <dependency>
         <version>${slf4j.version}</version>
       </dependency>
          <dependency>
+        <!-- try to generally exclude -nop as we try to use log4j12, this is done already for unitils -->
         <groupId>org.slf4j</groupId>
         <artifactId>slf4j-nop</artifactId>
         <version>${slf4j.version}</version>
       <dependency>
         <groupId>junit</groupId>
         <artifactId>junit</artifactId>
-        <version>4.12</version>
+        <version>4.13.1</version>
         <scope>test</scope>
       </dependency>
       <dependency>
           </exclusion>
         </exclusions>
       </dependency>
+      <dependency>
+        <groupId>org.objenesis</groupId>
+        <artifactId>objenesis</artifactId>
+        <version>3.1</version>
+      </dependency>
       <dependency>
         <groupId>org.unitils</groupId>
         <artifactId>unitils-dbunit</artifactId>
      <!--    <scope>test</scope>  -->
                <version>${project.version}</version>
          </dependency>
-
       <!-- ******* aspect ******* -->
       <dependency>
+        <!-- not really needed as long as aspectjweaver is on classpath which is a superset of aspectjrt -->
         <groupId>org.aspectj</groupId>
         <artifactId>aspectjrt</artifactId>
         <version>${aspectj.version}</version>
         <version>${aspectj.version}</version>
       </dependency>
       <!-- ******* VARIOUS ******* -->
+      <dependency>
+        <groupId>xml-resolver</groupId>
+        <artifactId>xml-resolver</artifactId>
+        <version>1.2</version>
+        <!-- checked 2020-08 -->
+      </dependency>
+      
       <dependency>
         <groupId>log4j</groupId>
         <artifactId>log4j</artifactId>
         <version>1.2.17</version>
       </dependency>
-      <dependency>
-        <groupId>javax.annotation</groupId>
-        <artifactId>jsr250-api</artifactId>
-        <version>1.0</version>
-      </dependency>
       <dependency>
         <groupId>net.sf.opencsv</groupId>
         <artifactId>opencsv</artifactId>
         <version>2.3</version>
       </dependency>
       <dependency>
-        <groupId>org.eclipse</groupId>
-        <artifactId>osgi</artifactId>
-        <version>3.6.0</version>
-      </dependency>
-      <dependency>
-        <groupId>cglib</groupId>
-        <artifactId>cglib</artifactId>
-        <version>${cglib.version}</version>
+        <groupId>org.osgi</groupId>
+        <artifactId>osgi.core</artifactId>
+        <version>7.0.0</version>
       </dependency>
       <dependency>
         <groupId>cglib</groupId>
         <artifactId>cglib-nodep</artifactId>
         <version>${cglib.version}</version>
       </dependency>
+      <!-- <dependency> -->
+      <!-- we try to have only dependencies to cglib-nodep to reduce size and to avoid
+           having 2 similar libraries. #9206  -->
+<!--         <groupId>cglib</groupId> -->
+<!--         <artifactId>cglib</artifactId> -->
+<!--         <version>${cglib.version}</version> -->
+<!--       </dependency> -->
       <dependency>
         <groupId>commons-lang</groupId>
         <artifactId>commons-lang</artifactId>
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-lang3</artifactId>
-        <version>3.5</version>
+        <version>3.11</version>
       </dependency>
       <dependency>
         <groupId>commons-collections</groupId>
       <dependency>
         <groupId>org.apache.httpcomponents</groupId>
         <artifactId>httpcore</artifactId>
-        <version>4.4.4</version>
+        <version>4.4.13</version>
       </dependency>
       <dependency>
         <groupId>commons-io</groupId>
         <artifactId>commons-io</artifactId>
-        <version>2.4</version>
+        <version>2.7</version>
+      </dependency>
+      <dependency>
+          <groupId>org.apache.commons</groupId>
+          <artifactId>commons-compress</artifactId>
+          <version>1.20</version>
+      </dependency>
+      <dependency>
+          <groupId>org.checkerframework</groupId>
+          <artifactId>checker-qual</artifactId>
+          <version>3.6.0</version>
       </dependency>
       <!-- only for version management, poi currently requires 1.6, commons-logging 
         1.1.1 requires 1.6, so we update here to the latest version -->
       <dependency>
         <groupId>commons-codec</groupId>
         <artifactId>commons-codec</artifactId>
-        <version>1.10</version>
+        <version>1.15</version>
       </dependency>
       <!-- only for version management, httpcore:4.2.4, commons-beanutils:1.8.3, 
         commons-collections:3.2.1 currently require 1.1.1 , httpclient:4.2.3, spring-modules-cache 
         <version>${commons-logging.version}</version>
       </dependency>
       <!-- only for version management, hibernate-commons-annotations:4.0.1.Final 
-        requires 3.1.0.CR2 , hibernate-ehcache:4.1.10 requires 3.1.0.GA , so we update 
-        here to the latest version 3.1.3.GA -->
+        requires 3.1.0.CR2 , so we update 
+        here to the latest version 3.4.1.Final -->
       <dependency>
         <groupId>org.jboss.logging</groupId>
         <artifactId>jboss-logging</artifactId>
-        <version>3.3.0.Final</version>
-      </dependency>
-      <!-- TODO com.springsource.org.aopalliance and com.springsource.org.apache.commons.logging 
-        seem to be duplicates of e.g. apache commons-logging. Needs to be further 
-        checked. -->
-         <!-- since hibernate 5.0.4 Dialect throws exception if jta is missing  -->
-         <dependency>
-        <groupId>javax.transaction</groupId>
-        <artifactId>jta</artifactId>
-        <version>1.1</version>
-      </dependency>  
+        <version>3.4.1.Final</version>
+        <!-- checked 2020-08 -->
+      </dependency>
+<!--     <dependency> -->
+<!--       see note in cdmib-persistence pom  -->
+<!--         <groupId>javax.transaction</groupId> -->
+<!--         <artifactId>jta</artifactId> -->
+<!--         <version>1.1</version> -->
+<!--       </dependency>   -->
                
       <!-- TODO xerces xmlParserAPIs duplicates many classes from jre and 
         xml-apis. It is a dependency that comes with xom:xom -->
       <dependency>
         <groupId>commons-beanutils</groupId>
         <artifactId>commons-beanutils</artifactId>
-        <version>1.9.2</version>
+        <version>1.9.4</version>
       </dependency>
       <dependency>
         <groupId>net.sf.json-lib</groupId>
         <version>2.4</version>
         <classifier>jdk15</classifier>
       </dependency>
+      <!-- media  -->
       <dependency>
         <groupId>org.devlib.schmidt</groupId>
         <artifactId>imageinfo</artifactId>
         <version>1.9</version>
       </dependency>
+       <dependency>
+        <groupId>de.digitalcollections.iiif</groupId>
+        <artifactId>iiif-apis</artifactId>
+        <version>0.3.8</version>
+      </dependency>
+<!--       <dependency> -->
+<!--         only for version management iterators depends in different versions from -->
+<!--               de.digitalcollections.iiif:iiif-apis:0.3.7 -->
+<!--           <groupId>org.dmfs</groupId> -->
+<!--           <artifactId>iterators</artifactId> -->
+<!--           <version>1.5</version> -->
+<!--       </dependency> -->
+      <!--         -->
       <dependency>
         <groupId>org.apache.poi</groupId>
         <artifactId>poi</artifactId>
         <artifactId>ooxml-schemas</artifactId>
         <version>1.4</version>
       </dependency>
+      <!--       <dependency> -->
+<!-- maybe needed in cdmlib-io, see https://poi.apache.org/help/faq.html  question 3 on when to use ooxml-schemas and when poi-ooxml-schemas  -->
+<!--         <groupId>org.apache.poi</groupId> -->
+<!--         <artifactId>ooxml-schemas</artifactId> -->
+<!--         <version>1.4</version> -->
+<!--       </dependency> -->
+      <dependency>
+       <!-- only for version management xmlbeans depends in different versions from 
+        org.apache.poi:poi-ooxml-schemas:3.13 and org.apache.poi:ooxml-schemas:1.4 -->
+       <groupId>org.apache.xmlbeans</groupId>
+       <artifactId>xmlbeans</artifactId>
+       <version>3.1.0</version>
+        <!-- checked 2020-08 -->
+      </dependency>
       <dependency>
         <groupId>org.docx4j</groupId>
         <artifactId>docx4j</artifactId>
-        <version>6.0.1</version>
+        <version>6.1.2</version>
+      </dependency>
+      <dependency>
+        <!-- only for version management jcl-over-slf4j depends in different versions from 
+        org.docx4j:docx4j:6.0.1 and org.apache.jena:jjena-tdb:1.1.2 -->
+        <groupId>org.slf4j</groupId>
+        <artifactId>jcl-over-slf4j</artifactId>
+        <version>1.7.25</version>
+      </dependency>
+      <dependency>
+        <!-- only for version management xalan depends in different versions from 
+        org.docx4j:docx4j:6.0.1 and xom:xom:1.2.5 -->
+       <groupId>xalan</groupId>
+       <artifactId>xalan</artifactId>
+       <version>2.7.2</version>
+      </dependency>
+      <dependency>
+        <!-- only for version management org.apache.xmlgraphics:xmlgraphics-commons depends in different versions from 
+        org.docx4j:docx4j:6.0.1 and org.apache.xmlgraphics:fop:1.1 -->
+       <groupId>org.apache.xmlgraphics</groupId>
+       <artifactId>xmlgraphics-commons</artifactId>
+       <version>2.4</version>
       </dependency>
       <dependency>
-        <groupId>org.apache.sanselan</groupId>
-        <artifactId>sanselan</artifactId>
-        <version>0.97-incubator</version>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-imaging</artifactId>
+        <version>1.0-alpha2</version>
       </dependency>
       <!-- joda-time -->
       <dependency>
         <groupId>joda-time</groupId>
         <artifactId>joda-time</artifactId>
-        <version>2.9.1</version>
+        <version>2.10.6</version>
       </dependency>
          <!-- maybe replaced by usertype.core -->
       <dependency>
         <artifactId>wsdl4j</artifactId>
         <version>1.6.3</version>
       </dependency>
+<!--       <dependency> -->
+<!--         <groupId>net.sf.dozer</groupId> -->
+<!--         <artifactId>dozer</artifactId> -->
+<!--         <version>5.5.1</version> -->
+<!--       </dependency> -->
+      <dependency>
+          <groupId>com.github.dozermapper</groupId>
+          <artifactId>dozer-core</artifactId>
+          <version>${dozer.version}</version>
+      </dependency>
       <dependency>
-        <groupId>net.sf.dozer</groupId>
-        <artifactId>dozer</artifactId>
-        <version>5.3.0</version>
+        <groupId>com.github.dozermapper</groupId>
+        <artifactId>dozer-spring4</artifactId>
+        <version>${dozer.version}</version>
       </dependency>
       <dependency>
         <groupId>net.sf.ehcache</groupId>
-        <artifactId>ehcache-core</artifactId>
-        <version>2.6.11</version>
+        <artifactId>ehcache</artifactId>
+        <version>2.10.6</version>
       </dependency>
       <!-- ******* XML ******* -->
       <dependency>
+<!--        xml-apis seems to be ALMOST fully included in java8 but ElementTraversal seems to be missing, therefore SDDDocumentBuilder does not compile -->
         <groupId>xml-apis</groupId>
         <artifactId>xml-apis</artifactId>
-        <!-- 
-            WARNING: do not upgrade to later versions 2.0.x of xml-apis
-            since these are effectivly reloated to the early beta version
-            1.0.b2
-        -->
+<!--             WARNING: do not upgrade to later versions 2.0.x of xml-apis -->
+<!--             since these are effectivly reloaded to the early beta version -->
+<!--             1.0.b2 -->
         <version>1.4.01</version>
       </dependency>
       <dependency>
         <groupId>xerces</groupId>
         <artifactId>xercesImpl</artifactId>
-        <version>2.11.0</version>
+        <version>2.12.0</version>
+        <!-- checked 2020-08 -->
       </dependency>
       <!-- >batik-ext required by Xerces 2.11.0 for class ElementTraversal, 
         as this is not included anymore in xml-apis 2.x -->
-      <dependency>
-        <groupId>org.apache.xmlgraphics</groupId>
-        <artifactId>batik-ext</artifactId>
-        <version>1.8</version>
-      </dependency>
+<!--       <dependency> -->
+<!--         <groupId>org.apache.xmlgraphics</groupId> -->
+<!--         <artifactId>batik-ext</artifactId> -->
+<!--         <version>1.13</version> -->
+<!--       </dependency> -->
       <dependency> <!-- required by cdmlib-print -->
         <groupId>org.apache.xmlgraphics</groupId>
         <artifactId>fop</artifactId>
-        <!-- version 1.1 does NOT work, because it depends on avalon-framework-api 
-          4.2.0 which is not available in central maven repository under the given 
-          groupID -->
-        <version>1.1</version>
-        <exclusions>
-          <!-- 1.1 depends on an old version of avalon-framework which does 
-            not exist in mvn repository under this groupId (has old groupId) -->
-          <exclusion>
-            <groupId>org.apache.avalon.framework</groupId>
-            <artifactId>avalon-framework-api</artifactId>
-          </exclusion>
-          <exclusion>
-            <groupId>org.apache.avalon.framework</groupId>
-            <artifactId>avalon-framework-impl</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
-      <!-- not directly required, but fix mentioned to force correct version 
-        number 4.3.1. Required by org.apache.xmlgraphics/fop 1.1 Remove when dependency 
-        in fop in corrected. -->
-      <dependency>
-        <groupId>org.apache.avalon.framework</groupId>
-        <artifactId>avalon-framework-api</artifactId>
-        <version>4.3.1</version>
+        <version>2.5</version>
       </dependency>
       <dependency>
         <groupId>org.odftoolkit</groupId>
           <!-- used in eu.etaxonomy.cdm.io.markup and for swagger -->
           <groupId>com.google.guava</groupId>
           <artifactId>guava</artifactId>
-          <version>23.0</version>
-      </dependency>
-      <dependency>
-        <groupId>jaxen</groupId>
-        <artifactId>jaxen</artifactId>
-        <version>1.1.6</version>
+          <version>29.0-jre</version>
       </dependency>
       <!-- last jdom 1.x version -->
          <dependency>
       <dependency>
         <groupId>com.thoughtworks.xstream</groupId>
         <artifactId>xstream</artifactId>
-        <version>1.4.7</version>
+        <version>1.4.14</version>
+      </dependency>
+      <dependency>
+      <groupId>xmlpull</groupId>
+        <artifactId>xmlpull</artifactId>
+        <version>1.2.0</version>
       </dependency>
       <dependency>
         <groupId>xpp3</groupId>
         <artifactId>xpp3</artifactId>
         <version>1.1.4c</version>
       </dependency>
-      <dependency>
-        <groupId>stax</groupId>
-        <artifactId>stax</artifactId>
-        <version>1.2.0</version>
-      </dependency>
+<!--       <dependency> -->
+<!--        stax is part of java8 and therefore not needed anymore -->
+<!--         <groupId>stax</groupId> -->
+<!--         <artifactId>stax</artifactId> -->
+<!--         <version>1.2.0</version> -->
+<!--       </dependency> -->
       <dependency>
         <groupId>xom</groupId>
         <artifactId>xom</artifactId>
-        <version>1.2.5</version>
+        <version>1.3.5</version>
         <exclusions>
           <!-- need to exclude com.ibm.icu:icu4j since it contains an invalid 
             file which causes the jetty-maven-plugin to fail see http://stackoverflow.com/questions/3026956/javassist-failure-in-hibernate-invalid-constant-type-60 -->
       <dependency>
         <groupId>net.sf.saxon</groupId>
         <artifactId>Saxon-HE</artifactId>
-        <version>9.7.0-2</version>
+        <version>10.1</version>
       </dependency>
       <!-- ******* http components (ViBRANT)******* -->
       <dependency>
       <dependency>
         <groupId>org.json</groupId>
         <artifactId>json</artifactId>
-        <version>20090211</version>
+        <version>20200518</version>
       </dependency>
       <!-- ******* HIBERNATE / EJB3 ******* -->
       <dependency>
         <groupId>org.hibernate.javax.persistence</groupId>
         <artifactId>hibernate-jpa-2.1-api</artifactId>
-        <version>1.0.0.Final</version>
+        <version>1.0.2.Final</version>
       </dependency>
       <dependency>
         <groupId>org.hibernate</groupId>
         <artifactId>hibernate-entitymanager</artifactId>
         <version>${hibernate.version}</version>
       </dependency>
-      <dependency>
-        <groupId>org.hibernate</groupId>
-        <artifactId>hibernate-ehcache</artifactId>
-        <version>${hibernate.version}</version>
-      </dependency>
       <dependency>
         <groupId>org.hibernate</groupId>
         <artifactId>hibernate-envers</artifactId>
         -->
         <version>0.9.5.2</version>
       </dependency>
+      <dependency>
+        <groupId>com.mchange</groupId>
+        <artifactId>mchange-commons-java</artifactId>
+        <!-- mchange-commons-java needs to match the version as defined in the c3p0/pom.xml -->
+        <version>0.2.11</version>
+      </dependency>
       <dependency>
         <groupId>org.hibernate.common</groupId>
         <artifactId>hibernate-commons-annotations</artifactId>
-        <version>5.0.1.Final</version>
+        <version>5.1.0.Final</version>
       </dependency>
       <dependency>
         <groupId>org.hibernate</groupId>
       <dependency>
         <groupId>org.javassist</groupId>
         <artifactId>javassist</artifactId>
-        <version>3.20.0-GA</version>
-      </dependency>
-      <dependency>
-        <groupId>org.hibernate</groupId>
-        <artifactId>hibernate-cglib-repack</artifactId>
-        <version>2.1_3</version>
+        <version>3.27.0-GA</version>
       </dependency>
 
       <!-- ******* SPRING ******* -->
       </dependency>
       <dependency>
         <groupId>org.springframework.security.oauth</groupId>
-      <artifactId>spring-security-oauth2</artifactId>
+        <artifactId>spring-security-oauth2</artifactId>
         <version>${spring-security-oauth2.version}</version>
       </dependency>
       <dependency>
         <artifactId>spring-cloud-security</artifactId>
         <version>${spring-security.version}</version>
       </dependency>
+      <dependency>
+        <!-- required by spring security core, but not needed anymore in spring security 5.x  -->
+        <groupId>aopalliance</groupId>
+        <artifactId>aopalliance</artifactId>
+        <version>1.0</version>
+      </dependency>
 
       <!-- ******* SERVLET/JSP/JSF ******* -->
       <dependency>
         <groupId>javax.servlet</groupId>
         <artifactId>javax.servlet-api</artifactId>
-        <version>3.1.0</version>
+        <version>4.0.1</version>
+        <!-- checked 2020-08 -->
       </dependency>
 
       <!-- yourkit profiler api controller (used in ..) -->
       <dependency>
         <groupId>javax.validation</groupId>
         <artifactId>validation-api</artifactId>
-        <version>1.1.0.Final</version>
+        <version>2.0.1.Final</version>
+        <!-- checked 2020-08 -->
       </dependency>
       <dependency>
-        <groupId>org.hibernate</groupId>
+        <groupId>org.hibernate.validator</groupId>
         <artifactId>hibernate-validator</artifactId>
         <version>${hibernate-validator.version}</version>
       </dependency>
       <dependency>
         <groupId>com.fasterxml</groupId>
         <artifactId>classmate</artifactId>
-        <version>1.3.1</version>
+        <version>1.5.1</version>     
+        <!-- checked 2020-08 -->
       </dependency>
          <dependency>
-       <groupId>javax.el</groupId>
-       <artifactId>javax.el-api</artifactId>
-       <version>2.2.5</version>
+        <groupId>javax.el</groupId>
+        <artifactId>javax.el-api</artifactId>
+        <version>3.0.0</version>
+        <!-- checked 2020-08 -->
          </dependency>
+      <dependency>
+          <groupId>jakarta.validation</groupId>
+          <artifactId>jakarta.validation-api</artifactId>
+          <version>3.0.0</version>
+          <!-- checked 2020-08 -->
+      </dependency>
          <dependency>
-               <groupId>org.glassfish.web</groupId>
-               <artifactId>javax.el</artifactId>
-               <version>2.2.6</version>
+                <groupId>org.glassfish.web</groupId>
+                <artifactId>javax.el</artifactId>
+                <version>2.2.6</version>
          </dependency>
          <dependency>
-           <groupId>org.hibernate</groupId>
-               <artifactId>hibernate-validator-cdi</artifactId>
-               <version>${hibernate-validator.version}</version>
+            <groupId>org.hibernate.validator</groupId>
+         <artifactId>hibernate-validator-cdi</artifactId>
+         <version>${hibernate-validator.version}</version>
          </dependency>
+      <dependency>
+         <!-- not clear if needed, but if needed v8.0 should be used to avoid problems with javax.validation.BootstrapConfiguration -->
+         <!-- it was a (currently excluded) transitiv dependency from org.geotools/gt-referencing  used in cdmlib-ext -->
+         <groupId>javax</groupId>
+         <artifactId>javaee-api</artifactId>
+         <version>8.0.1</version>
+      </dependency>
          
       <!-- for ikey-plus -->
       <dependency>
       <dependency>
         <groupId>com.itextpdf</groupId>
         <artifactId>itextpdf</artifactId>
-        <version>5.5.8</version>
+        <version>5.5.13.1</version>
         <scope>compile</scope>
       </dependency>
       <!-- AptView -->
         <artifactId>doxia-module-xhtml</artifactId>
         <version>${doxia.version}</version>
       </dependency>
+      <dependency>
+        <!-- managing version of plexus-utils to avoid multiple versions (3.0.15, 1.4.5) of the artifact -->
+       <groupId>org.codehaus.plexus</groupId>
+       <artifactId>plexus-utils</artifactId>
+       <version>3.3.0</version>
+        <!-- checked 2020-08 -->
+      </dependency>
       <!-- swagger (rest service doc) -->
       <dependency>
         <groupId>io.swagger</groupId>
       </dependency>
 
       <!-- dependencies for swagger-springmvc, added explicitely -->
-        <dependency>
+      <dependency>
         <groupId>com.fasterxml.jackson.core</groupId>
         <artifactId>jackson-databind</artifactId>
         <version>${jackson.version}</version>
       <dependency>
         <groupId>mysql</groupId>
         <artifactId>mysql-connector-java</artifactId>
-        <version>8.0.15</version>
+        <version>8.0.21</version>
       </dependency>
       <dependency>
         <groupId>org.mariadb.jdbc</groupId>
         <artifactId>mariadb-java-client</artifactId>
-        <version>2.4.0</version>
+        <version>2.6.2</version>
       </dependency>
       <dependency>
          <groupId>org.postgresql</groupId>
          <artifactId>postgresql</artifactId>
-         <version>9.4-1206-jdbc4</version>
+         <version>42.2.18</version>
       </dependency>
          <dependency>
         <groupId>com.h2database</groupId>
         <artifactId>h2</artifactId>
         <version>1.4.190</version>
       </dependency>
-      <!--for sqlserver2008 and sqlserver2005 -->
+      <!-- SQL Server -->
       <dependency>
         <groupId>com.microsoft.sqlserver</groupId>
-        <artifactId>jdbc4</artifactId>
-        <version>2.0</version>
+        <artifactId>mssql-jdbc</artifactId>
+        <version>8.4.1.jre8</version>
       </dependency>
          <dependency>
         <groupId>org.hsqldb</groupId>
         <artifactId>ojdbc</artifactId>
         <version>14</version>
         </dependency>   -->      
+      <!-- GIS/KML -->
+         <dependency>
+            <groupId>de.micromata.jak</groupId>
+            <artifactId>JavaAPIforKml</artifactId>
+            <version>2.2.1</version>
+         </dependency>
+         <dependency>
+           <groupId>org.geotools</groupId>
+           <artifactId>gt-opengis</artifactId>
+           <version>${geotools.version}</version>
+         </dependency>
+         <dependency>
+           <groupId>org.geotools</groupId>
+           <artifactId>gt-referencing</artifactId>
+           <version>${geotools.version}</version>
+         </dependency>
+         <dependency>
+           <groupId>org.geotools</groupId>
+           <artifactId>gt-epsg-wkt</artifactId>
+           <version>${geotools.version}</version>
+         </dependency>
+         <dependency>
+           <groupId>org.geotools</groupId>
+           <artifactId>gt-main</artifactId>
+           <version>${geotools.version}</version>
+         </dependency>
+    
       <dependency>
-        <groupId>com.taskadapter</groupId>
-        <artifactId>redmine-java-api</artifactId>
-        <version>3.1.0</version>
+         <groupId>com.sun</groupId>
+         <artifactId>tools</artifactId>
+         <version>1.8.0</version>
       </dependency>
-    </dependencies>    
+   </dependencies>    
   </dependencyManagement>
 </project>