X-Git-Url: https://dev.e-taxonomy.eu/gitweb/cdmlib.git/blobdiff_plain/6a052b69953b8d25ea981723cb02c81712ea575e..06fa9d4ecbd21667cb7177f3dbb9617671942025:/pom.xml

diff --git a/pom.xml b/pom.xml
index f86cadc85e..a70aac7aeb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -3,52 +3,54 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>eu.etaxonomy</groupId>
   <artifactId>cdmlib-parent</artifactId>
-  <version>5.18.0-SNAPSHOT</version>
+  <version>5.43.0-SNAPSHOT</version>
   <name>CDM Library</name>
   <description>The Java implementation of the Common Data Model (CDM), the data model for EDIT's internet platform for cybertaxonomy.</description>
-  <url>http://cybertaxonomy.eu/cdmlib/</url>
+  <url>https://cybertaxonomy.org/cdmlib/</url>
   <inceptionYear>2007</inceptionYear>
   <packaging>pom</packaging>
   <modules>
     <module>cdmlib-commons</module>
     <module>cdmlib-model</module>
-	<module>cdmlib-db</module>
+	<module>cdmlib-api</module>
+    <module>cdmlib-db</module>
     <module>cdmlib-test</module>
     <module>cdmlib-persistence</module>
     <module>cdmlib-services</module>
+    <module>cdmlib-cache</module>
     <module>cdmlib-ext</module>
     <module>cdmlib-io</module>
     <module>cdmlib-remote</module>
     <module>cdmlib-print</module>
     <module>cdmlib-remote-webapp</module>
-    <module>cdmlib-cache</module>
   </modules>
   <properties>    
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
     <java.codelevel>1.8</java.codelevel>
-    <spring.version>4.3.28.RELEASE</spring.version>                                 <!-- checked 2020-08, further upgrade possible -->
-    <spring-security.version>4.2.18.RELEASE</spring-security.version>               <!-- checked 2020-08, further upgrade possible -->
-    <spring-security-oauth2.version>2.5.0.RELEASE</spring-security-oauth2.version>  <!-- checked 2020-08 -->
+    <spring.version>4.3.30.RELEASE</spring.version>                                 <!-- checked 2020-08, further upgrade possible -->
+    <spring-security.version>4.2.20.RELEASE</spring-security.version>               <!-- checked 2020-08, further upgrade possible -->
+    <spring-security-oauth2.version>2.5.2.RELEASE</spring-security-oauth2.version>  <!-- checked 2020-08 -->
     <spring-cloud.version>1.1.3.RELEASE</spring-cloud.version>
-	<hibernate.version>5.1.17.Final</hibernate.version>
-	<hibernate-validator.version>6.1.5.Final</hibernate-validator.version>          <!-- checked 2020-08 -->
-    <hibernate-search.version>5.5.2.Final</hibernate-search.version>
-    <lucene.version>5.4.1</lucene.version>
+	<hibernate.version>5.4.33.Final</hibernate.version>
+	<hibernate-validator.version>6.2.3.Final</hibernate-validator.version>          <!-- checked 2020-08 -->
+    <hibernate-search.version>5.11.10.Final</hibernate-search.version>
+    <lucene.version>5.5.5</lucene.version>
 	<unitils.version>3.4.6</unitils.version>
-    <hsqldb.version>2.5.1</hsqldb.version>
-    <httpcomponents.version>4.5.12</httpcomponents.version>
-    <doxia.version>1.9.1</doxia.version>                <!-- checked 2020-08 -->
-    <poi.version>4.1.2</poi.version>                    <!-- checked 2020-08 -->
-    <jackson.version>2.11.2</jackson.version>           <!-- checked 2020-08 -->
-	<commons-logging.version>1.2</commons-logging.version> <!-- checked 2020-08 -->
-	<slf4j.version>1.7.30</slf4j.version>               <!-- checked 2020-08 -->
+    <httpcomponents.version>4.5.13</httpcomponents.version>
+    <doxia.version>1.11.1</doxia.version>                <!-- checked 2021-12 -->
+    <poi.version>5.2.2</poi.version>                    <!-- checked 2022-06 -->
+    <jackson.version>2.13.3</jackson.version>           <!-- checked 2022-05 -->
+	<!-- CAUTION when upgrading, 1.8x requires another log4j binding: https://logging.apache.org/log4j/2.x/log4j-slf4j-impl/index.html -->
+    <slf4j.version>1.7.36</slf4j.version>               <!-- checked 2022-06 -->
+	<log4j.version>2.19.0</log4j.version>
 	<jaxb.version>2.3.3</jaxb.version>                 <!-- checked 2020-08, there is a newer version 3.0.0-MX, not checked if compatible -->
 	<cglib.version>3.3.0</cglib.version>
-	<aspectj.version>1.9.6</aspectj.version>            <!-- checked 2020-08 -->
+	<aspectj.version>1.9.7</aspectj.version>            <!-- checked 2022-05 -->
 	<geotools.version>23.2</geotools.version>           <!-- checked 2020-08 -->
-    
-    <javadoc.opts>-Xdoclint:none</javadoc.opts>         
+    <dozer.version>6.5.2</dozer.version>                <!-- checked 2021-02 -->
+    <jakarta.mail.version>1.5.6</jakarta.mail.version>      <!-- compatible to the one in spring-context-support/4.3.28.RELEASE -->
+    <doclint>none</doclint>
   </properties>
   
   <scm>
@@ -58,7 +60,7 @@
   </scm>
   
   <prerequisites>
-    <maven>3.2.3</maven>
+    <maven>3.6.3</maven>
   </prerequisites>
   
     <mailingLists>
@@ -84,62 +86,34 @@
   <licenses>
     <license>
       <name>Mozilla Public License Version 1.1</name>
-      <url>http://www.mozilla.org/MPL/MPL-1.1.html</url>
+      <url>https://www.mozilla.org/MPL/MPL-1.1.html</url>
       <distribution>repo</distribution>
     </license>
   </licenses>
   <organization>
     <name>EDIT</name>
-    <url>https://cybertaxonomy.eu/</url>
+    <url>https://cybertaxonomy.org/</url>
   </organization>
   <developers>
     <developer>
-      <!-- your SVN account id please! -->
-      <id>a.kohlbecker</id>
-      <name>
-                Andreas Kohlbecker
-            </name>
-      <email>a.kohlbecker [at] bgbm.org</email>
-      <organization>
-                Botanical Garden Botanical Museum Berlin
-            </organization>
-      <organizationUrl>http://www.bgbm.org/BioDivInf/</organizationUrl>
-      <timezone>+1</timezone>
-      <roles>
-        <role>Architect</role>
-        <role>Java Developer</role>
-        <role>Release Manager</role>
-      </roles>
-      <url />
-    </developer>
-    <developer>
-      <!-- your SVN account id please! -->
       <id>k.luther</id>
-      <name>
-                Katja Luther
-            </name>
+      <name>Katja Luther</name>
       <email>k.luther [at] bgbm.org</email>
-      <organization>
-                Botanical Garden Botanical Museum Berlin
-            </organization>
-      <organizationUrl>http://www.bgbm.org/BioDivInf/</organizationUrl>
+      <organization>Botanical Garden Botanical Museum Berlin</organization>
+      <organizationUrl>https://www.bgbm.org/en/biodiversity-informatics</organizationUrl>
       <timezone>+1</timezone>
       <roles>
         <role>Java Developer</role>
+        <role>Release Manager</role>
       </roles>
       <url />
     </developer>
     <developer>
-      <!-- your SVN account id please! -->
       <id>a.mueller</id>
-      <name>
-                Andreas Müller
-            </name>
+      <name>Andreas Müller</name>
       <email>a.mueller [at] bgbm.org</email>
-      <organization>
-                Botanical Garden Botanical Museum Berlin
-            </organization>
-      <organizationUrl>http://www.bgbm.org/BioDivInf/</organizationUrl>
+      <organization>Botanical Garden Botanical Museum Berlin</organization>
+      <organizationUrl>https://www.bgbm.org/en/biodiversity-informatics</organizationUrl>
       <timezone>+1</timezone>
       <roles>
         <role>Architect</role>
@@ -147,34 +121,15 @@
         <role>Release Manager</role>
       </roles>
       <url />
-    </developer>
-	   <developer>
-      <!-- your SVN account id please! -->
-      <id>p.plitzner</id>
-      <name>
-               Patrick Plitzner
-            </name>
-      <email>p.plitzner [at] bgbm.org</email>
-      <organization>
-                Botanical Garden Botanical Museum Berlin
-            </organization>
-      <organizationUrl>http://www.bgbm.org/BioDivInf/</organizationUrl>
-      <timezone>+1</timezone>
-      <roles>
-        <role>Java Developer</role>
-      </roles>
-      <url />
     </developer>
   </developers>
-  <!--contributors> <contributor> <name>Test-Contributor</name> </contributor> 
-    </contributors -->
   <issueManagement>
     <system>Redmine</system>
     <url>https://dev.e-taxonomy.eu/redmine/projects/edit</url>
   </issueManagement>
   <ciManagement>
     <system>Jenkins</system>
-    <url>http://int.e-taxonomy.eu/jenkins</url>
+    <url>https://int.e-taxonomy.eu/jenkins</url>
   </ciManagement>
   <!-- **** REPOSITORIES **** -->
   <profiles>
@@ -205,29 +160,20 @@
     <!-- the cdm internal repository -->
     <repository>
       <id>EditRepository</id>
-      <url>http://cybertaxonomy.eu/mavenrepo/</url>
+      <url>https://cybertaxonomy.org/mavenrepo/</url>
     </repository>
-    <!-- apache incubating repository -->
-    <repository>
+    <!-- apache incubating repository, was used for jena-tdb -->
+ <!--   <repository>
       <id>ApacheIncubating</id>
-      <url>http://people.apache.org/repo/m2-incubating-repository/</url>
-    </repository>
-    <!-- Neccessary for hibernate-envers -->
-    <repository>
-  <!--    <releases>
-        <enabled>true</enabled>
-        <updatePolicy>always</updatePolicy>
-        <checksumPolicy>warn</checksumPolicy>
-      </releases>
-      <snapshots>
-        <enabled>false</enabled>
-        <updatePolicy>never</updatePolicy>
-        <checksumPolicy>fail</checksumPolicy>
-      </snapshots>   -->
+      <url>https://people.apache.org/repo/m2-incubating-repository/</url>
+    </repository> -->
+    <!-- was neccessary for hibernate-envers -->
+<!--    <repository>
       <id>jboss-repository</id>
       <name>JBoss Repository</name>
       <url>https://repository.jboss.org</url>
-    </repository>
+    </repository>  -->
+    <!-- required for org.geotools:gt-opengis/gt-referencing/gt-epsg-wkt/gt-main -->    
     <repository>
     	<id>OSGeo Repository</id>
     	<url>https://repo.osgeo.org/repository/release/</url>
@@ -239,7 +185,9 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-compiler-plugin</artifactId>
-		<version>2.3.2</version> 
+		<!-- TODO #6407#9919 upgrading to 3.x leads to test failures in model etc. -->
+    <!--   <version>3.10.1</version>  --> 
+        <version>2.5.1</version> 
         <configuration>
           <source>${java.codelevel}</source>
           <target>${java.codelevel}</target>
@@ -250,7 +198,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>
-        <version>3.0.0-M5</version>  <!-- updated 2020-09 -->
+        <version>3.0.0-M7</version>  <!-- updated 2022-06 -->
         <configuration>
           <argLine>-Xmx512M -Dfile.encoding=${project.build.sourceEncoding}</argLine>
           <runOrder>alphabetical</runOrder>
@@ -262,7 +210,7 @@
       <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-resources-plugin</artifactId>
-          <version>3.0.2</version>
+          <version>3.1.0</version>
           <configuration>
               <encoding>${project.build.sourceEncoding}</encoding>
           </configuration>
@@ -270,7 +218,7 @@
       <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>buildnumber-maven-plugin</artifactId>
-        <version>1.0-beta-3</version>
+        <version>1.4</version>
         <executions>
           <execution>
             <!--<phase>deploy</phase> -->
@@ -289,7 +237,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-site-plugin</artifactId>
-        <version>3.3</version>
+        <version>3.10.0</version>
         <configuration>
           <locales>en</locales>
           <outputEncoding>UTF-8</outputEncoding><!-- necessary? should be covered by project. properties output encoding -->
@@ -301,7 +249,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-source-plugin</artifactId>
-        <version>2.1.2</version>
+        <version>3.2.1</version>
         <executions>
           <execution>
             <id>attach-sources</id>
@@ -315,13 +263,14 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-javadoc-plugin</artifactId>
-        <version>2.7</version>
+        <version>3.3.1</version>
         <configuration>
           <stylesheet>maven</stylesheet>
           <quiet>true</quiet>
           <detectLinks>true</detectLinks>
           <failOnError>false</failOnError>
-          <additionalparam>${javadoc.opts}</additionalparam>
+          <!-- TODO do more finegrained exclusions, see e.g https://docs.oracle.com/javase/8/docs/technotes/tools/windows/javadoc.html#BEJEFABE -->
+          <doclint>${doclint}</doclint>
         </configuration>
         <executions>
           <execution>
@@ -336,7 +285,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-eclipse-plugin</artifactId>
-        <version>2.9</version>
+        <version>2.10</version>
         <configuration>
           <downloadSources>true</downloadSources>
           <downloadJavadocs>true</downloadJavadocs>
@@ -345,7 +294,7 @@
       <plugin>
         <groupId>com.agilejava.docbkx</groupId>
         <artifactId>docbkx-maven-plugin</artifactId>
-        <version>2.0.9</version>
+        <version>2.0.17</version>
         <executions>
           <execution>
             <goals>
@@ -357,9 +306,9 @@
         </executions>
         <dependencies>
           <dependency>
-            <groupId>org.docbook</groupId>
-            <artifactId>docbook-xml</artifactId>
-            <version>4.4</version>
+		    <groupId>net.sf.docbook</groupId>
+		    <artifactId>docbook-xml</artifactId>
+		    <version>5.0</version>
             <scope>runtime</scope>
           </dependency>
         </dependencies>
@@ -400,12 +349,12 @@
       <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>wagon-maven-plugin</artifactId>
-        <version>1.0-beta-3</version>
+        <version>2.0.2</version>
         <configuration>
           <fromDir>${project.build.directory}/docbkx/</fromDir>
           <includes>**/*</includes>
           <excludes />
-          <url>scpexe://cybertaxonomy.eu</url>
+          <url>scpexe://cybertaxonomy.org</url>
           <serverId>cybertaxonomy.eu</serverId>
           <toDir>var/www/wp5.e-taxonomy.eu/cdmlib/reference/${project.version}</toDir>
         </configuration>
@@ -422,17 +371,20 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-release-plugin</artifactId>
-        <version>2.1</version>
+        <version>2.5.3</version>
         <configuration>
           <allowTimestampedSnapshots>true</allowTimestampedSnapshots>
           <autoVersionSubmodules>true</autoVersionSubmodules>
           <preparationGoals>clean verify install</preparationGoals>
           <goals>deploy</goals><!-- skipping site-deploy by explicitly configuring 
             the goal here -->
-          <tagBase>http://dev.e-taxonomy.eu/svn/tags/cdmlib</tagBase>
+          <tagBase>https://dev.e-taxonomy.eu/gitweb/cdmlib.git/tags</tagBase>
         </configuration>
       </plugin>
       <plugin>
+	    <!-- groupId>ch.dvbern.oss.maven.jgitflow</groupId>
+        <artifactId>jgitflow-maven-plugin</artifactId>
+        <version>1.0-m8</version>  -->
         <groupId>external.atlassian.jgitflow</groupId>
         <artifactId>jgitflow-maven-plugin</artifactId>
         <version>1.0-m6</version>
@@ -451,14 +403,14 @@
           <dependency>
             <groupId>com.jcraft</groupId>
             <artifactId>jsch</artifactId>
-            <version>0.1.53</version>
+            <version>0.1.55</version>
           </dependency>
         </dependencies>
       </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-enforcer-plugin</artifactId>
-        <version>3.0.0-M2</version>
+        <version>3.1.0</version>
         <executions>
           <execution>
             <id>enforce</id>
@@ -484,33 +436,33 @@
       <extension>
         <groupId>org.apache.maven.wagon</groupId>
         <artifactId>wagon-scm</artifactId>
-        <version>1.0-beta-6</version>
+        <version>3.5.1</version>
       </extension>
       <extension>
         <groupId>org.apache.maven.wagon</groupId>
         <artifactId>wagon-ssh</artifactId>
-        <version>1.0-beta-6</version>
+        <version>3.5.1</version>
       </extension>
       <extension>
         <groupId>org.apache.maven.wagon</groupId>
         <artifactId>wagon-ssh-external</artifactId>
-        <version>1.0-beta-6</version>
+        <version>3.5.1</version>
       </extension>
       <extension>
         <groupId>org.apache.maven.scm</groupId>
         <artifactId>maven-scm-manager-plexus</artifactId>
-        <version>1.0</version>
+        <version>1.12.2</version>
       </extension>
       <extension>
         <groupId>org.apache.maven.scm</groupId>
         <artifactId>maven-scm-provider-svnexe</artifactId>
-        <version>1.0</version>
+        <version>1.12.2</version>
       </extension>
       <!-- WebDAV plugin to upload snapshots -->
       <extension>
         <groupId>org.apache.maven.wagon</groupId>
-        <artifactId>wagon-webdav</artifactId>
-        <version>1.0-beta-2</version>
+        <artifactId>wagon-webdav-jackrabbit</artifactId>
+        <version>3.5.1</version>
       </extension>
     </extensions>
     <pluginManagement>
@@ -529,10 +481,10 @@
         <!-- you will want to start by publishing your classes' Javadocs -->
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-javadoc-plugin</artifactId>
-        <version>2.7</version>
+        <version>3.3.1</version>
         <configuration>
           <detectLinks>true</detectLinks>
-          <additionalparam>${javadoc.opts}</additionalparam>
+          <doclint>${doclint}</doclint>
         </configuration>
       </plugin>
       <plugin>
@@ -540,7 +492,7 @@
           of your source code -->
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-jxr-plugin</artifactId>
-        <version>2.2</version>
+        <version>3.3.1</version>
       </plugin>
       <plugin>
         <!-- if you use @todo tags to remind you of things to be done (which 
@@ -557,15 +509,15 @@
           quality -->
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>cobertura-maven-plugin</artifactId>
-        <version>2.4</version>
+        <version>2.7</version>
         <!-- <executions> <execution> <id>clean</id> <phase>clean</phase> 
           <goals> <goal>clean</goal> </goals> </execution> </executions> -->
       </plugin>
       <!-- -->
       <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-project-info-reports-plugin</artifactId>
-        <version>2.8</version>
+	    <groupId>org.apache.maven.plugins</groupId>
+	    <artifactId>maven-project-info-reports-plugin</artifactId>
+	    <version>3.1.2</version>
         <configuration>
           <!-- when the dependencyLocations option is enabled maven will 
             determine if resources are located within a given repository. If that repository 
@@ -585,7 +537,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-changes-plugin</artifactId>
-        <version>2.3</version>
+        <version>2.12.1</version>
         <configuration>
           <issueLinkTemplatePerSystem>
             <default>%URL%/ticket/%ISSUE%</default>
@@ -611,25 +563,23 @@
     <site>
       <id>cybertaxonomy.eu</id>
       <name>CDM Library Website</name>
-      <url>scpexe://cybertaxonomy.eu/var/www/wp5.e-taxonomy.eu/cdmlib/</url>
+      <url>scpexe://cybertaxonomy.org/var/www/wp5.e-taxonomy.eu/cdmlib/</url>
     </site>
     <repository>
       <uniqueVersion>false</uniqueVersion>
       <id>cybertaxonomy.eu</id>
       <name>Edit Maven Repository</name>
-      <url>scpexe://cybertaxonomy.eu/var/www/wp5.e-taxonomy.eu/mavenrepo/</url>
+      <url>scpexe://cybertaxonomy.org/var/www/wp5.e-taxonomy.eu/mavenrepo/</url>
       <layout>default</layout>
     </repository>
   </distributionManagement>
   <!-- **** DEPENDENCIES **** -->
   <dependencies>
     <dependency>
+      <!-- junit is required for all module tests, also those not depending on cdmlib-test, so it is added here on parent level with test scope -->
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>log4j</groupId>
-      <artifactId>log4j</artifactId>
+      <scope>test</scope>
     </dependency>
   </dependencies>
   <dependencyManagement>
@@ -644,6 +594,11 @@
         <artifactId>cdmlib-model</artifactId>
         <version>${project.version}</version>
       </dependency>
+      <dependency>
+        <groupId>eu.etaxonomy</groupId>
+        <artifactId>cdmlib-api</artifactId>
+        <version>${project.version}</version>
+      </dependency>
       <dependency>
         <groupId>eu.etaxonomy</groupId>
         <artifactId>cdmlib-persistence</artifactId>
@@ -687,11 +642,17 @@
       
       <!--*********** JAXB********* -->
       <dependency>
-        <groupId>javax.xml.bind</groupId>
-        <artifactId>jaxb-api</artifactId>
-        <version>2.3.1</version>
-        <!-- checked 2020-08 -->
+        <groupId>jakarta.xml.bind</groupId>
+        <artifactId>jakarta.xml.bind-api</artifactId>
+        <version>${jaxb.version}</version>  <!-- not sure if jaxb.version is always the same -->
       </dependency>
+<!--       <dependency> -->
+<!--         replaced by jakarta.xml.bind-api -->
+<!--         <groupId>javax.xml.bind</groupId> -->
+<!--         <artifactId>jaxb-api</artifactId> -->
+<!--         <version>2.3.1</version> -->
+<!--         checked 2020-08 -->
+<!--       </dependency> -->
       <dependency>
          <!-- dependency for jaxb-api -->
          <groupId>javax.activation</groupId>
@@ -721,14 +682,14 @@
           <artifactId>jakarta.activation-api</artifactId>
           <version>1.2.2</version>
       </dependency>
-      <!--  JAB END -->
+      <!--  JAXB END -->
       
 	  <dependency>
 	    <!-- only for version management org.apache.ant:ant depends in different versions from 
              org.unitils:unitils-easymock:3.4.2 and org.glassfish.jaxb:jaxb-jxc:2.2.11 -->
 	    <groupId>org.apache.ant</groupId>
 	    <artifactId>ant</artifactId>
-	    <version>1.10.8</version>
+	    <version>1.10.12</version>
 	  </dependency>
       <!-- ******* hibernate uses slf4j ******* -->
       <dependency>
@@ -737,21 +698,22 @@
         <version>${slf4j.version}</version>
       </dependency>
       <dependency>
-        <groupId>org.slf4j</groupId>
-        <artifactId>slf4j-log4j12</artifactId>
-        <version>${slf4j.version}</version>
+        <groupId>org.apache.logging.log4j</groupId>
+        <artifactId>log4j-slf4j-impl</artifactId>
+        <version>${log4j.version}</version>
       </dependency>
-	  <dependency>
-        <!-- try to generally exclude -nop as we try to use log4j12, this is done already for unitils -->
+      <!-- dozer depends on jcl-over-slf4j -->
+      <dependency>
         <groupId>org.slf4j</groupId>
-        <artifactId>slf4j-nop</artifactId>
+        <artifactId>jcl-over-slf4j</artifactId>
         <version>${slf4j.version}</version>
       </dependency>
+      
       <!-- ******* testing ******* -->
       <dependency>
         <groupId>junit</groupId>
         <artifactId>junit</artifactId>
-        <version>4.13</version>
+        <version>4.13.2</version>
         <scope>test</scope>
       </dependency>
       <dependency>
@@ -766,12 +728,19 @@
         <version>${unitils.version}</version>
         <!-- <scope>test</scope> unscoped since we need this dependency at 
           compile time in persistence for H2DbSupport.java -->
+        <exclusions>
+          <exclusion>
+            <!-- we use jcl-over-slf4j instead -->
+            <groupId>commons-logging</groupId>
+            <artifactId>commons-logging</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>org.unitils</groupId>
         <artifactId>unitils-database</artifactId>
         <version>${unitils.version}</version>
-     <!--    <scope>test</scope>  -->
+        <scope>test</scope>
         <exclusions>
           <exclusion>
             <groupId>org.springframework</groupId>
@@ -790,11 +759,17 @@
             <artifactId>hibernate</artifactId>
           </exclusion>
           <exclusion>
+            <!-- we use log4j-slf4j-impl -->
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-nop</artifactId>
           </exclusion>
         </exclusions>
       </dependency>
+      <dependency>
+        <groupId>org.objenesis</groupId>
+        <artifactId>objenesis</artifactId>
+        <version>3.2</version>
+      </dependency>
       <dependency>
         <groupId>org.unitils</groupId>
         <artifactId>unitils-dbunit</artifactId>
@@ -853,19 +828,40 @@
         higher number needed for compatibility with current hibernate and Java 1.6 
         PreparedStatement -->
       <dependency>
+        <!-- currently still needed by cdmlib-persistence, once removed, scope should be set to test -->
         <groupId>commons-dbcp</groupId>
         <artifactId>commons-dbcp</artifactId>
         <version>1.4</version>
         <!-- <scope>test</scope> -->
+      </dependency>
+      <dependency>
+        <!-- currently still needed by cdmlib-persistence commons-dbcp dependency, once removed, scope should be set to test -->
+        <groupId>commons-pool</groupId>
+        <artifactId>commons-pool</artifactId>
+        <version>1.6</version>
+        <!-- <scope>test</scope> -->
       </dependency>
 	  <dependency>
 		<groupId>eu.etaxonomy</groupId>
 		<artifactId>cdmlib-test</artifactId>
-     <!--    <scope>test</scope>  -->
+        <scope>test</scope>
 		<version>${project.version}</version>
 	  </dependency>
+      <dependency>
+        <!-- used in cdmlib-services for the EmailSendTest -->
+        <groupId>org.subethamail</groupId>
+        <artifactId>subethasmtp</artifactId>
+        <version>3.1.7</version>
+        <scope>test</scope>
+      </dependency>
+      <dependency>
+        <groupId>javax.activation</groupId>
+        <artifactId>activation</artifactId>
+        <version>1.1.1</version>
+      </dependency>
       <!-- ******* aspect ******* -->
       <dependency>
+        <!-- not really needed as long as aspectjweaver is on classpath which is a superset of aspectjrt -->
         <groupId>org.aspectj</groupId>
         <artifactId>aspectjrt</artifactId>
         <version>${aspectj.version}</version>
@@ -884,10 +880,22 @@
       </dependency>
       
       <dependency>
+        <!-- should not be in use anymore -->
         <groupId>log4j</groupId>
         <artifactId>log4j</artifactId>
         <version>1.2.17</version>
       </dependency>
+      <dependency>
+        <groupId>org.apache.logging.log4j</groupId>
+        <artifactId>log4j-core</artifactId>
+        <version>${log4j.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.logging.log4j</groupId>
+        <artifactId>log4j-api</artifactId>
+        <version>${log4j.version}</version>
+      </dependency>
+      
       <dependency>
         <groupId>net.sf.opencsv</groupId>
         <artifactId>opencsv</artifactId>
@@ -896,8 +904,15 @@
       <dependency>
         <groupId>org.osgi</groupId>
         <artifactId>osgi.core</artifactId>
-        <version>7.0.0</version>
+        <version>8.0.0</version>
       </dependency>
+      <dependency>
+		 <groupId>org.osgi</groupId>
+		 <!-- for those dependencies linking to the old structure 
+			TODO better use exclusion but need to check if this is possible here -->
+         <artifactId>org.osgi.core</artifactId>
+		 <version>6.0.0</version>
+	  </dependency>
       <dependency>
         <groupId>cglib</groupId>
         <artifactId>cglib-nodep</artifactId>
@@ -918,7 +933,7 @@
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-lang3</artifactId>
-        <version>3.11</version>
+        <version>3.12.0</version>
       </dependency>
       <dependency>
         <groupId>commons-collections</groupId>
@@ -929,42 +944,39 @@
         <groupId>org.apache.httpcomponents</groupId>
         <artifactId>httpclient</artifactId>
         <version>${httpcomponents.version}</version>
+        <exclusions>
+          <exclusion>
+            <!-- we use jcl-over-slf4j instead -->
+            <groupId>commons-logging</groupId>
+            <artifactId>commons-logging</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>org.apache.httpcomponents</groupId>
         <artifactId>httpcore</artifactId>
-        <version>4.4.13</version>
+        <!-- Note: version differs from default httpcomponents version -->
+        <version>4.4.15</version>
       </dependency>
       <dependency>
         <groupId>commons-io</groupId>
         <artifactId>commons-io</artifactId>
-        <version>2.7</version>
+        <version>2.11.0</version>
       </dependency>
       <dependency>
           <groupId>org.apache.commons</groupId>
           <artifactId>commons-compress</artifactId>
-          <version>1.20</version>
+          <version>1.21</version>
       </dependency>
       <dependency>
           <groupId>org.checkerframework</groupId>
           <artifactId>checker-qual</artifactId>
-          <version>3.6.0</version>
+          <version>3.21.1</version>
       </dependency>
-      <!-- only for version management, poi currently requires 1.6, commons-logging 
-        1.1.1 requires 1.6, so we update here to the latest version -->
       <dependency>
         <groupId>commons-codec</groupId>
         <artifactId>commons-codec</artifactId>
-        <version>1.14</version>
-      </dependency>
-      <!-- only for version management, httpcore:4.2.4, commons-beanutils:1.8.3, 
-        commons-collections:3.2.1 currently require 1.1.1 , httpclient:4.2.3, spring-modules-cache 
-        require 1.1 and batik-ext requires 1.0.4, so we update here to the latest 
-        version 1.1.2, poi and springframework require 1.1.3 -->
-      <dependency>
-        <groupId>commons-logging</groupId>
-        <artifactId>commons-logging</artifactId>
-        <version>${commons-logging.version}</version>
+        <version>1.15</version>
       </dependency>
       <!-- only for version management, hibernate-commons-annotations:4.0.1.Final 
         requires 3.1.0.CR2 , so we update 
@@ -972,15 +984,26 @@
       <dependency>
         <groupId>org.jboss.logging</groupId>
         <artifactId>jboss-logging</artifactId>
-        <version>3.4.1.Final</version>
-        <!-- checked 2020-08 -->
+        <!-- v3.5.0.Final requires java11 -->
+        <version>3.4.3.Final</version>
+        <!-- checked 2022-05 -->
       </dependency>
 	  <dependency>
-	    <!-- since hibernate 5.0.4 Dialect throws exception if jta is missing  -->
-        <groupId>javax.transaction</groupId>
-        <artifactId>jta</artifactId>
-        <version>1.1</version>
-      </dependency>  
+	      <groupId>org.jboss.logging</groupId>
+	      <artifactId>jboss-logging-annotations</artifactId>
+	      <version>2.2.1.Final</version>
+	  </dependency>
+	  <dependency>
+        <groupId>org.jboss.logging</groupId>
+        <artifactId>jboss-logging-processor</artifactId>
+        <version>2.2.1.Final</version>
+      </dependency>
+<!-- 	  <dependency> -->
+<!-- 	    see note in cdmib-persistence pom  -->
+<!--         <groupId>javax.transaction</groupId> -->
+<!--         <artifactId>jta</artifactId> -->
+<!--         <version>1.1</version> -->
+<!--       </dependency>   -->
 		
       <!-- TODO xerces xmlParserAPIs duplicates many classes from jre and 
         xml-apis. It is a dependency that comes with xom:xom -->
@@ -999,12 +1022,27 @@
         <groupId>commons-beanutils</groupId>
         <artifactId>commons-beanutils</artifactId>
         <version>1.9.4</version>
+        <exclusions>
+          <exclusion>
+            <!-- we use jcl-over-slf4j instead -->
+            <groupId>commons-logging</groupId>
+            <artifactId>commons-logging</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>net.sf.json-lib</groupId>
         <artifactId>json-lib</artifactId>
         <version>2.4</version>
+        <!-- classifier required as json-lib exists on maven central as json-lib-2.4-jdk15.jar and xxx-jdk13.jar, see #9887 -->
         <classifier>jdk15</classifier>
+        <exclusions>
+          <exclusion>
+            <!-- we use jcl-over-slf4j instead -->
+            <groupId>commons-logging</groupId>
+            <artifactId>commons-logging</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <!-- media  -->
       <dependency>
@@ -1015,16 +1053,18 @@
        <dependency>
         <groupId>de.digitalcollections.iiif</groupId>
         <artifactId>iiif-apis</artifactId>
-        <version>0.3.8</version>
+        <version>0.3.9</version>
       </dependency>
-<!--       <dependency> -->
-<!--         only for version management iterators depends in different versions from -->
-<!--               de.digitalcollections.iiif:iiif-apis:0.3.7 -->
-<!--       	<groupId>org.dmfs</groupId> -->
-<!--       	<artifactId>iterators</artifactId> -->
-<!--       	<version>1.5</version> -->
-<!--       </dependency> -->
-      <!--         -->
+      <dependency>
+        <groupId>com.fasterxml.jackson.datatype</groupId>
+        <artifactId>jackson-datatype-jsr310</artifactId>
+        <version>${jackson.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>com.fasterxml.jackson.module</groupId>
+        <artifactId>jackson-module-parameter-names</artifactId>
+        <version>${jackson.version}</version>
+    </dependency>
       <dependency>
         <groupId>org.apache.poi</groupId>
         <artifactId>poi</artifactId>
@@ -1032,18 +1072,29 @@
       </dependency>
       <dependency>
         <groupId>org.apache.poi</groupId>
-        <artifactId>poi-ooxml-schemas</artifactId>
+        <artifactId>poi-ooxml</artifactId>
         <version>${poi.version}</version>
       </dependency>
       <dependency>
         <groupId>org.apache.poi</groupId>
-        <artifactId>poi-ooxml</artifactId>
+        <artifactId>poi-ooxml-lite</artifactId>
         <version>${poi.version}</version>
       </dependency>
       <dependency>
         <groupId>org.apache.poi</groupId>
-        <artifactId>ooxml-schemas</artifactId>
-        <version>1.4</version>
+        <artifactId>poi-ooxml-full</artifactId>
+        <version>${poi.version}</version>
+      </dependency>
+      <dependency>
+        <!-- indirect poi-schema and doxia dependency -->
+        <groupId>org.codehaus.plexus</groupId>
+        <artifactId>plexus-classworlds</artifactId>
+        <version>2.6.0</version>
+      </dependency>
+      <dependency>
+        <groupId>org.codehaus.plexus</groupId>
+        <artifactId>plexus-component-annotations</artifactId>
+        <version>2.1.1</version>
       </dependency>
       <!--       <dependency> -->
 <!-- maybe needed in cdmlib-io, see https://poi.apache.org/help/faq.html  question 3 on when to use ooxml-schemas and when poi-ooxml-schemas  -->
@@ -1052,24 +1103,21 @@
 <!--         <version>1.4</version> -->
 <!--       </dependency> -->
       <dependency>
-     	<!-- only for version management xmlbeans depends in different versions from 
-        org.apache.poi:poi-ooxml-schemas:3.13 and org.apache.poi:ooxml-schemas:1.4 -->
       	<groupId>org.apache.xmlbeans</groupId>
       	<artifactId>xmlbeans</artifactId>
-      	<version>3.1.0</version>
+      	<version>5.0.3</version>
         <!-- checked 2020-08 -->
       </dependency>
       <dependency>
         <groupId>org.docx4j</groupId>
-        <artifactId>docx4j</artifactId>
-        <version>6.1.2</version>
+        <artifactId>docx4j-JAXB-Internal</artifactId>
+        <version>8.3.7</version>
       </dependency>
       <dependency>
-        <!-- only for version management jcl-over-slf4j depends in different versions from 
-        org.docx4j:docx4j:6.0.1 and org.apache.jena:jjena-tdb:1.1.2 -->
-        <groupId>org.slf4j</groupId>
-        <artifactId>jcl-over-slf4j</artifactId>
-        <version>1.7.25</version>
+        <!-- dependency of guava and docx4j -->
+        <groupId>com.google.errorprone</groupId>
+        <artifactId>error_prone_annotations</artifactId>
+        <version>2.14.0</version>
       </dependency>
       <dependency>
         <!-- only for version management xalan depends in different versions from 
@@ -1083,25 +1131,36 @@
         org.docx4j:docx4j:6.0.1 and org.apache.xmlgraphics:fop:1.1 -->
       	<groupId>org.apache.xmlgraphics</groupId>
       	<artifactId>xmlgraphics-commons</artifactId>
-      	<version>2.4</version>
+      	<version>2.7</version>
       </dependency>
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-imaging</artifactId>
-        <version>1.0-alpha2</version>
+        <version>1.0-alpha3</version>
+      </dependency>
+      <dependency>
+        <groupId>org.cybertaxonomy.media</groupId>
+        <artifactId>media-info-model</artifactId>
+        <version>1.2.0</version>
       </dependency>
       <!-- joda-time -->
       <dependency>
         <groupId>joda-time</groupId>
         <artifactId>joda-time</artifactId>
-        <version>2.10.6</version>
+        <version>2.10.14</version>
       </dependency>
-	  <!-- maybe replaced by usertype.core -->
       <dependency>
         <groupId>org.jadira.usertype</groupId>
-        <artifactId>usertype.jodatime</artifactId>
-        <version>2.0.1</version>
+        <artifactId>usertype.core</artifactId>
+        <version>7.0.0.CR1</version>
       </dependency>
+      <!-- dependency of jadira usertype -->
+      <dependency>
+        <groupId>javax.enterprise</groupId>
+        <artifactId>cdi-api</artifactId>
+        <version>2.0.SP1</version>
+      </dependency>
+
       <dependency>
         <groupId>org.apache.lucene</groupId>
         <artifactId>lucene-core</artifactId>
@@ -1152,6 +1211,11 @@
         <artifactId>lucene-facet</artifactId>
         <version>${lucene.version}</version>
       </dependency>
+      <dependency>
+        <groupId>org.apache.lucene</groupId>
+        <artifactId>lucene-sandbox</artifactId>
+        <version>${lucene.version}</version>
+      </dependency>
             
       <dependency>
         <groupId>com.ibm.lsid</groupId>
@@ -1168,10 +1232,20 @@
         <artifactId>wsdl4j</artifactId>
         <version>1.6.3</version>
       </dependency>
+<!--       <dependency> -->
+<!--         <groupId>net.sf.dozer</groupId> -->
+<!--         <artifactId>dozer</artifactId> -->
+<!--         <version>5.5.1</version> -->
+<!--       </dependency> -->
       <dependency>
-        <groupId>net.sf.dozer</groupId>
-        <artifactId>dozer</artifactId>
-        <version>5.3.0</version>
+          <groupId>com.github.dozermapper</groupId>
+          <artifactId>dozer-core</artifactId>
+          <version>${dozer.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>com.github.dozermapper</groupId>
+        <artifactId>dozer-spring4</artifactId>
+        <version>${dozer.version}</version>
       </dependency>
       <dependency>
         <groupId>net.sf.ehcache</groupId>
@@ -1180,32 +1254,31 @@
       </dependency>
       <!-- ******* XML ******* -->
       <dependency>
+<!--        xml-apis seems to be ALMOST fully included in java8 but ElementTraversal seems to be missing, therefore SDDDocumentBuilder does not compile -->
         <groupId>xml-apis</groupId>
         <artifactId>xml-apis</artifactId>
-        <!-- 
-            WARNING: do not upgrade to later versions 2.0.x of xml-apis
-            since these are effectivly reloaded to the early beta version
-            1.0.b2
-        -->
+<!--             WARNING: do not upgrade to later versions 2.0.x of xml-apis -->
+<!--             since these are effectivly reloaded to the early beta version -->
+<!--             1.0.b2 -->
         <version>1.4.01</version>
       </dependency>
       <dependency>
         <groupId>xerces</groupId>
         <artifactId>xercesImpl</artifactId>
-        <version>2.12.0</version>
-        <!-- checked 2020-08 -->
+        <version>2.12.2</version>
+        <!-- checked 2022-06 -->
       </dependency>
-      <!-- >batik-ext required by Xerces 2.11.0 for class ElementTraversal, 
-        as this is not included anymore in xml-apis 2.x -->
-<!--       <dependency> -->
-<!--         <groupId>org.apache.xmlgraphics</groupId> -->
-<!--         <artifactId>batik-ext</artifactId> -->
-<!--         <version>1.13</version> -->
-<!--       </dependency> -->
       <dependency> <!-- required by cdmlib-print -->
         <groupId>org.apache.xmlgraphics</groupId>
         <artifactId>fop</artifactId>
-        <version>2.5</version>
+        <version>2.7</version>
+        <exclusions>
+          <exclusion>
+            <!-- we use jcl-over-slf4j instead -->
+            <groupId>commons-logging</groupId>
+            <artifactId>commons-logging</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>org.odftoolkit</groupId>
@@ -1216,8 +1289,13 @@
           <!-- used in eu.etaxonomy.cdm.io.markup and for swagger -->
           <groupId>com.google.guava</groupId>
           <artifactId>guava</artifactId>
-          <version>29.0-jre</version>
+          <version>31.1-jre</version>
       </dependency>
+	  <dependency>
+	      <groupId>com.google.code.findbugs</groupId>
+	      <artifactId>jsr305</artifactId>
+	      <version>3.0.2</version>
+	  </dependency>
       <!-- last jdom 1.x version -->
 	  <dependency>
         <groupId>org.jdom</groupId>
@@ -1233,30 +1311,27 @@
       <dependency>
         <groupId>com.thoughtworks.xstream</groupId>
         <artifactId>xstream</artifactId>
-        <version>1.4.12</version>
-      </dependency>
-      <dependency>
-      <groupId>xmlpull</groupId>
-        <artifactId>xmlpull</artifactId>
-        <version>1.2.0</version>
+        <version>1.4.19</version>
       </dependency>
       <dependency>
+        <!-- newer version exists for groupId org.ogce, need to check exclusions before moving -->
         <groupId>xpp3</groupId>
         <artifactId>xpp3</artifactId>
         <version>1.1.4c</version>
       </dependency>
-      <dependency>
-        <groupId>stax</groupId>
-        <artifactId>stax</artifactId>
-        <version>1.2.0</version>
-      </dependency>
+<!--       <dependency> -->
+<!--        stax is part of java8 and therefore not needed anymore -->
+<!--         <groupId>stax</groupId> -->
+<!--         <artifactId>stax</artifactId> -->
+<!--         <version>1.2.0</version> -->
+<!--       </dependency> -->
       <dependency>
         <groupId>xom</groupId>
         <artifactId>xom</artifactId>
-        <version>1.3.5</version>
+        <version>1.3.7</version>
         <exclusions>
           <!-- need to exclude com.ibm.icu:icu4j since it contains an invalid 
-            file which causes the jetty-maven-plugin to fail see http://stackoverflow.com/questions/3026956/javassist-failure-in-hibernate-invalid-constant-type-60 -->
+            file which causes the jetty-maven-plugin to fail see https://stackoverflow.com/questions/3026956/javassist-failure-in-hibernate-invalid-constant-type-60 -->
           <exclusion>
             <groupId>com.ibm.icu</groupId>
             <artifactId>icu4j</artifactId>
@@ -1267,7 +1342,7 @@
       <dependency>
         <groupId>net.sf.saxon</groupId>
         <artifactId>Saxon-HE</artifactId>
-        <version>10.1</version>
+        <version>11.3</version>
       </dependency>
       <!-- ******* http components (ViBRANT)******* -->
       <dependency>
@@ -1279,7 +1354,7 @@
       <dependency>
         <groupId>org.json</groupId>
         <artifactId>json</artifactId>
-        <version>20200518</version>
+        <version>20220320</version>
       </dependency>
       <!-- ******* HIBERNATE / EJB3 ******* -->
       <dependency>
@@ -1292,11 +1367,6 @@
         <artifactId>hibernate-core</artifactId>
         <version>${hibernate.version}</version>
       </dependency>
-      <dependency>
-        <groupId>org.hibernate</groupId>
-        <artifactId>hibernate-entitymanager</artifactId>
-        <version>${hibernate.version}</version>
-      </dependency>
       <dependency>
         <groupId>org.hibernate</groupId>
         <artifactId>hibernate-envers</artifactId>
@@ -1321,10 +1391,16 @@
         -->
         <version>0.9.5.2</version>
       </dependency>
+      <dependency>
+        <groupId>com.mchange</groupId>
+        <artifactId>mchange-commons-java</artifactId>
+        <!-- mchange-commons-java needs to match the version as defined in the c3p0/pom.xml -->
+        <version>0.2.11</version>
+      </dependency>
       <dependency>
         <groupId>org.hibernate.common</groupId>
         <artifactId>hibernate-commons-annotations</artifactId>
-        <version>5.1.0.Final</version>
+        <version>5.1.2.Final</version>
       </dependency>
       <dependency>
         <groupId>org.hibernate</groupId>
@@ -1336,10 +1412,24 @@
         <artifactId>hibernate-search-engine</artifactId>
         <version>${hibernate-search.version}</version>
       </dependency>
+
+      <dependency>
+        <!-- used by hibernate as bytecode provider framework -->
+        <groupId>net.bytebuddy</groupId>
+        <artifactId>byte-buddy</artifactId>
+        <version>1.12.10</version>
+      </dependency>
+      <!-- dependency of hibernate-core -->
+      <dependency>
+        <groupId>org.jboss.spec.javax.transaction</groupId>
+        <artifactId>jboss-transaction-api_1.2_spec</artifactId>
+        <version>1.1.1.Final</version>
+      </dependency>
       <dependency>
+        <!-- dependency of iiif-apis (and still by hibernate but will be removed in v5.6 as hibernate uses bytebuddy)  -->
         <groupId>org.javassist</groupId>
         <artifactId>javassist</artifactId>
-        <version>3.27.0-GA</version>
+        <version>3.29.0-GA</version>
       </dependency>
 
       <!-- ******* SPRING ******* -->
@@ -1347,6 +1437,12 @@
         <groupId>org.springframework</groupId>
         <artifactId>spring-core</artifactId>
         <version>${spring.version}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>commons-logging</groupId>
+            <artifactId>commons-logging</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>org.springframework</groupId>
@@ -1452,6 +1548,14 @@
         <version>4.0.1</version>
         <!-- checked 2020-08 -->
       </dependency>
+      <dependency>
+          <!-- management needed for some older dependencies -->
+          <!-- TODO check if possible to use exclusions -->
+          <groupId>javax.servlet</groupId>
+          <artifactId>servlet-api</artifactId>
+          <version>2.5</version>
+      </dependency>
+
 
       <!-- yourkit profiler api controller (used in ..) -->
       <dependency>
@@ -1487,8 +1591,8 @@
       <dependency>
           <groupId>jakarta.validation</groupId>
           <artifactId>jakarta.validation-api</artifactId>
-          <version>3.0.0</version>
-          <!-- checked 2020-08 -->
+          <version>3.0.2</version>
+          <!-- checked 2022-06 -->
       </dependency>
 	  <dependency>
 		 <groupId>org.glassfish.web</groupId>
@@ -1517,7 +1621,7 @@
       <dependency>
         <groupId>com.itextpdf</groupId>
         <artifactId>itextpdf</artifactId>
-        <version>5.5.13.1</version>
+        <version>5.5.13.3</version>
         <scope>compile</scope>
       </dependency>
       <!-- AptView -->
@@ -1535,8 +1639,8 @@
         <!-- managing version of plexus-utils to avoid multiple versions (3.0.15, 1.4.5) of the artifact -->
       	<groupId>org.codehaus.plexus</groupId>
       	<artifactId>plexus-utils</artifactId>
-      	<version>3.3.0</version>
-        <!-- checked 2020-08 -->
+      	<version>3.4.2</version>
+        <!-- checked 2022-06 -->
       </dependency>
       <!-- swagger (rest service doc) -->
       <dependency>
@@ -1573,17 +1677,17 @@
       <dependency>
         <groupId>mysql</groupId>
         <artifactId>mysql-connector-java</artifactId>
-        <version>8.0.21</version>
+        <version>8.0.29</version>
       </dependency>
       <dependency>
         <groupId>org.mariadb.jdbc</groupId>
         <artifactId>mariadb-java-client</artifactId>
-        <version>2.6.2</version>
+        <version>3.0.6</version>
       </dependency>
       <dependency>
          <groupId>org.postgresql</groupId>
          <artifactId>postgresql</artifactId>
-         <version>42.2.15</version>
+         <version>42.5.1</version>
       </dependency>
 	  <dependency>
         <groupId>com.h2database</groupId>
@@ -1594,12 +1698,7 @@
       <dependency>
         <groupId>com.microsoft.sqlserver</groupId>
         <artifactId>mssql-jdbc</artifactId>
-        <version>8.4.1.jre8</version>
-      </dependency>
-	  <dependency>
-        <groupId>org.hsqldb</groupId>
-        <artifactId>hsqldb</artifactId>
-        <version>${hsqldb.version}</version>
+        <version>9.4.1.jre8</version>
       </dependency>
       <dependency>
         <!-- SQL Server and Sybase -->
@@ -1617,11 +1716,6 @@
         <artifactId>ojdbc</artifactId>
         <version>14</version>
         </dependency>   -->      
-      <dependency>
-        <groupId>com.taskadapter</groupId>
-        <artifactId>redmine-java-api</artifactId>
-        <version>3.1.0</version>
-      </dependency>
       <!-- GIS/KML -->
 	  <dependency>
 	     <groupId>de.micromata.jak</groupId>
@@ -1654,6 +1748,23 @@
          <artifactId>tools</artifactId>
          <version>1.8.0</version>
       </dependency>
+      <dependency>
+        <!-- Email functionality (used in cdmlib-services) -->
+          <groupId>com.sun.mail</groupId>
+          <artifactId>javax.mail</artifactId>
+          <version>${jakarta.mail.version}</version>
+      </dependency>
+      <dependency>
+        <!-- only needed for PasswordResetService, may be replaced by Thymeleaf, but also needed in TaxEditor cdmlib modul -->
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-text</artifactId>
+        <version>1.10.0</version>
+      </dependency>
+      <dependency>
+        <groupId>org.passay</groupId>
+        <artifactId>passay</artifactId>
+        <version>1.6.1</version>
+      </dependency>
    </dependencies>    
   </dependencyManagement>
 </project>