diff --git a/pom.xml b/pom.xml
index 85ab0c8..7b97799 100644
--- a/pom.xml
+++ b/pom.xml
@@ -18,25 +18,25 @@
 -->
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
   <modelVersion>4.0.0</modelVersion>
-  
+
   <parent>
     <groupId>org.commonjava</groupId>
     <artifactId>commonjava</artifactId>
-    <version>18</version>
+    <version>21</version>
   </parent>
-  
+
   <groupId>org.commonjava.boms</groupId>
   <artifactId>web-commons-bom</artifactId>
   <version>30-SNAPSHOT</version>
-  
+
   <packaging>pom</packaging>
-  
+
   <name>Web Commons (BOM)</name>
   <description>List of common dependencies used in web applications.</description>
-  
+
   <url>https://github.com/Commonjava/web-commons-bom</url>
   <inceptionYear>2012-2024</inceptionYear>
-  
+
   <developers>
     <developer>
       <id>jdcasey</id>
@@ -44,34 +44,35 @@
       <name>John Casey</name>
     </developer>
   </developers>
-  
+
   <scm>
     <connection>scm:git:https://github.com/Commonjava/web-commons-bom</connection>
     <developerConnection>scm:git:https://github.com/Commonjava/web-commons-bom</developerConnection>
     <url>https://github.com/Commonjava/web-commons-bom</url>
     <tag>HEAD</tag>
   </scm>
-  
+
   <properties>
     <projectOwner>Red Hat, Inc.</projectOwner>
     <projectEmail>https://github.com/Commonjava/web-commons-bom</projectEmail>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-    <slf4j-version>2.0.7</slf4j-version>
+    <slf4j-version>2.0.17</slf4j-version>
     <weft-version>1.22</weft-version>
     <webdav-version>3.2.0</webdav-version>
-    <jackson-version>2.15.2</jackson-version>
-    <httpcoreVersion>4.4.15</httpcoreVersion>
-    <httpclientVersion>4.5.13</httpclientVersion>
+    <!-- Note jackson-core/databind was published as 2.20.0 but annotations was 2.20 -->
+    <jackson-version>2.20</jackson-version>
+    <httpcoreVersion>4.4.16</httpcoreVersion>
+    <httpclientVersion>4.5.14</httpclientVersion>
     <resteasy-version>3.0.12.Final</resteasy-version>
     <jaxrs-version>3.0.12.Final</jaxrs-version>
     <weld-version>3.1.9.Final</weld-version>
     <cdi-version>2.0</cdi-version>
-    <logback-version>1.5.13</logback-version>
+    <logback-version>1.5.19</logback-version>
     <enforceBestPractices>false</enforceBestPractices>
     <enforceStandards>false</enforceStandards>
     <enforceVersions>false</enforceVersions>
   </properties>
-  
+
   <dependencyManagement>
     <dependencies>
       <dependency>
@@ -79,7 +80,7 @@
         <artifactId>weft</artifactId>
         <version>${weft-version}</version>
       </dependency>
-      
+
       <dependency>
         <groupId>org.commonjava.web</groupId>
         <artifactId>webdav-handler-common</artifactId>
@@ -95,21 +96,16 @@
         <artifactId>webdav-handler-servlet</artifactId>
         <version>${webdav-version}</version>
       </dependency>
-      
-      <dependency>
-        <groupId>commons-lang</groupId>
-        <artifactId>commons-lang</artifactId>
-        <version>2.6</version>
-      </dependency>
+
       <dependency>
         <groupId>commons-io</groupId>
         <artifactId>commons-io</artifactId>
-        <version>2.14.0</version>
+        <version>2.20.0</version>
       </dependency>
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-lang3</artifactId>
-        <version>3.12.0</version>
+        <version>3.19.0</version>
       </dependency>
 
       <dependency>
@@ -157,14 +153,14 @@
         <artifactId>logback-classic</artifactId>
         <version>${logback-version}</version>
       </dependency>
-      
+
       <dependency>
         <groupId>args4j</groupId>
         <artifactId>args4j</artifactId>
-        <version>2.0.29</version>
+        <version>2.37</version>
       </dependency>
-      
-      
+
+
       <dependency>
         <groupId>org.jboss.resteasy</groupId>
         <artifactId>jaxrs-api</artifactId>
@@ -208,7 +204,7 @@
       <dependency>
         <groupId>com.google.code.gson</groupId>
         <artifactId>gson</artifactId>
-        <version>2.8.9</version>
+        <version>2.13.2</version>
       </dependency>
       <dependency>
         <groupId>org.apache.httpcomponents</groupId>
@@ -232,19 +228,19 @@
           </exclusion>
         </exclusions>
       </dependency>
-      
+
       <dependency>
         <groupId>com.google.guava</groupId>
         <artifactId>guava</artifactId>
         <version>32.0.0-jre</version>
       </dependency>
-      
+
       <dependency>
         <groupId>commons-codec</groupId>
         <artifactId>commons-codec</artifactId>
-        <version>1.15</version>
+        <version>1.19.0</version>
       </dependency>
-      
+
       <dependency>
         <groupId>org.jboss.weld.se</groupId>
         <artifactId>weld-se-shaded</artifactId>
@@ -283,12 +279,12 @@
       <dependency>
         <groupId>com.fasterxml.jackson.core</groupId>
         <artifactId>jackson-core</artifactId>
-        <version>${jackson-version}</version>
+        <version>${jackson-version}.0</version>
       </dependency>
       <dependency>
         <groupId>com.fasterxml.jackson.core</groupId>
         <artifactId>jackson-databind</artifactId>
-        <version>${jackson-version}</version>
+        <version>${jackson-version}.0</version>
       </dependency>
       <dependency>
         <groupId>com.fasterxml.jackson.core</groupId>
@@ -309,7 +305,7 @@
       </dependency>
     </dependencies>
   </dependencyManagement>
-  
+
   <build>
     <plugins>
       <plugin>