diff --git a/core/pom.xml b/core/pom.xml
index ea03f52b6b1..a32e3d1b623 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -29,7 +29,7 @@
     <licenses>
         <license>
             <name>The Apache Software License, Version 2.0</name>
-            <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
+            <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
             <distribution>repo</distribution>
             <comments>A business-friendly OSS license</comments>
         </license>
@@ -47,7 +47,7 @@
         <dependency>
             <groupId>org.codehaus.janino</groupId>
             <artifactId>janino</artifactId>
-            <version>3.1.2</version>
+            <version>3.1.6</version>
         </dependency>
         <dependency>
             <groupId>org.locationtech.jts</groupId>
@@ -73,14 +73,12 @@
         <dependency>
             <groupId>ch.poole</groupId>
             <artifactId>ConditionalRestrictionParser</artifactId>
-            <!-- TODO ORS: where is this defined? <version>${crparser.version}</version> -->
-            <version>0.3.1</version>
+            <version>0.3.4</version>
         </dependency>
         <dependency>
             <groupId>ch.poole</groupId>
             <artifactId>OpeningHoursParser</artifactId>
-            <!-- TODO ORS: where is this defined? <version>${ohparser.version}</version> -->
-            <version>0.25.0</version>
+            <version>0.28.1</version>
         </dependency>
 
         <!-- for using CGIAR: elevation data importing via tif files-->
@@ -124,13 +122,12 @@
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j</artifactId>
             <type>pom</type>
-            <version>2.17.1</version>
+            <version>2.20.0</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-compress</artifactId>
-            <version>1.23.0</version>
         </dependency>
         <!--   was included in old dropwizard dependency. Not anymore in 4+. Until tests are migrated to junit 5 it needs this package.   -->
         <dependency>
diff --git a/hmm-lib/pom.xml b/hmm-lib/pom.xml
index 54c1fc0ba1c..70d9f09a790 100644
--- a/hmm-lib/pom.xml
+++ b/hmm-lib/pom.xml
@@ -35,14 +35,14 @@
     <developers>
         <developer>
             <organization>BMW Car IT GmbH, BMW AG</organization>
-            <organizationUrl>http://www.bmw-carit.com, http://www.bmw.com</organizationUrl>
+            <organizationUrl>https://www.bmw-carit.com, https://www.bmw.com</organizationUrl>
         </developer>
     </developers>
 
     <licenses>
         <license>
             <name>Apache License, Version 2.0</name>
-            <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
+            <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
             <distribution>repo</distribution>
         </license>
     </licenses>
diff --git a/pom.xml b/pom.xml
index a0d5bc24b15..0a979b0f392 100644
--- a/pom.xml
+++ b/pom.xml
@@ -36,13 +36,6 @@
         <org-netbeans-modules-editor-indent.text.x-java.CodeStyle.project.alignMultilineTryResources>true</org-netbeans-modules-editor-indent.text.x-java.CodeStyle.project.alignMultilineTryResources>
     </properties>
 
-    <!-- ORS: remove? repositories>
-        <repository><id>simonpoole</id>
-            <name>OpeningHoursParser Repository</name>
-            <url>https://dl.bintray.com/simonpoole/osm</url>
-        </repository>
-    </repositories-->
-
     <scm>
         <connection>scm:git:git@github.com:graphhopper/graphhopper.git</connection>
         <developerConnection>scm:git:git@github.com:graphhopper/graphhopper.git</developerConnection>
@@ -52,7 +45,7 @@
     <licenses>
         <license>
             <name>Apache License, Version 2.0</name>
-            <url>http://www.apache.org/licenses/LICENSE-2.0</url>
+            <url>https://www.apache.org/licenses/LICENSE-2.0</url>
         </license>
     </licenses>
 
@@ -97,7 +90,7 @@
             <dependency>
                 <groupId>io.dropwizard</groupId>
                 <artifactId>dropwizard-dependencies</artifactId>
-                <version>2.0.21</version>
+                <version>4.0.5</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
@@ -130,7 +123,7 @@
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-compress</artifactId>
-                <version>1.21</version>
+                <version>1.25.0</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.logging.log4j</groupId>