From f6a29564903ac936e8e29ba7101ba5f76af9c589 Mon Sep 17 00:00:00 2001
From: Matthew Trew <matthew.trew@raspberrypi.org>
Date: Mon, 29 Sep 2025 11:22:26 +0100
Subject: [PATCH 1/9] Update swagger, guava, jwks-rsa, geoip

---
 pom.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index e329479f0b..346bd919d2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -31,7 +31,7 @@
         <web.xml.local>web-api-local.xml</web.xml.local>
         <dependency-check.version>12.1.3</dependency-check.version>
         <ossindex.version>3.2.0</ossindex.version>
-        <swagger-core.version>2.2.34</swagger-core.version>
+        <swagger-core.version>2.2.37</swagger-core.version>
         <jgit.version>6.10.1.202505221210-r</jgit.version>
         <surefire.jacoco.args />
         <failsafe.jacoco.args />
@@ -148,7 +148,7 @@
         <dependency>
             <groupId>com.google.guava</groupId>
             <artifactId>guava</artifactId>
-            <version>33.4.8-jre</version>
+            <version>33.5.0-jre</version>
         </dependency>
 
         <dependency>
@@ -235,7 +235,7 @@
         <dependency>
             <groupId>com.auth0</groupId>
             <artifactId>jwks-rsa</artifactId>
-            <version>0.22.2</version>
+            <version>0.23.0</version>
         </dependency>
         <dependency>
             <groupId>org.testcontainers</groupId>
@@ -477,7 +477,7 @@
         <dependency>
             <groupId>com.maxmind.geoip2</groupId>
             <artifactId>geoip2</artifactId>
-            <version>4.3.1</version>
+            <version>4.4.0</version>
         </dependency>
 
         <!-- These two don't need to be included in the war package so their scope is "provided" which means we

From ae798c6980bd33d778de43e2dbcbc4f2abc5d606 Mon Sep 17 00:00:00 2001
From: Matthew Trew <matthew.trew@raspberrypi.org>
Date: Mon, 29 Sep 2025 11:24:00 +0100
Subject: [PATCH 2/9] Update dependency-check

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 346bd919d2..416ca1a0c2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -29,7 +29,7 @@
         <web.xml>web-api-live.xml</web.xml>
         <web.xml.etl>web-etl.xml</web.xml.etl>
         <web.xml.local>web-api-local.xml</web.xml.local>
-        <dependency-check.version>12.1.3</dependency-check.version>
+        <dependency-check.version>12.1.6</dependency-check.version>
         <ossindex.version>3.2.0</ossindex.version>
         <swagger-core.version>2.2.37</swagger-core.version>
         <jgit.version>6.10.1.202505221210-r</jgit.version>

From 80f37d7820fb6e2d22b58cbd04c40f90e1ca3c2e Mon Sep 17 00:00:00 2001
From: Matthew Trew <matthew.trew@raspberrypi.org>
Date: Wed, 1 Oct 2025 09:15:10 +0100
Subject: [PATCH 3/9] Update log4j and swagger

---
 pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index 416ca1a0c2..3fb3b3346b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -11,7 +11,7 @@
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <segue.version>v3.20.6-SNAPSHOT</segue.version>
-        <log4j.version>2.25.1</log4j.version>
+        <log4j.version>2.25.2</log4j.version>
         <resteasy.version>6.2.12.Final</resteasy.version>
         <guice.version>7.0.0</guice.version>
         <oauth-client.version>1.39.0</oauth-client.version>
@@ -31,7 +31,7 @@
         <web.xml.local>web-api-local.xml</web.xml.local>
         <dependency-check.version>12.1.6</dependency-check.version>
         <ossindex.version>3.2.0</ossindex.version>
-        <swagger-core.version>2.2.37</swagger-core.version>
+        <swagger-core.version>2.2.38</swagger-core.version>
         <jgit.version>6.10.1.202505221210-r</jgit.version>
         <surefire.jacoco.args />
         <failsafe.jacoco.args />

From 2c7c0a7d5d9c9a3eccffac3c35f901f74151a438 Mon Sep 17 00:00:00 2001
From: Matthew Trew <matthew.trew@raspberrypi.org>
Date: Wed, 1 Oct 2025 09:19:34 +0100
Subject: [PATCH 4/9] Update lang3, bouncycastle, junit-5

---
 pom.xml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index 3fb3b3346b..f0428873d7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -19,7 +19,7 @@
         <jackson-databind.version>2.19.2</jackson-databind.version>
         <powermock.version>2.0.9</powermock.version>
         <junit-4.version>4.13.2</junit-4.version>
-        <junit-5.version>5.13.4</junit-5.version>
+        <junit-5.version>5.14.0</junit-5.version>
         <swagger-ui-version>4.13.2</swagger-ui-version>
         <prometheus.version>0.16.0</prometheus.version>
         <jetty-version>11.0.25</jetty-version>
@@ -325,7 +325,7 @@
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
-            <version>3.18.0</version>
+            <version>3.19.0</version>
         </dependency>
         <dependency>
             <groupId>org.apache.commons</groupId>
@@ -471,7 +471,7 @@
         <dependency>
             <groupId>org.bouncycastle</groupId>
             <artifactId>bcprov-jdk18on</artifactId>
-            <version>1.81</version>
+            <version>1.82</version>
         </dependency>
 
         <dependency>

From 9bd7f76ceb5a47c3c1835d8e9651242167f5318d Mon Sep 17 00:00:00 2001
From: Matthew Trew <matthew.trew@raspberrypi.org>
Date: Wed, 1 Oct 2025 09:22:28 +0100
Subject: [PATCH 5/9] Update surefire, snakeyaml, assertj, postgres

---
 pom.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index f0428873d7..5b329c0ea2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -52,7 +52,7 @@
         <dependency>
             <groupId>org.yaml</groupId>
             <artifactId>snakeyaml</artifactId>
-            <version>2.4</version>
+            <version>2.5</version>
         </dependency>
         <dependency>
             <groupId>org.isaacphysics.thirdparty</groupId>
@@ -223,7 +223,7 @@
         <dependency>
             <groupId>org.assertj</groupId>
             <artifactId>assertj-core</artifactId>
-            <version>3.27.3</version>
+            <version>3.27.6</version>
             <scope>test</scope>
         </dependency>
 
@@ -382,7 +382,7 @@
         <dependency>
             <groupId>org.postgresql</groupId>
             <artifactId>postgresql</artifactId>
-            <version>42.7.7</version>
+            <version>42.7.8</version>
         </dependency>
 
         <dependency>
@@ -557,7 +557,7 @@
                         See https://maven.apache.org/surefire/maven-surefire-plugin/examples/junit.html#manually-specifying-a-provider -->
                         <groupId>org.apache.maven.surefire</groupId>
                         <artifactId>surefire-junit47</artifactId>
-                        <version>3.5.3</version>
+                        <version>3.5.4</version>
                     </dependency>
                 </dependencies>
                 <configuration>

From 7909bc480432e9d68ad872590a72e1dab9170e4c Mon Sep 17 00:00:00 2001
From: Matthew Trew <matthew.trew@raspberrypi.org>
Date: Wed, 1 Oct 2025 09:30:32 +0100
Subject: [PATCH 6/9] Update resteasy

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 5b329c0ea2..b377cf0b2c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -12,7 +12,7 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <segue.version>v3.20.6-SNAPSHOT</segue.version>
         <log4j.version>2.25.2</log4j.version>
-        <resteasy.version>6.2.12.Final</resteasy.version>
+        <resteasy.version>6.2.14.Final</resteasy.version>
         <guice.version>7.0.0</guice.version>
         <oauth-client.version>1.39.0</oauth-client.version>
         <jackson.version>2.19.2</jackson.version>

From 429b4ffad15982d5a92c2794e4ec8fe35a8e3bd0 Mon Sep 17 00:00:00 2001
From: Matthew Trew <matthew.trew@raspberrypi.org>
Date: Wed, 1 Oct 2025 09:37:39 +0100
Subject: [PATCH 7/9] Update jetty

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index b377cf0b2c..91c4b7b0a0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -22,7 +22,7 @@
         <junit-5.version>5.14.0</junit-5.version>
         <swagger-ui-version>4.13.2</swagger-ui-version>
         <prometheus.version>0.16.0</prometheus.version>
-        <jetty-version>11.0.25</jetty-version>
+        <jetty-version>11.0.26</jetty-version>
         <jetty.port.api>8080</jetty.port.api>
         <jetty.port.etl>8090</jetty.port.etl>
         <testcontainers.version>1.21.3</testcontainers.version>

From 1d30daa33460313db361e708742857e87cea5e71 Mon Sep 17 00:00:00 2001
From: Matthew Trew <matthew.trew@raspberrypi.org>
Date: Wed, 1 Oct 2025 11:12:12 +0100
Subject: [PATCH 8/9] Update jackson, use BOM package to align indirect
 dependencies

---
 pom.xml | 34 +++++++++++-----------------------
 1 file changed, 11 insertions(+), 23 deletions(-)

diff --git a/pom.xml b/pom.xml
index 91c4b7b0a0..711bc3f7c9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -15,8 +15,8 @@
         <resteasy.version>6.2.14.Final</resteasy.version>
         <guice.version>7.0.0</guice.version>
         <oauth-client.version>1.39.0</oauth-client.version>
-        <jackson.version>2.19.2</jackson.version>
-        <jackson-databind.version>2.19.2</jackson-databind.version>
+        <jackson.version>2.20.0</jackson.version>
+        <jackson-annotations.version>2.20</jackson-annotations.version>
         <powermock.version>2.0.9</powermock.version>
         <junit-4.version>4.13.2</junit-4.version>
         <junit-5.version>5.14.0</junit-5.version>
@@ -309,12 +309,12 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>${jackson-databind.version}</version>
+            <version>${jackson.version}</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-annotations</artifactId>
-            <version>${jackson.version}</version>
+            <version>${jackson-annotations.version}</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.jakarta.rs</groupId>
@@ -722,29 +722,17 @@
         </resources>
     </build>
 
-    <!-- This block pins versions of indirect dependencies - useful to address security issues -->
+    <!-- This block pins versions of indirect dependencies - useful to address security issues, or to resolve
+    incompatibilities. -->
     <!-- TODO: When doing dependency updates, please make sure these are still necessary, and remove them if not -->
     <dependencyManagement>
         <dependencies>
             <dependency>
-                <groupId>com.fasterxml.jackson.datatype</groupId>
-                <artifactId>jackson-datatype-jsr310</artifactId>
-                <version>2.19.2</version>
-            </dependency>
-            <dependency>
-                <groupId>com.fasterxml.jackson.datatype</groupId>
-                <artifactId>jackson-datatype-jdk8</artifactId>
-                <version>2.19.2</version>
-            </dependency>
-            <dependency>
-                <groupId>com.fasterxml.jackson.jakarta.rs</groupId>
-                <artifactId>jackson-jakarta-rs-base</artifactId>
-                <version>2.19.2</version>
-            </dependency>
-            <dependency>
-                <groupId>com.fasterxml.jackson.module</groupId>
-                <artifactId>jackson-module-jakarta-xmlbind-annotations</artifactId>
-                <version>2.19.2</version>
+                <groupId>com.fasterxml.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>${jackson.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
             </dependency>
         </dependencies>
     </dependencyManagement>

From 018e9362888b86d9f55b4a549fa66e7522ed3e6e Mon Sep 17 00:00:00 2001
From: Matthew Trew <matthew.trew@raspberrypi.org>
Date: Thu, 2 Oct 2025 15:25:31 +0100
Subject: [PATCH 9/9] Restore jackson-databind variable, add comments for BOM
 and jackson-annotations

---
 pom.xml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 7c041d073b..0e7d098cdf 100644
--- a/pom.xml
+++ b/pom.xml
@@ -16,6 +16,11 @@
         <guice.version>7.0.0</guice.version>
         <oauth-client.version>1.39.0</oauth-client.version>
         <jackson.version>2.20.0</jackson.version>
+        <!-- 'jackson-databind' is kept separate to make it easier to update to later patch versions for security
+         reasons. -->
+        <jackson-databind.version>2.20.0</jackson-databind.version>
+        <!-- todo: 'jackson-annotations' would normally have the same version string as 'jackson'. This looks like a
+         typo from the maintainers - hopefully we can remove this next update. -->
         <jackson-annotations.version>2.20</jackson-annotations.version>
         <powermock.version>2.0.9</powermock.version>
         <junit-4.version>4.13.2</junit-4.version>
@@ -309,7 +314,7 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>${jackson.version}</version>
+            <version>${jackson-databind.version}</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
@@ -728,6 +733,8 @@
     <dependencyManagement>
         <dependencies>
             <dependency>
+                <!-- This "BOM" package ensures we get a compatible set of Jackson plugins across our indirect
+                 dependencies. More info here: https://github.com/FasterXML/jackson-bom -->
                 <groupId>com.fasterxml.jackson</groupId>
                 <artifactId>jackson-bom</artifactId>
                 <version>${jackson.version}</version>