From 45a902e88828b982d36c1e3acc64bdaf884ca3c5 Mon Sep 17 00:00:00 2001
From: Thierry Boileau <thierry.boileau@qlik.com>
Date: Thu, 11 Jun 2026 22:17:52 +0200
Subject: [PATCH 1/2] Issue #1510: Upgrade libraries to fix CVEs

---
 changes.md | 10 ++++++++++
 pom.xml    | 22 +++++++++++-----------
 2 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/changes.md b/changes.md
index 94fcf32214..a22b1c8f4e 100644
--- a/changes.md
+++ b/changes.md
@@ -2,6 +2,16 @@ Changes log
 ===========
 
 - 2.7 Release Candidate 1 (??-06-2026)
+  - Misc
+    - Upgraded Gson library to version 2.14.0.
+    - Upgraded Jackson library to version 2.19.4.
+    - Upgraded Jetty library to version 2.0.36.
+    - Upgraded JSON library to version 20260522.
+    - Upgraded Slf4j library to version 2.0.18.
+    - Upgraded Springframework library to version 6.2.19.
+    - Upgraded Swagger library to version 2.2.50.
+    - Upgraded Swagger parser library to version 2.1.43.
+    - Upgraded Thymeleaf library to version 3.1.5.RELEASE.
 
 - 2.7 Milestone 3 (10-06-2026)
   - Enhancements
diff --git a/pom.xml b/pom.xml
index 3fc5b96372..99f8d2316d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -52,22 +52,22 @@
 
         <!-- dependencies -->
         <lib-freemarker-version>2.3.34</lib-freemarker-version>
-        <lib-gson-version>2.13.1</lib-gson-version>
-        <lib-jackson-version>2.19.1</lib-jackson-version>
-        <lib-joda-time-version>2.14.0</lib-joda-time-version>
-        <lib-jetty-version>12.0.22</lib-jetty-version>
-        <lib-json-version>20250517</lib-json-version>
+        <lib-gson-version>2.14.0</lib-gson-version>
+        <lib-jackson-version>2.19.4</lib-jackson-version>
+        <lib-joda-time-version>2.14.2</lib-joda-time-version>
+        <lib-jetty-version>12.0.36</lib-jetty-version>
+        <lib-json-version>20260522</lib-json-version>
         <lib-log4j-version>1.2.17</lib-log4j-version>
         <lib-hamcrest-version>1.3</lib-hamcrest-version>
         <lib-osgi-version>4.3.1</lib-osgi-version>
-        <lib-slf4j-version>2.0.17</lib-slf4j-version>
-        <lib-spring-version>6.2.8</lib-spring-version>
-        <lib-swagger-core-version>2.2.43</lib-swagger-core-version>
-        <lib-swagger-parser-version>2.1.38</lib-swagger-parser-version>
-        <lib-thymeleaf-version>3.1.3.RELEASE</lib-thymeleaf-version>
+        <lib-slf4j-version>2.0.18</lib-slf4j-version>
+        <lib-spring-version>6.2.19</lib-spring-version>
+        <lib-swagger-core-version>2.2.50</lib-swagger-core-version>
+        <lib-swagger-parser-version>2.1.43</lib-swagger-parser-version>
+        <lib-thymeleaf-version>3.1.5.RELEASE</lib-thymeleaf-version>
         <lib-velocity-version>2.4.1</lib-velocity-version>
         <!-- tests -->
-        <lib-junit-version>5.13.2</lib-junit-version>
+        <lib-junit-version>5.14.4</lib-junit-version>
     </properties>
 
     <modules>

From 0ec23d89500f77d81761c4ba6860a8288416f196 Mon Sep 17 00:00:00 2001
From: Thierry Boileau <thierry.boileau@qlik.com>
Date: Thu, 11 Jun 2026 22:31:44 +0200
Subject: [PATCH 2/2] Issue #1510: Upgrade libraries to fix CVEs

---
 changes.md                      | 4 ++--
 org.restlet.ext.jackson/pom.xml | 2 +-
 pom.xml                         | 5 +++--
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/changes.md b/changes.md
index a22b1c8f4e..d9f548edfc 100644
--- a/changes.md
+++ b/changes.md
@@ -4,11 +4,11 @@ Changes log
 - 2.7 Release Candidate 1 (??-06-2026)
   - Misc
     - Upgraded Gson library to version 2.14.0.
-    - Upgraded Jackson library to version 2.19.4.
+    - Upgraded Jackson library to version 2.21 (LTS).
     - Upgraded Jetty library to version 2.0.36.
     - Upgraded JSON library to version 20260522.
     - Upgraded Slf4j library to version 2.0.18.
-    - Upgraded Springframework library to version 6.2.19.
+    - Upgraded Springframework library to version 7.0.8.
     - Upgraded Swagger library to version 2.2.50.
     - Upgraded Swagger parser library to version 2.1.43.
     - Upgraded Thymeleaf library to version 3.1.5.RELEASE.
diff --git a/org.restlet.ext.jackson/pom.xml b/org.restlet.ext.jackson/pom.xml
index efd957f9f7..dcbaa0908d 100644
--- a/org.restlet.ext.jackson/pom.xml
+++ b/org.restlet.ext.jackson/pom.xml
@@ -23,7 +23,7 @@
 		<dependency>
 			<groupId>com.fasterxml.jackson.core</groupId>
 			<artifactId>jackson-annotations</artifactId>
-			<version>${lib-jackson-version}</version>
+			<version>${lib-jackson-annotations-version}</version>
 		</dependency>
 		<dependency>
 			<groupId>com.fasterxml.jackson.core</groupId>
diff --git a/pom.xml b/pom.xml
index 99f8d2316d..61a5d6d781 100644
--- a/pom.xml
+++ b/pom.xml
@@ -53,7 +53,8 @@
         <!-- dependencies -->
         <lib-freemarker-version>2.3.34</lib-freemarker-version>
         <lib-gson-version>2.14.0</lib-gson-version>
-        <lib-jackson-version>2.19.4</lib-jackson-version>
+        <lib-jackson-version>2.21.4</lib-jackson-version>
+        <lib-jackson-annotations-version>2.21</lib-jackson-annotations-version>
         <lib-joda-time-version>2.14.2</lib-joda-time-version>
         <lib-jetty-version>12.0.36</lib-jetty-version>
         <lib-json-version>20260522</lib-json-version>
@@ -61,7 +62,7 @@
         <lib-hamcrest-version>1.3</lib-hamcrest-version>
         <lib-osgi-version>4.3.1</lib-osgi-version>
         <lib-slf4j-version>2.0.18</lib-slf4j-version>
-        <lib-spring-version>6.2.19</lib-spring-version>
+        <lib-spring-version>7.0.8</lib-spring-version>
         <lib-swagger-core-version>2.2.50</lib-swagger-core-version>
         <lib-swagger-parser-version>2.1.43</lib-swagger-parser-version>
         <lib-thymeleaf-version>3.1.5.RELEASE</lib-thymeleaf-version>