From 063ea401a1836868a5c5a7200b3f5a55c1f547b8 Mon Sep 17 00:00:00 2001
From: Aru Raghuwanshi <aruraghuwanshi@gmail.com>
Date: Tue, 10 Feb 2026 00:33:33 -0800
Subject: [PATCH 1/2] Shrink Dependencies

---
 embedded-tests/pom.xml   |  19 ++---
 indexing-service/pom.xml |   5 +-
 pom.xml                  | 150 +++++++++++++++++++++++++++++----------
 3 files changed, 121 insertions(+), 53 deletions(-)

diff --git a/embedded-tests/pom.xml b/embedded-tests/pom.xml
index fc7a720b9c35..ea2b4567da75 100644
--- a/embedded-tests/pom.xml
+++ b/embedded-tests/pom.xml
@@ -29,9 +29,6 @@
 
   <properties>
     <surefire.rerunFailingTestsCount>0</surefire.rerunFailingTestsCount>
-    <!--  Hadoop relies upon JDK 11 language level which breaks when upgraded to anything higher, but we can use 17 in \
-    embedded-tests, which supports more features such as multiline text block literal delimiter (""")  -->
-    <maven.compiler.release>17</maven.compiler.release>
   </properties>
 
   <parent>
@@ -549,7 +546,6 @@
     <dependency>
       <groupId>org.apache.httpcomponents.client5</groupId>
       <artifactId>httpclient5</artifactId>
-      <version>5.5</version>
       <scope>test</scope>
     </dependency>
 
@@ -557,14 +553,6 @@
 
   <build>
     <plugins>
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-compiler-plugin</artifactId>
-        <version>3.11.0</version>
-        <configuration>
-          <release>${maven.compiler.release}</release> <!-- forced for this module -->
-        </configuration>
-      </plugin>
       <!-- Skip this module from jacoco coverage as it contains only tests -->
       <plugin>
         <groupId>org.jacoco</groupId>
@@ -581,6 +569,13 @@
           <excludedGroups>docker-test</excludedGroups>
         </configuration>
       </plugin>
+      <plugin>
+        <groupId>org.owasp</groupId>
+        <artifactId>dependency-check-maven</artifactId>
+        <configuration>
+          <skip>true</skip>
+        </configuration>
+      </plugin>
     </plugins>
   </build>
 
diff --git a/indexing-service/pom.xml b/indexing-service/pom.xml
index f95129baaaa7..a3169677c930 100644
--- a/indexing-service/pom.xml
+++ b/indexing-service/pom.xml
@@ -72,8 +72,8 @@
             <artifactId>joda-time</artifactId>
         </dependency>
         <dependency>
-            <groupId>jakarta.inject</groupId>
-            <artifactId>jakarta.inject-api</artifactId>
+            <groupId>javax.inject</groupId>
+            <artifactId>javax.inject</artifactId>
         </dependency>
         <dependency>
             <groupId>com.google.inject</groupId>
@@ -260,7 +260,6 @@
         <dependency>
             <groupId>com.google.api.grpc</groupId>
             <artifactId>proto-google-common-protos</artifactId>
-            <version>2.48.0</version>
             <scope>test</scope>
         </dependency>
     </dependencies>
diff --git a/pom.xml b/pom.xml
index b2e228cf2dbf..a7523589a8ce 100644
--- a/pom.xml
+++ b/pom.xml
@@ -70,12 +70,7 @@
     </scm>
 
     <properties>
-        <!--  java 11 is no longer supported, but for backward compatibility reasons we plan to stay on 11 until druid37, see https://github.com/apache/druid/pull/18759.
-          Note for upgrade:
-          - remove the maven-compiler-plugin in embedded-tests
-          - remove exclusion of embedded-tests in strict compilation check
-          -->
-        <java.version>11</java.version>
+        <java.version>17</java.version>
         <maven.compiler.release>${java.version}</maven.compiler.release>
         <project.build.resourceEncoding>UTF-8</project.build.resourceEncoding>
         <aether.version>0.9.0.M2</aether.version>
@@ -84,10 +79,12 @@
         <!-- when updating apache ranger, verify the usage of aws-bundle-sdk vs aws-logs-sdk
         and update as needed in extensions-core/druid-ranger-security/pm.xml  -->
         <apache.ranger.version>2.7.0</apache.ranger.version>
+        <antlr4.version>4.5.3</antlr4.version>
         <gson.version>2.12.0</gson.version>
-        <scala.library.version>2.13.14</scala.library.version>
+        <scala.library.version>2.13.16</scala.library.version>
         <avatica.version>1.27.0</avatica.version>
         <avro.version>1.11.4</avro.version>
+        <bytebuddy.version>1.18.3</bytebuddy.version>
         <!--
             The base calcite parser was copied into the project; when updating Calcite run dev/upgrade-calcite-parser to adopt upstream changes
           -->
@@ -98,11 +95,11 @@
         <datasketches.memory.version>2.2.0</datasketches.memory.version>
         <derby.version>10.14.2.0</derby.version>
         <dropwizard.metrics.version>4.2.22</dropwizard.metrics.version>
-        <errorprone.version>2.35.1</errorprone.version>
+        <errorprone.version>2.36.0</errorprone.version>
         <fabric8.version>7.5.2</fabric8.version>
         <fastutil.version>8.5.4</fastutil.version>
         <guava.version>32.1.3-jre</guava.version>
-        <guice.version>5.1.0</guice.version>
+        <guice.version>6.0.0</guice.version>
         <hamcrest.version>2.2</hamcrest.version>
         <jetty.version>12.0.30</jetty.version>
         <jersey.version>1.19.4</jersey.version>
@@ -112,27 +109,27 @@
         <mysql.version>8.2.0</mysql.version>
         <mariadb.version>2.7.3</mariadb.version>
         <netty3.version>3.10.6.Final</netty3.version>
-        <netty4.version>4.2.6.Final</netty4.version>
+        <netty4.version>4.2.7.Final</netty4.version>
         <postgresql.version>42.7.2</postgresql.version>
         <protobuf.version>3.25.8</protobuf.version>
         <resilience4j.version>1.3.1</resilience4j.version>
-        <slf4j.version>2.0.16</slf4j.version>
+        <slf4j.version>2.0.17</slf4j.version>
         <jna.version>5.18.1</jna.version>
         <jna-platform.version>5.18.1</jna-platform.version>
         <hadoop.compile.version>3.3.6</hadoop.compile.version>
         <graaljs.version>22.3.5</graaljs.version>
         <mockito.version>5.14.2</mockito.version>
         <aws.sdk.version>1.12.784</aws.sdk.version>
-        <caffeine.version>2.8.0</caffeine.version>
-        <jacoco.version>0.8.12</jacoco.version>
+        <caffeine.version>2.9.3</caffeine.version>
+        <jacoco.version>0.8.14</jacoco.version>
         <testcontainers.version>2.0.3</testcontainers.version>
         <hibernate-validator.version>6.2.5.Final</hibernate-validator.version>
-        <httpclient.version>4.5.13</httpclient.version>
+        <httpclient.version>4.5.14</httpclient.version>
         <!-- When upgrading ZK, edit docs and integration tests as well (integration-tests/docker-base/setup.sh) -->
         <zookeeper.version>3.8.4</zookeeper.version>
         <checkerframework.version>3.48.1</checkerframework.version>
         <com.google.apis.client.version>2.2.0</com.google.apis.client.version>
-        <com.google.http.client.apis.version>1.42.3</com.google.http.client.apis.version>
+        <com.google.http.client.apis.version>1.43.3</com.google.http.client.apis.version>
         <com.google.apis.compute.version>v1-rev20230606-2.0.0</com.google.apis.compute.version>
         <com.google.cloud.storage.version>2.29.1</com.google.cloud.storage.version>
         <jdk.strong.encapsulation.argLine>
@@ -320,12 +317,12 @@
             <dependency>
                 <groupId>commons-codec</groupId>
                 <artifactId>commons-codec</artifactId>
-                <version>1.16.1</version>
+                <version>1.19.0</version>
             </dependency>
             <dependency>
                 <groupId>commons-io</groupId>
                 <artifactId>commons-io</artifactId>
-                <version>2.17.0</version>
+                <version>2.21.0</version>
             </dependency>
             <dependency>
                 <groupId>commons-logging</groupId>
@@ -416,6 +413,16 @@
                 <artifactId>kotlin-stdlib</artifactId>
                 <version>1.9.25</version>
             </dependency>
+            <dependency>
+                <groupId>org.jetbrains.kotlin</groupId>
+                <artifactId>kotlin-stdlib-jdk8</artifactId>
+                <version>1.9.25</version>
+            </dependency>
+            <dependency>
+                <groupId>org.jetbrains</groupId>
+                <artifactId>annotations</artifactId>
+                <version>26.0.2</version>
+            </dependency>
             <!-- Transitive dependency of kubernetes-client-java in kubernetes-extension,
             schema-repo in avro-extensions, and com.google.caliper:caliper in druid-server
             and direct dependency of druid-ranger
@@ -430,7 +437,24 @@
             <dependency>
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcpkix-jdk18on</artifactId>
-                <version>1.81</version>
+                <version>1.82</version>
+            </dependency>
+            <!-- Transitive dependency of docker-java and jetty -->
+            <dependency>
+                <groupId>jakarta.activation</groupId>
+                <artifactId>jakarta.activation-api</artifactId>
+                <version>1.2.2</version>
+            </dependency>
+            <!-- Transitive dependency of docker-java-transport-httpclient5 -->
+            <dependency>
+                <groupId>org.apache.httpcomponents.client5</groupId>
+                <artifactId>httpclient5</artifactId>
+                <version>5.5.1</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.httpcomponents.core5</groupId>
+                <artifactId>httpcore5</artifactId>
+                <version>5.3.6</version>
             </dependency>
             <!-- Transitive dependency of hive-common in druid-kerberos, druid-ranger-security and
             druid-iceberg-extension  -->
@@ -608,7 +632,7 @@
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-compress</artifactId>
-                <version>1.27.0</version>
+                <version>1.28.0</version>
             </dependency>
             <dependency>
                 <groupId>org.tukaani</groupId>
@@ -618,7 +642,7 @@
             <dependency>
                 <groupId>com.github.luben</groupId>
                 <artifactId>zstd-jni</artifactId>
-                <version>1.5.2-3</version>
+                <version>1.5.6-6</version>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson</groupId>
@@ -645,7 +669,12 @@
             <dependency>
                 <groupId>jakarta.inject</groupId>
                 <artifactId>jakarta.inject-api</artifactId>
-                <version>1.0.3</version>
+                <version>2.0.1</version>
+            </dependency>
+            <dependency>
+                <groupId>javax.inject</groupId>
+                <artifactId>javax.inject</artifactId>
+                <version>1</version>
             </dependency>
             <dependency>
                 <groupId>javax.el</groupId>
@@ -880,12 +909,12 @@
             <dependency>
                 <groupId>org.antlr</groupId>
                 <artifactId>antlr4-runtime</artifactId>
-                <version>4.5.3</version>
+                <version>${antlr4.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.antlr</groupId>
                 <artifactId>antlr4-coordinator</artifactId>
-                <version>4.5.3</version>
+                <version>${antlr4.version}</version>
             </dependency>
             <dependency>
                 <groupId>commons-cli</groupId>
@@ -895,7 +924,7 @@
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-dbcp2</artifactId>
-                <version>2.0.1</version>
+                <version>2.11.0</version>
             </dependency>
             <!-- this is relocated to at.yawk.lz4, but license checker script (the one that uses licenses.yaml)
              complains about stuff (our dependencies) using org.lz4 package, so put this here even though our own
@@ -923,6 +952,11 @@
                 <artifactId>protobuf-java</artifactId>
                 <version>${protobuf.version}</version>
             </dependency>
+            <dependency>
+                <groupId>com.google.api.grpc</groupId>
+                <artifactId>proto-google-common-protos</artifactId>
+                <version>2.48.0</version>
+            </dependency>
             <dependency>
                 <groupId>io.tesla.aether</groupId>
                 <artifactId>tesla-aether</artifactId>
@@ -1028,12 +1062,12 @@
             <dependency>
                 <groupId>org.ow2.asm</groupId>
                 <artifactId>asm</artifactId>
-                <version>9.8</version>
+                <version>9.9.1</version>
             </dependency>
             <dependency>
                 <groupId>org.ow2.asm</groupId>
                 <artifactId>asm-commons</artifactId>
-                <version>9.8</version>
+                <version>9.9.1</version>
             </dependency>
             <dependency>
                 <groupId>org.asynchttpclient</groupId>
@@ -1053,7 +1087,7 @@
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-collections4</artifactId>
-                <version>4.2</version>
+                <version>4.4</version>
             </dependency>
             <dependency>
                 <groupId>io.dropwizard.metrics</groupId>
@@ -1181,7 +1215,7 @@
             <dependency>
                 <groupId>com.github.docker-java</groupId>
                 <artifactId>docker-java-bom</artifactId>
-                <version>3.6.0</version>
+                <version>3.7.0</version>
                 <scope>import</scope>
                 <type>pom</type>
             </dependency>
@@ -1224,15 +1258,18 @@
             <dependency>
                 <groupId>org.assertj</groupId>
                 <artifactId>assertj-core</artifactId>
-                <version>3.24.2</version>
+                <version>3.27.7</version>
                 <scope>test</scope>
-                <exclusions>
-                  <!-- exclude older byte-buddy until assertj-core depends on 1.14+ for Java 21 -->
-                  <exclusion>
-                    <groupId>net.bytebuddy</groupId>
-                    <artifactId>byte-buddy</artifactId>
-                  </exclusion>
-                </exclusions>
+            </dependency>
+            <dependency>
+                <groupId>net.bytebuddy</groupId>
+                <artifactId>byte-buddy</artifactId>
+                <version>${bytebuddy.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>net.bytebuddy</groupId>
+                <artifactId>byte-buddy-agent</artifactId>
+                <version>${bytebuddy.version}</version>
             </dependency>
             <dependency>
                 <groupId>com.ircclouds.irc</groupId>
@@ -1736,6 +1773,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-enforcer-plugin</artifactId>
+                <version>3.6.2</version>
                 <executions>
                     <execution>
                         <id>default-cli</id>
@@ -1762,6 +1800,42 @@
                                         <exclude>org.eclipse.jetty.toolchain:jetty-servlet-api</exclude>
                                     </excludes>
                                 </bannedDependencies>
+                                <requireUpperBoundDeps>
+                                    <excludes>
+                                       <!-- Zookeeper 3.9.x is needed by Curator 5.8.0 but requires careful testing -->
+                                       <exclude>org.apache.zookeeper:zookeeper</exclude>
+                                       <!-- Guava 33.x is needed by google-cloud libraries; major version bump -->
+                                       <exclude>com.google.guava:guava</exclude>
+                                       <!-- Jackson 2.20.x is needed by docker-java 3.7.0 and fabric8; pending upgrade -->
+                                       <exclude>com.fasterxml.jackson.core:jackson-annotations</exclude>
+                                       <exclude>com.fasterxml.jackson.core:jackson-databind</exclude>
+                                       <exclude>com.fasterxml.jackson.core:jackson-core</exclude>
+                                       <exclude>com.fasterxml.jackson.datatype:jackson-datatype-jsr310</exclude>
+                                       <exclude>com.fasterxml.jackson.dataformat:jackson-dataformat-yaml</exclude>
+                                       <!-- Guice 7.0.0 is needed by fabric8; major version bump -->
+                                       <exclude>com.google.inject.extensions:guice-assistedinject</exclude>
+                                       <exclude>com.google.inject:guice</exclude>
+                                       <!-- jedis-mock 1.1.12 requires jedis 7.0.0; major version bump -->
+                                       <exclude>redis.clients:jedis</exclude>
+                                       <!-- Calcite test dependency wants reflections 0.10.2; API changes -->
+                                       <exclude>org.reflections:reflections</exclude>
+                                       <!-- Hadoop pulls RoaringBitmap 1.2.0; major version bump -->
+                                       <exclude>org.roaringbitmap:RoaringBitmap</exclude>
+                                       <!-- Hadoop/Parquet pulls aircompressor 2.0.2; major version bump -->
+                                       <exclude>io.airlift:aircompressor</exclude>
+                                       <!-- OkHttp/OkIO 3.x is needed; major version bump from 2.x -->
+                                       <exclude>com.squareup.okio:okio</exclude>
+                                       <!-- Jakarta Activation 2.x is Jakarta EE 9; major version bump -->
+                                       <exclude>com.sun.activation:jakarta.activation</exclude>
+                                       <!-- Confluent uses its own snakeyaml/kafka-clients versions -->
+                                       <exclude>org.yaml:snakeyaml</exclude>
+                                       <exclude>io.confluent:kafka-schema-registry-client</exclude>
+                                       <exclude>org.apache.kafka:kafka-clients</exclude>
+                                    </excludes>
+                                    <excludedScopes>
+                                       <excludedScope>provided</excludedScope>
+                                    </excludedScopes>
+                                </requireUpperBoundDeps>
                             </rules>
                             <fail>true</fail>
                         </configuration>
@@ -1888,7 +1962,7 @@
               <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>3.2.5</version>
+                    <version>3.5.4</version>
                     <configuration>
                         <!-- locale settings must be set on the command line before startup -->
                         <!-- set default options -->
@@ -1969,7 +2043,7 @@
                 <plugin>
                     <groupId>org.antlr</groupId>
                     <artifactId>antlr4-maven-plugin</artifactId>
-                    <version>4.5.3</version>
+                    <version>${antlr4.version}</version>
                 </plugin>
                 <plugin>
                     <groupId>org.codehaus.mojo</groupId>

From ce02d764f0bcdf2e3cd42333a7aded10623cc679 Mon Sep 17 00:00:00 2001
From: Aru Raghuwanshi <aruraghuwanshi@gmail.com>
Date: Tue, 10 Feb 2026 00:54:28 -0800
Subject: [PATCH 2/2] fixes

---
 embedded-tests/pom.xml   | 18 +++++++-----
 indexing-service/pom.xml |  4 +--
 pom.xml                  | 62 +++++++++++++++++-----------------------
 3 files changed, 39 insertions(+), 45 deletions(-)

diff --git a/embedded-tests/pom.xml b/embedded-tests/pom.xml
index ea2b4567da75..a08d91aeef65 100644
--- a/embedded-tests/pom.xml
+++ b/embedded-tests/pom.xml
@@ -29,6 +29,9 @@
 
   <properties>
     <surefire.rerunFailingTestsCount>0</surefire.rerunFailingTestsCount>
+    <!--  Hadoop relies upon JDK 11 language level which breaks when upgraded to anything higher, but we can use 17 in \
+    embedded-tests, which supports more features such as multiline text block literal delimiter (""")  -->
+    <maven.compiler.release>17</maven.compiler.release>
   </properties>
 
   <parent>
@@ -553,6 +556,14 @@
 
   <build>
     <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <version>3.11.0</version>
+        <configuration>
+          <release>${maven.compiler.release}</release> <!-- forced for this module -->
+        </configuration>
+      </plugin>
       <!-- Skip this module from jacoco coverage as it contains only tests -->
       <plugin>
         <groupId>org.jacoco</groupId>
@@ -569,13 +580,6 @@
           <excludedGroups>docker-test</excludedGroups>
         </configuration>
       </plugin>
-      <plugin>
-        <groupId>org.owasp</groupId>
-        <artifactId>dependency-check-maven</artifactId>
-        <configuration>
-          <skip>true</skip>
-        </configuration>
-      </plugin>
     </plugins>
   </build>
 
diff --git a/indexing-service/pom.xml b/indexing-service/pom.xml
index a3169677c930..0c09a0125937 100644
--- a/indexing-service/pom.xml
+++ b/indexing-service/pom.xml
@@ -72,8 +72,8 @@
             <artifactId>joda-time</artifactId>
         </dependency>
         <dependency>
-            <groupId>javax.inject</groupId>
-            <artifactId>javax.inject</artifactId>
+            <groupId>jakarta.inject</groupId>
+            <artifactId>jakarta.inject-api</artifactId>
         </dependency>
         <dependency>
             <groupId>com.google.inject</groupId>
diff --git a/pom.xml b/pom.xml
index a7523589a8ce..3ce5337a1d11 100644
--- a/pom.xml
+++ b/pom.xml
@@ -70,7 +70,12 @@
     </scm>
 
     <properties>
-        <java.version>17</java.version>
+        <!--  java 11 is no longer supported, but for backward compatibility reasons we plan to stay on 11 until druid37, see https://github.com/apache/druid/pull/18759.
+          Note for upgrade:
+          - remove the maven-compiler-plugin in embedded-tests
+          - remove exclusion of embedded-tests in strict compilation check
+          -->
+        <java.version>11</java.version>
         <maven.compiler.release>${java.version}</maven.compiler.release>
         <project.build.resourceEncoding>UTF-8</project.build.resourceEncoding>
         <aether.version>0.9.0.M2</aether.version>
@@ -79,12 +84,10 @@
         <!-- when updating apache ranger, verify the usage of aws-bundle-sdk vs aws-logs-sdk
         and update as needed in extensions-core/druid-ranger-security/pm.xml  -->
         <apache.ranger.version>2.7.0</apache.ranger.version>
-        <antlr4.version>4.5.3</antlr4.version>
         <gson.version>2.12.0</gson.version>
         <scala.library.version>2.13.16</scala.library.version>
         <avatica.version>1.27.0</avatica.version>
         <avro.version>1.11.4</avro.version>
-        <bytebuddy.version>1.18.3</bytebuddy.version>
         <!--
             The base calcite parser was copied into the project; when updating Calcite run dev/upgrade-calcite-parser to adopt upstream changes
           -->
@@ -99,7 +102,7 @@
         <fabric8.version>7.5.2</fabric8.version>
         <fastutil.version>8.5.4</fastutil.version>
         <guava.version>32.1.3-jre</guava.version>
-        <guice.version>6.0.0</guice.version>
+        <guice.version>5.1.0</guice.version>
         <hamcrest.version>2.2</hamcrest.version>
         <jetty.version>12.0.30</jetty.version>
         <jersey.version>1.19.4</jersey.version>
@@ -113,7 +116,7 @@
         <postgresql.version>42.7.2</postgresql.version>
         <protobuf.version>3.25.8</protobuf.version>
         <resilience4j.version>1.3.1</resilience4j.version>
-        <slf4j.version>2.0.17</slf4j.version>
+        <slf4j.version>2.0.16</slf4j.version>
         <jna.version>5.18.1</jna.version>
         <jna-platform.version>5.18.1</jna-platform.version>
         <hadoop.compile.version>3.3.6</hadoop.compile.version>
@@ -121,7 +124,7 @@
         <mockito.version>5.14.2</mockito.version>
         <aws.sdk.version>1.12.784</aws.sdk.version>
         <caffeine.version>2.9.3</caffeine.version>
-        <jacoco.version>0.8.14</jacoco.version>
+        <jacoco.version>0.8.12</jacoco.version>
         <testcontainers.version>2.0.3</testcontainers.version>
         <hibernate-validator.version>6.2.5.Final</hibernate-validator.version>
         <httpclient.version>4.5.14</httpclient.version>
@@ -418,11 +421,6 @@
                 <artifactId>kotlin-stdlib-jdk8</artifactId>
                 <version>1.9.25</version>
             </dependency>
-            <dependency>
-                <groupId>org.jetbrains</groupId>
-                <artifactId>annotations</artifactId>
-                <version>26.0.2</version>
-            </dependency>
             <!-- Transitive dependency of kubernetes-client-java in kubernetes-extension,
             schema-repo in avro-extensions, and com.google.caliper:caliper in druid-server
             and direct dependency of druid-ranger
@@ -669,12 +667,7 @@
             <dependency>
                 <groupId>jakarta.inject</groupId>
                 <artifactId>jakarta.inject-api</artifactId>
-                <version>2.0.1</version>
-            </dependency>
-            <dependency>
-                <groupId>javax.inject</groupId>
-                <artifactId>javax.inject</artifactId>
-                <version>1</version>
+                <version>1.0.3</version>
             </dependency>
             <dependency>
                 <groupId>javax.el</groupId>
@@ -909,12 +902,12 @@
             <dependency>
                 <groupId>org.antlr</groupId>
                 <artifactId>antlr4-runtime</artifactId>
-                <version>${antlr4.version}</version>
+                <version>4.5.3</version>
             </dependency>
             <dependency>
                 <groupId>org.antlr</groupId>
                 <artifactId>antlr4-coordinator</artifactId>
-                <version>${antlr4.version}</version>
+                <version>4.5.3</version>
             </dependency>
             <dependency>
                 <groupId>commons-cli</groupId>
@@ -924,7 +917,7 @@
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-dbcp2</artifactId>
-                <version>2.11.0</version>
+                <version>2.0.1</version>
             </dependency>
             <!-- this is relocated to at.yawk.lz4, but license checker script (the one that uses licenses.yaml)
              complains about stuff (our dependencies) using org.lz4 package, so put this here even though our own
@@ -1062,12 +1055,12 @@
             <dependency>
                 <groupId>org.ow2.asm</groupId>
                 <artifactId>asm</artifactId>
-                <version>9.9.1</version>
+                <version>9.8</version>
             </dependency>
             <dependency>
                 <groupId>org.ow2.asm</groupId>
                 <artifactId>asm-commons</artifactId>
-                <version>9.9.1</version>
+                <version>9.8</version>
             </dependency>
             <dependency>
                 <groupId>org.asynchttpclient</groupId>
@@ -1215,7 +1208,7 @@
             <dependency>
                 <groupId>com.github.docker-java</groupId>
                 <artifactId>docker-java-bom</artifactId>
-                <version>3.7.0</version>
+                <version>3.6.0</version>
                 <scope>import</scope>
                 <type>pom</type>
             </dependency>
@@ -1258,18 +1251,15 @@
             <dependency>
                 <groupId>org.assertj</groupId>
                 <artifactId>assertj-core</artifactId>
-                <version>3.27.7</version>
+                <version>3.24.2</version>
                 <scope>test</scope>
-            </dependency>
-            <dependency>
-                <groupId>net.bytebuddy</groupId>
-                <artifactId>byte-buddy</artifactId>
-                <version>${bytebuddy.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>net.bytebuddy</groupId>
-                <artifactId>byte-buddy-agent</artifactId>
-                <version>${bytebuddy.version}</version>
+                <exclusions>
+                  <!-- exclude older byte-buddy until assertj-core depends on 1.14+ for Java 21 -->
+                  <exclusion>
+                    <groupId>net.bytebuddy</groupId>
+                    <artifactId>byte-buddy</artifactId>
+                  </exclusion>
+                </exclusions>
             </dependency>
             <dependency>
                 <groupId>com.ircclouds.irc</groupId>
@@ -1962,7 +1952,7 @@
               <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>3.5.4</version>
+                    <version>3.2.5</version>
                     <configuration>
                         <!-- locale settings must be set on the command line before startup -->
                         <!-- set default options -->
@@ -2043,7 +2033,7 @@
                 <plugin>
                     <groupId>org.antlr</groupId>
                     <artifactId>antlr4-maven-plugin</artifactId>
-                    <version>${antlr4.version}</version>
+                    <version>4.5.3</version>
                 </plugin>
                 <plugin>
                     <groupId>org.codehaus.mojo</groupId>