This is an automated email from the ASF dual-hosted git repository.

rzo1 pushed a commit to branch TOMEE-4180
in repository https://gitbox.apache.org/repos/asf/tomee.git

commit 34e721406284fee0aa694f5000581bd2495ec5f7
Author: Richard Zowalla <[email protected]>
AuthorDate: Fri Jan 27 12:03:36 2023 +0100

    TOMEE-4180 - CXF 3.5.5
---
 .../arquillian-tomee-jaxws-tests/pom.xml           |   8 +-
 .../tests/jaxws/WebServiceContextEJBTest.java      |   3 +-
 boms/tomee-microprofile/pom.xml                    | 260 +---------
 boms/tomee-plume/pom.xml                           | 260 +---------
 boms/tomee-plus/pom.xml                            | 260 +---------
 boms/tomee-webprofile/pom.xml                      | 176 ++-----
 deps/cxf-shade/pom.xml                             | 165 +++---
 .../apache/cxf/jaxb/JAXBContextInitializer.java    | 571 ---------------------
 .../org/apache/cxf/jaxb/io/DataWriterImpl.java     | 321 ------------
 .../cxf/jaxrs/provider/AbstractJAXBProvider.java   |  44 +-
 .../jaxrs/provider/GenericArgumentComparator.java  |   4 +
 .../org/apache/cxf/jaxrs/utils/InjectionUtils.java | 140 ++---
 .../tomee/server/composer/ServerBuilder.java       |   2 +-
 pom.xml                                            |   6 +-
 server/openejb-cxf-rs/pom.xml                      | 241 +--------
 server/openejb-cxf-transport/pom.xml               |  51 +-
 server/openejb-cxf/pom.xml                         | 119 +----
 .../apache/openejb/server/cxf/CxfCatalogUtils.java |   1 -
 tomee/tomee-microprofile/mp-common/pom.xml         |  46 +-
 19 files changed, 378 insertions(+), 2300 deletions(-)

diff --git 
a/arquillian/arquillian-tomee-tests/arquillian-tomee-jaxws-tests/pom.xml 
b/arquillian/arquillian-tomee-tests/arquillian-tomee-jaxws-tests/pom.xml
index 1e2e2d5be8..fe63fbbb99 100644
--- a/arquillian/arquillian-tomee-tests/arquillian-tomee-jaxws-tests/pom.xml
+++ b/arquillian/arquillian-tomee-tests/arquillian-tomee-jaxws-tests/pom.xml
@@ -34,6 +34,12 @@
       <version>${project.version}</version>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>joda-time</groupId>
+      <artifactId>joda-time</artifactId>
+      <version>2.10.10</version>
+      <scope>provided</scope>
+    </dependency>
   </dependencies>
 
   <properties>
@@ -57,7 +63,7 @@
                 <artifactItem>
                   <groupId>joda-time</groupId>
                   <artifactId>joda-time</artifactId>
-                  <version>2.5</version>
+                  <version>2.10.10</version>
                   
<outputDirectory>${project.build.directory}/placeholder-dep</outputDirectory>
                 </artifactItem>
               </artifactItems>
diff --git 
a/arquillian/arquillian-tomee-tests/arquillian-tomee-jaxws-tests/src/test/java/org/apache/openejb/arquillian/tests/jaxws/WebServiceContextEJBTest.java
 
b/arquillian/arquillian-tomee-tests/arquillian-tomee-jaxws-tests/src/test/java/org/apache/openejb/arquillian/tests/jaxws/WebServiceContextEJBTest.java
index 8c773923ec..29941926f3 100644
--- 
a/arquillian/arquillian-tomee-tests/arquillian-tomee-jaxws-tests/src/test/java/org/apache/openejb/arquillian/tests/jaxws/WebServiceContextEJBTest.java
+++ 
b/arquillian/arquillian-tomee-tests/arquillian-tomee-jaxws-tests/src/test/java/org/apache/openejb/arquillian/tests/jaxws/WebServiceContextEJBTest.java
@@ -158,7 +158,8 @@ public class WebServiceContextEJBTest {
             new Throwable().printStackTrace();
 
             final MessageContext messageContext = context.getMessageContext();
-            final HttpServletRequest request = (HttpServletRequest) 
messageContext.get(MessageContext.SERVLET_REQUEST);
+            //cxf will map between servlet.request and http.request. using the 
mapping constant of cxf here
+            final HttpServletRequest request = (HttpServletRequest) 
messageContext.get("HTTP.REQUEST");
 
             final String testHeader = request.getHeader("XX-Test");
             return "Hello, " + name + ", test header is set to " + testHeader;
diff --git a/boms/tomee-microprofile/pom.xml b/boms/tomee-microprofile/pom.xml
index 18ef76035d..fb0cf21d88 100644
--- a/boms/tomee-microprofile/pom.xml
+++ b/boms/tomee-microprofile/pom.xml
@@ -125,7 +125,7 @@
     <dependency>
       <groupId>com.sun.xml.messaging.saaj</groupId>
       <artifactId>saaj-impl</artifactId>
-      <version>1.5.1</version>
+      <version>1.5.3</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -309,230 +309,10 @@
         </exclusion>
       </exclusions>
     </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-bindings-soap</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-bindings-xml</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-frontend-jaxws</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-frontend-simple</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-management</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-extension-providers</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-extension-search</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-json-basic</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
     <dependency>
       <groupId>org.apache.cxf</groupId>
       <artifactId>cxf-rt-rs-mp-client</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-cors</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-jose-jaxrs</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-jose</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-oauth2</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-service-description</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-sse</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-security-saml</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-security</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-ws-addr</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-ws-policy</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-ws-security</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-wsdl</artifactId>
-      <version>3.4.10</version>
+      <version>3.5.5</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1489,7 +1269,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-bindings</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1500,7 +1280,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-policy</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1511,7 +1291,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-ws-security-common</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1522,7 +1302,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-ws-security-dom</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1533,7 +1313,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-ws-security-policy-stax</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1544,7 +1324,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-ws-security-stax</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1850,21 +1630,10 @@
         </exclusion>
       </exclusions>
     </dependency>
-    <dependency>
-      <groupId>org.jvnet.mimepull</groupId>
-      <artifactId>mimepull</artifactId>
-      <version>1.9.11</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
     <dependency>
       <groupId>org.jvnet.staxex</groupId>
       <artifactId>stax-ex</artifactId>
-      <version>1.8.1</version>
+      <version>1.8.3</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -2114,17 +1883,6 @@
         </exclusion>
       </exclusions>
     </dependency>
-    <dependency>
-      <groupId>xml-resolver</groupId>
-      <artifactId>xml-resolver</artifactId>
-      <version>1.2</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
   </dependencies>
 </project>
 
diff --git a/boms/tomee-plume/pom.xml b/boms/tomee-plume/pom.xml
index ed4d33cc58..63b9fa6353 100644
--- a/boms/tomee-plume/pom.xml
+++ b/boms/tomee-plume/pom.xml
@@ -125,7 +125,7 @@
     <dependency>
       <groupId>com.sun.xml.messaging.saaj</groupId>
       <artifactId>saaj-impl</artifactId>
-      <version>1.5.1</version>
+      <version>1.5.3</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -408,230 +408,10 @@
         </exclusion>
       </exclusions>
     </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-bindings-soap</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-bindings-xml</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-frontend-jaxws</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-frontend-simple</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-management</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-extension-providers</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-extension-search</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-json-basic</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
     <dependency>
       <groupId>org.apache.cxf</groupId>
       <artifactId>cxf-rt-rs-mp-client</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-cors</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-jose-jaxrs</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-jose</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-oauth2</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-service-description</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-sse</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-security-saml</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-security</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-ws-addr</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-ws-policy</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-ws-security</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-wsdl</artifactId>
-      <version>3.4.10</version>
+      <version>3.5.5</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1588,7 +1368,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-bindings</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1599,7 +1379,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-policy</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1610,7 +1390,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-ws-security-common</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1621,7 +1401,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-ws-security-dom</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1632,7 +1412,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-ws-security-policy-stax</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1643,7 +1423,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-ws-security-stax</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1993,21 +1773,10 @@
         </exclusion>
       </exclusions>
     </dependency>
-    <dependency>
-      <groupId>org.jvnet.mimepull</groupId>
-      <artifactId>mimepull</artifactId>
-      <version>1.9.11</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
     <dependency>
       <groupId>org.jvnet.staxex</groupId>
       <artifactId>stax-ex</artifactId>
-      <version>1.8.1</version>
+      <version>1.8.3</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -2257,17 +2026,6 @@
         </exclusion>
       </exclusions>
     </dependency>
-    <dependency>
-      <groupId>xml-resolver</groupId>
-      <artifactId>xml-resolver</artifactId>
-      <version>1.2</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
   </dependencies>
 </project>
 
diff --git a/boms/tomee-plus/pom.xml b/boms/tomee-plus/pom.xml
index 96d774d411..8987350a4d 100644
--- a/boms/tomee-plus/pom.xml
+++ b/boms/tomee-plus/pom.xml
@@ -125,7 +125,7 @@
     <dependency>
       <groupId>com.sun.xml.messaging.saaj</groupId>
       <artifactId>saaj-impl</artifactId>
-      <version>1.5.1</version>
+      <version>1.5.3</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -419,230 +419,10 @@
         </exclusion>
       </exclusions>
     </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-bindings-soap</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-bindings-xml</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-frontend-jaxws</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-frontend-simple</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-management</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-extension-providers</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-extension-search</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-json-basic</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
     <dependency>
       <groupId>org.apache.cxf</groupId>
       <artifactId>cxf-rt-rs-mp-client</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-cors</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-jose-jaxrs</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-jose</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-oauth2</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-service-description</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-sse</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-security-saml</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-security</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-ws-addr</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-ws-policy</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-ws-security</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-wsdl</artifactId>
-      <version>3.4.10</version>
+      <version>3.5.5</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1621,7 +1401,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-bindings</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1632,7 +1412,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-policy</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1643,7 +1423,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-ws-security-common</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1654,7 +1434,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-ws-security-dom</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1665,7 +1445,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-ws-security-policy-stax</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1676,7 +1456,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-ws-security-stax</artifactId>
-      <version>2.3.3</version>
+      <version>2.4.1</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -1993,21 +1773,10 @@
         </exclusion>
       </exclusions>
     </dependency>
-    <dependency>
-      <groupId>org.jvnet.mimepull</groupId>
-      <artifactId>mimepull</artifactId>
-      <version>1.9.11</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
     <dependency>
       <groupId>org.jvnet.staxex</groupId>
       <artifactId>stax-ex</artifactId>
-      <version>1.8.1</version>
+      <version>1.8.3</version>
       <exclusions>
         <exclusion>
           <artifactId>*</artifactId>
@@ -2257,17 +2026,6 @@
         </exclusion>
       </exclusions>
     </dependency>
-    <dependency>
-      <groupId>xml-resolver</groupId>
-      <artifactId>xml-resolver</artifactId>
-      <version>1.2</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
   </dependencies>
 </project>
 
diff --git a/boms/tomee-webprofile/pom.xml b/boms/tomee-webprofile/pom.xml
index 9924df2edc..33e524a9a6 100644
--- a/boms/tomee-webprofile/pom.xml
+++ b/boms/tomee-webprofile/pom.xml
@@ -78,6 +78,17 @@
         </exclusion>
       </exclusions>
     </dependency>
+    <dependency>
+      <groupId>com.sun.xml.messaging.saaj</groupId>
+      <artifactId>saaj-impl</artifactId>
+      <version>1.5.3</version>
+      <exclusions>
+        <exclusion>
+          <artifactId>*</artifactId>
+          <groupId>*</groupId>
+        </exclusion>
+      </exclusions>
+    </dependency>
     <dependency>
       <groupId>commons-beanutils</groupId>
       <artifactId>commons-beanutils</artifactId>
@@ -210,127 +221,6 @@
         </exclusion>
       </exclusions>
     </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-management</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-extension-providers</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-extension-search</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-json-basic</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-cors</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-jose-jaxrs</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-jose</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-oauth2</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-service-description</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-sse</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-security</artifactId>
-      <version>3.4.10</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>*</artifactId>
-          <groupId>*</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
     <dependency>
       <groupId>org.apache.geronimo.components</groupId>
       <artifactId>geronimo-transaction</artifactId>
@@ -430,6 +320,17 @@
         </exclusion>
       </exclusions>
     </dependency>
+    <dependency>
+      <groupId>org.apache.neethi</groupId>
+      <artifactId>neethi</artifactId>
+      <version>3.0.3</version>
+      <exclusions>
+        <exclusion>
+          <artifactId>*</artifactId>
+          <groupId>*</groupId>
+        </exclusion>
+      </exclusions>
+    </dependency>
     <dependency>
       <groupId>org.apache.openejb.shade</groupId>
       <artifactId>quartz-openejb-shade</artifactId>
@@ -1278,6 +1179,17 @@
         </exclusion>
       </exclusions>
     </dependency>
+    <dependency>
+      <groupId>org.jvnet.staxex</groupId>
+      <artifactId>stax-ex</artifactId>
+      <version>1.8.3</version>
+      <exclusions>
+        <exclusion>
+          <artifactId>*</artifactId>
+          <groupId>*</groupId>
+        </exclusion>
+      </exclusions>
+    </dependency>
     <dependency>
       <groupId>org.metatype.sxc</groupId>
       <artifactId>sxc-jaxb-core</artifactId>
@@ -1311,6 +1223,17 @@
         </exclusion>
       </exclusions>
     </dependency>
+    <dependency>
+      <groupId>org.reactivestreams</groupId>
+      <artifactId>reactive-streams</artifactId>
+      <version>1.0.3</version>
+      <exclusions>
+        <exclusion>
+          <artifactId>*</artifactId>
+          <groupId>*</groupId>
+        </exclusion>
+      </exclusions>
+    </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>slf4j-api</artifactId>
@@ -1333,6 +1256,17 @@
         </exclusion>
       </exclusions>
     </dependency>
+    <dependency>
+      <groupId>wsdl4j</groupId>
+      <artifactId>wsdl4j</artifactId>
+      <version>1.6.3</version>
+      <exclusions>
+        <exclusion>
+          <artifactId>*</artifactId>
+          <groupId>*</groupId>
+        </exclusion>
+      </exclusions>
+    </dependency>
   </dependencies>
 </project>
 
diff --git a/deps/cxf-shade/pom.xml b/deps/cxf-shade/pom.xml
index 7d588c64e5..b1a8fc3dcb 100644
--- a/deps/cxf-shade/pom.xml
+++ b/deps/cxf-shade/pom.xml
@@ -38,14 +38,55 @@
   <dependencies>
     <dependency>
       <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-transports-http</artifactId>
+      <artifactId>cxf-core</artifactId>
       <version>${version.cxf}</version>
+      <exclusions>
+        <exclusion>
+          <groupId>jakarta.xml.soap</groupId>
+          <artifactId>jakarta.xml.soap-api</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-core</artifactId>
+      <artifactId>cxf-rt-databinding-jaxb</artifactId>
+      <version>${version.cxf}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.cxf</groupId>
+      <artifactId>cxf-rt-frontend-jaxrs</artifactId>
       <version>${version.cxf}</version>
     </dependency>
+    <dependency>
+      <groupId>org.apache.cxf</groupId>
+      <artifactId>cxf-rt-frontend-jaxws</artifactId>
+      <version>${version.cxf}</version>
+      <exclusions>
+        <exclusion>
+          <groupId>org.ow2.asm</groupId>
+          <artifactId>asm</artifactId>
+        </exclusion>
+      </exclusions>
+      <!--
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.cxf</groupId>
+          <artifactId>cxf-rt-ws-addr</artifactId>
+        </exclusion>
+      </exclusions>
+      -->
+    </dependency>
+    <dependency>
+      <groupId>org.apache.cxf</groupId>
+      <artifactId>cxf-rt-management</artifactId>
+      <version>${version.cxf}</version>
+      <exclusions>
+        <exclusion>
+          <groupId>jakarta.xml.soap</groupId>
+          <artifactId>jakarta.xml.soap-api</artifactId>
+        </exclusion>
+      </exclusions>
+    </dependency>
     <dependency>
       <groupId>org.apache.cxf</groupId>
       <artifactId>cxf-rt-rs-client</artifactId>
@@ -53,94 +94,99 @@
     </dependency>
     <dependency>
       <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-frontend-jaxrs</artifactId>
+      <artifactId>cxf-rt-rs-extension-providers</artifactId>
       <version>${version.cxf}</version>
     </dependency>
+    <!--
     <dependency>
       <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-databinding-jaxb</artifactId>
+      <artifactId>cxf-rt-rs-extension-search</artifactId>
       <version>${version.cxf}</version>
     </dependency>
-
-    <!-- add transitive dependencies so including this is equivalent to 
including regular deps -->
+    -->
     <dependency>
-      <groupId>org.glassfish.jaxb</groupId>
-      <artifactId>jaxb-runtime</artifactId>
-      <version>2.3.3</version>
+      <groupId>org.apache.cxf</groupId>
+      <artifactId>cxf-rt-rs-security-cors</artifactId>
+      <version>${version.cxf}</version>
     </dependency>
     <dependency>
-      <groupId>org.apache.ws.xmlschema</groupId>
-      <artifactId>xmlschema-core</artifactId>
-      <version>2.2.5</version>
+      <groupId>org.apache.cxf</groupId>
+      <artifactId>cxf-rt-rs-security-oauth2</artifactId>
+      <version>${version.cxf}</version>
     </dependency>
     <dependency>
-      <groupId>com.fasterxml.woodstox</groupId>
-      <artifactId>woodstox-core</artifactId>
-      <version>${version.woodstox}</version>
+      <groupId>org.apache.cxf</groupId>
+      <artifactId>cxf-rt-rs-service-description</artifactId>
+      <version>${version.cxf}</version>
     </dependency>
-
-    <!-- for IntelliJ in case patch is added as sources
     <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-beans</artifactId>
-      <version>5.3.6</version>
-      <scope>provided</scope>
+      <groupId>org.apache.cxf</groupId>
+      <artifactId>cxf-rt-rs-sse</artifactId>
+      <version>${version.cxf}</version>
     </dependency>
     <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-context</artifactId>
-      <version>5.3.6</version>
-      <scope>provided</scope>
+      <groupId>org.apache.cxf</groupId>
+      <artifactId>cxf-rt-transports-http</artifactId>
+      <version>${version.cxf}</version>
     </dependency>
+
     <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-webmvc</artifactId>
-      <version>5.3.6</version>
-      <scope>provided</scope>
+      <groupId>org.apache.cxf</groupId>
+      <artifactId>cxf-rt-ws-security</artifactId>
+      <version>${version.cxf}</version>
+      <exclusions>
+        <!-- Exclude some weird transient dependency to jaxb-runtime from 
ehcache -->
+        <exclusion>
+          <groupId>org.glassfish.jaxb</groupId>
+          <artifactId>jaxb-runtime</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
-      <groupId>org.apache.tomee</groupId>
-      <artifactId>javaee-api</artifactId>
-      <version>${version.javaee-api}</version>
-      <scope>provided</scope>
+      <groupId>org.apache.cxf</groupId>
+      <artifactId>cxf-rt-wsdl</artifactId>
+      <version>${version.cxf}</version>
     </dependency>
+
+    <!-- add transitive dependencies so including this is equivalent to 
including regular deps -->
     <dependency>
-      <groupId>org.apache.aries.blueprint</groupId>
-      <artifactId>blueprint-parser</artifactId>
-      <version>1.6.0</version>
-      <scope>provided</scope>
+      <groupId>org.apache.ws.xmlschema</groupId>
+      <artifactId>xmlschema-core</artifactId>
+      <version>2.2.5</version>
     </dependency>
     <dependency>
-      <groupId>org.osgi</groupId>
-      <artifactId>org.osgi.core</artifactId>
-      <version>6.0.0</version>
-      <scope>provided</scope>
+      <groupId>com.fasterxml.woodstox</groupId>
+      <artifactId>woodstox-core</artifactId>
+      <version>6.4.0</version>
     </dependency>
     <dependency>
-      <groupId>org.osgi</groupId>
-      <artifactId>osgi.cmpn</artifactId>
-      <version>6.0.0</version>
-      <scope>provided</scope>
+      <groupId>wsdl4j</groupId>
+      <artifactId>wsdl4j</artifactId>
+      <version>1.6.3</version>
     </dependency>
     <dependency>
-      <groupId>org.ow2.asm</groupId>
-      <artifactId>asm</artifactId>
-      <version>9.1</version>
-      <scope>provided</scope>
+      <groupId>org.reactivestreams</groupId>
+      <artifactId>reactive-streams</artifactId>
+      <version>1.0.3</version>
     </dependency>
     <dependency>
-      <groupId>org.apache.aries.blueprint</groupId>
-      <artifactId>org.apache.aries.blueprint.api</artifactId>
-      <version>1.0.1</version>
-      <scope>provided</scope>
+      <groupId>org.apache.neethi</groupId>
+      <artifactId>neethi</artifactId>
+      <version>3.0.3</version>
     </dependency>
+
+    <!-- is this required -->
     <dependency>
-      <groupId>org.apache.aries.blueprint</groupId>
-      <artifactId>org.apache.aries.blueprint.core</artifactId>
-      <version>1.10.2</version>
-      <scope>provided</scope>
+      <groupId>com.sun.xml.messaging.saaj</groupId>
+      <artifactId>saaj-impl</artifactId>
+      <version>1.5.3</version>
+      <exclusions>
+        <exclusion>
+          <groupId>jakarta.xml.soap</groupId>
+          <artifactId>jakarta.xml.soap-api</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
-    -->
 
   </dependencies>
 
@@ -184,7 +230,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-shade-plugin</artifactId>
-        <version>2.3</version>
+        <version>3.2.4</version>
         <executions>
           <execution>
             <phase>package</phase>
@@ -195,6 +241,7 @@
               <createSourcesJar>true</createSourcesJar>
               <useBaseVersion>true</useBaseVersion>
               <createDependencyReducedPom>false</createDependencyReducedPom>
+              
<promoteTransitiveDependencies>true</promoteTransitiveDependencies>
               <artifactSet>
                 <includes>
                   <include>org.apache.cxf:*</include> <!-- only CXF to make 
sure we don't add other things -->
diff --git 
a/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxb/JAXBContextInitializer.java 
b/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxb/JAXBContextInitializer.java
deleted file mode 100644
index 1cd9325104..0000000000
--- 
a/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxb/JAXBContextInitializer.java
+++ /dev/null
@@ -1,571 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.cxf.jaxb;
-
-import java.lang.annotation.Annotation;
-import java.lang.reflect.Array;
-import java.lang.reflect.Field;
-import java.lang.reflect.GenericArrayType;
-import java.lang.reflect.Method;
-import java.lang.reflect.Modifier;
-import java.lang.reflect.ParameterizedType;
-import java.lang.reflect.Type;
-import java.lang.reflect.TypeVariable;
-import java.lang.reflect.WildcardType;
-import java.util.Collection;
-import java.util.HashSet;
-import java.util.Map;
-import java.util.Set;
-import java.util.logging.Level;
-import java.util.logging.Logger;
-
-import javax.xml.bind.annotation.XmlAccessType;
-import javax.xml.bind.annotation.XmlAttribute;
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
-import javax.xml.bind.annotation.XmlSeeAlso;
-import javax.xml.bind.annotation.XmlTransient;
-import javax.xml.bind.annotation.XmlType;
-import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
-import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapters;
-import javax.xml.namespace.QName;
-
-import org.apache.cxf.Bus;
-import org.apache.cxf.common.classloader.ClassLoaderUtils;
-import org.apache.cxf.common.jaxb.JAXBUtils;
-import org.apache.cxf.common.logging.LogUtils;
-import org.apache.cxf.common.util.ReflectionUtil;
-import org.apache.cxf.common.util.StringUtils;
-import org.apache.cxf.service.ServiceModelVisitor;
-import org.apache.cxf.service.model.MessageInfo;
-import org.apache.cxf.service.model.MessagePartInfo;
-import org.apache.cxf.service.model.OperationInfo;
-import org.apache.cxf.service.model.ServiceInfo;
-import org.apache.cxf.service.model.UnwrappedOperationInfo;
-
-/**
- * Walks the service model and sets up the classes for the context.
- */
-class JAXBContextInitializer extends ServiceModelVisitor {
-    private static final Logger LOG = 
LogUtils.getL7dLogger(JAXBContextInitializer.class);
-    private Set<Class<?>> classes;
-    private Collection<Object> typeReferences;
-    private Set<Class<?>> globalAdapters = new HashSet<>();
-    private Map<String, Object> unmarshallerProperties;
-    private Bus bus;
-
-    JAXBContextInitializer(Bus bus, ServiceInfo serviceInfo,
-                           Set<Class<?>> classes,
-                           Collection<Object> typeReferences,
-                           Map<String, Object> unmarshallerProperties) {
-        super(serviceInfo);
-        this.classes = classes;
-        this.typeReferences = typeReferences;
-        this.unmarshallerProperties = unmarshallerProperties;
-        this.bus = bus;
-    }
-
-    @Override
-    public void begin(MessagePartInfo part) {
-        Class<?> clazz = part.getTypeClass();
-        if (clazz == null) {
-            return;
-        }
-
-        if (Exception.class.isAssignableFrom(clazz)) {
-            //exceptions are handled special, make sure we mark it
-            part.setProperty(JAXBDataBinding.class.getName() + 
".CUSTOM_EXCEPTION",
-                             Boolean.TRUE);
-        }
-        boolean isFromWrapper = 
part.getMessageInfo().getOperation().isUnwrapped();
-        if (isFromWrapper
-            && !Boolean.TRUE.equals(part.getProperty("messagepart.isheader"))) 
{
-            UnwrappedOperationInfo uop = 
(UnwrappedOperationInfo)part.getMessageInfo().getOperation();
-            OperationInfo op = uop.getWrappedOperation();
-            MessageInfo inf = null;
-            if (uop.getInput() == part.getMessageInfo()) {
-                inf = op.getInput();
-            } else if (uop.getOutput() == part.getMessageInfo()) {
-                inf = op.getOutput();
-            }
-            if (inf != null
-                && inf.getFirstMessagePart().getTypeClass() != null) {
-                //if the wrapper has a type class, we don't need to do anything
-                //as everything would have been discovered when walking the
-                //wrapper type (unless it's a header which wouldn't be in the 
wrapper)
-                return;
-            }
-        }
-        if (isFromWrapper
-            && clazz.isArray()
-            && !Byte.TYPE.equals(clazz.getComponentType())) {
-            clazz = clazz.getComponentType();
-        }
-
-        Annotation[] a = 
(Annotation[])part.getProperty("parameter.annotations");
-        checkForAdapter(clazz, a);
-
-        Type genericType = (Type) part.getProperty("generic.type");
-        if (genericType != null) {
-            boolean isList = Collection.class.isAssignableFrom(clazz);
-            if (isFromWrapper) {
-                if (genericType instanceof Class
-                    && ((Class<?>)genericType).isArray()) {
-                    Class<?> cl2 = (Class<?>)genericType;
-                    if (cl2.isArray()
-                        && !Byte.TYPE.equals(cl2.getComponentType())) {
-                        genericType = cl2.getComponentType();
-                    }
-                    addType(genericType);
-                } else if (!isList) {
-                    addType(genericType);
-                }
-            } else {
-                addType(genericType, true);
-            }
-
-            if (isList
-                && genericType instanceof ParameterizedType) {
-                ParameterizedType pt = (ParameterizedType) genericType;
-                if (pt.getActualTypeArguments().length > 0
-                    && pt.getActualTypeArguments()[0] instanceof Class) {
-
-                    Class<? extends Object> arrayCls =
-                        Array.newInstance((Class<?>) 
pt.getActualTypeArguments()[0], 0).getClass();
-                    clazz = arrayCls;
-                    part.setTypeClass(clazz);
-                    if (isFromWrapper) {
-                        addType(clazz.getComponentType(), true);
-                    }
-                } else if (pt.getActualTypeArguments().length > 0
-                    && pt.getActualTypeArguments()[0] instanceof 
GenericArrayType) {
-                    GenericArrayType gat = 
(GenericArrayType)pt.getActualTypeArguments()[0];
-                    gat.getGenericComponentType();
-                    Class<? extends Object> arrayCls =
-                        Array.newInstance((Class<?>) 
gat.getGenericComponentType(), 0).getClass();
-                    clazz = Array.newInstance(arrayCls, 0).getClass();
-                    part.setTypeClass(clazz);
-                    if (isFromWrapper) {
-                        addType(clazz.getComponentType(), true);
-                    }
-                }
-            }
-            if (isFromWrapper && isList) {
-                clazz = null;
-            }
-        }
-        if (clazz != null) {
-            if (!isFromWrapper
-                && clazz.getAnnotation(XmlRootElement.class) == null
-                && clazz.getAnnotation(XmlType.class) != null
-                && 
StringUtils.isEmpty(clazz.getAnnotation(XmlType.class).name())) {
-                Object ref = createTypeReference(part.getName(), clazz);
-                if (ref != null) {
-                    typeReferences.add(ref);
-                }
-            }
-
-            addClass(clazz);
-        }
-    }
-
-    private void checkForAdapter(Class<?> clazz, Annotation[] anns) {
-        if (anns != null) {
-            for (Annotation a : anns) {
-                if 
(XmlJavaTypeAdapter.class.isAssignableFrom(a.annotationType())) {
-                    Type t = 
Utils.getTypeFromXmlAdapter((XmlJavaTypeAdapter)a);
-                    if (t != null) {
-                        addType(t);
-                    }
-                }
-            }
-        }
-        XmlJavaTypeAdapter xjta = 
clazz.getAnnotation(XmlJavaTypeAdapter.class);
-        if (xjta != null) {
-            Type t = Utils.getTypeFromXmlAdapter(xjta);
-            if (t != null) {
-                addType(t);
-            }
-        }
-        if (clazz.getPackage() != null) {
-            XmlJavaTypeAdapters adapt = 
clazz.getPackage().getAnnotation(XmlJavaTypeAdapters.class);
-            if (adapt != null) {
-                for (XmlJavaTypeAdapter a : adapt.value()) {
-                    globalAdapters.add(a.type());
-                }
-                for (XmlJavaTypeAdapter a : adapt.value()) {
-                    Type t = Utils.getTypeFromXmlAdapter(a);
-                    if (t != null) {
-                        addType(t);
-                    }
-                }
-            }
-        }
-    }
-
-    private void addType(Type cls) {
-        addType(cls, false);
-    }
-    private void addType(Type cls, boolean allowArray) {
-        if (cls instanceof Class) {
-            if (globalAdapters.contains(cls)) {
-                return;
-            }
-            if (((Class<?>)cls).isArray() && !allowArray) {
-                addClass(((Class<?>)cls).getComponentType());
-            } else {
-                addClass((Class<?>)cls);
-            }
-        } else if (cls instanceof ParameterizedType) {
-            final ParameterizedType parameterizedType = (ParameterizedType)cls;
-            addType(parameterizedType.getRawType());
-            if (!parameterizedType.getRawType().equals(Enum.class)) {
-                for (Type t2 : parameterizedType.getActualTypeArguments()) {
-                    if (shouldTypeBeAdded(t2, parameterizedType)) {
-                        addType(t2);
-                    }
-                }
-            }
-        } else if (cls instanceof GenericArrayType) {
-            Class<?> ct;
-            GenericArrayType gt = (GenericArrayType)cls;
-            Type componentType = gt.getGenericComponentType();
-            if (componentType instanceof Class) {
-                ct = (Class<?>)componentType;
-            } else if (componentType instanceof ParameterizedType) {
-                final ParameterizedType parameterizedType = 
(ParameterizedType)componentType;
-                final Type rawType = parameterizedType.getRawType();
-                if (rawType instanceof Class) {
-                    ct = (Class<?>)rawType;
-                } else {
-                    throw new IllegalArgumentException("Unable to determine 
type for " + rawType);
-                }
-                if (!parameterizedType.getRawType().equals(Enum.class)) {
-                    for (Type t2 : parameterizedType.getActualTypeArguments()) 
{
-                        if (shouldTypeBeAdded(t2, parameterizedType)) {
-                            addType(t2);
-                        }
-                    }
-                }
-            } else {
-                TypeVariable<?> tv = (TypeVariable<?>)componentType;
-                Type[] bounds = tv.getBounds();
-                if (bounds != null && bounds.length == 1) {
-                    if (bounds[0] instanceof Class) {
-                        ct = (Class<?>)bounds[0];
-                    } else {
-                        throw new IllegalArgumentException("Unable to 
determine type for: " + tv);
-                    }
-                } else {
-                    throw new IllegalArgumentException("Unable to determine 
type for: " + tv);
-                }
-            }
-            ct = Array.newInstance(ct, 0).getClass();
-
-            addClass(ct);
-        } else if (cls instanceof WildcardType) {
-            for (Type t : ((WildcardType)cls).getUpperBounds()) {
-                addType(t);
-            }
-            for (Type t : ((WildcardType)cls).getLowerBounds()) {
-                addType(t);
-            }
-        } else if (cls instanceof TypeVariable) {
-            for (Type t : ((TypeVariable<?>)cls).getBounds()) {
-                addType(t);
-            }
-        }
-    }
-
-    private boolean shouldTypeBeAdded(final Type t2, final ParameterizedType 
parameterizedType) {
-        if (!(t2 instanceof TypeVariable)) {
-            return true;
-        }
-        TypeVariable<?> typeVariable = (TypeVariable<?>) t2;
-        final Type[] bounds = typeVariable.getBounds();
-        for (Type bound : bounds) {
-            if (bound instanceof ParameterizedType && 
bound.equals(parameterizedType)) {
-                return false;
-            }
-        }
-        return true;
-    }
-
-    void addClass(Class<?> claz) {
-        if (Throwable.class.isAssignableFrom(claz)) {
-            if (!Throwable.class.equals(claz)
-                && !Exception.class.equals(claz)) {
-                walkReferences(claz);
-            }
-            addClass(String.class);
-        } else if (claz.getName().startsWith("java.")
-            || claz.getName().startsWith("javax.")
-            || claz.getName().startsWith("jakarta.")) {
-            return;
-        } else {
-            Class<?> cls = JAXBUtils.getValidClass(claz);
-            if (cls == null
-                && ReflectionUtil.getDeclaredConstructors(claz).length > 0
-                && !Modifier.isAbstract(claz.getModifiers())) {
-                if (LOG.isLoggable(Level.INFO)) {
-                    LOG.info("Class " + claz.getName() + " does not have a 
default constructor which JAXB requires.");
-                }
-                Object factory = createFactory(claz);
-                unmarshallerProperties.put("com.sun.xml.bind.ObjectFactory", 
factory);
-                cls = claz;
-            }
-            if (null != cls) {
-                if (classes.contains(cls)) {
-                    return;
-                }
-
-                if (!cls.isInterface()) {
-                    classes.add(cls);
-                }
-
-                XmlSeeAlso xsa = cls.getAnnotation(XmlSeeAlso.class);
-                if (xsa != null) {
-                    for (Class<?> c : xsa.value()) {
-                        addClass(c);
-                    }
-                }
-                XmlJavaTypeAdapter xjta = 
cls.getAnnotation(XmlJavaTypeAdapter.class);
-                if (xjta != null) {
-                    //has an adapter.   We need to inspect the adapter and then
-                    //return as the adapter will handle the superclass
-                    //and interfaces and such
-                    Type t = Utils.getTypeFromXmlAdapter(xjta);
-                    if (t != null) {
-                        addType(t);
-                    }
-                    return;
-                }
-
-                if (cls.getSuperclass() != null) {
-                    //JAXB should do this, but it doesn't always.
-                    //in particular, older versions of jaxb don't
-                    addClass(cls.getSuperclass());
-                }
-
-                if (!cls.isInterface()) {
-                    walkReferences(cls);
-                }
-            }
-        }
-    }
-
-    private void walkReferences(Class<?> cls) {
-        if (cls == null) {
-            return;
-        }
-        if (cls.getName().startsWith("java.")
-            || cls.getName().startsWith("javax.")
-            || cls.getName().startsWith("jakarta.")) {
-            return;
-        }
-        //walk the public fields/methods to try and find all the classes. JAXB 
will only load the
-        //EXACT classes in the fields/methods if they are in a different 
package. Thus,
-        //subclasses won't be found and the xsi:type stuff won't work at all.
-        //We'll grab the public field/method types and then add the 
ObjectFactory stuff
-        //as well as look for jaxb.index files in those packages.
-
-        XmlAccessType accessType = Utils.getXmlAccessType(cls);
-
-        if (accessType != XmlAccessType.PROPERTY) {   // only look for fields 
if we are instructed to
-            //fields are accessible even if not public, must look at the 
declared fields
-            //then walk to parents declared fields, etc...
-            Field[] fields = ReflectionUtil.getDeclaredFields(cls);
-            for (Field f : fields) {
-                if (isFieldAccepted(f, accessType)) {
-                    XmlJavaTypeAdapter xjta = Utils.getFieldXJTA(f);
-                    if (xjta != null) {
-                        Type t = Utils.getTypeFromXmlAdapter(xjta);
-                        if (t != null) {
-                            addType(t);
-                            continue;
-                        }
-                    }
-                    addType(f.getGenericType());
-                }
-            }
-            walkReferences(cls.getSuperclass());
-        }
-
-        if (accessType != XmlAccessType.FIELD) {   // only look for methods if 
we are instructed to
-            Method[] methods = ReflectionUtil.getDeclaredMethods(cls);
-            for (Method m : methods) {
-                if (isMethodAccepted(m, accessType)) {
-                    XmlJavaTypeAdapter xjta = Utils.getMethodXJTA(m);
-                    if (xjta != null) {
-                        Type t = Utils.getTypeFromXmlAdapter(xjta);
-                        if (t != null) {
-                            addType(t);
-                            continue;
-                        }
-                    }
-                    addType(m.getGenericReturnType());
-                    for (Type t : m.getGenericParameterTypes()) {
-                        addType(t);
-                    }
-                }
-            }
-        }
-    }
-
-    /**
-     * Checks if the field is accepted as a JAXB property.
-     */
-    static boolean isFieldAccepted(Field field, XmlAccessType accessType) {
-        // We only accept non static fields which are not marked @XmlTransient 
or has transient modifier
-        if (field.isAnnotationPresent(XmlTransient.class)
-            || Modifier.isTransient(field.getModifiers())) {
-            return false;
-        }
-        if (Modifier.isStatic(field.getModifiers())) {
-            return field.isAnnotationPresent(XmlAttribute.class);
-        }
-        if (accessType == XmlAccessType.PUBLIC_MEMBER
-            && !Modifier.isPublic(field.getModifiers())) {
-            return false;
-        }
-        if (accessType == XmlAccessType.NONE
-            || accessType == XmlAccessType.PROPERTY) {
-            return checkJaxbAnnotation(field.getAnnotations());
-        }
-        return true;
-    }
-
-    /**
-     * Checks if the method is accepted as a JAXB property getter.
-     */
-    static boolean isMethodAccepted(Method method, XmlAccessType accessType) {
-        // We only accept non static property getters which are not marked 
@XmlTransient
-        if (Modifier.isStatic(method.getModifiers())
-                || method.isAnnotationPresent(XmlTransient.class)
-                || !Modifier.isPublic(method.getModifiers())
-                || "getClass".equals(method.getName())) {
-            return false;
-        }
-
-        // must not have parameters and return type must not be void
-        if (method.getReturnType() == Void.class || method.getReturnType() == 
Void.TYPE
-            || method.getParameterTypes().length != 0
-            || (method.getDeclaringClass().equals(Throwable.class)
-            && !("getMessage".equals(method.getName())))
-            || !(method.getName().startsWith("get")
-                    || method.getName().startsWith("is"))) {
-            return false;
-        }
-        int beginIndex = 3;
-        if (method.getName().startsWith("is")) {
-            beginIndex = 2;
-        }
-
-        Method setter = null;
-        try {
-            setter = method.getDeclaringClass()
-                .getMethod("set" + method.getName().substring(beginIndex),
-                           new Class[] {method.getReturnType()});
-        } catch (Exception e) {
-            //getter, but no setter
-        }
-        if (setter != null) {
-            if (setter.isAnnotationPresent(XmlTransient.class)
-                || !Modifier.isPublic(setter.getModifiers())) {
-                return false;
-            }
-        } else if (!Collection.class.isAssignableFrom(method.getReturnType())
-            && !Throwable.class.isAssignableFrom(method.getDeclaringClass())) {
-            //no setter, it's not a collection (thus getter().add(...)), and
-            //not an Exception,
-            return false;
-        }
-
-        if (accessType == XmlAccessType.NONE
-            || accessType == XmlAccessType.FIELD) {
-            return checkJaxbAnnotation(method.getAnnotations());
-        }
-        return true;
-    }
-
-    /**
-     * Checks if there are JAXB annotations among the annotations of the class 
member.
-     * @param annotations the array of annotations from the class member
-     * @return true if JAXB annotations are present, false otherwise
-     */
-    static boolean checkJaxbAnnotation(Annotation[] annotations) {
-        // must check if there are any jaxb annotations
-        Package jaxbAnnotationsPackage = XmlElement.class.getPackage();
-        for (Annotation annotation : annotations) {
-            if (annotation.annotationType().getPackage() == 
jaxbAnnotationsPackage) {
-                return true;
-            }
-        }
-        return false;
-    }
-
-    /**
-     * The TypeReference class is a sun specific class that is found in two 
different
-     * locations depending on environment. In IBM JDK the class is not 
available at all.
-     * So we have to load it at runtime.
-     *
-     * @param n
-     * @param cls
-     * @return initiated TypeReference
-     */
-    private static Object createTypeReference(QName n, Class<?> cls) {
-        Class<?> refClass = null;
-        try {
-            refClass = 
ClassLoaderUtils.loadClass("com.sun.xml.bind.api.TypeReference",
-                                                  
JAXBContextInitializer.class);
-        } catch (Throwable ex) {
-            try {
-                refClass = 
ClassLoaderUtils.loadClass("com.sun.xml.internal.bind.api.TypeReference",
-                                                      
JAXBContextInitializer.class);
-            } catch (Throwable ex2) {
-                //ignore
-            }
-        }
-        if (refClass != null) {
-            try {
-                return refClass.getConstructor(QName.class, Type.class, new 
Annotation[0].getClass()) //NOPMD
-                    .newInstance(n, cls, new Annotation[0]);
-            } catch (Throwable e) {
-                //ignore
-            }
-        }
-        return null;
-    }
-
-    @SuppressWarnings("unused")
-    private Object createFactory(Class<?> cls) {
-        FactoryClassCreator creator = 
bus.getExtension(FactoryClassCreator.class);
-
-        Class<?> factoryClass = creator.createFactory(cls);
-        try {
-            return factoryClass.newInstance();
-        } catch (Exception e) {
-           //ignore
-        }
-        return null;
-    }
-
-
-}
\ No newline at end of file
diff --git 
a/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxb/io/DataWriterImpl.java 
b/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxb/io/DataWriterImpl.java
deleted file mode 100644
index c7de57f3cd..0000000000
--- a/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxb/io/DataWriterImpl.java
+++ /dev/null
@@ -1,321 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.cxf.jaxb.io;
-
-
-import java.lang.annotation.Annotation;
-import java.lang.reflect.Method;
-import java.nio.charset.StandardCharsets;
-import java.util.Collection;
-import java.util.Map;
-import java.util.Map.Entry;
-import java.util.logging.Level;
-import java.util.logging.Logger;
-
-import javax.xml.bind.JAXBException;
-import javax.xml.bind.MarshalException;
-import javax.xml.bind.Marshaller;
-import javax.xml.bind.PropertyException;
-import javax.xml.bind.ValidationEvent;
-import javax.xml.bind.ValidationEventHandler;
-import javax.xml.bind.annotation.adapters.XmlAdapter;
-import javax.xml.bind.attachment.AttachmentMarshaller;
-
-import org.apache.cxf.Bus;
-import org.apache.cxf.common.i18n.Message;
-import org.apache.cxf.common.jaxb.JAXBUtils;
-import org.apache.cxf.common.logging.LogUtils;
-import org.apache.cxf.common.util.ReflectionUtil;
-import org.apache.cxf.databinding.DataWriter;
-import org.apache.cxf.interceptor.Fault;
-import org.apache.cxf.jaxb.JAXBDataBase;
-import org.apache.cxf.jaxb.JAXBDataBinding;
-import org.apache.cxf.jaxb.JAXBEncoderDecoder;
-import org.apache.cxf.jaxb.MarshallerEventHandler;
-import org.apache.cxf.jaxb.attachment.JAXBAttachmentMarshaller;
-import org.apache.cxf.message.MessageUtils;
-import org.apache.cxf.service.model.MessagePartInfo;
-import org.apache.ws.commons.schema.XmlSchemaElement;
-
-public class DataWriterImpl<T> extends JAXBDataBase implements DataWriter<T> {
-    private static final Logger LOG = 
LogUtils.getLogger(JAXBDataBinding.class);
-
-    ValidationEventHandler veventHandler;
-    boolean setEventHandler = true;
-    boolean noEscape;
-    private JAXBDataBinding databinding;
-    private Bus bus;
-
-    public DataWriterImpl(Bus bus, JAXBDataBinding binding) {
-        this(bus, binding, false);
-    }
-    public DataWriterImpl(Bus bus, JAXBDataBinding binding, boolean noEsc) {
-        super(binding.getContext());
-        databinding = binding;
-        noEscape = noEsc;
-        this.bus = bus;
-    }
-
-    public void write(Object obj, T output) {
-        write(obj, null, output);
-    }
-
-    public void setProperty(String prop, Object value) {
-        if (prop.equals(org.apache.cxf.message.Message.class.getName())) {
-            org.apache.cxf.message.Message m = 
(org.apache.cxf.message.Message)value;
-            veventHandler = getValidationEventHandler(m, 
JAXBDataBinding.WRITER_VALIDATION_EVENT_HANDLER);
-            if (veventHandler == null) {
-                veventHandler = databinding.getValidationEventHandler();
-            }
-            setEventHandler = MessageUtils.getContextualBoolean(m,
-                    JAXBDataBinding.SET_VALIDATION_EVENT_HANDLER, true);
-        }
-    }
-
-    private static class MtomValidationHandler implements 
ValidationEventHandler {
-        ValidationEventHandler origHandler;
-        JAXBAttachmentMarshaller marshaller;
-        MtomValidationHandler(ValidationEventHandler v,
-                                     JAXBAttachmentMarshaller m) {
-            origHandler = v;
-            marshaller = m;
-        }
-
-        public boolean handleEvent(ValidationEvent event) {
-            // CXF-1194/CXF-7438 this hack is specific to MTOM, so pretty safe 
to leave in
-            // here before calling the origHandler.
-            String msg = event.getMessage();
-            if ((msg.startsWith("cvc-type.3.1.2") || 
msg.startsWith("cvc-complex-type.2.2"))
-                && 
msg.contains(marshaller.getLastMTOMElementName().getLocalPart())) {
-                return true;
-            }
-
-            if (origHandler != null) {
-                return origHandler.handleEvent(event);
-            }
-            return false;
-        }
-
-    }
-
-    public Marshaller createMarshaller(Object elValue, MessagePartInfo part) {
-        //Class<?> cls = null;
-        //if (part != null) {
-        //    cls = part.getTypeClass();
-        //}
-        //
-        //if (cls == null) {
-        //    cls = null != elValue ? elValue.getClass() : null;
-        //}
-        //
-        //if (cls != null && cls.isArray() && elValue instanceof Collection) {
-        //    Collection<?> col = (Collection<?>)elValue;
-        //    elValue = 
col.toArray((Object[])Array.newInstance(cls.getComponentType(), col.size()));
-        //}
-        Marshaller marshaller;
-        try {
-
-            marshaller = context.createMarshaller();
-            marshaller.setProperty(Marshaller.JAXB_ENCODING, 
StandardCharsets.UTF_8.name());
-            marshaller.setProperty(Marshaller.JAXB_FRAGMENT, true);
-            marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, 
Boolean.FALSE);
-            marshaller.setListener(databinding.getMarshallerListener());
-            databinding.applyEscapeHandler(!noEscape, eh -> 
JAXBUtils.setEscapeHandler(marshaller, eh));
-
-            if (setEventHandler) {
-                ValidationEventHandler h = veventHandler;
-                if (veventHandler == null) {
-                    h = new ValidationEventHandler() {
-                        public boolean handleEvent(ValidationEvent event) {
-                            //continue on warnings only
-                            return event.getSeverity() == 
ValidationEvent.WARNING;
-                        }
-                    };
-                }
-                marshaller.setEventHandler(h);
-            }
-
-            final Map<String, String> nspref = 
databinding.getDeclaredNamespaceMappings();
-            final Map<String, String> nsctxt = 
databinding.getContextualNamespaceMap();
-            // set the prefix mapper if either of the prefix map is configured
-            if (nspref != null || nsctxt != null) {
-                Object mapper = JAXBUtils.setNamespaceMapper(bus, nspref != 
null ? nspref : nsctxt, marshaller);
-                if (nsctxt != null) {
-                    setContextualNamespaceDecls(mapper, nsctxt);
-                }
-            }
-            if (databinding.getMarshallerProperties() != null) {
-                for (Map.Entry<String, Object> propEntry
-                    : databinding.getMarshallerProperties().entrySet()) {
-                    try {
-                        marshaller.setProperty(propEntry.getKey(), 
propEntry.getValue());
-                    } catch (PropertyException pe) {
-                        LOG.log(Level.INFO, "PropertyException setting 
Marshaller properties", pe);
-                    }
-                }
-            }
-
-            marshaller.setSchema(schema);
-            AttachmentMarshaller atmarsh = getAttachmentMarshaller();
-            marshaller.setAttachmentMarshaller(atmarsh);
-
-            if (schema != null
-                && atmarsh instanceof JAXBAttachmentMarshaller) {
-                //we need a special even handler for XOP attachments
-                marshaller.setEventHandler(new 
MtomValidationHandler(marshaller.getEventHandler(),
-                                                            
(JAXBAttachmentMarshaller)atmarsh));
-            }
-        } catch (javax.xml.bind.MarshalException ex) {
-            Message faultMessage = new Message("MARSHAL_ERROR", LOG, 
ex.getLinkedException()
-                .getMessage());
-            throw new Fault(faultMessage, ex);
-        } catch (JAXBException ex) {
-            throw new Fault(new Message("MARSHAL_ERROR", LOG, 
ex.getMessage()), ex);
-        }
-        for (XmlAdapter<?, ?> adapter : 
databinding.getConfiguredXmlAdapters()) {
-            marshaller.setAdapter(adapter);
-        }
-        return marshaller;
-    }
-
-    //REVISIT should this go into JAXBUtils?
-    private static void setContextualNamespaceDecls(Object mapper, Map<String, 
String> nsctxt) {
-        try {
-            Method m = ReflectionUtil.getDeclaredMethod(mapper.getClass(),
-                                                        
"setContextualNamespaceDecls", new Class<?>[]{String[].class});
-            String[] args = new String[nsctxt.size() * 2];
-            int ai = 0;
-            for (Entry<String, String> nsp : nsctxt.entrySet()) {
-                args[ai++] = nsp.getValue();
-                args[ai++] = nsp.getKey();
-            }
-            m.invoke(mapper, new Object[]{args});
-        } catch (Exception e) {
-            // ignore
-            LOG.log(Level.WARNING, "Failed to set the contextual namespace 
map", e);
-        }
-
-    }
-
-    public void write(Object obj, MessagePartInfo part, T output) {
-        boolean honorJaxbAnnotation = honorJAXBAnnotations(part);
-        if (part != null && !part.isElement() && part.getTypeClass() != null) {
-            honorJaxbAnnotation = true;
-        }
-        checkPart(part, obj);
-
-        if (obj != null
-            || !(part.getXmlSchema() instanceof XmlSchemaElement)) {
-
-            if (obj instanceof Exception
-                && part != null
-                && 
Boolean.TRUE.equals(part.getProperty(JAXBDataBinding.class.getName()
-                                                        + 
".CUSTOM_EXCEPTION"))) {
-                JAXBEncoderDecoder.marshallException(createMarshaller(obj, 
part),
-                                                     (Exception)obj,
-                                                     part,
-                                                     output);
-                onCompleteMarshalling();
-            } else {
-                Annotation[] anns = getJAXBAnnotation(part);
-                if (!honorJaxbAnnotation || anns.length == 0) {
-                    JAXBEncoderDecoder.marshall(createMarshaller(obj, part), 
obj, part, output);
-                    onCompleteMarshalling();
-                } else if (honorJaxbAnnotation && anns.length > 0) {
-                    //RpcLit will use the JAXB Bridge to marshall part message 
when it is
-                    //annotated with 
@XmlList,@XmlAttachmentRef,@XmlJavaTypeAdapter
-                    //TODO:Cache the JAXBRIContext
-
-                    
JAXBEncoderDecoder.marshalWithBridge(part.getConcreteName(),
-                                                         part.getTypeClass(),
-                                                         anns,
-                                                         
databinding.getContextClasses(),
-                                                         obj,
-                                                         output,
-                                                         
getAttachmentMarshaller());
-                }
-            }
-        } else if (needToRender(part)) {
-            JAXBEncoderDecoder.marshallNullElement(createMarshaller(null, 
part),
-                                                   output, part);
-
-            onCompleteMarshalling();
-        }
-    }
-
-    private void checkPart(MessagePartInfo part, Object object) {
-        if (part == null || part.getTypeClass() == null || object == null) {
-            return;
-        }
-        Class<?> typeClass = part.getTypeClass();
-        if (typeClass == null) {
-            return;
-        }
-        if (typeClass.isPrimitive()) {
-            if (typeClass == Long.TYPE) {
-                typeClass = Long.class;
-            } else if (typeClass == Integer.TYPE) {
-                typeClass = Integer.class;
-            } else if (typeClass == Short.TYPE) {
-                typeClass = Short.class;
-            } else if (typeClass == Byte.TYPE) {
-                typeClass = Byte.class;
-            } else if (typeClass == Character.TYPE) {
-                typeClass = Character.class;
-            } else if (typeClass == Double.TYPE) {
-                typeClass = Double.class;
-            } else if (typeClass == Float.TYPE) {
-                typeClass = Float.class;
-            } else if (typeClass == Boolean.TYPE) {
-                typeClass = Boolean.class;
-            }
-        } else if (typeClass.isArray() && object instanceof Collection) {
-            //JAXB allows a pseudo [] <--> List equivalence
-            return;
-        }
-        if (!typeClass.isInstance(object)) {
-            throw new IllegalArgumentException("Part " + part.getName() + " 
should be of type "
-                + typeClass.getName() + ", not "
-                + object.getClass().getName());
-        }
-    }
-
-    private boolean needToRender(MessagePartInfo part) {
-        if (part != null && part.getXmlSchema() instanceof XmlSchemaElement) {
-            XmlSchemaElement element = (XmlSchemaElement)part.getXmlSchema();
-            return element.isNillable() && element.getMinOccurs() > 0;
-        }
-        return false;
-    }
-
-    private void onCompleteMarshalling() {
-        if (setEventHandler && veventHandler instanceof 
MarshallerEventHandler) {
-            try {
-                ((MarshallerEventHandler) veventHandler).onMarshalComplete();
-            } catch (MarshalException e) {
-                if (e.getLinkedException() != null) {
-                    throw new Fault(new Message("MARSHAL_ERROR", LOG,
-                            e.getLinkedException().getMessage()), e);
-                }
-                throw new Fault(new Message("MARSHAL_ERROR", LOG, 
e.getMessage()), e);
-            }
-        }
-    }
-}
diff --git 
a/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxrs/provider/AbstractJAXBProvider.java
 
b/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxrs/provider/AbstractJAXBProvider.java
index 165d9120d6..c43d5b42b5 100644
--- 
a/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxrs/provider/AbstractJAXBProvider.java
+++ 
b/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxrs/provider/AbstractJAXBProvider.java
@@ -99,8 +99,8 @@ public abstract class AbstractJAXBProvider<T> extends 
AbstractConfigurableProvid
     private static final String JAXB_DEFAULT_NAME = "##default";
     private static final Set<Class<?>> UNSUPPORTED_CLASSES =
         new HashSet<Class<?>>(Arrays.asList(InputStream.class,
-                                            OutputStream.class,
-                                            StreamingOutput.class));
+            OutputStream.class,
+            StreamingOutput.class));
     protected Set<Class<?>> collectionContextClasses = 
ConcurrentHashMap.newKeySet();
 
     protected Map<String, String> jaxbElementClassMap = Collections.emptyMap();
@@ -177,7 +177,7 @@ public abstract class AbstractJAXBProvider<T> extends 
AbstractConfigurableProvid
     }
 
     protected static void setMarshallerProp(Marshaller ms, Object value,
-                                          String name1, String name2) throws 
Exception {
+                                            String name1, String name2) throws 
Exception {
         try {
             ms.setProperty(name1, value);
         } catch (PropertyException ex) {
@@ -361,9 +361,9 @@ public abstract class AbstractJAXBProvider<T> extends 
AbstractConfigurableProvid
             || isSupported(type, genericType, anns);
     }
     public void writeTo(T t, Type genericType, Annotation[] annotations,
-                 MediaType mediaType,
-                 MultivaluedMap<String, Object> httpHeaders,
-                 OutputStream entityStream) throws IOException, 
WebApplicationException {
+                        MediaType mediaType,
+                        MultivaluedMap<String, Object> httpHeaders,
+                        OutputStream entityStream) throws IOException, 
WebApplicationException {
         @SuppressWarnings("unchecked")
         Class<T> type = (Class<T>)t.getClass();
         writeTo(t, type, genericType, annotations, mediaType, httpHeaders, 
entityStream);
@@ -575,7 +575,7 @@ public abstract class AbstractJAXBProvider<T> extends 
AbstractConfigurableProvid
                 }
             } catch (JAXBException ex) {
                 LOG.fine("Error creating a JAXBContext using ObjectFactory : "
-                            + ex.getMessage());
+                    + ex.getMessage());
             }
             return null;
         });
@@ -602,7 +602,7 @@ public abstract class AbstractJAXBProvider<T> extends 
AbstractConfigurableProvid
             return this.objectFactoryOrIndexMap.get(type.getName());
         } else {
             boolean ret = type.getResource("ObjectFactory.class") != null
-                    || type.getResource("jaxb.index") != null;
+                || type.getResource("jaxb.index") != null;
             this.objectFactoryOrIndexMap.put(type.getName(), ret);
             return ret;
         }
@@ -621,7 +621,7 @@ public abstract class AbstractJAXBProvider<T> extends 
AbstractConfigurableProvid
     protected Unmarshaller createUnmarshaller(Class<?> cls, Type genericType, 
boolean isCollection)
         throws JAXBException {
         JAXBContext context = isCollection ? getCollectionContext(cls)
-                                           : getJAXBContext(cls, genericType);
+            : getJAXBContext(cls, genericType);
         Unmarshaller unmarshaller = context.createUnmarshaller();
         if (validateInputIfPossible) {
             Schema theSchema = getSchema(cls);
@@ -647,7 +647,7 @@ public abstract class AbstractJAXBProvider<T> extends 
AbstractConfigurableProvid
         throws JAXBException {
 
         Class<?> objClazz = JAXBElement.class.isAssignableFrom(cls)
-                            ? ((JAXBElement<?>)obj).getDeclaredType() : cls;
+            ? ((JAXBElement<?>)obj).getDeclaredType() : cls;
 
         JAXBContext context = getJAXBContext(objClazz, genericType);
         Marshaller marshaller = context.createMarshaller();
@@ -766,7 +766,7 @@ public abstract class AbstractJAXBProvider<T> extends 
AbstractConfigurableProvid
         }
         Throwable t = linked != null ? linked : e.getCause() != null ? 
e.getCause() : e;
         String message = new 
org.apache.cxf.common.i18n.Message("JAXB_EXCEPTION",
-                             BUNDLE, sb.toString()).toString();
+            BUNDLE, sb.toString()).toString();
         handleExceptionEnd(t, message, read);
     }
 
@@ -815,19 +815,19 @@ public abstract class AbstractJAXBProvider<T> extends 
AbstractConfigurableProvid
                                                             OutputStream os,
                                                             boolean 
dropAtXmlLevel) {
         return TransformUtils.createTransformWriterIfNeeded(writer, os,
-                                                      outElementsMap,
-                                                      dropAtXmlLevel ? 
outDropElements : null,
-                                                      outAppendMap,
-                                                      attributesToElements,
-                                                      null);
+            outElementsMap,
+            dropAtXmlLevel ? outDropElements : null,
+            outAppendMap,
+            attributesToElements,
+            null);
     }
 
     protected XMLStreamReader createTransformReaderIfNeeded(XMLStreamReader 
reader, InputStream is) {
         return TransformUtils.createTransformReaderIfNeeded(reader, is,
-                                                            inDropElements,
-                                                            inElementsMap,
-                                                            inAppendMap,
-                                                            true);
+            inDropElements,
+            inElementsMap,
+            inAppendMap,
+            true);
     }
 
     protected XMLStreamReader createDepthReaderIfNeeded(XMLStreamReader 
reader, InputStream is) {
@@ -930,7 +930,7 @@ public abstract class AbstractJAXBProvider<T> extends 
AbstractConfigurableProvid
                     List<Object> newList = new ArrayList<>(theList.size());
                     for (Object o : theList) {
                         
newList.add(org.apache.cxf.jaxrs.utils.JAXBUtils.useAdapter(
-                                        ((JAXBElement<?>)o).getValue(), 
adapter, false));
+                            ((JAXBElement<?>)o).getValue(), adapter, false));
                     }
                     theList = newList;
                 } else if (!(first instanceof JAXBElement) && isJaxbElement) {
@@ -949,7 +949,7 @@ public abstract class AbstractJAXBProvider<T> extends 
AbstractConfigurableProvid
                 T[] values = (T[])Array.newInstance(type, theList.size());
                 for (int i = 0; i < theList.size(); i++) {
                     values[i] = 
(T)org.apache.cxf.jaxrs.utils.JAXBUtils.useAdapter(
-                                       theList.get(i), adapter, false);
+                        theList.get(i), adapter, false);
                 }
                 return values;
             }
diff --git 
a/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxrs/provider/GenericArgumentComparator.java
 
b/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxrs/provider/GenericArgumentComparator.java
index 505acfa796..fee24e0ab7 100644
--- 
a/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxrs/provider/GenericArgumentComparator.java
+++ 
b/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxrs/provider/GenericArgumentComparator.java
@@ -26,6 +26,10 @@ import java.util.Comparator;
 
 import org.apache.cxf.jaxrs.utils.GenericsUtils;
 
+/**
+ * Note: This class isn't contained in the official CXF release series. <p></p>
+ * It is only present in the cxf-shade of the TomEE project.
+ */
 public class GenericArgumentComparator implements Comparator<Class<?>> {
 
     private final Class<?> genericInterface;
diff --git 
a/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxrs/utils/InjectionUtils.java 
b/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxrs/utils/InjectionUtils.java
index 72380f197e..4ea69aca28 100644
--- 
a/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxrs/utils/InjectionUtils.java
+++ 
b/deps/cxf-shade/src/patch/java/org/apache/cxf/jaxrs/utils/InjectionUtils.java
@@ -133,8 +133,8 @@ public final class InjectionUtils {
         boolean useJaxb;
         try {
             ClassLoaderUtils.loadClass(
-                    "javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter",
-                    InjectionUtils.class);
+                "javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter",
+                InjectionUtils.class);
             useJaxb = true;
         } catch (final ClassNotFoundException cnfe) {
             useJaxb = false;
@@ -273,7 +273,7 @@ public final class InjectionUtils {
                     f.set(o, v);
                 } catch (IllegalAccessException ex) {
                     reportServerError("FIELD_ACCESS_FAILURE",
-                                      f.getType().getName());
+                        f.getType().getName());
                 }
                 return null;
             }
@@ -281,7 +281,7 @@ public final class InjectionUtils {
     }
 
     public static Object extractFieldValue(final Field f,
-                                        final Object o) {
+                                           final Object o) {
         return AccessController.doPrivileged(new PrivilegedAction<Object>() {
             public Object run() {
                 try {
@@ -289,7 +289,7 @@ public final class InjectionUtils {
                     return f.get(o);
                 } catch (IllegalAccessException ex) {
                     reportServerError("FIELD_ACCESS_FAILURE",
-                                      f.getType().getName());
+                        f.getType().getName());
                 }
                 return null;
             }
@@ -370,15 +370,15 @@ public final class InjectionUtils {
     }
 
     public static void injectThroughMethod(Object requestObject,
-                                               Method method,
-                                               Object parameterValue) {
+                                           Method method,
+                                           Object parameterValue) {
         injectThroughMethod(requestObject, method, parameterValue, null);
     }
 
     public static void injectThroughMethod(Object requestObject,
-                                               Method method,
-                                               Object parameterValue,
-                                               Message inMessage) {
+                                           Method method,
+                                           Object parameterValue,
+                                           Message inMessage) {
         try {
             Method methodToInvoke = checkProxy(method, requestObject);
             methodToInvoke.invoke(requestObject, new Object[]{parameterValue});
@@ -481,8 +481,8 @@ public final class InjectionUtils {
         boolean adapterHasToBeUsed = false;
         Class<?> cls = pClass;
         Class<?> valueType = !USE_JAXB
-                ? cls
-                : JAXBUtils.getValueTypeFromAdapter(pClass, pClass, paramAnns);
+            ? cls
+            : JAXBUtils.getValueTypeFromAdapter(pClass, pClass, paramAnns);
         if (valueType != cls) {
             cls = valueType;
             adapterHasToBeUsed = true;
@@ -501,8 +501,8 @@ public final class InjectionUtils {
         } catch (Exception ex) {
             Throwable t = getOrThrowActualException(ex);
             LOG.warning(new 
org.apache.cxf.common.i18n.Message("CLASS_CONSTRUCTOR_FAILURE",
-                                                               BUNDLE,
-                                                               
pClass.getName()).toString());
+                BUNDLE,
+                pClass.getName()).toString());
             Response r = 
JAXRSUtils.toResponse(HttpUtils.getParameterFailureStatus(pType));
             throw ExceptionUtils.toHttpException(t, r);
         }
@@ -551,30 +551,30 @@ public final class InjectionUtils {
          */
         return ExceptionUtils.toNotAcceptableException(ex, null);
     }
-    
+
     public static <T> Optional<ParamConverter<T>> getParamConverter(Class<T> 
pClass,
-            Type genericType, Annotation[] anns, Message message) {
-        
+                                                                    Type 
genericType, Annotation[] anns, Message message) {
+
         if (message != null) {
             ServerProviderFactory pf = 
ServerProviderFactory.getInstance(message);
             ParamConverter<T> pm = pf.createParameterHandler(pClass, 
genericType, anns, message);
             return Optional.ofNullable(pm);
         }
-        
+
         return Optional.empty();
     }
 
     public static <T> T createFromParameterHandler(String value,
-                                                    Class<T> pClass,
-                                                    Type genericType,
-                                                    Annotation[] anns,
-                                                    Message message) {
+                                                   Class<T> pClass,
+                                                   Type genericType,
+                                                   Annotation[] anns,
+                                                   Message message) {
         return getParamConverter(pClass, genericType, anns, message)
             .map(pm -> pm.fromString(value))
             .orElse(null);
     }
-    
-    
+
+
 
     public static void reportServerError(String messageName, String parameter) 
{
         reportServerError(messageName, parameter, true);
@@ -583,14 +583,14 @@ public final class InjectionUtils {
     public static void reportServerError(String messageName, String parameter, 
boolean logError) {
         org.apache.cxf.common.i18n.Message errorMessage =
             new org.apache.cxf.common.i18n.Message(messageName,
-                                                   BUNDLE,
-                                                   parameter);
+                BUNDLE,
+                parameter);
         if (logError) {
             LOG.severe(errorMessage.toString());
         }
         Response r = 
JAXRSUtils.toResponseBuilder(Response.Status.INTERNAL_SERVER_ERROR)
-                         .type(MediaType.TEXT_PLAIN_TYPE)
-                         .entity(errorMessage.toString()).build();
+            .type(MediaType.TEXT_PLAIN_TYPE)
+            .entity(errorMessage.toString()).build();
         throw ExceptionUtils.toInternalServerErrorException(null, r);
     }
 
@@ -616,8 +616,8 @@ public final class InjectionUtils {
         if (factoryMethodEx != null) {
             Throwable t = getOrThrowActualException(factoryMethodEx);
             LOG.warning(new 
org.apache.cxf.common.i18n.Message("CLASS_VALUE_OF_FAILURE",
-                                                               BUNDLE,
-                                                               
cls.getName()).toString());
+                BUNDLE,
+                cls.getName()).toString());
             throw new WebApplicationException(t, 
HttpUtils.getParameterFailureStatus(pType));
         }
         return result;
@@ -656,8 +656,8 @@ public final class InjectionUtils {
         try {
             if (paramType.isInterface()) {
                 paramType = 
org.apache.cxf.jaxrs.utils.JAXBUtils.getValueTypeFromAdapter(paramType,
-                                                                               
          paramType,
-                                                                               
          paramAnns);
+                    paramType,
+                    paramAnns);
             }
             bean = paramType.newInstance();
         } catch (IllegalAccessException ex) {
@@ -705,7 +705,7 @@ public final class InjectionUtils {
                         setter = m;
                     } else if (m.getName().equalsIgnoreCase("get" + memberKey)
                         || isBooleanType(m.getReturnType())
-                           && m.getName().equalsIgnoreCase("is" + memberKey)) {
+                        && m.getName().equalsIgnoreCase("is" + memberKey)) {
                         getter = m;
                     }
                     if (setter != null && getter != null) {
@@ -742,11 +742,11 @@ public final class InjectionUtils {
                     for (MultivaluedMap<String, String> processedValues : 
processedValuesList) {
                         if (InjectionUtils.isSupportedCollectionOrArray(type)) 
{
                             Object appendValue = 
InjectionUtils.injectIntoCollectionOrArray(type,
-                                                            genericType, 
paramAnns, processedValues,
-                                                            isbean, true,
-                                                            pType, message);
+                                genericType, paramAnns, processedValues,
+                                isbean, true,
+                                pType, message);
                             paramValue = 
InjectionUtils.mergeCollectionsOrArrays(paramValue, appendValue,
-                                                            genericType);
+                                genericType);
                         } else if (isSupportedMap(genericType)) {
                             Object appendValue = injectIntoMap(
                                 genericType, paramAnns, processedValues, true, 
pType, message);
@@ -754,7 +754,7 @@ public final class InjectionUtils {
 
                         } else if (isbean) {
                             paramValue = InjectionUtils.handleBean(type, 
paramAnns, processedValues,
-                                                            pType, message, 
decoded);
+                                pType, message, decoded);
                         } else {
                             paramValue = InjectionUtils.handleParameter(
                                 
processedValues.values().iterator().next().get(0),
@@ -800,13 +800,13 @@ public final class InjectionUtils {
             MultivaluedMap<Object, Object> theValues = new MetadataMap<>();
             ParameterizedType valueParamType = (ParameterizedType) secondType;
             Class<?> valueType = (Class<?>) 
InjectionUtils.getType(valueParamType
-                               .getActualTypeArguments(), 0);
+                .getActualTypeArguments(), 0);
 
             for (Map.Entry<String, List<String>> processedValuesEntry : 
processedValues.entrySet()) {
                 List<String> valuesList = processedValuesEntry.getValue();
                 for (String value : valuesList) {
                     Object o = InjectionUtils.handleParameter(value,
-                                       decoded, valueType, valueType, 
paramAnns, pathParam, message);
+                        decoded, valueType, valueType, paramAnns, pathParam, 
message);
                     
theValues.add(convertStringToPrimitive(processedValuesEntry.getKey(), keyType), 
o);
                 }
             }
@@ -819,7 +819,7 @@ public final class InjectionUtils {
             List<String> valuesList = processedValuesEntry.getValue();
             for (String value : valuesList) {
                 Object o = InjectionUtils.handleParameter(value,
-                                   decoded, valueType, valueType, paramAnns, 
pathParam, message);
+                    decoded, valueType, valueType, paramAnns, pathParam, 
message);
                 theValues.put(
                     convertStringToPrimitive(processedValuesEntry.getKey(), 
keyType),
                     o);
@@ -841,7 +841,7 @@ public final class InjectionUtils {
 
                 return InjectionUtils.isPrimitive(firstType)
                     && (InjectionUtils.isPrimitive(secondRawType)
-                        || allowedMapListValue(secondRawType, secondType));
+                    || allowedMapListValue(secondRawType, secondType));
             }
         }
         return false;
@@ -857,8 +857,8 @@ public final class InjectionUtils {
     }
 
     private static List<MultivaluedMap<String, String>> processValues(Class<?> 
type, Type genericType,
-                                        MultivaluedMap<String, String> values,
-                                        boolean isbean) {
+                                                                      
MultivaluedMap<String, String> values,
+                                                                      boolean 
isbean) {
         final List<MultivaluedMap<String, String>> valuesList;
 
         if (isbean && InjectionUtils.isSupportedCollectionOrArray(type)) {
@@ -934,7 +934,7 @@ public final class InjectionUtils {
             int firstLen = Array.getLength(first);
             int secondLen = Array.getLength(second);
             Object mergedArray = 
Array.newInstance(InjectionUtils.getActualType(genericType),
-                                                    firstLen + secondLen);
+                firstLen + secondLen);
             System.arraycopy(first, 0, mergedArray, 0, firstLen);
             System.arraycopy(second, 0, mergedArray, firstLen, secondLen);
             return mergedArray;
@@ -958,10 +958,10 @@ public final class InjectionUtils {
     private static Object injectIntoCollectionOrArray(Class<?> rawType,
                                                       Type genericType,
                                                       Annotation[] paramAnns,
-                                        MultivaluedMap<String, String> values,
-                                        boolean isbean, boolean decoded,
-                                        ParameterType pathParam, Message 
message) {
-     //CHECKSTYLE:ON
+                                                      MultivaluedMap<String, 
String> values,
+                                                      boolean isbean, boolean 
decoded,
+                                                      ParameterType pathParam, 
Message message) {
+        //CHECKSTYLE:ON
         Class<?> type = getCollectionType(rawType);
 
         final Class<?> realType;
@@ -999,7 +999,7 @@ public final class InjectionUtils {
             valuesList = checkPathSegment(valuesList, realType, pathParam);
             for (int ind = 0; ind < valuesList.size(); ind++) {
                 Object o = InjectionUtils.handleParameter(valuesList.get(ind), 
decoded,
-                               realType, realGenericType, paramAnns, 
pathParam, message);
+                    realType, realGenericType, paramAnns, pathParam, message);
                 addToCollectionValues(theValues, o, ind);
             }
         }
@@ -1048,7 +1048,7 @@ public final class InjectionUtils {
                                                boolean decoded,
                                                ParameterType pathParam,
                                                Message message) {
-    //CHECKSTYLE:ON
+        //CHECKSTYLE:ON
 
         if (paramValues == null || paramValues.size() == 1 && 
paramValues.get(0) == null) {
             if (defaultValue != null) {
@@ -1071,17 +1071,17 @@ public final class InjectionUtils {
             MultivaluedMap<String, String> paramValuesMap = new 
MetadataMap<>();
             paramValuesMap.put("", paramValues);
             value = InjectionUtils.injectIntoCollectionOrArray(paramType, 
genericType, paramAnns,
-                                                paramValuesMap, false, 
decoded, pathParam, message);
+                paramValuesMap, false, decoded, pathParam, message);
         } else {
             String result = null;
             if (!paramValues.isEmpty()) {
                 boolean isLast = pathParam == ParameterType.PATH ? true : 
false;
                 result = isLast ? paramValues.get(paramValues.size() - 1)
-                                : paramValues.get(0);
+                    : paramValues.get(0);
             }
             if (result != null) {
                 value = InjectionUtils.handleParameter(result, decoded, 
paramType, genericType,
-                                                       paramAnns, pathParam, 
message);
+                    paramAnns, pathParam, message);
             }
         }
         return value;
@@ -1115,7 +1115,7 @@ public final class InjectionUtils {
         if (proxy == null) {
             ClassLoader loader
                 = 
proxyClassLoaderCache.getProxyClassLoader(Proxy.class.getClassLoader(),
-                                                            new 
Class<?>[]{Proxy.class, ThreadLocalProxy.class, type});
+                new Class<?>[]{Proxy.class, ThreadLocalProxy.class, type});
             if (!canSeeAllClasses(loader, new Class<?>[]{Proxy.class, 
ThreadLocalProxy.class, type})) {
                 LOG.log(Level.FINE, "find a loader from ProxyClassLoader 
cache,"
                     + " but can't see all interfaces");
@@ -1123,13 +1123,13 @@ public final class InjectionUtils {
                 LOG.log(Level.FINE, "create a new one with parent  " + 
Proxy.class.getClassLoader());
                 proxyClassLoaderCache.removeStaleProxyClassLoader(type);
                 
proxyClassLoaderCache.getProxyClassLoader(Proxy.class.getClassLoader(),
-                                                          new 
Class<?>[]{Proxy.class, ThreadLocalProxy.class, type});
+                    new Class<?>[]{Proxy.class, ThreadLocalProxy.class, type});
 
 
             }
             return (ThreadLocalProxy<T>)Proxy.newProxyInstance(loader,
-                                   new Class[] {type, ThreadLocalProxy.class },
-                                   new ThreadLocalInvocationHandler<T>());
+                new Class[] {type, ThreadLocalProxy.class },
+                new ThreadLocalInvocationHandler<T>());
         }
 
         return (ThreadLocalProxy<T>)proxy;
@@ -1205,8 +1205,8 @@ public final class InjectionUtils {
                 }
                 try {
                     if (value == InjectionUtils.extractFromMethod(instance,
-                                                                  
getGetterFromSetter(method),
-                                                                  false)) {
+                        getGetterFromSetter(method),
+                        false)) {
                         continue;
                     }
 
@@ -1259,8 +1259,8 @@ public final class InjectionUtils {
     }
 
     public static void injectContexts(Object requestObject,
-                                 AbstractResourceInfo resource,
-                                 Message message) {
+                                      AbstractResourceInfo resource,
+                                      Message message) {
         if (resource.contextsAvailable()) {
             injectContextMethods(requestObject, resource, message);
             injectContextFields(requestObject, resource, message);
@@ -1279,8 +1279,8 @@ public final class InjectionUtils {
                 continue;
             }
             Object o = JAXRSUtils.createContextValue(message,
-                                              
method.getGenericParameterTypes()[0],
-                                              entry.getKey());
+                method.getGenericParameterTypes()[0],
+                entry.getKey());
 
             if (o != null) {
                 if (!cri.isSingleton()) {
@@ -1381,7 +1381,7 @@ public final class InjectionUtils {
                         Map<Object, Object> map = CastUtils.cast((Map<?, 
?>)value);
                         for (Map.Entry<Object, Object> entry : map.entrySet()) 
{
                             values.add(propertyName + '.' + 
entry.getKey().toString(),
-                                       entry.getValue().toString());
+                                entry.getValue().toString());
                         }
                     }
                 } else {
@@ -1523,10 +1523,10 @@ public final class InjectionUtils {
     }
 
     public static Type getGenericResponseType(Method invoked,
-                                        Class<?> serviceCls,
-                                        Object targetObject,
-                                        Class<?> targetType,
-                                        Exchange exchange) {
+                                              Class<?> serviceCls,
+                                              Object targetObject,
+                                              Class<?> targetType,
+                                              Exchange exchange) {
         if (targetObject == null) {
             return null;
         }
@@ -1534,7 +1534,7 @@ public final class InjectionUtils {
         if (GenericEntity.class.isAssignableFrom(targetObject.getClass())) {
             type = processGenericTypeIfNeeded(serviceCls, targetType, 
((GenericEntity<?>)targetObject).getType());
         } else if (invoked == null
-                   || !invoked.getReturnType().isAssignableFrom(targetType)) {
+            || !invoked.getReturnType().isAssignableFrom(targetType)) {
             // when a method has been invoked it is still possible that either 
an ExceptionMapper
             // or a ResponseHandler filter overrides a response entity; if it 
happens then
             // the Type is the class of the response object, unless this new 
entity is assignable
diff --git 
a/itests/tomee-server-composer/src/main/java/org/apache/tomee/server/composer/ServerBuilder.java
 
b/itests/tomee-server-composer/src/main/java/org/apache/tomee/server/composer/ServerBuilder.java
index 451b206d4d..0794727304 100644
--- 
a/itests/tomee-server-composer/src/main/java/org/apache/tomee/server/composer/ServerBuilder.java
+++ 
b/itests/tomee-server-composer/src/main/java/org/apache/tomee/server/composer/ServerBuilder.java
@@ -53,7 +53,7 @@ public abstract class ServerBuilder<T extends 
ServerBuilder<T>> {
 
     protected final File archive;
     protected FileFilter filter = pathname -> true;
-    protected Duration await = new Duration("1 minute");
+    protected Duration await = new Duration("3 minutes");
     protected boolean list = false;
     protected boolean debug = false;
     protected final ArrayList<Consumer<File>> homeConsumers = new 
ArrayList<>();
diff --git a/pom.xml b/pom.xml
index 008c869a59..e81e7ba8b5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -191,12 +191,12 @@
     <!-- Jakarta EE Impl. -->
     <tomcat.version>9.0.71</tomcat.version>
     <!-- com.sun -->
-    <version.impl.saaj>1.5.1</version.impl.saaj>
+    <version.impl.saaj>1.5.3</version.impl.saaj>
     <!-- org.apache -->
     <version.activemq>5.16.5</version.activemq>
     <version.batchee>1.0.2</version.batchee>
     <version.bval>2.0.5</version.bval>
-    <version.cxf>3.4.10</version.cxf>
+    <version.cxf>3.5.5</version.cxf>
     <version.geronimo.components>3.1.5</version.geronimo.components>
     
<version.geronimo-javamail_1.6_mail>1.0.1</version.geronimo-javamail_1.6_mail>
     <version.johnzon>1.2.19</version.johnzon>
@@ -213,6 +213,8 @@
 
     <!-- Other API and Impl. not in Jakarta EE -->
     <version.woodstox>6.4.0</version.woodstox>
+    <version.xmlsec>2.3.2</version.xmlsec>
+    <version.wss4j>2.4.1</version.wss4j>
     <version.ehcache>2.10.6</version.ehcache>
     
<version.geronimo-jcache_1.0_spec>1.0-alpha-1</version.geronimo-jcache_1.0_spec>
     <version.krazo>1.1.1</version.krazo>
diff --git a/server/openejb-cxf-rs/pom.xml b/server/openejb-cxf-rs/pom.xml
index b0208d3bd1..3695c43705 100644
--- a/server/openejb-cxf-rs/pom.xml
+++ b/server/openejb-cxf-rs/pom.xml
@@ -38,39 +38,27 @@
       <exclusions>
         <exclusion>
           <groupId>org.glassfish.jaxb</groupId>
-          <artifactId>jaxb-xjc</artifactId>
+          <artifactId>*</artifactId>
         </exclusion>
         <exclusion>
           <groupId>javax.annotation</groupId>
           <artifactId>javax.annotation-api</artifactId>
         </exclusion>
         <exclusion>
-          <groupId>jakarta.activation</groupId>
-          <artifactId>jakarta.activation-api</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.glassfish.jaxb</groupId>
-          <artifactId>jaxb-xjc</artifactId>
+          <groupId>jakarta.annotation</groupId>
+          <artifactId>jakarta.annotation-api</artifactId>
         </exclusion>
         <exclusion>
-          <groupId>org.apache.geronimo.specs</groupId>
-          <artifactId>geronimo-javamail_1.5_spec</artifactId>
+          <groupId>jakarta.activation</groupId>
+          <artifactId>jakarta.activation-api</artifactId>
         </exclusion>
         <exclusion>
           <groupId>org.apache.geronimo.specs</groupId>
-          <artifactId>geronimo-javamail_1.4_spec</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>javax.ws.rs</groupId>
-          <artifactId>jsr311-api</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>javax.ws.rs</groupId>
-          <artifactId>javax.ws.rs-api</artifactId>
+          <artifactId>*</artifactId>
         </exclusion>
         <exclusion>
           <groupId>jakarta.ws.rs</groupId>
-          <artifactId>jakarta.ws.rs-api</artifactId>
+          <artifactId>*</artifactId>
         </exclusion>
         <exclusion>
           <groupId>xalan</groupId>
@@ -82,23 +70,7 @@
         </exclusion>
         <exclusion>
           <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-transports-http</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-core</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-rs-client</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-frontend-jaxrs</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-databinding-jaxb</artifactId>
+          <artifactId>*</artifactId>
         </exclusion>
       </exclusions>
     </dependency>
@@ -117,192 +89,20 @@
       <artifactId>openejb-cxf-transport</artifactId>
       <version>${project.version}</version>
     </dependency>
+
     <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-service-description</artifactId>
-      <version>${version.cxf}</version>
-      <exclusions>
-        <exclusion>
-          <groupId>org.glassfish.jaxb</groupId>
-          <artifactId>jaxb-xjc</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-transports-http</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-core</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-rs-client</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-frontend-jaxrs</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-databinding-jaxb</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-extension-search</artifactId>
-      <version>${version.cxf}</version>
-      <exclusions>
-        <exclusion>
-          <groupId>org.glassfish.jaxb</groupId>
-          <artifactId>jaxb-xjc</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-transports-http</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-core</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-rs-client</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-frontend-jaxrs</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-databinding-jaxb</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-cors</artifactId>
-      <version>${version.cxf}</version>
-      <exclusions>
-        <exclusion>
-          <groupId>org.glassfish.jaxb</groupId>
-          <artifactId>jaxb-xjc</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-transports-http</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-core</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-rs-client</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-frontend-jaxrs</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-databinding-jaxb</artifactId>
-        </exclusion>
-      </exclusions>
+      <groupId>org.apache.openwebbeans</groupId>
+      <artifactId>openwebbeans-spi</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-security-oauth2</artifactId>
-      <version>${version.cxf}</version>
-      <exclusions>
-        <exclusion>
-          <groupId>org.glassfish.jaxb</groupId>
-          <artifactId>jaxb-xjc</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.geronimo.specs</groupId>
-          <artifactId>geronimo-servlet_3.0_spec</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-transports-http</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-core</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-rs-client</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-frontend-jaxrs</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-databinding-jaxb</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency> <!-- JAXBElementProvider -->
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-extension-providers</artifactId>
-      <version>${version.cxf}</version>
-      <exclusions>
-        <exclusion>
-          <groupId>org.glassfish.jaxb</groupId>
-          <artifactId>jaxb-xjc</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-transports-http</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-core</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-rs-client</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-frontend-jaxrs</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-databinding-jaxb</artifactId>
-        </exclusion>
-      </exclusions>
+      <groupId>org.apache.openwebbeans</groupId>
+      <artifactId>openwebbeans-impl</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-rs-sse</artifactId>
-      <version>${version.cxf}</version>
-      <exclusions>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-transports-http</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-core</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-rs-client</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-frontend-jaxrs</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-databinding-jaxb</artifactId>
-        </exclusion>
-      </exclusions>
+      <groupId>org.apache.openwebbeans</groupId>
+      <artifactId>openwebbeans-web</artifactId>
     </dependency>
+
     <dependency> <!-- JohnzonProvider, WadlDocumentMessageBodyWriter and 
JsrProvider -->
       <groupId>org.apache.johnzon</groupId>
       <artifactId>johnzon-jaxrs</artifactId>
@@ -311,6 +111,15 @@
       <groupId>org.apache.johnzon</groupId>
       <artifactId>johnzon-jsonb</artifactId>
     </dependency>
+    <dependency>
+      <groupId>org.apache.johnzon</groupId>
+      <artifactId>johnzon-core</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.johnzon</groupId>
+      <artifactId>johnzon-mapper</artifactId>
+    </dependency>
+
     <dependency>
       <groupId>org.codehaus.jettison</groupId>
       <artifactId>jettison</artifactId>
diff --git a/server/openejb-cxf-transport/pom.xml 
b/server/openejb-cxf-transport/pom.xml
index 730070a75c..d420ff182a 100644
--- a/server/openejb-cxf-transport/pom.xml
+++ b/server/openejb-cxf-transport/pom.xml
@@ -38,31 +38,19 @@
       <exclusions>
         <exclusion>
           <groupId>org.glassfish.jaxb</groupId>
-          <artifactId>jaxb-xjc</artifactId>
+          <artifactId>*</artifactId>
         </exclusion>
         <exclusion>
-          <groupId>jakarta.activation</groupId>
-          <artifactId>jakarta.activation-api</artifactId>
+          <groupId>javax.activation</groupId>
+          <artifactId>javax.activation-api</artifactId>
         </exclusion>
         <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-transports-http</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-core</artifactId>
+          <groupId>jakarta.annotation</groupId>
+          <artifactId>jakarta.annotation-api</artifactId>
         </exclusion>
         <exclusion>
           <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-rs-client</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-frontend-jaxrs</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-databinding-jaxb</artifactId>
+          <artifactId>*</artifactId>
         </exclusion>
       </exclusions>
     </dependency>
@@ -71,32 +59,5 @@
       <artifactId>openejb-http</artifactId>
       <version>${project.version}</version>
     </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-management</artifactId>
-      <version>${version.cxf}</version>
-      <exclusions>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-transports-http</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-core</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-rs-client</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-frontend-jaxrs</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-databinding-jaxb</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
   </dependencies>
 </project>
diff --git a/server/openejb-cxf/pom.xml b/server/openejb-cxf/pom.xml
index 14c9012f75..1de533c354 100644
--- a/server/openejb-cxf/pom.xml
+++ b/server/openejb-cxf/pom.xml
@@ -33,7 +33,6 @@
 
   <properties>
     <tomee.build.name>${project.groupId}.server.cxf</tomee.build.name>
-    <wss4j.version>2.3.3</wss4j.version>
     <openejb.osgi.import.pkg>
       org.apache.xml.resolver*;resolution:=optional,
       *
@@ -60,15 +59,27 @@
       <groupId>wsdl4j</groupId>
       <artifactId>wsdl4j</artifactId>
     </dependency>
+    <!-- override woodstox to mitigate woodstox CVE-2022-40152 -->
+    <dependency>
+      <groupId>com.fasterxml.woodstox</groupId>
+      <artifactId>woodstox-core</artifactId>
+      <version>${version.woodstox}</version>
+    </dependency>
     <dependency>
       <groupId>org.apache.santuario</groupId>
       <artifactId>xmlsec</artifactId>
-      <version>2.2.3</version>
+      <version>${version.xmlsec}</version>
+      <exclusions>
+        <exclusion>
+          <groupId>com.fasterxml.woodstox</groupId>
+          <artifactId>woodstox-core</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-ws-security-dom</artifactId>
-      <version>${wss4j.version}</version>
+      <version>${version.wss4j}</version>
       <exclusions>
         <exclusion>
           <groupId>org.apache.santuario</groupId>
@@ -76,7 +87,7 @@
         </exclusion>
         <exclusion>
           <groupId>org.apache.geronimo.specs</groupId>
-          <artifactId>geronimo-javamail_1.4_spec</artifactId>
+          <artifactId>*</artifactId>
         </exclusion>
         <exclusion>
           <groupId>org.apache.geronimo.javamail</groupId>
@@ -84,15 +95,15 @@
         </exclusion>
         <exclusion>
           <groupId>net.sf.ehcache</groupId>
-          <artifactId>ehcache</artifactId>
+          <artifactId>*</artifactId>
         </exclusion>
         <exclusion>
           <groupId>org.ehcache</groupId>
           <artifactId>*</artifactId>
         </exclusion>
         <exclusion>
-          <artifactId>guava</artifactId>
           <groupId>com.google.guava</groupId>
+          <artifactId>guava</artifactId>
         </exclusion>
         <exclusion>
           <groupId>org.codehaus.woodstox</groupId>
@@ -117,7 +128,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-policy</artifactId>
-      <version>${wss4j.version}</version>
+      <version>${version.wss4j}</version>
       <exclusions>
         <exclusion>
           <groupId>com.fasterxml.woodstox</groupId>
@@ -132,11 +143,11 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-ws-security-stax</artifactId>
-      <version>${wss4j.version}</version>
+      <version>${version.wss4j}</version>
       <exclusions>
         <exclusion>
           <groupId>net.sf.ehcache</groupId>
-          <artifactId>ehcache</artifactId>
+          <artifactId>*</artifactId>
         </exclusion>
         <exclusion>
           <groupId>org.ehcache</groupId>
@@ -147,7 +158,7 @@
     <dependency>
       <groupId>org.apache.wss4j</groupId>
       <artifactId>wss4j-ws-security-policy-stax</artifactId>
-      <version>${wss4j.version}</version>
+      <version>${version.wss4j}</version>
     </dependency>
     <dependency>
       <groupId>org.apache.xbean</groupId>
@@ -177,98 +188,12 @@
       <exclusions>
         <exclusion>
           <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-transports-http</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-core</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-rs-client</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-frontend-jaxrs</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-databinding-jaxb</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.glassfish.jaxb</groupId>
-          <artifactId>jaxb-xjc</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-frontend-jaxws</artifactId>
-      <version>${version.cxf}</version>
-      <exclusions>
-        <exclusion>
-          <groupId>org.glassfish.jaxb</groupId>
-          <artifactId>jaxb-xjc</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.ow2.asm</groupId>
-          <artifactId>asm</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.geronimo.specs</groupId>
-          <artifactId>geronimo-javamail_1.4_spec</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>javax.annotation</groupId>
-          <artifactId>javax.annotation-api</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>com.sun.xml.bind</groupId>
-          <artifactId>jaxb-core</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>com.sun.xml.bind</groupId>
-          <artifactId>jaxb-impl</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-transports-http</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-core</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-databinding-jaxb</artifactId>
+          <artifactId>*</artifactId>
         </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.cxf</groupId>
-      <artifactId>cxf-rt-ws-security</artifactId>
-      <version>${version.cxf}</version>
-      <exclusions>
         <exclusion>
           <groupId>org.glassfish.jaxb</groupId>
-          <artifactId>jaxb-xjc</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.ehcache</groupId>
           <artifactId>*</artifactId>
         </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-transports-http</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-core</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-databinding-jaxb</artifactId>
-        </exclusion>
       </exclusions>
     </dependency>
     <dependency>
diff --git 
a/server/openejb-cxf/src/main/java/org/apache/openejb/server/cxf/CxfCatalogUtils.java
 
b/server/openejb-cxf/src/main/java/org/apache/openejb/server/cxf/CxfCatalogUtils.java
index bbf9a8b2ee..d0e2b40f70 100644
--- 
a/server/openejb-cxf/src/main/java/org/apache/openejb/server/cxf/CxfCatalogUtils.java
+++ 
b/server/openejb-cxf/src/main/java/org/apache/openejb/server/cxf/CxfCatalogUtils.java
@@ -19,7 +19,6 @@ package org.apache.openejb.server.cxf;
 
 import org.apache.cxf.Bus;
 import org.apache.cxf.catalog.OASISCatalogManager;
-import org.apache.xml.resolver.Catalog;
 import org.apache.openejb.util.Logger;
 import org.apache.openejb.util.LogCategory;
 
diff --git a/tomee/tomee-microprofile/mp-common/pom.xml 
b/tomee/tomee-microprofile/mp-common/pom.xml
index 297a8eda2c..a24ed633b0 100644
--- a/tomee/tomee-microprofile/mp-common/pom.xml
+++ b/tomee/tomee-microprofile/mp-common/pom.xml
@@ -270,19 +270,7 @@
         <!-- exclude in favor of cxf-shade -->
         <exclusion>
           <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-core</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-transports-http</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-rs-client</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.cxf</groupId>
-          <artifactId>cxf-rt-frontend-jaxrs</artifactId>
+          <artifactId>*</artifactId>
         </exclusion>
       </exclusions>
     </dependency>
@@ -293,19 +281,39 @@
       <exclusions>
         <exclusion>
           <groupId>org.glassfish.jaxb</groupId>
-          <artifactId>jaxb-xjc</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>javax.ws.rs</groupId>
-          <artifactId>javax.ws.rs-api</artifactId>
+          <artifactId>*</artifactId>
         </exclusion>
         <exclusion>
           <groupId>javax.annotation</groupId>
           <artifactId>javax.annotation-api</artifactId>
         </exclusion>
+        <exclusion>
+          <groupId>jakarta.annotation</groupId>
+          <artifactId>jakarta.annotation-api</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>jakarta.activation</groupId>
+          <artifactId>jakarta.activation-api</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.geronimo.specs</groupId>
+          <artifactId>*</artifactId>
+        </exclusion>
         <exclusion>
           <groupId>jakarta.ws.rs</groupId>
-          <artifactId>jakarta.ws.rs-api</artifactId>
+          <artifactId>*</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>xalan</groupId>
+          <artifactId>xalan</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>xalan</groupId>
+          <artifactId>serializer</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.cxf</groupId>
+          <artifactId>*</artifactId>
         </exclusion>
       </exclusions>
     </dependency>


Reply via email to