diff --git a/datamanager-app/pom.xml b/datamanager-app/pom.xml
index ceaab0707..0fd8cfc65 100644
--- a/datamanager-app/pom.xml
+++ b/datamanager-app/pom.xml
@@ -83,10 +83,34 @@
       <groupId>com.vaadin</groupId>
       <!-- Replace artifactId with vaadin-core to use only free components -->
       <artifactId>vaadin</artifactId>
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.commons</groupId>
+          <artifactId>commons-lang3</artifactId>
+        </exclusion>
+      </exclusions>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-lang3</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-fileupload2-core</artifactId>
     </dependency>
     <dependency>
       <groupId>com.vaadin</groupId>
       <artifactId>vaadin-spring-boot-starter</artifactId>
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.commons</groupId>
+          <artifactId>commons-fileupload2-core</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.commons</groupId>
+          <artifactId>commons-lang3</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.springframework.boot</groupId>
@@ -172,11 +196,6 @@
       <artifactId>spring-boot-starter-test</artifactId>
       <scope>test</scope>
     </dependency>
-    <dependency>
-      <groupId>com.vaadin</groupId>
-      <artifactId>vaadin-testbench</artifactId>
-      <scope>test</scope>
-    </dependency>
     <!-- Include JUnit 4 support for TestBench and others -->
     <dependency>
       <groupId>org.junit.vintage</groupId>
diff --git a/datamanager-app/src/main/java/life/qbic/datamanager/configuration/FinancingDatasourceConfig.java b/datamanager-app/src/main/java/life/qbic/datamanager/configuration/FinancingDatasourceConfig.java
index 3d783e820..de4826baa 100644
--- a/datamanager-app/src/main/java/life/qbic/datamanager/configuration/FinancingDatasourceConfig.java
+++ b/datamanager-app/src/main/java/life/qbic/datamanager/configuration/FinancingDatasourceConfig.java
@@ -4,7 +4,6 @@
 import java.util.Map;
 import java.util.Objects;
 import javax.sql.DataSource;
-import org.apache.commons.dbcp2.BasicDataSource;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.autoconfigure.jdbc.DataSourceProperties;
@@ -55,7 +54,6 @@ public DataSourceProperties dataSourceProperties() {
   public DataSource dataSource() {
     return dataSourceProperties()
         .initializeDataSourceBuilder()
-        .type(BasicDataSource.class)
         .build();
   }
 
diff --git a/datamanager-app/src/main/resources/application.properties b/datamanager-app/src/main/resources/application.properties
index e9ecd26a1..5ef08f9f3 100644
--- a/datamanager-app/src/main/resources/application.properties
+++ b/datamanager-app/src/main/resources/application.properties
@@ -48,7 +48,7 @@ spring.jpa.database=mysql
 spring.jpa.show-sql=false
 spring.jpa.properties.hibernate.format_sql=false
 # In case you want to access the H2 database (if you use one)
-spring.h2.console.enabled=true
+spring.h2.console.enabled=false
 # Set explicitly to false to close a session on request finish
 # https://www.baeldung.com/spring-open-session-in-view.
 spring.jpa.open-in-view=false
diff --git a/datamanager-bom/pom.xml b/datamanager-bom/pom.xml
index 1e40b4cbe..74c2061a1 100644
--- a/datamanager-bom/pom.xml
+++ b/datamanager-bom/pom.xml
@@ -11,14 +11,16 @@
   <description>Bill of Materials for DataManager artifacts</description>
 
   <properties>
-    <vaadin.version>24.4.13</vaadin.version>
+    <apache.poi.version>5.5.1</apache.poi.version>
+    <jackson.version>2.18.3</jackson.version>
+    <jakarta.persistence.version>3.2.0</jakarta.persistence.version>
+    <logback.version>1.5.24</logback.version>
     <maven.compiler.source>21</maven.compiler.source>
     <maven.compiler.target>21</maven.compiler.target>
-    <jakarta.persistence.version>3.2.0</jakarta.persistence.version>
-    <jackson.version>2.18.3</jackson.version>
-    <sonar.projectKey>qbicsoftware_data-manager-app</sonar.projectKey>
-    <sonar.organization>qbicsoftware</sonar.organization>
     <sonar.host.url>https://sonarcloud.io</sonar.host.url>
+    <sonar.organization>qbicsoftware</sonar.organization>
+    <sonar.projectKey>qbicsoftware_data-manager-app</sonar.projectKey>
+    <vaadin.version>24.4.13</vaadin.version>
   </properties>
 
   <distributionManagement>
@@ -129,10 +131,31 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-fileupload2-core</artifactId>
+        <version>2.0.0-M4</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-lang3</artifactId>
+        <version>3.20.0</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.activemq</groupId>
+        <artifactId>artemis-jakarta-server</artifactId>
+        <exclusions>
+          <exclusion>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+          </exclusion>
+        </exclusions>
+        <version>2.43.0</version> <!-- version 2.44 is signed differently-->
+      </dependency>
       <dependency>
         <groupId>com.sun.mail</groupId>
         <artifactId>jakarta.mail</artifactId>
-        <version>2.0.1</version>
+        <version>2.0.2</version>
       </dependency>
       <dependency>
         <groupId>org.spockframework</groupId>
@@ -190,12 +213,12 @@
       <dependency>
         <groupId>commons-io</groupId>
         <artifactId>commons-io</artifactId>
-        <version>2.19.0</version>
+        <version>2.20.0</version>
       </dependency>
       <dependency>
         <groupId>org.apache.poi</groupId>
         <artifactId>poi</artifactId>
-        <version>5.4.0</version>
+        <version>${apache.poi.version}</version>
       </dependency>
       <dependency>
         <groupId>com.fasterxml.jackson.core</groupId>
@@ -205,7 +228,13 @@
       <dependency>
         <groupId>org.apache.poi</groupId>
         <artifactId>poi-ooxml</artifactId>
-        <version>5.4.0</version>
+        <version>${apache.poi.version}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>net.javacrumbs.shedlock</groupId>
@@ -227,17 +256,48 @@
       <dependency>
         <groupId>org.docx4j</groupId>
         <artifactId>docx4j-JAXB-ReferenceImpl</artifactId>
-        <version>11.5.3</version>
+        <version>11.5.9</version>
+        <exclusions>
+          <exclusion>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+          </exclusion>
+        </exclusions>
+      </dependency>
+      <!-- https://mvnrepository.com/artifact/org.apache.commons/commons-lang3/3.20.0 -->
+      <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-lang3</artifactId>
+        <version>3.20.0</version>
       </dependency>
       <dependency>
         <groupId>edu.kit.datamanager</groupId>
         <artifactId>ro-crate-java</artifactId>
         <version>1.1.1</version>
+        <exclusions>
+          <exclusion>
+            <groupId>commons-beanutils</groupId>
+            <artifactId>commons-beanutils</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
+
+      <dependency>
+        <groupId>commons-beanutils</groupId>
+        <artifactId>commons-beanutils</artifactId>
+        <version>1.11.0</version>
+      </dependency>
+
       <dependency>
         <groupId>org.docx4j</groupId>
         <artifactId>docx4j-core</artifactId>
-        <version>11.5.0</version>
+        <version>11.5.9</version>
+        <exclusions>
+          <exclusion>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>org.glassfish.jaxb</groupId>
diff --git a/identity-infrastructure/pom.xml b/identity-infrastructure/pom.xml
index 7f14fa8a5..6b8e82508 100644
--- a/identity-infrastructure/pom.xml
+++ b/identity-infrastructure/pom.xml
@@ -24,7 +24,6 @@
     <dependency>
       <groupId>org.apache.activemq</groupId>
       <artifactId>artemis-jakarta-server</artifactId>
-      <version>2.41.0</version>
     </dependency>
 
   </dependencies>
diff --git a/logging/pom.xml b/logging/pom.xml
index b75eeb99e..9551d3588 100644
--- a/logging/pom.xml
+++ b/logging/pom.xml
@@ -15,23 +15,23 @@
       <dependency>
         <groupId>org.slf4j</groupId>
         <artifactId>slf4j-api</artifactId>
-        <version>2.0.16</version>
+        <version>2.0.17</version>
       </dependency>
       <dependency>
         <groupId>org.slf4j</groupId>
         <artifactId>slf4j-simple</artifactId>
-        <version>2.0.16</version>
+        <version>2.0.17</version>
       </dependency>
       <!-- https://mvnrepository.com/artifact/ch.qos.logback/logback-core -->
       <dependency>
         <groupId>ch.qos.logback</groupId>
         <artifactId>logback-classic</artifactId>
-        <version>1.5.12</version>
+        <version>${logback.version}</version>
       </dependency>
       <dependency>
         <groupId>ch.qos.logback</groupId>
         <artifactId>logback-core</artifactId>
-        <version>1.5.16</version>
+        <version>${logback.version}</version>
       </dependency>
     </dependencies>
   </dependencyManagement>
diff --git a/pgp-keys-override.list b/pgp-keys-override.list
index d46b29e28..650e7e1e8 100644
--- a/pgp-keys-override.list
+++ b/pgp-keys-override.list
@@ -67,7 +67,7 @@ io.opencensus:*:*                    = 0x600EA202B1EC682F4A788E5AAC7A514BC9F9BB7
 xerces:xercesImpl:*                  = 0x6CB87B18A453990EAC9453F87D713008CC07E9AD  # xercesImpl.  [oai_citation:12‡Untitled.txt](file-service://file-1UbSKN5j1vX3Pe1FvyAMhb)
 
 # Sigstore (your own plugin/libs)
-dev.sigstore:*:*                     = 0x2C02310024BAAE4B34976FFEAC74A3385D0E3252  # sigstore-maven-plugin / sigstore-java.  [oai_citation:13‡Untitled.txt](file-service://file-1UbSKN5j1vX3Pe1FvyAMhb)
+dev.sigstore:*:*                     = 0x300b49c14dfa7e0ad9d8515400e008229f5daf37  # sigstore-maven-plugin / sigstore-java.  [oai_citation:13‡Untitled.txt](file-service://file-1UbSKN5j1vX3Pe1FvyAMhb)
 
 # Misc seen in log
 io.github.hakky54:sslcontext-kickstart:* = 0xE5138A8E9F2E7E42D38B14D99AEE152CDCCEBFCB  # sslcontext-kickstart.  [oai_citation:14‡Untitled.txt](file-service://file-1UbSKN5j1vX3Pe1FvyAMhb)
@@ -106,7 +106,6 @@ org.hibernate.orm:*:* = 0x1452F35849B50750F6A3BBB4B54011358B352F85
 # --- Apache ActiveMQ Artemis (many modules in your log) ---
 org.apache.activemq:*:*      = 0x28417C95E8906D108392822354A43F3254868410
 
-
 # --- JGroups (unsigned in Maven Central) ---
 org.jgroups:jgroups:*         = noSig
 org.jgroups:jgroups:*:pom     = noSig
@@ -225,8 +224,8 @@ org.jboss.forge.roaster:roaster-jdt:2.29.0.Final:pom = 0x001A438334F162E6AFB27F3
 # Misc seen in the log
 io.methvin:directory-watcher:0.18.0                = 0xAEE8A343247713A5A198640D4D1670765EF90EAB
 io.methvin:directory-watcher:0.18.0:pom            = 0xAEE8A343247713A5A198640D4D1670765EF90EAB
-org.mariadb.jdbc:mariadb-java-client:3.5.6         = 0x4C470FFFEFC4D3DC59778655CE1A3DD5E3C94F49
-org.mariadb.jdbc:mariadb-java-client:3.5.6:pom     = 0x4C470FFFEFC4D3DC59778655CE1A3DD5E3C94F49
+org.mariadb.jdbc:mariadb-java-client:3.5.7         = 0x4C470FFFEFC4D3DC59778655CE1A3DD5E3C94F49
+org.mariadb.jdbc:mariadb-java-client:3.5.7:pom     = 0x4C470FFFEFC4D3DC59778655CE1A3DD5E3C94F49
 com.helger.commons:ph-commons:11.1.5               = 0x670BE7D076A0C89F5F07625AE57428DA9E879E7D
 com.helger.commons:ph-commons:11.1.5:pom           = 0x670BE7D076A0C89F5F07625AE57428DA9E879E7D
 org.tomlj:tomlj:1.0.0                              = 0x80F6D6B0D90C6747753344CAB5A9E81B565E89E0
diff --git a/pom.xml b/pom.xml
index 6d6d025ff..9762e4bf4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -36,24 +36,29 @@
   </modules>
   <packaging>pom</packaging>
 
+
+  <parent>
+    <!-- https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-starter-parent -->
+    <groupId>org.springframework.boot</groupId>
+    <artifactId>spring-boot-starter-parent</artifactId>
+    <version>3.5.9</version>
+  </parent>
+
+
   <properties>
+    <apache.poi.version>5.5.1</apache.poi.version>
+    <jackson.version>2.18.3</jackson.version>
+    <jakarta.persistence.version>3.2.0</jakarta.persistence.version>
     <java.version>21</java.version>
-    <vaadin.version>24.4.13</vaadin.version>
+    <logback.version>1.5.24</logback.version>
     <maven.compiler.source>21</maven.compiler.source>
     <maven.compiler.target>21</maven.compiler.target>
-    <jakarta.persistence.version>3.2.0</jakarta.persistence.version>
-    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-    <jackson.version>2.18.3</jackson.version>
-    <sonar.projectKey>qbicsoftware_data-manager-app</sonar.projectKey>
-    <sonar.organization>qbicsoftware</sonar.organization>
     <sonar.host.url>https://sonarcloud.io</sonar.host.url>
+    <sonar.organization>qbicsoftware</sonar.organization>
+    <sonar.projectKey>qbicsoftware_data-manager-app</sonar.projectKey>
+    <vaadin.version>24.4.13</vaadin.version>
   </properties>
 
-  <parent>
-    <groupId>org.springframework.boot</groupId>
-    <artifactId>spring-boot-starter-parent</artifactId>
-    <version>3.5.6</version>
-  </parent>
 
   <repositories>
     <!-- The order of definitions matters. Explicitly defining central here to make sure it has the highest priority. -->
@@ -243,7 +248,7 @@
       <plugin>
         <groupId>dev.sigstore</groupId>
         <artifactId>sigstore-maven-plugin</artifactId>
-        <version>1.3.0</version>
+        <version>2.0.0</version>
         <executions>
           <execution>
             <id>sigstore-sign</id>