From 78c5c326845cd5902e7483f98034dd4c2b720a80 Mon Sep 17 00:00:00 2001
From: zkirksey <zachary.kirksey@ibm.com>
Date: Wed, 25 Feb 2026 11:42:19 -0500
Subject: [PATCH 1/9] Upgrade Karaf to 4.4.10 and remove Jetty bundle
 replacements

---
 .../src/main/filtered-resources/component.xml |  3 -
 .../etc/org.apache.karaf.features.xml         | 72 +------------------
 .../src/main/resources/common-bin.xml         |  3 -
 pom.xml                                       |  4 +-
 4 files changed, 2 insertions(+), 80 deletions(-)

diff --git a/distribution/ddf-catalog/src/main/filtered-resources/component.xml b/distribution/ddf-catalog/src/main/filtered-resources/component.xml
index 94fbcdb0250a..42c30ea4fe2b 100644
--- a/distribution/ddf-catalog/src/main/filtered-resources/component.xml
+++ b/distribution/ddf-catalog/src/main/filtered-resources/component.xml
@@ -19,9 +19,6 @@
             <outputDirectory>./</outputDirectory>
             <excludes>
                 <exclude>etc/org.apache.karaf.features.cfg</exclude>
-                <!-- need to upgrade jetty for CVE-2025-5115 -->
-                <exclude>**/jetty/**/${karaf.jetty.version}/*</exclude>
-                <exclude>**/jetty/**/${karaf.jetty.version}</exclude>
             </excludes>
         </fileSet>
         <fileSet>
diff --git a/distribution/ddf-common/src/main/resources-filtered/etc/org.apache.karaf.features.xml b/distribution/ddf-common/src/main/resources-filtered/etc/org.apache.karaf.features.xml
index c6da6e695180..38e76da76fa9 100644
--- a/distribution/ddf-common/src/main/resources-filtered/etc/org.apache.karaf.features.xml
+++ b/distribution/ddf-common/src/main/resources-filtered/etc/org.apache.karaf.features.xml
@@ -39,77 +39,7 @@
     <overrideBundleDependency/>
 
     <!-- A list of bundle URI replacements that allows changing external feature definitions -->
-    <bundleReplacements>
-        <!-- need to upgrade jetty for CVE-2025-5115 -->
-        <bundle originalUri="mvn:org.eclipse.jetty.http2/http2-client/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty.http2/http2-client/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty.http2/http2-common/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty.http2/http2-common/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty.http2/http2-hpack/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty.http2/http2-hpack/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty.http2/http2-http-client-transport/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty.http2/http2-http-client-transport/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty.http2/http2-server/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty.http2/http2-server/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-alpn-client/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-alpn-client/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-alpn-java-client/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-alpn-java-client/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-alpn-java-server/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-alpn-java-server/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-alpn-openjdk8-client/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-alpn-openjdk8-client/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-alpn-opendjk8-server/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-alpn-openjdk8-server/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-alpn-server/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-alpn-server/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-client/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-client/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-continuation/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-continuation/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-http/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-http/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-io/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-io/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-jaas/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-jaas/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-jmx/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-jmx/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-openid/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-openid/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-proxy/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-proxy/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-rewrite/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-rewrite/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-security/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-security/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-server/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-server/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-servlet/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-servlet/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-servlets/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-servlets/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-util/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-util/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-util-ajax/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-util-ajax/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty/jetty-xml/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty/jetty-xml/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty.websocket/javax-websocket-client-impl/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty.websocket/javax-websocket-client-impl/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty.websocket/javax-websocket-server-impl/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty.websocket/javax-websocket-server-impl/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty.websocket/websocket-api/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty.websocket/websocket-api/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty.websocket/websocket-client/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty.websocket/websocket-client/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty.websocket/websocket-common/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty.websocket/websocket-common/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty.websocket/websocket-server/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty.websocket/websocket-server/${jetty.version}" />
-        <bundle originalUri="mvn:org.eclipse.jetty.websocket/websocket-servlet/${karaf.jetty.version}"
-                replacement="mvn:org.eclipse.jetty.websocket/websocket-servlet/${jetty.version}" />
-    </bundleReplacements>
+    <bundleReplacements/>
 
     <!-- A list of feature replacements that allows changing external feature definitions -->
     <featureReplacements/>
diff --git a/distribution/ddf-common/src/main/resources/common-bin.xml b/distribution/ddf-common/src/main/resources/common-bin.xml
index 043948f08a23..ed46e2d06306 100644
--- a/distribution/ddf-common/src/main/resources/common-bin.xml
+++ b/distribution/ddf-common/src/main/resources/common-bin.xml
@@ -45,9 +45,6 @@
                 <exclude>system/**/*kibana*</exclude>
                 <exclude>**/jetty/**/9.4.6.v20170531/*</exclude>
                 <exclude>**/jetty/**/8.1.14.v20131031/*</exclude>
-                <!-- need to upgrade jetty for CVE-2025-5115 -->
-                <exclude>**/jetty/**/${karaf.jetty.version}/*</exclude>
-                <exclude>**/jetty/**/${karaf.jetty.version}</exclude>
                 <exclude>**/pax/web/**/7.0.0/*</exclude>
                 <!--
                 Since Karaf v2.2.9, Karaf includes a default user "karaf" with its own authentication key in it, thus
diff --git a/pom.xml b/pom.xml
index 59b74da0eef1..3e5961e15ebd 100644
--- a/pom.xml
+++ b/pom.xml
@@ -224,8 +224,6 @@
         <jdom.bundle.version>1.1_4</jdom.bundle.version>
         <jdom2.bundle.version>2.0.6.1_1</jdom2.bundle.version>
         <jetty.version>9.4.58.v20250814</jetty.version>
-        <!-- need to upgrade jetty for CVE-2025-5115 -->
-        <karaf.jetty.version>9.4.57.v20241219</karaf.jetty.version>
         <jgroups.version>3.6.13.Final</jgroups.version>
         <joda-convert.version>1.7</joda-convert.version>
         <dev.failsafe.version>3.2.4</dev.failsafe.version>
@@ -241,7 +239,7 @@
         <jts.spatial4j.version>1.17.1</jts.spatial4j.version>
         <jvnet-ogc.version>2.6.1</jvnet-ogc.version>
         <jwnl.version>1.3.3</jwnl.version>
-        <karaf.version>4.4.8</karaf.version>
+        <karaf.version>4.4.10</karaf.version>
         <jansi.version>2.4.2</jansi.version>
         <org.osgi.util.promise.version>1.2.0</org.osgi.util.promise.version>
         <org.osgi.util.function.version>1.2.0</org.osgi.util.function.version>

From f87c5dd9ddaf40057cf4e7d8150317d1d7f151ed Mon Sep 17 00:00:00 2001
From: zkirksey <zachary.kirksey@ibm.com>
Date: Wed, 25 Feb 2026 11:58:59 -0500
Subject: [PATCH 2/9] Update maxsize for ddf catalog zip

---
 distribution/ddf-catalog/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/distribution/ddf-catalog/pom.xml b/distribution/ddf-catalog/pom.xml
index 46d11c2ab477..cb7edb19fc3c 100644
--- a/distribution/ddf-catalog/pom.xml
+++ b/distribution/ddf-catalog/pom.xml
@@ -183,7 +183,7 @@
                         <configuration>
                             <rules>
                                 <requireFilesSize>
-                                    <maxsize>384000000</maxsize>
+                                    <maxsize>416000000</maxsize>
                                     <minsize>240000000</minsize>
                                     <files>
                                         <file>${project.build.directory}/${distribution.file.name}.zip</file>

From f7d7d7285b43f063e1e5c1d05995eb4590651d91 Mon Sep 17 00:00:00 2001
From: Zac Kirksey <zachary.kirksey@ibm.com>
Date: Wed, 25 Feb 2026 12:45:43 -0500
Subject: [PATCH 3/9] Upgrade pax versions to satisfy new karaf version

---
 pom.xml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index 3e5961e15ebd..80b1d6b05260 100644
--- a/pom.xml
+++ b/pom.xml
@@ -123,9 +123,9 @@
         <spock.version>2.3-groovy-4.0</spock.version>
         <mockito.version>3.6.28</mockito.version>
         <pax.exam.version>4.14.0</pax.exam.version>
-        <pax.logging.version>2.3.0</pax.logging.version>
-        <pax.url.version>2.6.17</pax.url.version>
-        <pax.web.version>8.0.33</pax.web.version>
+        <pax.logging.version>2.3.2</pax.logging.version>
+        <pax.url.version>2.7.0</pax.url.version>
+        <pax.web.version>8.0.34</pax.web.version>
         <restito.version>1.1.2</restito.version>
         <restassured.version>5.5.0</restassured.version>
         <groovy.version>4.0.23</groovy.version>

From bd72bcece017a0e04d8d062bc32015b135a3e516 Mon Sep 17 00:00:00 2001
From: Zac Kirksey <zachary.kirksey@ibm.com>
Date: Wed, 25 Feb 2026 13:39:06 -0500
Subject: [PATCH 4/9] Upgrading more libraries to satisfy karaf upgrade

---
 pom.xml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pom.xml b/pom.xml
index 80b1d6b05260..9e12ec520efd 100644
--- a/pom.xml
+++ b/pom.xml
@@ -151,9 +151,9 @@
         <abdera.version>1.1.3</abdera.version>
         <antlr.version>4.3</antlr.version>
         <apache.shiro.version>1.13.0</apache.shiro.version>
-        <asm.version>9.8</asm.version>
+        <asm.version>9.9</asm.version>
         <awaitility.version>3.1.6</awaitility.version>
-        <bouncy.version>1.81</bouncy.version>
+        <bouncy.version>1.83</bouncy.version>
         <c3p0.version>0.9.5.5</c3p0.version>
         <cal10n.version>0.8.1</cal10n.version>
         <cal10n.thirdparty.bundle.version>${cal10n.version}_1</cal10n.thirdparty.bundle.version>
@@ -170,9 +170,9 @@
         <commons-csv.version>1.4</commons-csv.version>
         <commons-digester.version>1.8.1</commons-digester.version>
         <commons-exec.version>1.3</commons-exec.version>
-        <commons-io.version>2.20.0</commons-io.version>
+        <commons-io.version>2.21.0</commons-io.version>
         <commons-lang.version>2.6</commons-lang.version>
-        <commons-lang3.version>3.18.0</commons-lang3.version>
+        <commons-lang3.version>3.20.0</commons-lang3.version>
         <commons-logging.version>1.3.5</commons-logging.version>
         <commons-math3.version>3.6.1</commons-math3.version>
         <commons-net.version>3.5</commons-net.version>
@@ -203,7 +203,7 @@
         <httpmime.version>${httpclient.version}</httpmime.version>
         <jai-imageio-core.version>1.4.0</jai-imageio-core.version>
         <JavaAPIforKml.version>2.2.1_CODICE_1</JavaAPIforKml.version>
-        <jackson.version>2.18.4</jackson.version>
+        <jackson.version>2.21.0</jackson.version>
         <jakarta.xml.bind.version>2.3.2</jakarta.xml.bind.version>
         <jakarta.activation.version>1.2.2</jakarta.activation.version>
         <jakarta.mail.version>1.6.7</jakarta.mail.version>
@@ -940,7 +940,7 @@
                 <plugin>
                     <groupId>org.codehaus.mojo</groupId>
                     <artifactId>exec-maven-plugin</artifactId>
-                    <version>3.5.1</version>
+                    <version>3.6.3</version>
                 </plugin>
                 <plugin>
                     <groupId>org.codehaus.mojo</groupId>

From bb8049f3a7645715e25c6ed6e69900453e9512b1 Mon Sep 17 00:00:00 2001
From: Zac Kirksey <zachary.kirksey@ibm.com>
Date: Wed, 25 Feb 2026 15:05:19 -0500
Subject: [PATCH 5/9] Revert jackson version to latest supported by maven2

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 9e12ec520efd..91b2458a2b4a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -203,7 +203,7 @@
         <httpmime.version>${httpclient.version}</httpmime.version>
         <jai-imageio-core.version>1.4.0</jai-imageio-core.version>
         <JavaAPIforKml.version>2.2.1_CODICE_1</JavaAPIforKml.version>
-        <jackson.version>2.21.0</jackson.version>
+        <jackson.version>2.20.0</jackson.version>
         <jakarta.xml.bind.version>2.3.2</jakarta.xml.bind.version>
         <jakarta.activation.version>1.2.2</jakarta.activation.version>
         <jakarta.mail.version>1.6.7</jakarta.mail.version>

From 4058edce9c44ef231b15d3413aac33ddd08c476b Mon Sep 17 00:00:00 2001
From: Zac Kirksey <zachary.kirksey@ibm.com>
Date: Wed, 25 Feb 2026 15:24:48 -0500
Subject: [PATCH 6/9] Fixing jackson version

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 91b2458a2b4a..bcb225fbbbe3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -203,7 +203,7 @@
         <httpmime.version>${httpclient.version}</httpmime.version>
         <jai-imageio-core.version>1.4.0</jai-imageio-core.version>
         <JavaAPIforKml.version>2.2.1_CODICE_1</JavaAPIforKml.version>
-        <jackson.version>2.20.0</jackson.version>
+        <jackson.version>2.21</jackson.version>
         <jakarta.xml.bind.version>2.3.2</jakarta.xml.bind.version>
         <jakarta.activation.version>1.2.2</jakarta.activation.version>
         <jakarta.mail.version>1.6.7</jakarta.mail.version>

From 44e7edffdd8236afe056cf4be9aa5506c266d523 Mon Sep 17 00:00:00 2001
From: Zac Kirksey <zachary.kirksey@ibm.com>
Date: Wed, 25 Feb 2026 15:41:02 -0500
Subject: [PATCH 7/9] Should finally fix jackson versions

---
 features/utilities/src/main/feature/feature.xml | 2 +-
 pom.xml                                         | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/features/utilities/src/main/feature/feature.xml b/features/utilities/src/main/feature/feature.xml
index 087a39aa6c07..be077a2a3079 100644
--- a/features/utilities/src/main/feature/feature.xml
+++ b/features/utilities/src/main/feature/feature.xml
@@ -203,7 +203,7 @@
 
     <feature name="jackson" version="${project.version}">
         <bundle>mvn:com.fasterxml.jackson.core/jackson-core/${jackson.version}</bundle>
-        <bundle>mvn:com.fasterxml.jackson.core/jackson-annotations/${jackson.version}</bundle>
+        <bundle>mvn:com.fasterxml.jackson.core/jackson-annotations/${jackson.annotations.version}</bundle>
         <bundle>mvn:com.fasterxml.jackson.core/jackson-databind/${jackson.version}</bundle>
         <bundle>mvn:com.fasterxml.jackson.datatype/jackson-datatype-jsr310/${jackson.version}</bundle>
     </feature>
diff --git a/pom.xml b/pom.xml
index bcb225fbbbe3..7ff663e147cb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -203,7 +203,8 @@
         <httpmime.version>${httpclient.version}</httpmime.version>
         <jai-imageio-core.version>1.4.0</jai-imageio-core.version>
         <JavaAPIforKml.version>2.2.1_CODICE_1</JavaAPIforKml.version>
-        <jackson.version>2.21</jackson.version>
+        <jackson.annotations.version>2.21</jackson.annotations.version>
+        <jackson.version>2.21.0</jackson.version>
         <jakarta.xml.bind.version>2.3.2</jakarta.xml.bind.version>
         <jakarta.activation.version>1.2.2</jakarta.activation.version>
         <jakarta.mail.version>1.6.7</jakarta.mail.version>

From 24a8b110fa11ad46dec84475b327949fabdd86d3 Mon Sep 17 00:00:00 2001
From: Zac Kirksey <zachary.kirksey@ibm.com>
Date: Wed, 25 Feb 2026 19:22:20 -0500
Subject: [PATCH 8/9] Upgrade c3p0 to address CVE-2026-27727

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 7ff663e147cb..fbc56792dd32 100644
--- a/pom.xml
+++ b/pom.xml
@@ -154,7 +154,7 @@
         <asm.version>9.9</asm.version>
         <awaitility.version>3.1.6</awaitility.version>
         <bouncy.version>1.83</bouncy.version>
-        <c3p0.version>0.9.5.5</c3p0.version>
+        <c3p0.version>0.12.0</c3p0.version>
         <cal10n.version>0.8.1</cal10n.version>
         <cal10n.thirdparty.bundle.version>${cal10n.version}_1</cal10n.thirdparty.bundle.version>
         <camel.version>3.22.4</camel.version>

From f004f6d648682ac025945b0ad87dd266c8dade3b Mon Sep 17 00:00:00 2001
From: Zac Kirksey <zachary.kirksey@ibm.com>
Date: Wed, 25 Feb 2026 20:03:51 -0500
Subject: [PATCH 9/9] Attempt to fix itest

---
 .../org/codice/ddf/test/common/configurators/KarafOptions.java | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libs/test-common/src/main/java/org/codice/ddf/test/common/configurators/KarafOptions.java b/libs/test-common/src/main/java/org/codice/ddf/test/common/configurators/KarafOptions.java
index 4497fa6ae6fd..5e4d22bbc5e9 100644
--- a/libs/test-common/src/main/java/org/codice/ddf/test/common/configurators/KarafOptions.java
+++ b/libs/test-common/src/main/java/org/codice/ddf/test/common/configurators/KarafOptions.java
@@ -133,7 +133,8 @@ private Option getMavenRepositoryOptions() {
                 + "http://svn.apache.org/repos/asf/servicemix/m2-repo@id=servicemix,"
                 + "http://repository.springsource.com/maven/bundles/release@id=springsource,"
                 + "http://repository.springsource.com/maven/bundles/external@id=springsourceext,"
-                + "http://oss.sonatype.org/content/repositories/releases/@id=sonatype"),
+                + "http://oss.sonatype.org/content/repositories/releases/@id=sonatype,"
+                + "https://repo.osgeo.org/repository/release/@id=osgeo"),
         when(System.getProperty("maven.repo.local") != null)
             .useOptions(
                 editConfigurationFilePut(