diff --git a/pom.xml b/pom.xml
index 75a9bef..5b62261 100644
--- a/pom.xml
+++ b/pom.xml
@@ -11,7 +11,7 @@
 
     <properties>
         <skip.asciidoc>false</skip.asciidoc>
-        <httpclient.version>4.5.3</httpclient.version>
+        <httpclient.version>4.5.13</httpclient.version>
         <jersey-bundle.version>1.19.3</jersey-bundle.version>
         <org.json.version>20160810</org.json.version>
         <jersey.server.version>1.19.3</jersey.server.version>
@@ -25,10 +25,48 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <servlet-api>2.5</servlet-api>
         <maven.test.skip>false</maven.test.skip>
-        <jacoco-maven-plugin.version>0.7.9</jacoco-maven-plugin.version>
-        <sonar-maven-plugin.version>3.0.2</sonar-maven-plugin.version>
-        <hibernate-annotations.version>3.5.6-Final</hibernate-annotations.version>
+        <jacoco-maven-plugin.version>0.8.6</jacoco-maven-plugin.version>
+        <sonar-maven-plugin.version>3.2</sonar-maven-plugin.version>
+        <dependency-check-maven.version>6.1.5</dependency-check-maven.version>
+        <hibernate-core.version>5.4.30.Final</hibernate-core.version>
     </properties>
+
+    <profiles>
+        <profile>
+            <id>local-fast-build</id>
+            <properties>
+                <skip.asciidoc>true</skip.asciidoc>
+                <maven.test.skip>true</maven.test.skip>
+            </properties>
+        </profile>
+        <profile>
+            <id>securitycheck</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.owasp</groupId>
+                        <artifactId>dependency-check-maven</artifactId>
+                        <version>${dependency-check-maven.version}</version>
+                        <configuration>
+                            <skipProvidedScope>true</skipProvidedScope>
+                            <skipRuntimeScope>true</skipRuntimeScope>
+                            <failBuildOnCVSS>7</failBuildOnCVSS>
+                            <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
+                            <suppressionFiles>${basedir}/securitycheck/suppressed.xml</suppressionFiles>
+                        </configuration>
+                        <executions>
+                            <execution>
+                                <goals>
+                                    <goal>check</goal>
+                                </goals>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
+
     <dependencies>
         <dependency>
             <groupId>org.apache.httpcomponents</groupId>
@@ -95,6 +133,18 @@
             <artifactId>postgresql</artifactId>
             <version>42.2.18</version>
         </dependency>
+        <!-- https://mvnrepository.com/artifact/org.apache.commons/commons-collections4 -->
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-collections4</artifactId>
+            <version>4.4</version>
+        </dependency>
+        <!-- https://mvnrepository.com/artifact/org.apache.commons/commons-lang3 -->
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>3.12.0</version>
+        </dependency>
         <dependency>
             <groupId>junit</groupId>
             <artifactId>junit</artifactId>
@@ -105,6 +155,7 @@
             <groupId>org.easymock</groupId>
             <artifactId>easymock</artifactId>
             <version>${easymock.version}</version>
+            <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.powermock</groupId>
@@ -122,16 +173,17 @@
             <groupId>org.jacoco</groupId>
             <artifactId>jacoco-maven-plugin</artifactId>
             <version>${jacoco-maven-plugin.version}</version>
+            <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-annotations</artifactId>
-            <version>2.5.4</version>
+            <version>2.12.3</version>
         </dependency>
         <dependency>
             <groupId>org.hibernate</groupId>
-            <artifactId>hibernate-annotations</artifactId>
-            <version>${hibernate-annotations.version}</version>
+            <artifactId>hibernate-core</artifactId>
+            <version>${hibernate-core.version}</version>
         </dependency>
         <dependency>
             <groupId>org.slf4j</groupId>
@@ -141,7 +193,7 @@
         <dependency>
             <groupId>com.auth0</groupId>
             <artifactId>java-jwt</artifactId>
-            <version>3.2.0</version>
+            <version>3.15.0</version>
         </dependency>
         <dependency>
             <groupId>commons-codec</groupId>
@@ -160,11 +212,6 @@
                 </exclusion>
             </exclusions>-->
         </dependency>
-<!--        <dependency>-->
-<!--            <groupId>javax.mail</groupId>-->
-<!--            <artifactId>mail</artifactId>-->
-<!--            <version>${javax.mail.version}</version>-->
-<!--        </dependency>-->
         <!-- https://mvnrepository.com/artifact/com.sun.mail/jakarta.mail -->
         <dependency>
             <groupId>com.sun.mail</groupId>
@@ -203,8 +250,9 @@
                 </configuration>
             </plugin>
             <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-war-plugin</artifactId>
-                <version>2.1</version>
+                <version>3.3.1</version>
                 <configuration>
                     <archive>
                         <manifest>
@@ -220,7 +268,7 @@
                 <version>2.7</version>
             </plugin>
             <plugin>
-                <groupId>org.codehaus.mojo</groupId>
+                <groupId>org.sonarsource.scanner.maven</groupId>
                 <artifactId>sonar-maven-plugin</artifactId>
                 <version>${sonar-maven-plugin.version}</version>
             </plugin>
diff --git a/securitycheck/suppressed.xml b/securitycheck/suppressed.xml
new file mode 100644
index 0000000..0b7abcb
--- /dev/null
+++ b/securitycheck/suppressed.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+    <suppress>
+        <notes><![CDATA[
+      file name: log4j-1.2.16.jar
+      ]]></notes>
+        <packageUrl regex="true">^pkg:maven/log4j/log4j@.*$</packageUrl>
+        <vulnerabilityName>CVE-2019-17571</vulnerabilityName>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+   file name: log4j-1.2.16.jar
+   ]]></notes>
+        <packageUrl regex="true">^pkg:maven/log4j/log4j@.*$</packageUrl>
+        <vulnerabilityName>CVE-2020-9488</vulnerabilityName>
+    </suppress>
+</suppressions>
\ No newline at end of file
diff --git a/src/main/java/org/eclipse/openk/elogbook/controller/BackendControllerResponsibility.java b/src/main/java/org/eclipse/openk/elogbook/controller/BackendControllerResponsibility.java
index 1e7d0f7..8e48cd5 100644
--- a/src/main/java/org/eclipse/openk/elogbook/controller/BackendControllerResponsibility.java
+++ b/src/main/java/org/eclipse/openk/elogbook/controller/BackendControllerResponsibility.java
@@ -18,7 +18,7 @@
 import java.util.Date;
 import java.util.List;
 import javax.persistence.EntityManager;
-import org.apache.commons.lang.SerializationUtils;
+import org.apache.commons.lang3.SerializationUtils;
 import org.apache.log4j.Logger;
 import org.eclipse.openk.elogbook.common.JsonGeneratorBase;
 import org.eclipse.openk.elogbook.common.mapper.HResponsibilityMapper;
diff --git a/src/main/java/org/eclipse/openk/elogbook/controller/EmailService.java b/src/main/java/org/eclipse/openk/elogbook/controller/EmailService.java
index 33309dc..d46b853 100644
--- a/src/main/java/org/eclipse/openk/elogbook/controller/EmailService.java
+++ b/src/main/java/org/eclipse/openk/elogbook/controller/EmailService.java
@@ -13,8 +13,8 @@
 
 
 import jakarta.mail.MessagingException;
-import org.apache.commons.lang.time.DateFormatUtils;
-import org.apache.commons.lang.time.DateUtils;
+import org.apache.commons.lang3.time.DateFormatUtils;
+import org.apache.commons.lang3.time.DateUtils;
 import org.apache.log4j.Logger;
 import org.eclipse.openk.elogbook.common.BackendConfig;
 import org.eclipse.openk.elogbook.common.Globals;