From 3785eb55691085181c3cbe566b0a090feb34fae7 Mon Sep 17 00:00:00 2001
From: Arjan Tijms <arjan.tijms@omnifish.ee>
Date: Mon, 18 Mar 2024 16:57:56 +0100
Subject: [PATCH] Fix several warnings during building

Signed-off-by: Arjan Tijms <arjan.tijms@omnifish.ee>
---
 impl/pom.xml                                  | 16 ++--
 .../mapping/DefaultPrincipalMapper.java       |  6 +-
 .../exousia/modules/def/DefaultPolicy.java    | 78 ++++++++++--------
 .../locked/SimplePolicyConfiguration.java     | 79 ++++---------------
 .../modules/locked/SimplePolicyProvider.java  | 26 +++++-
 spi/tomcat/pom.xml                            | 18 ++---
 6 files changed, 104 insertions(+), 119 deletions(-)

diff --git a/impl/pom.xml b/impl/pom.xml
index 7d9a68e..b7fa559 100644
--- a/impl/pom.xml
+++ b/impl/pom.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
 
-    Copyright (c) 2021, 2023 Contributors to Eclipse Foundation.
+    Copyright (c) 2021, 2024 Contributors to Eclipse Foundation.
     Copyright (c) 2010, 2019 Oracle and/or its affiliates. All rights reserved.
 
     This program and the accompanying materials are made available under the
@@ -96,21 +96,21 @@
         <dependency>
             <groupId>jakarta.servlet</groupId>
             <artifactId>jakarta.servlet-api</artifactId>
-            <version>6.1.0-M1</version>
+            <version>6.1.0-M2</version>
             <scope>provided</scope>
             <optional>true</optional>
         </dependency>
         <dependency>
             <groupId>jakarta.authorization</groupId>
             <artifactId>jakarta.authorization-api</artifactId>
-            <version>3.0.0-M1</version>
+            <version>3.0.0-M2</version>
             <scope>provided</scope>
             <optional>true</optional>
         </dependency>
         <dependency>
             <groupId>org.javassist</groupId>
             <artifactId>javassist</artifactId>
-            <version>3.29.2-GA</version>
+            <version>3.30.2-GA</version>
             <scope>provided</scope>
             <optional>true</optional>
         </dependency>
@@ -178,7 +178,7 @@
             
             <plugin>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>3.10.1</version>
+                <version>3.12.1</version>
                 <configuration>
                     <release>17</release>
                 </configuration>
@@ -286,7 +286,7 @@
                             </groups>
                             <bottom><![CDATA[
 Comments to: <a href="mailto:exousia-dev@eclipse.org">exousia-dev@eclipse.org</a>.<br>
-Copyright &#169; 2021, 2023 Eclipse Foundation. All rights reserved.<br>
+Copyright &#169; 2021, 2024 Eclipse Foundation. All rights reserved.<br>
 Use is subject to <a href="http://www.eclipse.org/legal/epl-2.0" target="_top">license terms</a>.]]>
                             </bottom>
                         </configuration>
@@ -298,7 +298,7 @@ Use is subject to <a href="http://www.eclipse.org/legal/epl-2.0" target="_top">l
             <plugin>
                 <groupId>org.eclipse.dash</groupId>
                 <artifactId>license-tool-plugin</artifactId>
-                <version>1.0.2</version>
+                <version>1.1.0</version>
                 <executions>
                     <execution>
                         <id>license-check</id>
@@ -313,7 +313,7 @@ Use is subject to <a href="http://www.eclipse.org/legal/epl-2.0" target="_top">l
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>flatten-maven-plugin</artifactId>
-                <version>1.5.0</version>
+                <version>1.6.0</version>
                 <configuration>
                     <flattenMode>ossrh</flattenMode>
                 </configuration>
diff --git a/impl/src/main/java/org/glassfish/exousia/mapping/DefaultPrincipalMapper.java b/impl/src/main/java/org/glassfish/exousia/mapping/DefaultPrincipalMapper.java
index f055495..c5cf276 100644
--- a/impl/src/main/java/org/glassfish/exousia/mapping/DefaultPrincipalMapper.java
+++ b/impl/src/main/java/org/glassfish/exousia/mapping/DefaultPrincipalMapper.java
@@ -40,6 +40,9 @@
 import javax.security.auth.Subject;
 
 /**
+ * TODO: much or all of this should be removed and/or refactored.
+ * The servers supported here via reflection don't support this version of authorization
+ * at all, and have no need to be longer supported here.
  *
  * @author Arjan Tijms
  */
@@ -74,7 +77,8 @@ private static void tryInitGeronimo() {
             // Geronimo 3.0.1 contains a protection mechanism to ensure only a Geronimo policy provider is installed.
             // This protection can be beat by creating an instance of GeronimoPolicyConfigurationFactory once. This instance
             // will statically register itself with an internal Geronimo class
-            geronimoPolicyConfigurationFactoryInstance = Class.forName("org.apache.geronimo.security.jacc.mappingprovider.GeronimoPolicyConfigurationFactory").newInstance();
+            geronimoPolicyConfigurationFactoryInstance =
+                Class.forName("org.apache.geronimo.security.jacc.mappingprovider.GeronimoPolicyConfigurationFactory").getDeclaredConstructor().newInstance();
             geronimoContextToRoleMapping = new ConcurrentHashMap<>();
         } catch (Exception e) {
             // ignore
diff --git a/impl/src/main/java/org/glassfish/exousia/modules/def/DefaultPolicy.java b/impl/src/main/java/org/glassfish/exousia/modules/def/DefaultPolicy.java
index 1181ae8..4b75a96 100644
--- a/impl/src/main/java/org/glassfish/exousia/modules/def/DefaultPolicy.java
+++ b/impl/src/main/java/org/glassfish/exousia/modules/def/DefaultPolicy.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2023 Contributors to the Eclipse Foundation.
+ * Copyright (c) 2023, 2024 Contributors to the Eclipse Foundation.
  * Copyright (c) 2019, 2021 OmniFaces. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
@@ -16,18 +16,17 @@
  */
 package org.glassfish.exousia.modules.def;
 
+import static jakarta.security.jacc.PolicyContext.PRINCIPAL_MAPPER;
 import static java.util.Collections.list;
 
 import jakarta.security.jacc.Policy;
 import jakarta.security.jacc.PolicyConfiguration;
 import jakarta.security.jacc.PolicyConfigurationFactory;
 import jakarta.security.jacc.PolicyContext;
-import jakarta.security.jacc.PolicyContextException;
 import jakarta.security.jacc.PrincipalMapper;
 import java.security.Permission;
 import java.security.PermissionCollection;
 import java.security.Permissions;
-import java.security.Principal;
 import java.util.Map;
 import java.util.Set;
 import javax.security.auth.Subject;
@@ -38,46 +37,55 @@
  */
 public class DefaultPolicy implements Policy {
 
-    @Override
-    public boolean implies(Permission permissionToBeChecked, Subject subject) {
-        PolicyConfiguration policyConfiguration = getPolicyConfigurationFactory().getPolicyConfiguration();
-        PrincipalMapper roleMapper = getRoleMapper();
+    private PolicyConfigurationFactory policyConfigurationFactory;
+    private PrincipalMapper principalMapper;
 
-        if (isExcluded(policyConfiguration.getExcludedPermissions(), permissionToBeChecked)) {
-            // Excluded permissions cannot be accessed by anyone
-            return false;
-        }
+    @Override
+    public boolean isExcluded(Permission permissionToBeChecked) {
+        return isExcluded(
+                getPolicyConfigurationFactory().getPolicyConfiguration().getExcludedPermissions(),
+                permissionToBeChecked);
+    }
 
-        if (isUnchecked(policyConfiguration.getUncheckedPermissions(), permissionToBeChecked)) {
-            // Unchecked permissions are free to be accessed by everyone
-            return true;
-        }
+    @Override
+    public boolean isUnchecked(Permission permissionToBeChecked) {
+        return isUnchecked(
+                getPolicyConfigurationFactory().getPolicyConfiguration().getUncheckedPermissions(),
+                permissionToBeChecked);
+    }
 
+    @Override
+    public boolean impliesByRole(Permission permissionToBeChecked, Subject subject) {
         if (subject == null) {
+            // Without a subject we can't check for roles, so we can shortcut the outcome.
             return false;
         }
 
-        Set<Principal> currentUserPrincipals = subject.getPrincipals();
+        // Get the configuration and mapper instances.
+        // Note that these are obtained for the current (application) context ID, and this policy could potentially
+        // be used for multiple context IDs. Therefore these objects should not be cached as instance data of this policy.
+        PolicyConfiguration policyConfiguration = getPolicyConfigurationFactory().getPolicyConfiguration();
+        PrincipalMapper roleMapper = getRoleMapper();
 
-        if (!roleMapper.isAnyAuthenticatedUserRoleMapped() && !currentUserPrincipals.isEmpty()) {
+        if (!roleMapper.isAnyAuthenticatedUserRoleMapped() && !subject.getPrincipals().isEmpty()) {
             // The "any authenticated user" role is not mapped, so available to anyone and the current
-            // user is assumed to be authenticated (we assume that an unauthenticated user doesn't have any
+            // caller is assumed to be authenticated (we assume that an unauthenticated caller doesn't have any
             // principals whatever they are)
             if (hasAccessViaRole(policyConfiguration.getPerRolePermissions(), "**", permissionToBeChecked)) {
                 // Access is granted purely based/ on the user being authenticated
-                // (the actual roles, if any, the user has it not important)
+                // (the actual roles, if any, the caller has are not important)
                 return true;
             }
         }
 
-        if (hasAccessViaRoles(policyConfiguration.getPerRolePermissions(), roleMapper.getMappedRoles(subject),
-                permissionToBeChecked)) {
-            // Access is granted via role. Note that if this returns false/ it doesn't mean the permission is not granted.
-            // A role can only grant, not take away permissions.
-            return true;
-        }
-
-        return false;
+        // Check to see if access is granted via role.
+        // Note that if this returns false it doesn't necessarily mean the permission is not granted.
+        // A role can only grant, not take away permissions. Other checks (perhaps another custom policy that embeds us)
+        // may still grant the permission.
+        return hasAccessViaRoles(
+                policyConfiguration.getPerRolePermissions(),
+                roleMapper.getMappedRoles(subject),
+                permissionToBeChecked);
     }
 
     @Override
@@ -110,19 +118,19 @@ public PermissionCollection getPermissionCollection(Subject subject) {
     // ### Private methods
 
     private PolicyConfigurationFactory getPolicyConfigurationFactory() {
-        try {
-            return PolicyConfigurationFactory.getPolicyConfigurationFactory();
-        } catch (ClassNotFoundException | PolicyContextException e) {
-            throw new IllegalStateException(e);
+        if (policyConfigurationFactory == null) {
+            policyConfigurationFactory = PolicyConfigurationFactory.get();
         }
+
+        return policyConfigurationFactory;
     }
 
     private PrincipalMapper getRoleMapper() {
-        try {
-            return PolicyContext.getContext(PolicyContext.PRINCIPAL_MAPPER);
-        } catch (PolicyContextException e) {
-            throw new IllegalStateException(e);
+        if (principalMapper == null) {
+            principalMapper = PolicyContext.get(PRINCIPAL_MAPPER);
         }
+
+        return principalMapper;
     }
 
     private boolean isExcluded(PermissionCollection excludedPermissions, Permission permission) {
diff --git a/impl/src/main/java/org/glassfish/exousia/modules/locked/SimplePolicyConfiguration.java b/impl/src/main/java/org/glassfish/exousia/modules/locked/SimplePolicyConfiguration.java
index 6ada7a7..3bf2012 100644
--- a/impl/src/main/java/org/glassfish/exousia/modules/locked/SimplePolicyConfiguration.java
+++ b/impl/src/main/java/org/glassfish/exousia/modules/locked/SimplePolicyConfiguration.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2021, 2023 Contributors to Eclipse Foundation.
+ * Copyright (c) 2021, 2024 Contributors to Eclipse Foundation.
  * Copyright (c) 1997, 2018 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
@@ -21,16 +21,21 @@
 import static java.util.logging.Level.INFO;
 import static java.util.logging.Level.SEVERE;
 
+import jakarta.security.jacc.EJBRoleRefPermission;
+import jakarta.security.jacc.PolicyConfiguration;
+import jakarta.security.jacc.PolicyContext;
+import jakarta.security.jacc.PolicyContextException;
+import jakarta.security.jacc.PolicyContextHandler;
+import jakarta.security.jacc.WebResourcePermission;
+import jakarta.security.jacc.WebRoleRefPermission;
+import jakarta.security.jacc.WebUserDataPermission;
 import java.lang.reflect.Constructor;
-import java.security.AccessController;
 import java.security.CodeSource;
 import java.security.Permission;
 import java.security.PermissionCollection;
 import java.security.Permissions;
 import java.security.Principal;
-import java.security.PrivilegedAction;
 import java.security.ProtectionDomain;
-import java.security.SecurityPermission;
 import java.util.ArrayList;
 import java.util.Enumeration;
 import java.util.List;
@@ -39,17 +44,8 @@
 import java.util.concurrent.locks.ReentrantReadWriteLock;
 import java.util.logging.Level;
 import java.util.logging.Logger;
-
 import javax.management.MBeanPermission;
 import javax.security.auth.Subject;
-import jakarta.security.jacc.EJBRoleRefPermission;
-import jakarta.security.jacc.PolicyConfiguration;
-import jakarta.security.jacc.PolicyContext;
-import jakarta.security.jacc.PolicyContextException;
-import jakarta.security.jacc.PolicyContextHandler;
-import jakarta.security.jacc.WebResourcePermission;
-import jakarta.security.jacc.WebRoleRefPermission;
-import jakarta.security.jacc.WebUserDataPermission;
 
 /**
  * The methods of this interface are used by containers to create policy statements in a Policy provider.
@@ -66,7 +62,6 @@ public class SimplePolicyConfiguration implements PolicyConfiguration {
     public static final int INSERVICE_STATE = 2;
     public static final int DELETED_STATE = 3;
 
-    private static final Permission setPolicyPermission = new SecurityPermission("setPolicy");
     private String contextId;
     private int state = OPEN_STATE;
 
@@ -186,7 +181,6 @@ public String getContextID() throws PolicyContextException {
      */
     @Override
     public void addToRole(String roleName, PermissionCollection permissions) throws PolicyContextException {
-        checkSetPolicyPermission();
         writeLock.lock();
         try {
             assertStateIsOpen();
@@ -222,7 +216,6 @@ public void addToRole(String roleName, PermissionCollection permissions) throws
      */
     @Override
     public void addToRole(String roleName, Permission permission) throws PolicyContextException {
-        checkSetPolicyPermission();
         writeLock.lock();
         try {
             assertStateIsOpen();
@@ -253,7 +246,6 @@ public void addToRole(String roleName, Permission permission) throws PolicyConte
      */
     @Override
     public void addToUncheckedPolicy(PermissionCollection permissions) throws PolicyContextException {
-        checkSetPolicyPermission();
         writeLock.lock();
         try {
             assertStateIsOpen();
@@ -286,7 +278,6 @@ public void addToUncheckedPolicy(PermissionCollection permissions) throws Policy
      */
     @Override
     public void addToUncheckedPolicy(Permission permission) throws PolicyContextException {
-        checkSetPolicyPermission();
         writeLock.lock();
         try {
             assertStateIsOpen();
@@ -319,7 +310,6 @@ public void addToUncheckedPolicy(Permission permission) throws PolicyContextExce
      */
     @Override
     public void addToExcludedPolicy(PermissionCollection permissions) throws PolicyContextException {
-        checkSetPolicyPermission();
         writeLock.lock();
         try {
             assertStateIsOpen();
@@ -352,7 +342,6 @@ public void addToExcludedPolicy(PermissionCollection permissions) throws PolicyC
      */
     @Override
     public void addToExcludedPolicy(Permission permission) throws PolicyContextException {
-        checkSetPolicyPermission();
         writeLock.lock();
         try {
             assertStateIsOpen();
@@ -383,7 +372,6 @@ public void addToExcludedPolicy(Permission permission) throws PolicyContextExcep
      */
     @Override
     public void removeRole(String roleName) throws PolicyContextException {
-        checkSetPolicyPermission();
         writeLock.lock();
         try {
             assertStateIsOpen();
@@ -419,7 +407,6 @@ public void removeRole(String roleName) throws PolicyContextException {
      */
     @Override
     public void removeUncheckedPolicy() throws PolicyContextException {
-        checkSetPolicyPermission();
         writeLock.lock();
         try {
             assertStateIsOpen();
@@ -445,7 +432,6 @@ public void removeUncheckedPolicy() throws PolicyContextException {
      */
     @Override
     public void removeExcludedPolicy() throws PolicyContextException {
-        checkSetPolicyPermission();
         writeLock.lock();
         try {
             assertStateIsOpen();
@@ -486,7 +472,6 @@ public void removeExcludedPolicy() throws PolicyContextException {
      */
     @Override
     public void linkConfiguration(PolicyConfiguration link) throws PolicyContextException {
-        checkSetPolicyPermission();
         readLock.lock();
         try {
             assertStateIsOpen();
@@ -520,7 +505,6 @@ public void linkConfiguration(PolicyConfiguration link) throws PolicyContextExce
      */
     @Override
     public void delete() throws PolicyContextException {
-        checkSetPolicyPermission();
         SharedState.removeLinks(contextId);
 
         /*
@@ -562,7 +546,6 @@ public void delete() throws PolicyContextException {
      */
     @Override
     public void commit() throws PolicyContextException {
-        checkSetPolicyPermission();
         boolean initRoles = false;
         writeLock.lock();
         try {
@@ -665,14 +648,6 @@ protected static SimplePolicyConfiguration getPolicyConfig(String pcid) {
         return SharedState.lookupConfig(pcid);
     }
 
-    protected static void checkSetPolicyPermission() {
-        SecurityManager securityManager = System.getSecurityManager();
-        if (securityManager != null) {
-            securityManager.checkPermission(setPolicyPermission);
-        }
-
-    }
-
     private void setState(int stateValue) {
         this.state = stateValue;
     }
@@ -809,8 +784,8 @@ public static PermissionCollection getPermissions(PermissionCollection basePerms
     /**
      * Evaluates the policy to determine whether the permissions is granted to the ProtectionDomain.
      *
-     * @param domain the ProtectionDomain to test
-     * @param permission the Permission object to be tested for implication.
+     * @param permissionToBeChecked the Permission object to be tested for implication.
+     * @param subject the subject to test
      *
      * @return integer -1 if excluded, 0 if not implied, 1 if implied granted to this ProtectionDomain.
      *
@@ -991,22 +966,12 @@ private PermissionCollection getPermissions(PermissionCollection basePerms, Perm
     static void refresh() throws PolicyContextException {
     }
 
-    static void doPrivilegedLog(Level level, String msg, Object[] params) {
+    static void doLog(Level level, String msg, Object[] params) {
         Logger logger = SharedState.getLogger();
 
         if (logger.isLoggable(level)) {
-            if (System.getSecurityManager() == null) {
-                logger.log(level, msg, params);
-            } else {
-                AccessController.doPrivileged(new PrivilegedAction<Object>() {
+            logger.log(level, msg, params);
 
-                    @Override
-                    public Object run() {
-                        logger.log(level, msg, params);
-                        return null;
-                    }
-                });
-            }
         }
     }
 
@@ -1014,18 +979,8 @@ static void doPrivilegedLog(Level level, String msg, Throwable t) {
         Logger logger = SharedState.getLogger();
 
         if (logger.isLoggable(level)) {
-            if (System.getSecurityManager() == null) {
-                logger.log(level, msg, t);
-            } else {
-                AccessController.doPrivileged(new PrivilegedAction<Object>() {
+            logger.log(level, msg, t);
 
-                    @Override
-                    public Object run() {
-                        logger.log(level, msg, t);
-                        return null;
-                    }
-                });
-            }
         }
     }
 
@@ -1033,7 +988,7 @@ public Object run() {
     // ### Internal logging interfaces start here ###
 
     static void logGetPermissionsFailure(Object o, Throwable t) {
-        doPrivilegedLog(INFO, "getPermissions.failure", new Object[] { PolicyContext.getContextID(), o });
+        doLog(INFO, "getPermissions.failure", new Object[] { PolicyContext.getContextID(), o });
         doPrivilegedLog(INFO, "getPermissions.failure", t);
     }
 
@@ -1048,12 +1003,12 @@ private static boolean permissionShouldBeLogged(Permission permission) {
 
     static void logAccessFailure(Permission permissionToBeChecked, Subject subject) {
         if (permissionShouldBeLogged(permissionToBeChecked) || SharedState.getLogger().isLoggable(FINE)) {
-            doPrivilegedLog(FINE, "Domain.that.failed", new Object[] { PolicyContext.getContextID(), permissionToBeChecked, subject });
+            doLog(FINE, "Domain.that.failed", new Object[] { PolicyContext.getContextID(), permissionToBeChecked, subject });
         }
     }
 
     static void logException(Level level, String msg, Throwable t) {
-        doPrivilegedLog(level, msg, new Object[] { PolicyContext.getContextID() });
+        doLog(level, msg, new Object[] { PolicyContext.getContextID() });
         doPrivilegedLog(level, msg, t);
     }
 
diff --git a/impl/src/main/java/org/glassfish/exousia/modules/locked/SimplePolicyProvider.java b/impl/src/main/java/org/glassfish/exousia/modules/locked/SimplePolicyProvider.java
index df986e5..fa51308 100644
--- a/impl/src/main/java/org/glassfish/exousia/modules/locked/SimplePolicyProvider.java
+++ b/impl/src/main/java/org/glassfish/exousia/modules/locked/SimplePolicyProvider.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2023 Contributors to Eclipse Foundation.
+ * Copyright (c) 2023, 2024 Contributors to Eclipse Foundation.
  * Copyright (c) 1997, 2018 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
@@ -36,7 +36,7 @@ public class SimplePolicyProvider implements Policy {
     /**
      * ThreadLocal object to keep track of the reentrancy status of each thread. It contains a byte[] object whose single
      * element is either 0 (initial value or no reentrancy), or 1 (current thread is reentrant). When a thread exists the
-     * implies method, byte[0] is alwasy reset to 0.
+     * implies method, byte[0] is always reset to 0.
      */
     private static ThreadLocal<Object> reentrancyStatus = new ThreadLocal<>() {
         @Override
@@ -49,8 +49,8 @@ protected synchronized Object initialValue() {
      * Evaluates the global policy for the permissions granted to the ProtectionDomain and tests whether the permission is
      * granted.
      *
-     * @param domain the ProtectionDomain to test
-     * @param permission the Permission object to be tested for implication.
+     * @param permissionToBeChecked the Permission object to be tested for implication.
+     * @param subject the Subject to test
      *
      * @return true if "permission" is a proper subset of a permission granted to this ProtectionDomain.
      *
@@ -125,6 +125,24 @@ public PermissionCollection getPermissionCollection(Subject subject) {
         return null;
     }
 
+    @Override
+    public boolean impliesByRole(Permission permissionToBeChecked, Subject subject) {
+        // TODO Auto-generated method stub
+        return false;
+    }
+
+    @Override
+    public boolean isExcluded(Permission permissionToBeChecked) {
+        // TODO Auto-generated method stub
+        return false;
+    }
+
+    @Override
+    public boolean isUnchecked(Permission permissionToBeChecked) {
+        // TODO Auto-generated method stub
+        return false;
+    }
+
     /*
      * NB:
      * Excluded permissions should be removed from the collections returned by getPermissions.
diff --git a/spi/tomcat/pom.xml b/spi/tomcat/pom.xml
index 048b42c..96d7398 100644
--- a/spi/tomcat/pom.xml
+++ b/spi/tomcat/pom.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
 
-    Copyright (c) 2021, 2023 Contributors to Eclipse Foundation.
+    Copyright (c) 2021, 2024 Contributors to Eclipse Foundation.
     Copyright (c) 2010, 2019 Oracle and/or its affiliates. All rights reserved.
 
     This program and the accompanying materials are made available under the
@@ -92,21 +92,21 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 
-        <maven.compiler.source>11</maven.compiler.source>
-        <maven.compiler.target>11</maven.compiler.target>
+        <maven.compiler.source>17</maven.compiler.source>
+        <maven.compiler.target>17</maven.compiler.target>
     </properties>
 
     <dependencies>
         <dependency>
             <groupId>jakarta.servlet</groupId>
             <artifactId>jakarta.servlet-api</artifactId>
-            <version>6.0.0</version>
+            <version>6.1.0-M2</version>
             <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>jakarta.authorization</groupId>
             <artifactId>jakarta.authorization-api</artifactId>
-            <version>2.1.0</version>
+            <version>3.0.0-SNAPSHOT</version>
             <scope>provided</scope>
         </dependency>
 
@@ -119,7 +119,7 @@
         <dependency>
             <groupId>org.apache.tomcat</groupId>
             <artifactId>tomcat-catalina</artifactId>
-            <version>10.1.13</version>
+            <version>11.0.0-M18</version>
             <scope>provided</scope>
         </dependency>
 
@@ -156,7 +156,7 @@
         </resources>
 
         <plugins>
-            <!-- Sets minimal Maven version to 3.6.0 -->
+            <!-- Sets minimal Maven version to 3.9.0 -->
             <plugin>
                 <artifactId>maven-enforcer-plugin</artifactId>
                 <executions>
@@ -168,7 +168,7 @@
                         <configuration>
                             <rules>
                                 <requireMavenVersion>
-                                    <version>3.6.0</version>
+                                    <version>3.9.0</version>
                                 </requireMavenVersion>
                             </rules>
                         </configuration>
@@ -211,7 +211,7 @@
                             </groups>
                             <bottom><![CDATA[
 Comments to: <a href="mailto:exousia-dev@eclipse.org">exousia-dev@eclipse.org</a>.<br>
-Copyright &#169; 2021, 2023 Eclipse Foundation. All rights reserved.<br>
+Copyright &#169; 2021, 2024 Eclipse Foundation. All rights reserved.<br>
 Use is subject to <a href="http://www.eclipse.org/legal/epl-2.0" target="_top">license terms</a>.]]>
                             </bottom>
                         </configuration>