From 716694f0429100fbec8150e0880143eff4eb337b Mon Sep 17 00:00:00 2001
From: Kal Ahmed <kal.ahmed@epimorphics.com>
Date: Wed, 11 Mar 2026 09:34:18 +0000
Subject: [PATCH 1/3] Bump tomcat to 11.0.18

---
 CHANGELOG.md | 12 ++++++++++++
 pom.xml      |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..9e36d4a
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,12 @@
+# Changelog
+
+All notable changes to this project from 2026-03-11 onward will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [4.0.1-SNAPSHOT]
+
+### Security
+
+* Bump Tomcat 11.0.14 to 11.0.18
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 824de91..5f73d54 100644
--- a/pom.xml
+++ b/pom.xml
@@ -14,7 +14,7 @@
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <maven.compiler.source>21</maven.compiler.source>
     <maven.compiler.target>21</maven.compiler.target>
-    <tomcat.version>11.0.15</tomcat.version>
+    <tomcat.version>11.0.18</tomcat.version>
     <jena.version>5.6.0</jena.version>
     <lib.version>4.0.1</lib.version>
     <jersey.version>3.1.11</jersey.version>

From 2058d0fd4c3f8c5d964371c74469581e58bccfba Mon Sep 17 00:00:00 2001
From: Kal Ahmed <kal.ahmed@epimorphics.com>
Date: Wed, 11 Mar 2026 09:40:03 +0000
Subject: [PATCH 2/3] Bump shiro-core and shiro-web to 2.1.0

---
 CHANGELOG.md |  3 ++-
 pom.xml      | 25 ++++++++++++++++++++++++-
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9e36d4a..fbdc600 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,4 +9,5 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
-* Bump Tomcat 11.0.14 to 11.0.18
\ No newline at end of file
+* Bump Tomcat 11.0.14 to 11.0.18
+* Update transitive dependencies org.apache.shiro:shiro-core and org.apache.shiro:shiro-web 2.0.5 to 2.1.0
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 5f73d54..3f9aaf4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -27,8 +27,8 @@
       <releases>
         <enabled>true</enabled>
       </releases>
-
     </repository>
+
     <repository>
       <id>apache-repo-snapshots</id>
       <url>https://repository.apache.org/content/repositories/snapshots/</url>
@@ -175,10 +175,33 @@
           <groupId>org.eclipse.jetty.orbit</groupId>
           <artifactId>javax.servlet</artifactId>
         </exclusion>
+        <exclusion>
+          <groupId>org.apache.shiro</groupId>
+          <artifactId>shiro-core</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.shiro</groupId>
+          <artifactId>shiro-web</artifactId>
+        </exclusion>
       </exclusions>
       <scope>test</scope>
     </dependency>
 
+    <!-- Override shiro-core in jena-fuseki-main -->
+    <dependency>
+      <groupId>org.apache.shiro</groupId>
+      <artifactId>shiro-core</artifactId>
+      <version>2.1.0</version>
+      <scope>test</scope>
+    </dependency>
+
+    <!-- Override shiro-web in jena-fuseki-main -->
+    <dependency>
+      <groupId>org.apache.shiro</groupId>
+      <artifactId>shiro-web</artifactId>
+      <version>2.1.0</version>
+      <scope>test</scope>
+    </dependency>
   </dependencies>
 
   <build>

From 1401b93d612973f993f70f42d9260a2f2b474a96 Mon Sep 17 00:00:00 2001
From: Kal Ahmed <kal.ahmed@epimorphics.com>
Date: Wed, 11 Mar 2026 09:45:16 +0000
Subject: [PATCH 3/3] Override jetty libs from jena-fuseki-main

---
 CHANGELOG.md |  3 ++-
 pom.xml      | 21 +++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fbdc600..fffdacc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,4 +10,5 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Security
 
 * Bump Tomcat 11.0.14 to 11.0.18
-* Update transitive dependencies org.apache.shiro:shiro-core and org.apache.shiro:shiro-web 2.0.5 to 2.1.0
\ No newline at end of file
+* Update transitive dependencies org.apache.shiro:shiro-core and org.apache.shiro:shiro-web 2.0.5 to 2.1.0
+* Update transitive dependencies org.eclipse.jetty.ee10:jetty-ee10-servlet, org.eclipse.jetty.ee10:jetty-ee10-servlets and org.eclipse.jetty:jetty-security 12.1.1 to 12.1.7
diff --git a/pom.xml b/pom.xml
index 3f9aaf4..ddc71ff 100644
--- a/pom.xml
+++ b/pom.xml
@@ -202,8 +202,29 @@
       <version>2.1.0</version>
       <scope>test</scope>
     </dependency>
+
+    <!-- Override jetty dependencies in jena-fuseki-main -->
+    <dependency>
+      <groupId>org.eclipse.jetty.ee10</groupId>
+      <artifactId>jetty-ee10-servlet</artifactId>
+      <version>12.1.7</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.eclipse.jetty.ee10</groupId>
+      <artifactId>jetty-ee10-servlets</artifactId>
+      <version>12.1.7</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.eclipse.jetty</groupId>
+      <artifactId>jetty-security</artifactId>
+      <version>12.1.7</version>
+      <scope>test</scope>
+    </dependency>
   </dependencies>
 
+
   <build>
     <plugins>
       <plugin>