diff --git a/distribution/ddf-common/src/main/resources-filtered/etc/org.apache.karaf.features.xml b/distribution/ddf-common/src/main/resources-filtered/etc/org.apache.karaf.features.xml
index 38e76da76fa9..eab6bf1024a6 100644
--- a/distribution/ddf-common/src/main/resources-filtered/etc/org.apache.karaf.features.xml
+++ b/distribution/ddf-common/src/main/resources-filtered/etc/org.apache.karaf.features.xml
@@ -38,8 +38,42 @@
     <!-- A list of repository URIs, feature identifiers and bundle URIs to override "dependency" flag -->
     <overrideBundleDependency/>
 
-    <!-- A list of bundle URI replacements that allows changing external feature definitions -->
-    <bundleReplacements/>
+    <!--
+        Force every foreign Jackson bundle version (Karaf 4.4.11 specs ships 2.18.3,
+        CXF 3.6.10 cxf-jackson ships 2.21.0, pax-web 8.0.35 keycloak-adapter-core ships
+        2.21.1) to converge on DDF's pinned ${jackson.version} from
+        features/utilities/feature.xml. Range [2,3) matches any Jackson 2.x.x —
+        replacing the canonical version with itself is a harmless no-op.
+
+        Without this, multiple jackson-* versions end up exporting the same
+        osgi.wiring.package, and the Felix resolver (especially 4.4.11's) burns
+        minutes of CPU exploring permutations against uses-constraints during the
+        catalog-app + spatial-app + catalog-solr-app runtime install (and can OOM
+        before finding a valid wiring on the default 6g heap).
+    -->
+    <bundleReplacements>
+        <bundle originalUri="mvn:com.fasterxml.jackson.core/jackson-core/[2,3)"
+                replacement="mvn:com.fasterxml.jackson.core/jackson-core/${jackson.version}"
+                mode="maven"/>
+        <bundle originalUri="mvn:com.fasterxml.jackson.core/jackson-databind/[2,3)"
+                replacement="mvn:com.fasterxml.jackson.core/jackson-databind/${jackson.version}"
+                mode="maven"/>
+        <bundle originalUri="mvn:com.fasterxml.jackson.core/jackson-annotations/[2,3)"
+                replacement="mvn:com.fasterxml.jackson.core/jackson-annotations/${jackson.annotations.version}"
+                mode="maven"/>
+        <bundle originalUri="mvn:com.fasterxml.jackson.dataformat/jackson-dataformat-yaml/[2,3)"
+                replacement="mvn:com.fasterxml.jackson.dataformat/jackson-dataformat-yaml/${jackson.version}"
+                mode="maven"/>
+        <bundle originalUri="mvn:com.fasterxml.jackson.jaxrs/jackson-jaxrs-base/[2,3)"
+                replacement="mvn:com.fasterxml.jackson.jaxrs/jackson-jaxrs-base/${jackson.version}"
+                mode="maven"/>
+        <bundle originalUri="mvn:com.fasterxml.jackson.jaxrs/jackson-jaxrs-json-provider/[2,3)"
+                replacement="mvn:com.fasterxml.jackson.jaxrs/jackson-jaxrs-json-provider/${jackson.version}"
+                mode="maven"/>
+        <bundle originalUri="mvn:com.fasterxml.jackson.datatype/jackson-datatype-jsr310/[2,3)"
+                replacement="mvn:com.fasterxml.jackson.datatype/jackson-datatype-jsr310/${jackson.version}"
+                mode="maven"/>
+    </bundleReplacements>
 
     <!-- A list of feature replacements that allows changing external feature definitions -->
     <featureReplacements/>
diff --git a/features/apps/pom.xml b/features/apps/pom.xml
index 0c53ba535910..43c0c1b41e49 100644
--- a/features/apps/pom.xml
+++ b/features/apps/pom.xml
@@ -149,13 +149,6 @@
             <type>xml</type>
             <classifier>features</classifier>
         </dependency>
-        <dependency>
-            <groupId>org.codice.opendj.embedded</groupId>
-            <artifactId>opendj-embedded-app</artifactId>
-            <version>${opendj-embedded.app.version}</version>
-            <type>xml</type>
-            <classifier>features</classifier>
-        </dependency>
         <!--end feature dependencies-->
     </dependencies>
 
diff --git a/features/security/src/main/feature/feature.xml b/features/security/src/main/feature/feature.xml
index 008bb1276ddf..034dd10dbbe2 100644
--- a/features/security/src/main/feature/feature.xml
+++ b/features/security/src/main/feature/feature.xml
@@ -313,26 +313,11 @@
         <bundle>mvn:ddf.security.claims/security-claims-ldap/${project.version}</bundle>
     </feature>
 
-    <feature name="embedded-ldap" version="${project.version}"
-            description="Embedded LDAP for integration testing.">
-        <configfile
-                finalname="${ddf.etc}/Claims_Handler_Manager-ddf.security.sts.claimsHandler.ClaimsHandlerManager.config"
-                override="false">
-            mvn:ddf.security.claims/security-claims-ldap/${project.version}/config/default-ldap-claimshandler
-        </configfile>
-        <configfile
-                finalname="${ddf.etc}/Ldap_Login_Config-ddf.ldap.ldaplogin.LdapLoginConfig.config"
-                override="false">
-            mvn:ddf.security.jaas/security-jaas-ldap/${project.version}/config/default-ldaplogin
-        </configfile>
-    </feature>
-
     <feature name="security-all" version="${project.version}"
              description="All DDF security features">
         <feature>security-core-services</feature>
         <feature>oidc-auth</feature>
         <feature>saml-auth</feature>
         <feature>ldap-auth</feature>
-        <feature>embedded-ldap</feature>
     </feature>
 </features>
diff --git a/platform/security/security-oidc-bundle/pom.xml b/platform/security/security-oidc-bundle/pom.xml
index fda1c7e1aa28..068933ee2c26 100644
--- a/platform/security/security-oidc-bundle/pom.xml
+++ b/platform/security/security-oidc-bundle/pom.xml
@@ -145,6 +145,13 @@
                             !com.nimbusds.jose.shaded.json,
                             !org.reflections.*,
                             !javassist,
+                            !com.unboundid.*,
+                            !de.flapdoodle.*,
+                            !fi.iki.*,
+                            !org.h2.*,
+                            !org.junit.jupiter.*,
+                            !org.ldaptive.*,
+                            !org.skife.*,
                             net.minidev.*;version="${json-smart.version}",
                             *
                         </Import-Package>
diff --git a/pom.xml b/pom.xml
index e2d87bb85b43..d1e46bb86d5f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -123,9 +123,9 @@
         <spock.version>2.3-groovy-4.0</spock.version>
         <mockito.version>3.6.28</mockito.version>
         <pax.exam.version>4.14.0</pax.exam.version>
-        <pax.logging.version>2.3.2</pax.logging.version>
-        <pax.url.version>2.7.0</pax.url.version>
-        <pax.web.version>8.0.34</pax.web.version>
+        <pax.logging.version>2.3.3</pax.logging.version>
+        <pax.url.version>2.7.1</pax.url.version>
+        <pax.web.version>8.0.35</pax.web.version>
         <restito.version>1.1.2</restito.version>
         <restassured.version>5.5.0</restassured.version>
         <groovy.version>4.0.23</groovy.version>
@@ -151,9 +151,9 @@
         <abdera.version>1.1.3</abdera.version>
         <antlr.version>4.3</antlr.version>
         <apache.shiro.version>1.13.0</apache.shiro.version>
-        <asm.version>9.9</asm.version>
+        <asm.version>9.9.1</asm.version>
         <awaitility.version>3.1.6</awaitility.version>
-        <bouncy.version>1.83</bouncy.version>
+        <bouncy.version>1.84</bouncy.version>
         <c3p0.version>0.12.0</c3p0.version>
         <cal10n.version>0.8.1</cal10n.version>
         <cal10n.thirdparty.bundle.version>${cal10n.version}_1</cal10n.thirdparty.bundle.version>
@@ -170,10 +170,10 @@
         <commons-csv.version>1.4</commons-csv.version>
         <commons-digester.version>1.8.1</commons-digester.version>
         <commons-exec.version>1.3</commons-exec.version>
-        <commons-io.version>2.21.0</commons-io.version>
+        <commons-io.version>2.22.0</commons-io.version>
         <commons-lang.version>2.6</commons-lang.version>
         <commons-lang3.version>3.20.0</commons-lang3.version>
-        <commons-logging.version>1.3.5</commons-logging.version>
+        <commons-logging.version>1.3.6</commons-logging.version>
         <commons-math3.version>3.6.1</commons-math3.version>
         <commons-net.version>3.5</commons-net.version>
         <commons-pool.version>1.6</commons-pool.version>
@@ -182,7 +182,7 @@
         <components-font-awesome.version>4.7.0</components-font-awesome.version>
         <countryconverter.version>0.2.4</countryconverter.version>
         <cryptomator.version>1.6.1</cryptomator.version>
-        <cxf.version>3.6.10</cxf.version>
+        <cxf.version>3.6.11</cxf.version>
         <decanter.version>2.9.0</decanter.version>
         <dropwizard.version>4.1.25</dropwizard.version>
         <equinox.version>3.17.200</equinox.version>
@@ -198,13 +198,13 @@
         <gson.version>2.13.2</gson.version>
         <guava.version>33.4.0-jre</guava.version>
         <hawtbuff.version>1.11</hawtbuff.version>
-        <httpclient.version>4.5.13</httpclient.version>
+        <httpclient.version>4.5.14</httpclient.version>
         <httpcore.version>4.4.15</httpcore.version>
         <httpmime.version>${httpclient.version}</httpmime.version>
         <jai-imageio-core.version>1.4.0</jai-imageio-core.version>
         <JavaAPIforKml.version>2.2.1_CODICE_1</JavaAPIforKml.version>
         <jackson.annotations.version>2.21</jackson.annotations.version>
-        <jackson.version>2.21.1</jackson.version>
+        <jackson.version>2.21.2</jackson.version>
         <jakarta.xml.bind.version>2.3.2</jakarta.xml.bind.version>
         <jakarta.activation.version>1.2.2</jakarta.activation.version>
         <jakarta.mail.version>1.6.7</jakarta.mail.version>
@@ -241,12 +241,12 @@
         <jts.spatial4j.version>1.17.1</jts.spatial4j.version>
         <jvnet-ogc.version>2.6.1</jvnet-ogc.version>
         <jwnl.version>1.3.3</jwnl.version>
-        <karaf.version>4.4.10</karaf.version>
-        <jansi.version>2.4.2</jansi.version>
-        <org.osgi.util.promise.version>1.2.0</org.osgi.util.promise.version>
+        <karaf.version>4.4.11</karaf.version>
+        <jansi.version>2.4.3</jansi.version>
+        <org.osgi.util.promise.version>1.3.0</org.osgi.util.promise.version>
         <org.osgi.util.function.version>1.2.0</org.osgi.util.function.version>
         <la4j.version>0.6.0</la4j.version>
-        <apache-log4j.version>2.17.2</apache-log4j.version>
+        <apache-log4j.version>2.25.4</apache-log4j.version>
         <logback.classic.version>1.2.13</logback.classic.version>
         <logback.version>1.2.13</logback.version>
         <mariadb.version>2.4.1</mariadb.version>
@@ -257,7 +257,6 @@
         <net.minidev.asm.version>1.0.2</net.minidev.asm.version>
         <objenesis.version>3.1</objenesis.version>
         <ogc-tools-gml-jts.version>1.2.0</ogc-tools-gml-jts.version>
-        <opendj-embedded.app.version>1.3.3</opendj-embedded.app.version>
         <opensaml.version>3.4.6</opensaml.version>
         <opensaml.osgi.version>3.4.5_2</opensaml.osgi.version>
         <nimbus.oidc.version>11.33</nimbus.oidc.version>
@@ -277,7 +276,7 @@
         <ows-v_1_0_0-schema.version>1.1.0</ows-v_1_0_0-schema.version>
         <ogc-filter-v_1_1_0-schema.thirdparty.version>1.1.0_5</ogc-filter-v_1_1_0-schema.thirdparty.version>
         <openjson.version>1.0.13</openjson.version>
-        <pac4j.version>6.4.2</pac4j.version>
+        <pac4j.version>6.5.2</pac4j.version>
         <pdfbox.version>3.0.5</pdfbox.version>
         <poi.version>5.4.1</poi.version>
         <xmlbeans.version>5.3.0</xmlbeans.version>