diff --git a/.classpath b/.classpath
index d773c80c77..7d9628dbdf 100644
--- a/.classpath
+++ b/.classpath
@@ -18,30 +18,30 @@
 	<classpathentry kind="lib" path="lib/ant-1.10.1.jar"/>
 	<classpathentry kind="lib" path="lib/ant-launcher-1.10.1.jar"/>
 	<classpathentry kind="lib" path="lib/log4j-1.2.17.jar"/>
-	<classpathentry exported="true" kind="lib" path="ooxml-lib/xmlbeans-3.1.0.jar" sourcepath="ooxml-lib/xmlbeans-3.1.0.jar"/>
+	<classpathentry exported="true" kind="lib" path="lib/ooxml/xmlbeans-4.0.0.jar" sourcepath="lib/ooxml/xmlbeans-3.1.0.jar"/>
 	<classpathentry kind="lib" path="lib/hamcrest-core-1.3.jar"/>
 	<classpathentry kind="lib" path="lib/junit-4.13.jar"/>
-	<classpathentry kind="lib" path="ooxml-lib/curvesapi-1.06.jar"/>
-	<classpathentry exported="true" kind="lib" path="ooxml-lib/ooxml-schemas-1.4.jar" sourcepath="ooxml-lib/ooxml-schemas-1.4-sources.jar"/>
-	<classpathentry exported="true" kind="lib" path="ooxml-lib/ooxml-security-1.1.jar" sourcepath="ooxml-lib/ooxml-security-1.1-sources.jar"/>
+	<classpathentry kind="lib" path="lib/ooxml/curvesapi-1.06.jar"/>
+	<classpathentry exported="true" kind="lib" path="lib/ooxml/ooxml-schemas-1.4.jar" sourcepath="lib/ooxml/ooxml-schemas-1.4-sources.jar"/>
+	<classpathentry exported="true" kind="lib" path="lib/ooxml/ooxml-security-1.1.jar" sourcepath="lib/ooxml/ooxml-security-1.1-sources.jar"/>
 	<classpathentry kind="lib" path="lib/jmh-core-1.19.jar"/>
 	<classpathentry kind="lib" path="lib/jmh-generator-annprocess-1.19.jar"/>
 	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/JavaSE-1.8"/>
 	<classpathentry exported="true" kind="lib" path="compile-lib/slf4j-api-1.7.30.jar"/>
-	<classpathentry kind="lib" path="compile-lib/bcpkix-jdk15on-1.65.jar"/>
-	<classpathentry kind="lib" path="compile-lib/bcprov-ext-jdk15on-1.65.jar"/>
-	<classpathentry kind="lib" path="ooxml-testlib/reflections.jar"/>
-	<classpathentry kind="lib" path="ooxml-testlib/guava.jar"/>
-	<classpathentry kind="lib" path="ooxml-testlib/javassist.jar"/>
-	<classpathentry exported="true" kind="lib" path="compile-lib/xmlsec-2.1.5.jar"/>
-	<classpathentry exported="true" kind="lib" path="lib/commons-codec-1.14.jar"/>
+	<classpathentry kind="lib" path="compile-lib/bcpkix-jdk15on-1.66.jar"/>
+	<classpathentry kind="lib" path="compile-lib/bcprov-ext-jdk15on-1.66.jar"/>
+	<classpathentry kind="lib" path="ooxml-tests/reflections.jar"/>
+	<classpathentry kind="lib" path="ooxml-tests/guava.jar"/>
+	<classpathentry kind="lib" path="ooxml-tests/javassist.jar"/>
+	<classpathentry exported="true" kind="lib" path="lib/ooxml-provided/xmlsec-2.2.0.jar"/>
+	<classpathentry exported="true" kind="lib" path="lib/commons-codec-1.15.jar"/>
 	<classpathentry exported="true" kind="lib" path="lib/commons-logging-1.2.jar"/>
 	<classpathentry exported="true" kind="lib" path="lib/commons-collections4-4.4.jar"/>
 	<classpathentry kind="lib" path="lib/commons-math3-3.6.1.jar"/>
 	<classpathentry kind="lib" path="lib/xmlunit-core-2.5.1.jar"/>
 	<classpathentry kind="lib" path="lib/objenesis-2.6.jar"/>
 	<classpathentry kind="lib" path="lib/commons-compress-1.20.jar"/>
-	<classpathentry kind="lib" path="lib/mockito-core-3.3.3.jar"/>
+	<classpathentry kind="lib" path="lib/mockito-core-3.5.15.jar"/>
 	<classpathentry kind="lib" path="lib/byte-buddy-1.10.1.jar"/>
 	<classpathentry kind="lib" path="lib/byte-buddy-agent-1.10.1.jar"/>
 	<classpathentry kind="lib" path="compile-lib/batik-all-1.12.jar"/>
diff --git a/build.gradle b/build.gradle
index d34280d88f..a0698cfc58 100644
--- a/build.gradle
+++ b/build.gradle
@@ -108,12 +108,12 @@ subprojects {
     version = '5.0.0-SNAPSHOT'
     ext {
         bouncyCastleVersion = '1.66'
-        commonsCodecVersion = '1.14'
+        commonsCodecVersion = '1.15'
         commonsCompressVersion = '1.20'
         commonsMathVersion = '3.6.1'
         japicmpversion = '4.1.2'
         junitVersion = '4.13'
-        mockitoVersion = '3.5.0'
+        mockitoVersion = '3.5.15'
         xmlbeansVersion = '4.0.0'
     }
 
diff --git a/build.xml b/build.xml
index a2aafb712b..9c6d89daa2 100644
--- a/build.xml
+++ b/build.xml
@@ -267,7 +267,7 @@ under the License.
 
     <!-- jars in the /lib directory, see the fetch-jars target-->
     <dependency prefix="main.commons-logging" artifact="commons-logging:commons-logging:1.2" usage="main"/>
-    <dependency prefix="main.commons-codec" artifact="commons-codec:commons-codec:1.14" usage="main"/>
+    <dependency prefix="main.commons-codec" artifact="commons-codec:commons-codec:1.15" usage="main"/>
     <dependency prefix="main.log4j" artifact="log4j:log4j:1.2.17" usage="main"/>
     <dependency prefix="main.commons-collections4" artifact="org.apache.commons:commons-collections4:4.4" usage="main"/>
     <dependency prefix="main.commons-math3" artifact="org.apache.commons:commons-math3:3.6.1" usage="main"/>
@@ -278,7 +278,7 @@ under the License.
     <dependency prefix="main.jmhAnnotation" artifact="org.openjdk.jmh:jmh-generator-annprocess:1.25" usage="main-tests"/>
     <dependency prefix="main.hamcrest" artifact="org.hamcrest:hamcrest:2.2" usage="main-tests"/>
     <dependency prefix="main.xmlunit" artifact="org.xmlunit:xmlunit-core:2.7.0" usage="main-tests"/>
-    <dependency prefix="main.mockito" artifact="org.mockito:mockito-core:3.5.0" usage="main-tests"/>
+    <dependency prefix="main.mockito" artifact="org.mockito:mockito-core:3.5.15" usage="main-tests"/>
     <dependency prefix="main.byte-buddy" artifact="net.bytebuddy:byte-buddy:1.10.14" usage="main-tests"/>
     <dependency prefix="main.byte-buddy-agent" artifact="net.bytebuddy:byte-buddy-agent:1.10.14" usage="main-tests"/>
     <dependency prefix="main.objenesis" artifact="org.objenesis:objenesis:3.1" usage="main-tests"/>
@@ -597,7 +597,8 @@ under the License.
                 <include name="ant*-1.10.1.jar"/>
             </fileset>
             <fileset dir="${basedir}/lib/main-tests">
-                <include name="mockito-core-3.2.4.jar"/>
+                <include name="mockito-core-3.2*.jar"/>
+                <include name="mockito-core-3.5.0.jar"/>
                 <include name="hamcrest-core*"/>
             </fileset>
             <fileset dir="${basedir}/lib/ooxml">
diff --git a/maven/poi.pom b/maven/poi.pom
index ef709c4261..8699cef120 100644
--- a/maven/poi.pom
+++ b/maven/poi.pom
@@ -76,7 +76,7 @@
     <dependency>
       <groupId>commons-codec</groupId>
       <artifactId>commons-codec</artifactId>
-      <version>1.14</version>
+      <version>1.15</version>
     </dependency>
     <dependency>
       <groupId>org.apache.commons</groupId>
diff --git a/sonar/main/pom.xml b/sonar/main/pom.xml
index bc5176d64c..00c49dae1b 100644
--- a/sonar/main/pom.xml
+++ b/sonar/main/pom.xml
@@ -123,7 +123,7 @@
         <dependency>
             <groupId>commons-codec</groupId>
             <artifactId>commons-codec</artifactId>
-            <version>1.14</version>
+            <version>1.15</version>
         </dependency>
         <dependency>
             <groupId>com.zaxxer</groupId>
diff --git a/sonar/pom.xml b/sonar/pom.xml
index ab8a8faa89..35de60c29f 100644
--- a/sonar/pom.xml
+++ b/sonar/pom.xml
@@ -84,7 +84,7 @@
         <xmlbeans.version>4.0.0</xmlbeans.version>
         <junit.version>4.13</junit.version>
         <xmlunit.version>2.7.0</xmlunit.version>
-        <mockito.version>3.5.0</mockito.version>
+        <mockito.version>3.5.15</mockito.version>
         <maven.plugin.resources.version>3.1.0</maven.plugin.resources.version>
         <maven.plugin.jar.version>3.2.0</maven.plugin.jar.version>
         <maven.plugin.clean.version>3.1.0</maven.plugin.clean.version>