diff --git a/.classpath b/.classpath
index 3ec3aa2132..7657c421d8 100644
--- a/.classpath
+++ b/.classpath
@@ -20,7 +20,7 @@
 	<classpathentry kind="lib" path="lib/log4j-1.2.17.jar"/>
 	<classpathentry exported="true" kind="lib" path="ooxml-lib/xmlbeans-3.1.0.jar" sourcepath="ooxml-lib/xmlbeans-3.1.0.jar"/>
 	<classpathentry kind="lib" path="lib/hamcrest-core-1.3.jar"/>
-	<classpathentry kind="lib" path="lib/junit-4.12.jar"/>
+	<classpathentry kind="lib" path="lib/junit-4.13.jar"/>
 	<classpathentry kind="lib" path="ooxml-lib/curvesapi-1.06.jar"/>
 	<classpathentry exported="true" kind="lib" path="ooxml-lib/ooxml-schemas-1.4.jar" sourcepath="ooxml-lib/ooxml-schemas-1.4-sources.jar"/>
 	<classpathentry exported="true" kind="lib" path="ooxml-lib/ooxml-security-1.1.jar" sourcepath="ooxml-lib/ooxml-security-1.1-sources.jar"/>
@@ -41,7 +41,7 @@
 	<classpathentry kind="lib" path="lib/xmlunit-core-2.5.1.jar"/>
 	<classpathentry kind="lib" path="lib/objenesis-2.6.jar"/>
 	<classpathentry kind="lib" path="lib/commons-compress-1.19.jar"/>
-	<classpathentry kind="lib" path="lib/mockito-core-3.0.0.jar"/>
+	<classpathentry kind="lib" path="lib/mockito-core-3.2.4.jar"/>
 	<classpathentry kind="lib" path="lib/byte-buddy-1.10.1.jar"/>
 	<classpathentry kind="lib" path="lib/byte-buddy-agent-1.10.1.jar"/>
 	<classpathentry kind="lib" path="compile-lib/batik-all-1.11.jar"/>
diff --git a/build.gradle b/build.gradle
index ffbb415254..524fa4516a 100644
--- a/build.gradle
+++ b/build.gradle
@@ -44,7 +44,7 @@ configurations {
 }
 
 dependencies {
-    antLibs("junit:junit:4.12")
+    antLibs("junit:junit:4.13")
     antLibs("org.apache.ant:ant-junit:1.10.4")
     antLibs("org.apache.ant:ant-junit4:1.10.4")
 }
@@ -187,8 +187,8 @@ project('main') {
         implementation 'javax.activation:activation:1.1.1'
         implementation 'com.zaxxer:SparseBitSet:1.2'
 
-        testImplementation 'junit:junit:4.12'
-        testImplementation 'org.mockito:mockito-core:3.0.0'
+        testImplementation 'junit:junit:4.13'
+        testImplementation 'org.mockito:mockito-core:3.2.4'
         testImplementation 'org.reflections:reflections:0.9.11'
     }
 
@@ -245,15 +245,15 @@ project('ooxml') {
         implementation 'org.apache.xmlgraphics:xmlgraphics-commons:2.3'
 
         // for ooxml-lite, should we move this somewhere else?
-        implementation 'junit:junit:4.12'
+        implementation 'junit:junit:4.13'
 
         implementation project(':main')
         implementation project(':scratchpad')		// TODO: get rid of this dependency!
         implementation files('../../ooxml-lib/ooxml-schemas-1.4.jar')
         implementation files('../../ooxml-lib/ooxml-security-1.1.jar')
 
-        testImplementation 'junit:junit:4.12'
-        testImplementation 'org.mockito:mockito-core:3.0.0'
+        testImplementation 'junit:junit:4.13'
+        testImplementation 'org.mockito:mockito-core:3.2.4'
         testImplementation 'org.xmlunit:xmlunit-core:2.5.1'
         testImplementation 'org.reflections:reflections:0.9.11'
         testImplementation project(path: ':main', configuration: 'tests')
@@ -316,7 +316,7 @@ project('integrationtest') {
         implementation project(':scratchpad')
         implementation project(':examples')
 
-        testImplementation 'junit:junit:4.12'
+        testImplementation 'junit:junit:4.13'
     }
 
 	jar {
@@ -353,7 +353,7 @@ project('scratchpad') {
 
         // cyclic-dependency here: implementation project(':ooxml')
 
-        testImplementation 'junit:junit:4.12'
+        testImplementation 'junit:junit:4.13'
         testImplementation project(path: ':main', configuration: 'tests')
     }
 
diff --git a/build.xml b/build.xml
index 3448b2df39..b86e4ae1b4 100644
--- a/build.xml
+++ b/build.xml
@@ -177,8 +177,8 @@ under the License.
               value="${repository.m2}/maven2/commons-codec/commons-codec/1.13/commons-codec-1.13.jar"/>
     <property name="main.log4j.jar" location="${main.lib}/log4j-1.2.17.jar"/>
     <property name="main.log4j.url" value="${repository.m2}/maven2/log4j/log4j/1.2.17/log4j-1.2.17.jar"/>
-    <property name="main.junit.jar" location="${main.lib}/junit-4.12.jar"/>
-    <property name="main.junit.url" value="${repository.m2}/maven2/junit/junit/4.12/junit-4.12.jar"/>
+    <property name="main.junit.jar" location="${main.lib}/junit-4.13.jar"/>
+    <property name="main.junit.url" value="${repository.m2}/maven2/junit/junit/4.13/junit-4.13.jar"/>
     <property name="main.jmh.jar" location="${main.lib}/jmh-core-1.19.jar"/>
     <property name="main.jmh.url" value="${repository.m2}/maven2/org/openjdk/jmh/jmh-core/1.19/jmh-core-1.19.jar"/>
     <property name="main.jmhAnnotation.jar" location="${main.lib}/jmh-generator-annprocess-1.19.jar"/>
@@ -188,8 +188,8 @@ under the License.
     <property name="main.hamcrest.url" value="${repository.m2}/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar"/>
     <property name="main.xmlunit.jar" location="${main.lib}/xmlunit-core-2.5.1.jar"/>
     <property name="main.xmlunit.url" value="${repository.m2}/maven2/org/xmlunit/xmlunit-core/2.5.1/xmlunit-core-2.5.1.jar"/>
-    <property name="main.mockito.jar" location="${main.lib}/mockito-core-3.0.0.jar"/>
-    <property name="main.mockito.url" value="${repository.m2}/maven2/org/mockito/mockito-core/3.0.0/mockito-core-3.0.0.jar"/>
+    <property name="main.mockito.jar" location="${main.lib}/mockito-core-3.2.4.jar"/>
+    <property name="main.mockito.url" value="${repository.m2}/maven2/org/mockito/mockito-core/3.2.4/mockito-core-3.2.4.jar"/>
     <property name="main.byte-buddy.jar" location="${main.lib}/byte-buddy-1.10.1.jar"/>
     <property name="main.byte-buddy.url" value="${repository.m2}/maven2/net/bytebuddy/byte-buddy/1.10.1/byte-buddy-1.10.1.jar"/>
     <property name="main.byte-buddy-agent.jar" location="${main.lib}/byte-buddy-agent-1.10.1.jar"/>
@@ -681,6 +681,7 @@ under the License.
                 <include name="xercesImpl-*.jar"/>
                 <include name="junit-3*"/>
                 <include name="junit-4.11*"/>
+                <include name="junit-4.12*"/>
                 <include name="forbiddenapis-1.*.jar"/>
                 <include name="forbiddenapis-2.0.jar"/>
                 <include name="forbiddenapis-2.1.jar"/>
@@ -688,6 +689,7 @@ under the License.
                 <include name="forbiddenapis-2.5.jar"/>
                 <include name="apache-rat-0.11.jar"/>
                 <include name="mockito-core-2*.jar"/>
+                <include name="mockito-core-3.0*.jar"/>
                 <include name="byte-buddy-*1.7*.jar"/>
                 <include name="byte-buddy-*1.9*.jar"/>
                 <include name="jaxb-api-2.3.0.jar"/>
diff --git a/maven/poi.pom b/maven/poi.pom
index a3d15a8b0b..87a4371715 100644
--- a/maven/poi.pom
+++ b/maven/poi.pom
@@ -104,7 +104,7 @@
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
       <scope>test</scope>
-      <version>4.12</version>
+      <version>4.13</version>
     </dependency>
   </dependencies>
 
diff --git a/osgi/pom.xml b/osgi/pom.xml
index 315182e004..6f57c36374 100644
--- a/osgi/pom.xml
+++ b/osgi/pom.xml
@@ -65,7 +65,7 @@
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
-      <version>4.12</version>
+      <version>4.13</version>
     </dependency>
     <dependency>
       <groupId>org.ops4j.pax.exam</groupId>