diff --git a/osgi/karaf/commands/pom.xml b/osgi/karaf/commands/pom.xml
index 2ec3d795665..55a1e47d6c7 100644
--- a/osgi/karaf/commands/pom.xml
+++ b/osgi/karaf/commands/pom.xml
@@ -76,6 +76,7 @@
                         <Import-Package>
               !org.apache.cxf.karaf.commands,
               org.apache.karaf.shell*;version="[4,5)",
+              org.apache.cxf*;version="[4.1.5,4.1.6)",
               *
                         </Import-Package>
                         <_nouses>true</_nouses>
diff --git a/osgi/karaf/features/src/main/resources/features.xml b/osgi/karaf/features/src/main/resources/features.xml
index ccc1b4b22e1..66ce7dad621 100644
--- a/osgi/karaf/features/src/main/resources/features.xml
+++ b/osgi/karaf/features/src/main/resources/features.xml
@@ -22,7 +22,7 @@
 
     <feature name="cxf-specs-jakarta-servlet" version="6.1.0">
         <bundle start-level="10">mvn:jakarta.servlet/jakarta.servlet-api/6.1.0</bundle>
-        <bundle start-level="10" start="false">mvn:org.ops4j.pax.web/pax-web-compatibility-servlet/11.0.1</bundle>
+        <bundle start-level="10" start="false">mvn:org.ops4j.pax.web/pax-web-compatibility-servlet/11.1.0</bundle>
     </feature>
 
     <feature name="cxf-specs" version="${project.version}">
@@ -30,7 +30,7 @@
         <bundle start-level="10" dependency="true">mvn:jakarta.activation/jakarta.activation-api/${cxf.jakarta.activation.version}</bundle>
         <bundle start-level="10" dependency="true">mvn:jakarta.annotation/jakarta.annotation-api/${cxf.jakarta.annotation-api.version}</bundle>
         <bundle start-level="10">mvn:jakarta.xml.bind/jakarta.xml.bind-api/4.0.2</bundle>
-        <bundle start-level="10" start="false">mvn:org.ops4j.pax.web/pax-web-compatibility-jaxb3/11.0.1</bundle>
+        <bundle start-level="10" start="false">mvn:org.ops4j.pax.web/pax-web-compatibility-jaxb3/11.1.0</bundle>
         <bundle start-level="10" dependency="true">mvn:jakarta.xml.ws/jakarta.xml.ws-api/${cxf.jakarta.wsapi.version}</bundle>
         <bundle start-level="10" dependency="true">mvn:jakarta.ws.rs/jakarta.ws.rs-api/${cxf.jakarta.ws.rs.version}</bundle>
         <bundle start-level="10" dependency="true">mvn:jakarta.xml.soap/jakarta.xml.soap-api/${cxf.jakarta.soapapi.version}</bundle>
@@ -120,6 +120,8 @@
         <bundle start-level="30" dependency="true">mvn:org.apache.neethi/neethi/${cxf.neethi.version}</bundle>
         <bundle start-level="30" dependency="true">mvn:org.apache.servicemix.bundles/org.apache.servicemix.bundles.jasypt/${cxf.jasypt.bundle.version}</bundle>
         <bundle start-level="30">mvn:org.apache.wss4j/wss4j-bindings/${cxf.jakarta.wss4j.version}</bundle>
+        <!-- wrap to force opensaml version range -->
+        <!--bundle start-level="30">wrap:mvn:org.apache.wss4j/wss4j-ws-security-common/${cxf.jakarta.wss4j.version}$overwrite=merge&amp;Import-Package=net.shibboleth.shared.xml;resolution:=optional,net.shibboleth.shared.xml.impl;resolution:=optional,net.shibboleth.utilities.java.support.primitive;resolution:=optional,com.sun.security.jgss;resolution:=optional,jakarta.mail.internet;version="[2.1,3)",java.io,java.lang,java.lang.invoke,java.lang.reflect,java.math,java.net,java.nio.charset,java.nio.file,java.security,java.security.cert,java.security.interfaces,java.security.spec,java.time,java.time.format,java.time.temporal,java.util,java.util.concurrent,java.util.function,java.util.regex,javax.crypto,javax.crypto.spec,javax.naming,javax.naming.ldap,javax.security.auth,javax.security.auth.callback,javax.security.auth.kerberos,javax.security.auth.login,javax.security.auth.x500,javax.xml.crypto,javax.xml.crypto.dom,javax.xml.crypto.dsig,javax.xml.crypto.dsig.keyinfo,javax.xml.namespace,javax.xml.transform,javax.xml.transform.dom,javax.xml.transform.sax,javax.xml.transform.stream,org.apache.jcp.xml.dsig.internal.dom;version="[4.0,5)",org.apache.wss4j.common.bsp,org.apache.wss4j.common.crypto,org.apache.wss4j.common.ext,org.apache.wss4j.common.kerberos,org.apache.wss4j.common.saml,org.apache.wss4j.common.saml.bean,org.apache.wss4j.common.saml.builder,org.apache.wss4j.common.util,org.apache.xml.security;version="[4.0,5)",org.apache.xml.security.algorithms;version="[4.0,5)",org.apache.xml.security.encryption;version="[4.0,5)",org.apache.xml.security.encryption.params;version="[4.0,5)",org.apache.xml.security.exceptions;version="[4.0,5)",org.apache.xml.security.stax.ext;version="[4.0,5)",org.apache.xml.security.stax.impl.util;version="[4.0,5)",org.apache.xml.security.utils;version="[4.0,5)",org.bouncycastle.asn1;resolution:=optional;version="[1.82,2)",org.bouncycastle.asn1.x500;resolution:=optional;version="[1.82,2)",org.bouncycastle.asn1.x509;resolution:=optional;version="[1.82,2)",org.ehcache;resolution:=optional;version="[3.11,4)",org.ehcache.config;resolution:=optional;version="[3.11,4)",org.ehcache.config.builders;resolution:=optional;version="[3.11,4)",org.ehcache.config.units;resolution:=optional;version="[3.11,4)",org.ehcache.expiry;resolution:=optional;version="[3.11,4)",org.ietf.jgss,org.jasypt.encryption.pbe,org.jasypt.iv,org.jasypt.salt,org.opensaml*;version="[5,6)",org.slf4j;version="[2.0,3)",org.w3c.dom,org.xml.sax</bundle-->
         <bundle start-level="30">mvn:org.apache.wss4j/wss4j-ws-security-common/${cxf.jakarta.wss4j.version}</bundle>
         <bundle start-level="30">mvn:org.apache.wss4j/wss4j-bindings/${cxf.jakarta.wss4j.version}</bundle>
         <bundle start-level="30">mvn:org.apache.wss4j/wss4j-ws-security-dom/${cxf.jakarta.wss4j.version}</bundle>
@@ -610,9 +612,9 @@
         <bundle dependency="true">mvn:jakarta.management.j2ee/jakarta.management.j2ee-api/1.1.4</bundle>
         <!-- <bundle dependency="true">mvn:org.apache.geronimo.specs/geronimo-jta_1.1_spec/${cxf.geronimo.jta.version}</bundle> -->
         <!-- <bundle dependency="true">mvn:org.apache.activemq/activemq-osgi/6.1.3.20240820</bundle> -->
-        <bundle dependency="true">wrap:mvn:org.apache.activemq/artemis-core-client/${cxf.activemq.artemis.version}$Bundle-SymbolicName=artemis-core-client&amp;Bundle-Version=${cxf.activemq.artemis.version}&amp;Export-Package=!org.apache.activemq.artemis.core*,org.apache.activemq.artemis.core.config.impl;version=${cxf.activemq.artemis.version},org.apache.activemq.artemis*;version=${cxf.activemq.artemis.version}</bundle>
-        <bundle dependency="true">wrap:mvn:org.apache.activemq/artemis-jms-client/${cxf.activemq.artemis.version}$Bundle-SymbolicName=artemis-jms-client&amp;Bundle-Version=${cxf.activemq.artemis.version}&amp;Export-Package=org.apache.activemq.artemis*;version=${cxf.activemq.artemis.version}</bundle>
-        <bundle dependency="true">wrap:mvn:org.apache.activemq/artemis-server/${cxf.activemq.artemis.version}$Bundle-SymbolicName=artemis-server&amp;Bundle-Version=${cxf.activemq.artemis.version}&amp;Export-Package=!org.apache.activemq.artemis.spi.core.*,org.apache.activemq.artemis*;version=${cxf.activemq.artemis.version}</bundle>
+        <bundle dependency="true">wrap:mvn:org.apache.artemis/artemis-core-client/${cxf.activemq.artemis.version}$Bundle-SymbolicName=artemis-core-client&amp;Bundle-Version=${cxf.activemq.artemis.version}&amp;Export-Package=!org.apache.activemq.artemis.core*,org.apache.activemq.artemis.core.config.impl;version=${cxf.activemq.artemis.version},org.apache.activemq.artemis*;version=${cxf.activemq.artemis.version}</bundle>
+        <bundle dependency="true">wrap:mvn:org.apache.artemis/artemis-jms-client/${cxf.activemq.artemis.version}$Bundle-SymbolicName=artemis-jms-client&amp;Bundle-Version=${cxf.activemq.artemis.version}&amp;Export-Package=org.apache.activemq.artemis*;version=${cxf.activemq.artemis.version}</bundle>
+        <bundle dependency="true">wrap:mvn:org.apache.artemis/artemis-server/${cxf.activemq.artemis.version}$Bundle-SymbolicName=artemis-server&amp;Bundle-Version=${cxf.activemq.artemis.version}&amp;Export-Package=!org.apache.activemq.artemis.spi.core.*,org.apache.activemq.artemis*;version=${cxf.activemq.artemis.version}</bundle>
         <bundle dependency="true">mvn:jakarta.jws/jakarta.jws-api/3.0.0</bundle>
         <bundle>mvn:org.apache.cxf.services.wsn/cxf-services-wsn-core/${project.version}</bundle>
     </feature>
@@ -654,7 +656,7 @@
         <!-- <bundle start-level="30">mvn:org.apache.servicemix.specs/org.apache.servicemix.specs.javax-el-api-3.0.0/${cxf.servicemix.javax.el.version}</bundle> -->
         <!-- <bundle start-level="30">mvn:org.apache.servicemix.bundles/org.apache.servicemix.bundles.javax-el-impl/4.0.2_1</bundle> -->
         <bundle start-level="10" dependency="true">mvn:jakarta.el/jakarta.el-api/6.0.1</bundle>
-        <bundle start-level="10" dependency='true' start='false'>mvn:org.ops4j.pax.web/pax-web-compatibility-el/11.0.1</bundle>
+        <bundle start-level="10" dependency='true' start='false'>mvn:org.ops4j.pax.web/pax-web-compatibility-el/11.1.0</bundle>
     </feature>
 
     <!-- pax-cdi features are not included in TESB -->
diff --git a/parent/pom.xml b/parent/pom.xml
index 5ea05918fb2..342eb09fd41 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -101,12 +101,12 @@
         <cxf.cdi.api.version>4.0.1</cxf.cdi.api.version>
         <cxf.classgraph.version>4.8.25</cxf.classgraph.version>
         <cxf.classmate.version>1.5.1</cxf.classmate.version>
-        <cxf.commons-codec.version>1.17.1</cxf.commons-codec.version>
+        <cxf.commons-codec.version>1.21.0</cxf.commons-codec.version>
         <cxf.commons-io.version>2.16.1</cxf.commons-io.version>
         <cxf.commons-jcs-jcache.version>2.2.1</cxf.commons-jcs-jcache.version>
-        <cxf.commons-lang3.version>3.18.0</cxf.commons-lang3.version>
+        <cxf.commons-lang3.version>3.20.0</cxf.commons-lang3.version>
         <cxf.commons-logging.version>1.2</cxf.commons-logging.version>
-        <cxf.commons-text.version>1.13.1</cxf.commons-text.version>
+        <cxf.commons-text.version>1.15.0</cxf.commons-text.version>
         <cxf.derby.version>10.16.1.1</cxf.derby.version>
         <cxf.dom4j.version>2.2.0</cxf.dom4j.version>
         <cxf.dropwizard3.version>3.2.6</cxf.dropwizard3.version>
@@ -119,7 +119,7 @@
         <cxf.geronimo.openapi.version>1.0.15</cxf.geronimo.openapi.version>
         <cxf.glassfish.el.version>4.0.2</cxf.glassfish.el.version>
         <cxf.glassfish.json.version>2.0.1</cxf.glassfish.json.version>
-        <cxf.guava.version>33.3.0-jre</cxf.guava.version>
+        <cxf.guava.version>33.5.0-jre</cxf.guava.version>
         <cxf.guava.failureaccess.version>1.0.2</cxf.guava.failureaccess.version>
         <cxf.hamcrest.version>3.0</cxf.hamcrest.version>
         <cxf.hazelcast.version>5.5.0</cxf.hazelcast.version>
@@ -189,8 +189,8 @@
         <cxf.msv.version>2022.7</cxf.msv.version>
         <cxf.neethi.version>3.2.1</cxf.neethi.version>
         <cxf.netty.version.range>[4,5)</cxf.netty.version.range>
-        <cxf.netty.version>4.1.131.Final</cxf.netty.version>
-        <cxf.netty.tcnative.version>2.0.69.Final</cxf.netty.tcnative.version>
+        <cxf.netty.version>4.2.12.Final</cxf.netty.version>
+        <cxf.netty.tcnative.version>2.0.75.Final</cxf.netty.tcnative.version>
         <cxf.olingo.version>2.0.13</cxf.olingo.version>
         <cxf.openjpa.version>3.2.2</cxf.openjpa.version>
         <cxf.opentelemetry.version>1.59.0</cxf.opentelemetry.version>
@@ -708,6 +708,7 @@
                         <_versionpolicy>[$(version;==;$(@)),$(version;+;$(@)))</_versionpolicy>
                         <Import-Package>
                             ${cxf.osgi.import},
+                            org.apache.cxf.*;version="${cxf.tesb.version-range}",
                             *
                         </Import-Package>
                         <DynamicImport-Package>
diff --git a/pom.xml b/pom.xml
index 09c4035c5fe..9e6bba6e439 100644
--- a/pom.xml
+++ b/pom.xml
@@ -40,8 +40,7 @@
     </issueManagement>
     <properties>
         <original.version>4.1.5.1</original.version>
-        <cxf.features.tesb.version>4.1.0.5.20260401</cxf.features.tesb.version>
-        <cxf.tesb.version-range>[4.1,4.2)</cxf.tesb.version-range>
+        <cxf.tesb.version-range>[4.1.5,4.1.6)</cxf.tesb.version-range>
         <cxf.tesb.major-version-range>[4,5)</cxf.tesb.major-version-range>
         <cxf.rs.openapi.v3.tesb.version>4.1.5.1</cxf.rs.openapi.v3.tesb.version>
         <cxf.rs.swagger.ui.tesb.version>4.1.5.1</cxf.rs.swagger.ui.tesb.version>
@@ -61,7 +60,7 @@
         <cxf.joda.time.tesb.version>2.11.1</cxf.joda.time.tesb.version>
         <cxf.karaf.tesb.version>4.4.6</cxf.karaf.tesb.version>
         <cxf.karaf.features.tesb.version>4.4.6.20260417</cxf.karaf.features.tesb.version>
-        <cxf.opensaml.bundle.tesb.version>5.1.4_1.tesb1</cxf.opensaml.bundle.tesb.version>
+        <cxf.opensaml.bundle.tesb.version>5.1.4_1.tesb2</cxf.opensaml.bundle.tesb.version>
         <cxf.osgi.tesb.version>8.0.0</cxf.osgi.tesb.version>
         <cxf.pax-web.features.tesb.version>11.1.0.20260420</cxf.pax-web.features.tesb.version>
         <cxf.servicemix.aspectj.tesb.version>1.9.21.1_1</cxf.servicemix.aspectj.tesb.version>
@@ -70,7 +69,7 @@
         <cxf.swagger-ui.tesb.version>5.29.3</cxf.swagger-ui.tesb.version>
         <cxf.validation2.api.tesb.version>2.0.2</cxf.validation2.api.tesb.version>
         <cxf.xerces.bundle.tesb.version>2.12.2.tesb2_1</cxf.xerces.bundle.tesb.version>
-        <cxf.xmlsec.bundle.tesb.version>4.0.4</cxf.xmlsec.bundle.tesb.version>
+        <cxf.xmlsec.bundle.tesb.version>3.0.5</cxf.xmlsec.bundle.tesb.version>
 
         <cxf.osgi.javax.stream.tesb.version-range>[0,2)</cxf.osgi.javax.stream.tesb.version-range>
 
diff --git a/services/sts/sts-core/pom.xml b/services/sts/sts-core/pom.xml
index 285dff5b4c8..b72bd4ab75c 100644
--- a/services/sts/sts-core/pom.xml
+++ b/services/sts/sts-core/pom.xml
@@ -39,7 +39,7 @@
         <cxf.osgi.import>
             jakarta.servlet*;version="${cxf.osgi.jakarta.servlet.version}",
             !org.apache.cxf.sts.*,
-            org.apache.cxf.*,
+            org.apache.cxf.*;version="${cxf.tesb.version-range}",
             org.springframework.ldap*;resolution:=optional,
             org.ehcache*;resolution:=optional;version="${cxf.ehcache.osgi.version}",
             org.opensaml*;version="${cxf.opensaml.osgi.version}",
diff --git a/services/xkms/pom.xml b/services/xkms/pom.xml
index 791178ffd2a..a1197de09b3 100644
--- a/services/xkms/pom.xml
+++ b/services/xkms/pom.xml
@@ -38,5 +38,7 @@
         <module>xkms-client</module>
         <module>xkms-war</module>
         <module>xkms-x509-repo-ldap</module>
+        <module>xkms-features</module>
+        <module>xkms-osgi</module>
     </modules>
 </project>
diff --git a/tools/validator/pom.xml b/tools/validator/pom.xml
index dede480a24e..4f30894cf39 100644
--- a/tools/validator/pom.xml
+++ b/tools/validator/pom.xml
@@ -85,4 +85,58 @@
             <scope>test</scope>
         </dependency>
     </dependencies>
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.felix</groupId>
+                <artifactId>maven-bundle-plugin</artifactId>
+                <extensions>true</extensions>
+                <executions>
+                    <execution>
+                        <id>versions</id>
+                        <phase>validate</phase>
+                        <goals>
+                            <goal>cleanVersions</goal>
+                        </goals>
+                        <configuration>
+                            <versions>
+                                <cxf.osgi.version.clean>${project.version}</cxf.osgi.version.clean>
+                            </versions>
+                        </configuration>
+                    </execution>
+                </executions>
+                <configuration>
+                    <obrRepository>NONE</obrRepository>
+                    <instructions>
+                        <Bundle-SymbolicName>${cxf.osgi.symbolic.name}</Bundle-SymbolicName>
+                        <Bundle-ActivationPolicy>${cxf.bundle.activation.policy}</Bundle-ActivationPolicy>
+                        <Implementation-Vendor>The Apache Software Foundation</Implementation-Vendor>
+                        <Implementation-Vendor-Id>org.apache</Implementation-Vendor-Id>
+                        <Implementation-Version>${cxf.osgi.version.clean}</Implementation-Version>
+                        <Specification-Vendor>The Apache Software Foundation</Specification-Vendor>
+                        <Specification-Version>${cxf.osgi.version.clean}</Specification-Version>
+                        <Bundle-DocURL>http://cxf.apache.org</Bundle-DocURL>
+                        <Fragment-Host>${cxf.fragment.host}</Fragment-Host>
+                        <_failok>true</_failok>
+                        <_nouses>true</_nouses>
+                        <_versionpolicy>[$(version;==;$(@)),$(version;+;$(@)))</_versionpolicy>
+                        <Export-Package>${cxf.osgi.export}</Export-Package>
+                        <Import-Package>
+                            ${cxf.osgi.import},
+                            *
+                        </Import-Package>
+                        <DynamicImport-Package>
+                            ${cxf.osgi.dynamic.import}
+                        </DynamicImport-Package>
+                        <Export-Service>
+                            ${cxf.export.service}
+                        </Export-Service>
+                        <Bundle-Activator>${cxf.bundle.activator}</Bundle-Activator>
+                        <Automatic-Module-Name>${cxf.module.name}</Automatic-Module-Name>
+                    </instructions>
+                    <niceManifest>true</niceManifest>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
 </project>