diff --git a/build.gradle b/build.gradle
index 59656cf..0521ef2 100644
--- a/build.gradle
+++ b/build.gradle
@@ -96,7 +96,7 @@ dependencies {
     appComponent("com.haulmont.cuba:cuba-global:$cubaVersion")
 }
 
-def hsql = 'org.hsqldb:hsqldb:2.4.1'
+def hsql = 'org.hsqldb:hsqldb:2.5.2'
 
 configure([globalModule, coreModule, webModule, restApiModule, portalModule]) {
     apply(plugin: 'java')
@@ -272,6 +272,11 @@ configure(restApiModule) {
 
         compile("com.haulmont.cuba:cuba-client-tests:$cubaVersion")
 
+        compile(bom['org.dom4j:dom4j']) {
+            exclude group: 'xpp3', module: 'xpp3'
+            exclude group: 'pull-parser', module: 'pull-parser'
+        }
+
         // required for Spring multipart resolver
         compile(bom['commons-fileupload:commons-fileupload'])
 
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index ffb5977..4c46317 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -2,4 +2,4 @@ distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-5.4.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-5.6.4-bin.zip
diff --git a/modules/global/src/com/haulmont/addon/restapi/bom.properties b/modules/global/src/com/haulmont/addon/restapi/bom.properties
index 92f10a3..e82b711 100644
--- a/modules/global/src/com/haulmont/addon/restapi/bom.properties
+++ b/modules/global/src/com/haulmont/addon/restapi/bom.properties
@@ -13,19 +13,23 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-org.springframework.security.oauth/spring-security-oauth2=2.5.1.RELEASE
-io.swagger/swagger-models=1.5.21
+org.springframework.security.oauth/spring-security-oauth2=2.5.2.RELEASE
+io.swagger/swagger-models=1.5.24
 
 # We explicitly duplicate spring security dependencies versions defined in the CUBA bom.properties, because these versions
 # may be changed in CUBA bugfix releases, but REST API add-on releases depend on CUBA 7.2.0 and don't receive these versions
 # updates. That's why we need to store explicit version numbers right in the REST API add-on sources in order to control
 # dependencies.
-org.springframework.security=5.5.8
+org.springframework.security=5.7.14
 org.springframework.security/spring-security-core=${org.springframework.security}
 org.springframework.security/spring-security-web=${org.springframework.security}
 org.springframework.security/spring-security-config=${org.springframework.security}
 org.springframework.security/spring-security-taglibs=${org.springframework.security}
-org.springframework=5.3.23
+org.springframework=5.3.39
 org.springframework/spring-webmvc=${org.springframework}
 org.springframework/spring-context-support=${org.springframework}
-org.springframework.ldap/spring-ldap-core=2.3.8.RELEASE
\ No newline at end of file
+org.springframework.ldap/spring-ldap-core=2.3.8.RELEASE
+org.dom4j/dom4j=2.1.4
+
+org.jmockit/jmockit = 1.49
+junit/junit = 4.13.2
\ No newline at end of file