diff --git a/build.gradle b/build.gradle
index f5ac7254da..b82fede28a 100644
--- a/build.gradle
+++ b/build.gradle
@@ -52,7 +52,7 @@ configure(allprojects) { project ->
 	ext.hsqldbVersion        = "2.3.4"
 	ext.httpasyncVersion     = "4.1.3"
 	ext.httpclientVersion    = "4.5.5"
-	ext.jackson2Version      = "2.8.11"
+	ext.jackson2Version      = "2.8.11.1"
 	ext.jasperreportsVersion = "6.2.1"  // our tests fail with JR-internal NPEs against 6.2.2 and higher
 	ext.javamailVersion      = "1.5.6"
 	ext.jettyVersion         = "9.3.14.v20161028"  // as of 9.3.15, Jetty has hard Servlet 3.1 requirement
@@ -75,7 +75,7 @@ configure(allprojects) { project ->
 	ext.testngVersion        = "6.9.10"
 	ext.tiles2Version        = "2.2.2"
 	ext.tiles3Version        = "3.0.7"
-	ext.tomcatVersion        = "8.5.27"
+	ext.tomcatVersion        = "8.5.28"
 	ext.tyrusVersion         = "1.3.5"  // constrained by WebLogic 12.1.3 support
 	ext.undertowVersion      = "1.3.33.Final"
 	ext.xmlunitVersion       = "1.6"
@@ -704,7 +704,7 @@ project("spring-web") {
 		optional("com.squareup.okhttp:okhttp:${okhttpVersion}")
 		optional("com.squareup.okhttp3:okhttp:${okhttp3Version}")
 		optional("com.fasterxml.jackson.core:jackson-databind:${jackson2Version}")
-		optional("com.fasterxml.jackson.dataformat:jackson-dataformat-xml:${jackson2Version}")
+		optional("com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.8.11")
 		optional("com.google.code.gson:gson:${gsonVersion}")
 		optional("com.rometools:rome:${romeVersion}")
 		optional("org.eclipse.jetty:jetty-servlet:${jettyVersion}") {
@@ -724,8 +724,8 @@ project("spring-web") {
 		testCompile("org.apache.taglibs:taglibs-standard-jstlel:1.2.1") {
 			exclude group: "org.apache.taglibs", module: "taglibs-standard-spec"
 		}
-		testCompile("com.fasterxml.jackson.datatype:jackson-datatype-joda:${jackson2Version}")
-		testCompile("com.fasterxml.jackson.datatype:jackson-datatype-jdk8:${jackson2Version}")
+		testCompile("com.fasterxml.jackson.datatype:jackson-datatype-joda:2.8.11")
+		testCompile("com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.8.11")
 		testCompile("com.fasterxml.jackson.module:jackson-module-kotlin:${jackson2Version}")
     	testCompile("com.squareup.okhttp3:mockwebserver:${okhttp3Version}")
 		testRuntime("com.sun.mail:javax.mail:${javamailVersion}")
@@ -837,7 +837,7 @@ project("spring-webmvc") {
 			exclude group: "org.springframework", module: "spring-context"
 		}
 		optional("com.fasterxml.jackson.core:jackson-databind:${jackson2Version}")
-		optional("com.fasterxml.jackson.dataformat:jackson-dataformat-xml:${jackson2Version}")
+		optional("com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.8.11")
 		optional("com.rometools:rome:${romeVersion}")
 		optional("javax.el:javax.el-api:2.2.5")
 		optional("org.apache.tiles:tiles-api:${tiles3Version}")