The xacml jar's were updated as much as possible to use dependencies that had security fixes. Unable to update velocity as there is no newer release available - ideally we would remove that code in a future date.