diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 7eae50f947..74861e5e9e 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -79,7 +79,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        java-version: ['11.x', '17.x', '21.x']
+        java-version: ['17.x', '21.x']
       fail-fast: false
     steps:
       - name: "checking out"
@@ -111,19 +111,15 @@ jobs:
     strategy:
       matrix:
         node-version: ['20.x', '22.x', '24.x']
-        java-version: ['11.x', '17.x', '21.x']
+        java-version: ['17.x', '21.x']
         # Reduce the combinations to reduce the total number of jobs
         exclude:
           - node-version: '20.x'
             java-version: '17.x'
           - node-version: '20.x'
             java-version: '21.x'
-          - node-version: '22.x'
-            java-version: '11.x'
           - node-version: '22.x'
             java-version: '21.x'
-          - node-version: '24.x'
-            java-version: '11.x'
           - node-version: '24.x'
             java-version: '17.x'
       fail-fast: false
@@ -201,14 +197,14 @@ jobs:
         uses: actions/setup-java@v3
         with:
           distribution: 'temurin'
-          java-version: '11.x'
+          java-version: '17.x'
       ############
       # Publish
       ##########
       - name: Set up Maven Central Repository
         uses: actions/setup-java@v3
         with:
-          java-version: '11'
+          java-version: '17'
           distribution: 'temurin'
           server-id: geosolutions
           server-username: MAVEN_USERNAME
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4e3f2f5f5f..5672816beb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -5,7 +5,7 @@ on:
     - master
     # using filter pattern: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet
     - '[cC][0-9][0-9][0-9]-+**' # c123 or c123-something for custom branch
-    - '[0-9][0-9][0-9][0-9].[0-9][0-9].xx' # stable brances. E.g. 2021.01.xx
+    - '[0-9][0-9][0-9][0-9].[0-9][0-9].xx' # stable branches. E.g. 2021.01.xx
     - '[geonode]-[0-9].[0-9].x' # stable branches for GeoNode. E.g. geonode-4.4.x
 
 jobs:
@@ -22,7 +22,7 @@ jobs:
         uses: actions/setup-java@v3
         with:
           distribution: 'temurin'
-          java-version: '11.x'
+          java-version: '17.x'
       ############
       # CACHING
       ##########
diff --git a/.github/workflows/create_release.yml b/.github/workflows/create_release.yml
index 09b8de786c..38212a8e9a 100644
--- a/.github/workflows/create_release.yml
+++ b/.github/workflows/create_release.yml
@@ -41,7 +41,7 @@ jobs:
       - name: "setting up Java"
         uses: actions/setup-java@v1
         with:
-          java-version: '11.x'
+          java-version: '17.x'
       ############
       # CACHING
       ##########
diff --git a/.github/workflows/post_release.yml b/.github/workflows/post_release.yml
index d6b564668b..d70bf51cc4 100644
--- a/.github/workflows/post_release.yml
+++ b/.github/workflows/post_release.yml
@@ -21,10 +21,10 @@ jobs:
         script: |
             core.setFailed('This workflow can not run on master branch')
     - uses: actions/checkout@v3
-    - name: Set up JDK 11
+    - name: Set up JDK 17
       uses: actions/setup-java@v3
       with:
-        java-version: '11.x'
+        java-version: '17.x'
         distribution: 'adopt'
         cache: maven
 
diff --git a/.github/workflows/pre_release.yml b/.github/workflows/pre_release.yml
index ca21e705e1..97b36e09ce 100644
--- a/.github/workflows/pre_release.yml
+++ b/.github/workflows/pre_release.yml
@@ -37,10 +37,10 @@ jobs:
         script: |
             core.setFailed('This workflow can not run on master branch')
     - uses: actions/checkout@v3
-    - name: Set up JDK 11
+    - name: Set up JDK 17
       uses: actions/setup-java@v3
       with:
-        java-version: '11.x'
+        java-version: '17.x'
         distribution: 'adopt'
         cache: maven
 
diff --git a/binary/bin-war/pom.xml b/binary/bin-war/pom.xml
index 72c10bbe1a..792ce108f2 100644
--- a/binary/bin-war/pom.xml
+++ b/binary/bin-war/pom.xml
@@ -14,7 +14,7 @@
     <url>http://www.geo-solutions.it</url>
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <tomcat.version>9.0.116</tomcat.version>
+        <tomcat.version>11.0.22</tomcat.version>
         <binary.number>${mapstore2.version}</binary.number>
     </properties>
 
diff --git a/binary/pom.xml b/binary/pom.xml
index b39feebfb8..7f055ae24a 100644
--- a/binary/pom.xml
+++ b/binary/pom.xml
@@ -13,7 +13,7 @@
     <url>http://www.geo-solutions.it</url>
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <tomcat.version>9.0.118</tomcat.version>
+        <tomcat.version>11.0.22</tomcat.version>
         <binary.number>${mapstore2.version}</binary.number>
     </properties>
     <dependencies>
diff --git a/binary/tomcat/conf/web.xml b/binary/tomcat/conf/web.xml
index b4fc5b61da..09d0d44fc4 100644
--- a/binary/tomcat/conf/web.xml
+++ b/binary/tomcat/conf/web.xml
@@ -15,11 +15,10 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
+<web-app xmlns="https://jakarta.ee/xml/ns/jakartaee"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-  xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
-                      http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
-  version="4.0">
+  xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_6_0.xsd"
+  version="6.0">
 
   <!-- ======================== Introduction ============================== -->
   <!-- This document defines default values for *all* web applications      -->
diff --git a/java/services/pom.xml b/java/services/pom.xml
index 5eae8354eb..0007b3dcdb 100644
--- a/java/services/pom.xml
+++ b/java/services/pom.xml
@@ -86,10 +86,9 @@
         </dependency>
 
         <!-- servlet -->
-        <!-- https://mvnrepository.com/artifact/javax.servlet/javax.servlet-api -->
         <dependency>
-            <groupId>javax.servlet</groupId>
-            <artifactId>javax.servlet-api</artifactId>
+            <groupId>jakarta.servlet</groupId>
+            <artifactId>jakarta.servlet-api</artifactId>
         </dependency>
 
         <!-- json-lib -->
@@ -143,8 +142,8 @@
                 <version>3.10.1</version>
                 <configuration>
                     <encoding>utf8</encoding>
-                    <source>8</source>
-                    <target>8</target>
+                    <source>17</source>
+                    <target>17</target>
                     <debug>true</debug>
                     <encoding>UTF-8</encoding>
                     <!--
diff --git a/java/services/src/main/java/it/geosolutions/mapstore/controllers/BaseMapStoreController.java b/java/services/src/main/java/it/geosolutions/mapstore/controllers/BaseMapStoreController.java
index 638023dc92..c6bc4538fd 100644
--- a/java/services/src/main/java/it/geosolutions/mapstore/controllers/BaseMapStoreController.java
+++ b/java/services/src/main/java/it/geosolutions/mapstore/controllers/BaseMapStoreController.java
@@ -1,6 +1,6 @@
 package it.geosolutions.mapstore.controllers;
 
-import javax.servlet.ServletContext;
+import jakarta.servlet.ServletContext;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
diff --git a/java/services/src/main/java/it/geosolutions/mapstore/controllers/extensions/ExtensionsController.java b/java/services/src/main/java/it/geosolutions/mapstore/controllers/extensions/ExtensionsController.java
index 001b3a9bb2..9da6b9eb33 100644
--- a/java/services/src/main/java/it/geosolutions/mapstore/controllers/extensions/ExtensionsController.java
+++ b/java/services/src/main/java/it/geosolutions/mapstore/controllers/extensions/ExtensionsController.java
@@ -10,8 +10,8 @@
 import java.io.IOException;
 import java.nio.file.Paths;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.apache.commons.io.IOUtils;
 import org.springframework.stereotype.Controller;
diff --git a/java/services/src/main/java/it/geosolutions/mapstore/controllers/rest/config/LoadAssetsController.java b/java/services/src/main/java/it/geosolutions/mapstore/controllers/rest/config/LoadAssetsController.java
index 165011840e..fd13071c72 100644
--- a/java/services/src/main/java/it/geosolutions/mapstore/controllers/rest/config/LoadAssetsController.java
+++ b/java/services/src/main/java/it/geosolutions/mapstore/controllers/rest/config/LoadAssetsController.java
@@ -12,8 +12,8 @@
 import java.util.function.Predicate;
 import java.util.stream.Stream;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.apache.commons.io.IOUtils;
 import org.springframework.beans.factory.annotation.Value;
diff --git a/java/services/src/main/java/it/geosolutions/mapstore/controllers/rest/config/SetParamsController.java b/java/services/src/main/java/it/geosolutions/mapstore/controllers/rest/config/SetParamsController.java
index b5128c6943..29848633cc 100644
--- a/java/services/src/main/java/it/geosolutions/mapstore/controllers/rest/config/SetParamsController.java
+++ b/java/services/src/main/java/it/geosolutions/mapstore/controllers/rest/config/SetParamsController.java
@@ -28,10 +28,8 @@
 import org.springframework.web.bind.annotation.RequestHeader;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
-
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URI;
diff --git a/java/services/src/main/java/it/geosolutions/mapstore/controllers/rest/config/UploadPluginController.java b/java/services/src/main/java/it/geosolutions/mapstore/controllers/rest/config/UploadPluginController.java
index a708ceb316..ff7096eaed 100644
--- a/java/services/src/main/java/it/geosolutions/mapstore/controllers/rest/config/UploadPluginController.java
+++ b/java/services/src/main/java/it/geosolutions/mapstore/controllers/rest/config/UploadPluginController.java
@@ -16,6 +16,7 @@
 import it.geosolutions.mapstore.utils.ResourceUtils;
 import org.apache.commons.io.FileUtils;
 import org.apache.commons.io.IOUtils;
+import org.apache.commons.io.input.CloseShieldInputStream;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
@@ -24,14 +25,15 @@
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.ResponseBody;
 
-import javax.servlet.ServletContext;
+import jakarta.servlet.ServletContext;
+
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileNotFoundException;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.HashMap;
@@ -69,6 +71,8 @@ public class UploadPluginController extends BaseMapStoreController {
     @Secured({"ROLE_ADMIN"})
     @RequestMapping(value = "/uploadPlugin", method = RequestMethod.POST, headers = "Accept=application/json")
     public @ResponseBody String uploadPlugin(InputStream dataStream) throws IOException {
+        File servletTempDir = (File) context.getAttribute(ServletContext.TEMPDIR);
+        Path tempDir = Files.createTempDirectory(servletTempDir.toPath(), "mapstore-upload-");
         try (ZipInputStream zip = new ZipInputStream(dataStream)) {
             ZipEntry entry = zip.getNextEntry();
             String pluginName = null;
@@ -85,12 +89,12 @@ public class UploadPluginController extends BaseMapStoreController {
 
                     if (lower.endsWith("index.js")) {
                         bundleEntryName = normalizedEntry;
-                        File tempBundle = File.createTempFile("mapstore-bundle", ".js");
+                        File tempBundle = Files.createTempFile(tempDir, "mapstore-bundle", ".js").toFile();
                         storeAsset(zip, tempBundle);
                         // We'll resolve final relative target after we know pluginName
                         tempFilesToRelativeTargets.put(tempBundle, "__BUNDLE__");
                     } else if (lower.equals("index.json")) {
-                        JsonNode json = readJSON(zip);
+                        JsonNode json = readJSON(CloseShieldInputStream.wrap(zip));
                         JsonNode plugins = json.get("plugins");
                         if (plugins == null || !plugins.isArray() || plugins.isEmpty()) {
                             throw new IOException("Invalid bundle: index.json has no 'plugins' array");
@@ -108,13 +112,13 @@ public class UploadPluginController extends BaseMapStoreController {
                             addPluginConfiguration(plugin);
                         }
                     } else if (lower.startsWith("translations/")) {
-                        File tempAsset = File.createTempFile("mapstore-asset-translations", ".json");
+                        File tempAsset = Files.createTempFile(tempDir, "mapstore-asset-translations", ".json").toFile();
                         storeAsset(zip, tempAsset);
                         // Target relative to extensions root: <pluginName>/<translations/...>
                         tempFilesToRelativeTargets.put(tempAsset, PLUGIN_PATH_PREFIX + normalizedEntry);
                         addTranslations = true;
                     } else if (lower.startsWith("assets/")) {
-                        File tempAsset = File.createTempFile("mapstore-asset", ".tmp");
+                        File tempAsset = Files.createTempFile(tempDir, "mapstore-asset", ".tmp").toFile();
                         storeAsset(zip, tempAsset);
                         // Target relative to extensions root: <pluginName>/<assets/...>
                         tempFilesToRelativeTargets.put(tempAsset, PLUGIN_PATH_PREFIX + normalizedEntry);
@@ -159,6 +163,8 @@ public class UploadPluginController extends BaseMapStoreController {
             }
 
             return plugin.toString();
+        } finally {
+            FileUtils.deleteDirectory(tempDir.toFile());
         }
     }
 
@@ -212,7 +218,7 @@ private boolean shouldStorePluginsConfigAsPatch() {
     private boolean canUseDataDir() {
         return !getDataDir().isEmpty() &&
                Stream.of(getDataDir().split(","))
-                       .anyMatch(folder -> !folder.trim().isEmpty() && new File(folder).exists());
+                   .anyMatch(folder -> !folder.trim().isEmpty() && new File(folder).exists());
     }
 
     /**
@@ -250,7 +256,7 @@ private boolean canUseDataDir() {
             for (int i = 0; i < plugins.size(); i++) {
                 JsonNode plugin = plugins.get(i);
                 String name = plugin.has("name") ? plugin.get("name").asText()
-                        : plugin.get("value").get("name").asText();
+                    : plugin.get("value").get("name").asText();
                 if (name.contentEquals(pluginName)) {
                     toRemove = i;
                 }
@@ -445,7 +451,7 @@ private void storeJSONConfig(Object config, String configName) throws IOExceptio
     }
 
     private void addExtension(String pluginName, String pluginBundleRelative, String translationsRelative)
-            throws IOException {
+        throws IOException {
         ObjectNode config;
         Optional<File> extensionsConfigFile = findResource(getExtensionsConfigPath());
         if (extensionsConfigFile.isPresent()) {
@@ -484,25 +490,16 @@ private ObjectNode getExtensionConfig() throws IOException {
     }
 
     private JsonNode readJSON(InputStream input) throws IOException {
-        byte[] buffer = new byte[4096];
-        int read;
-        StringBuilder json = new StringBuilder();
-        while ((read = input.read(buffer)) >= 0) {
-            json.append(new String(buffer, 0, read, StandardCharsets.UTF_8));
-        }
-        return jsonMapper.readTree(json.toString());
+        return jsonMapper.readTree(input);
     }
 
     private void storeAsset(ZipInputStream zip, File file) throws IOException {
         try (FileOutputStream outFile = new FileOutputStream(file)) {
-            byte[] buffer = new byte[8192];
-            int read;
-            while ((read = zip.read(buffer)) >= 0) {
-                outFile.write(buffer, 0, read);
-            }
+            IOUtils.copy(zip, outFile);
         }
     }
 
+    @Override
     public void setContext(ServletContext context) {
         this.context = context;
     }
diff --git a/java/services/src/main/java/it/geosolutions/mapstore/filters/NoCacheFilter.java b/java/services/src/main/java/it/geosolutions/mapstore/filters/NoCacheFilter.java
index d59f85e34a..5f0645bd8b 100644
--- a/java/services/src/main/java/it/geosolutions/mapstore/filters/NoCacheFilter.java
+++ b/java/services/src/main/java/it/geosolutions/mapstore/filters/NoCacheFilter.java
@@ -1,6 +1,6 @@
 package it.geosolutions.mapstore.filters;
-import javax.servlet.*;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.*;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 
 public class NoCacheFilter implements Filter {
diff --git a/java/services/src/main/java/it/geosolutions/mapstore/utils/ResourceUtils.java b/java/services/src/main/java/it/geosolutions/mapstore/utils/ResourceUtils.java
index 6b2c9fcd57..9231347fbb 100644
--- a/java/services/src/main/java/it/geosolutions/mapstore/utils/ResourceUtils.java
+++ b/java/services/src/main/java/it/geosolutions/mapstore/utils/ResourceUtils.java
@@ -18,7 +18,7 @@
 import java.util.function.Predicate;
 import java.util.stream.Stream;
 
-import javax.servlet.ServletContext;
+import jakarta.servlet.ServletContext;
 
 public class ResourceUtils {
 
diff --git a/java/services/src/test/java/it/geosolutions/mapstore/ConfigControllerTest.java b/java/services/src/test/java/it/geosolutions/mapstore/ConfigControllerTest.java
index 636874cb4c..cf90f58068 100644
--- a/java/services/src/test/java/it/geosolutions/mapstore/ConfigControllerTest.java
+++ b/java/services/src/test/java/it/geosolutions/mapstore/ConfigControllerTest.java
@@ -12,7 +12,7 @@
 import java.io.File;
 import java.io.IOException;
 
-import javax.servlet.ServletContext;
+import jakarta.servlet.ServletContext;
 
 import org.junit.Before;
 import org.junit.Test;
diff --git a/java/services/src/test/java/it/geosolutions/mapstore/ExtensionsControllerTest.java b/java/services/src/test/java/it/geosolutions/mapstore/ExtensionsControllerTest.java
index c9d4b7ef7d..c80ae54f48 100644
--- a/java/services/src/test/java/it/geosolutions/mapstore/ExtensionsControllerTest.java
+++ b/java/services/src/test/java/it/geosolutions/mapstore/ExtensionsControllerTest.java
@@ -13,7 +13,7 @@
 import java.io.File;
 import java.io.IOException;
 
-import javax.servlet.ServletContext;
+import jakarta.servlet.ServletContext;
 
 import org.apache.commons.io.FileUtils;
 import org.junit.Before;
diff --git a/java/services/src/test/java/it/geosolutions/mapstore/LoadAssetControllerTest.java b/java/services/src/test/java/it/geosolutions/mapstore/LoadAssetControllerTest.java
index c5340ce194..4fa69bdc0a 100644
--- a/java/services/src/test/java/it/geosolutions/mapstore/LoadAssetControllerTest.java
+++ b/java/services/src/test/java/it/geosolutions/mapstore/LoadAssetControllerTest.java
@@ -14,7 +14,7 @@
 import java.io.File;
 import java.io.IOException;
 
-import javax.servlet.ServletContext;
+import jakarta.servlet.ServletContext;
 
 import org.apache.commons.io.FileUtils;
 import org.junit.Before;
diff --git a/java/services/src/test/java/it/geosolutions/mapstore/UploadPluginControllerTest.java b/java/services/src/test/java/it/geosolutions/mapstore/UploadPluginControllerTest.java
index f9acd31110..297aef1bbb 100644
--- a/java/services/src/test/java/it/geosolutions/mapstore/UploadPluginControllerTest.java
+++ b/java/services/src/test/java/it/geosolutions/mapstore/UploadPluginControllerTest.java
@@ -13,7 +13,7 @@
 import org.mockito.Mockito;
 import org.mockito.stubbing.Answer;
 
-import javax.servlet.ServletContext;
+import jakarta.servlet.ServletContext;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
@@ -58,6 +58,7 @@ public void testUninstallPluginPathNormalization() throws IOException {
         Mockito.when(context.getRealPath(Mockito.contains("pluginsConfig.json"))).thenReturn(tempConfig.getAbsolutePath());
         File tempExtensions = TestUtils.copyToTemp(ConfigControllerTest.class, "/extensionsWithPlugin.json");
         File tempDist = TestUtils.getDataDir();
+        Mockito.when(context.getAttribute(ServletContext.TEMPDIR)).thenReturn(tempDist);
 
         // Mock a legitimate folder inside the base directory
         Mockito.when(context.getRealPath(Mockito.contains("extensions.json"))).thenReturn(tempExtensions.getAbsolutePath());
@@ -89,6 +90,7 @@ public void testUploadValidBundle() throws IOException {
         Mockito.when(context.getRealPath(Mockito.endsWith("pluginsConfig.json"))).thenReturn(tempConfig.getAbsolutePath());
         File tempExtensions = TestUtils.copyToTemp(ConfigControllerTest.class, "/extensions.json");
         File tempDist = TestUtils.getDataDir();
+        Mockito.when(context.getAttribute(ServletContext.TEMPDIR)).thenReturn(tempDist);
         Mockito.when(context.getRealPath(Mockito.contains("extensions.json"))).thenReturn(tempExtensions.getAbsolutePath());
         Mockito.when(context.getRealPath(Mockito.contains("My"))).thenAnswer(
                 (Answer<String>) invocation -> {
@@ -112,6 +114,7 @@ public void testUploadValidBundleReplace() throws IOException {
         Mockito.when(context.getRealPath(Mockito.endsWith("pluginsConfig.json"))).thenReturn(tempConfig.getAbsolutePath());
         File tempExtensions = TestUtils.copyToTemp(ConfigControllerTest.class, "/extensionsWithPlugin.json");
         File tempDist = TestUtils.getDataDir();
+        Mockito.when(context.getAttribute(ServletContext.TEMPDIR)).thenReturn(tempDist);
         Mockito.when(context.getRealPath(Mockito.contains("extensions.json"))).thenReturn(tempExtensions.getAbsolutePath());
         Mockito.when(context.getRealPath(Mockito.contains("My"))).thenAnswer(
                 (Answer<String>) invocation -> {
@@ -139,6 +142,7 @@ public void testUploadValidBundleUsingPatch() throws IOException {
         Mockito.when(context.getRealPath(Mockito.endsWith(".patch"))).thenReturn(tempDir.getAbsolutePath() + "/pluginsConfig.json.patch");
         File tempExtensions = TestUtils.copyToTemp(ConfigControllerTest.class, "/extensions.json");
         File tempDist = TestUtils.getDataDir();
+        Mockito.when(context.getAttribute(ServletContext.TEMPDIR)).thenReturn(tempDist);
         Mockito.when(context.getRealPath(Mockito.contains("extensions.json"))).thenReturn(tempExtensions.getAbsolutePath());
         Mockito.when(context.getRealPath(Mockito.contains("dist/extensions/"))).thenAnswer(
                 (Answer<String>) invocation -> {
@@ -162,6 +166,7 @@ public void testCustomBundlesPath() throws IOException {
         Mockito.when(context.getRealPath(Mockito.endsWith("pluginsConfig.json"))).thenReturn(tempConfig.getAbsolutePath());
         File tempExtensions = TestUtils.copyToTemp(ConfigControllerTest.class, "/extensions.json");
         File tempDist = TestUtils.getDataDir();
+        Mockito.when(context.getAttribute(ServletContext.TEMPDIR)).thenReturn(tempDist);
         controller.setBundlesPath("custom");
         Mockito.when(context.getRealPath(Mockito.contains("extensions.json"))).thenReturn(tempExtensions.getAbsolutePath());
         Mockito.when(context.getRealPath(Mockito.contains("custom/"))).thenAnswer(
@@ -184,6 +189,7 @@ public void testUploadInvalidBundle() throws IOException {
         Mockito.when(context.getRealPath(Mockito.contains("pluginsConfig.json"))).thenReturn(tempConfig.getAbsolutePath());
         File tempExtensions = TestUtils.copyToTemp(ConfigControllerTest.class, "/extensions.json");
         File tempDist = TestUtils.getDataDir();
+        Mockito.when(context.getAttribute(ServletContext.TEMPDIR)).thenReturn(tempDist);
         Mockito.when(context.getRealPath(Mockito.contains("extensions.json"))).thenReturn(tempExtensions.getAbsolutePath());
         Mockito.when(context.getRealPath(Mockito.contains("/extensions/"))).thenAnswer(
                 (Answer<String>) invocation -> {
@@ -206,6 +212,7 @@ public void testUploadValidBundleWithDataDir() throws IOException {
         controller.setDataDir(dataDir.getAbsolutePath());
         ServletContext context = Mockito.mock(ServletContext.class);
         controller.setContext(context);
+        Mockito.when(context.getAttribute(ServletContext.TEMPDIR)).thenReturn(dataDir);
         File tempConfig = TestUtils.copyTo(UploadPluginControllerTest.class.getResourceAsStream("/pluginsConfig.json"), dataDir, "/configs/pluginsConfig.json");
         File tempExtensions = TestUtils.copyTo(UploadPluginControllerTest.class.getResourceAsStream("/extensions.json"), dataDir, "/extensions/extensions.json");
         InputStream zipStream = UploadPluginControllerTest.class.getResourceAsStream("/plugin.zip");
@@ -222,6 +229,7 @@ public void testUploadValidBundleWithMultipleDataDir() throws IOException {
         controller.setDataDir(dataDir1.getAbsolutePath() + "," + dataDir2.getAbsolutePath());
         ServletContext context = Mockito.mock(ServletContext.class);
         controller.setContext(context);
+        Mockito.when(context.getAttribute(ServletContext.TEMPDIR)).thenReturn(dataDir1);
         // we load from dataDir2 (less priority)
         File tempConfig = TestUtils.copyTo(
                 UploadPluginControllerTest.class.getResourceAsStream("/pluginsConfig.json"),
@@ -245,6 +253,7 @@ public void testUninstallPlugin() throws IOException {
         Mockito.when(context.getRealPath(Mockito.contains("pluginsConfig.json"))).thenReturn(tempConfig.getAbsolutePath());
         File tempExtensions = TestUtils.copyToTemp(ConfigControllerTest.class, "/extensionsWithPlugin.json");
         File tempDist = TestUtils.getDataDir();
+        Mockito.when(context.getAttribute(ServletContext.TEMPDIR)).thenReturn(tempDist);
         Mockito.when(context.getRealPath(Mockito.contains("extensions.json"))).thenReturn(tempExtensions.getAbsolutePath());
         Mockito.when(context.getRealPath(Mockito.contains("My"))).thenAnswer(
                 (Answer<String>) invocation -> {
@@ -305,6 +314,7 @@ public void testUploadBlocksZipSlip_DotDotInAssets() throws IOException {
         Mockito.when(context.getRealPath(Mockito.contains("extensions.json"))).thenReturn(tempExtensions.getAbsolutePath());
 
         File tempDist = TestUtils.getDataDir();
+        Mockito.when(context.getAttribute(ServletContext.TEMPDIR)).thenReturn(tempDist);
         Mockito.when(context.getRealPath(Mockito.contains("dist/extensions/"))).thenAnswer(
                 (Answer<String>) invocation -> {
                     String path = (String) invocation.getArguments()[0];
@@ -329,6 +339,7 @@ public void testUploadBlocksZipSlip_AbsoluteUnixEntry() throws IOException {
         Mockito.when(context.getRealPath(Mockito.contains("extensions.json"))).thenReturn(tempExtensions.getAbsolutePath());
 
         File tempDist = TestUtils.getDataDir();
+        Mockito.when(context.getAttribute(ServletContext.TEMPDIR)).thenReturn(tempDist);
         Mockito.when(context.getRealPath(Mockito.contains("dist/extensions/"))).thenReturn(
                 tempDist.getAbsolutePath() + File.separator + "ignored"
         );
@@ -349,6 +360,7 @@ public void testUploadBlocksZipSlip_WindowsDriveEntry() throws IOException {
         Mockito.when(context.getRealPath(Mockito.endsWith("pluginsConfig.json"))).thenReturn(tempConfig.getAbsolutePath());
         File tempExtensions = TestUtils.copyToTemp(ConfigControllerTest.class, "/extensions.json");
         Mockito.when(context.getRealPath(Mockito.contains("extensions.json"))).thenReturn(tempExtensions.getAbsolutePath());
+        Mockito.when(context.getAttribute(ServletContext.TEMPDIR)).thenReturn(TestUtils.getDataDir());
 
         Map<String, byte[]> extras = new HashMap<>();
         extras.put("C:\\evil.js", "drv".getBytes(StandardCharsets.UTF_8));
@@ -368,6 +380,7 @@ public void testUploadBlocksZipSlip_BackslashTraversalInAssets() throws IOExcept
         Mockito.when(context.getRealPath(Mockito.contains("extensions.json"))).thenReturn(tempExtensions.getAbsolutePath());
 
         File tempDist = TestUtils.getDataDir();
+        Mockito.when(context.getAttribute(ServletContext.TEMPDIR)).thenReturn(tempDist);
         Mockito.when(context.getRealPath(Mockito.contains("dist/extensions/"))).thenAnswer(
                 (Answer<String>) invocation -> {
                     String path = (String) invocation.getArguments()[0];
@@ -390,6 +403,7 @@ public void testUploadBlocksZipSlip_TraversalInBundleName() throws IOException {
         Mockito.when(context.getRealPath(Mockito.endsWith("pluginsConfig.json"))).thenReturn(tempConfig.getAbsolutePath());
         File tempExtensions = TestUtils.copyToTemp(ConfigControllerTest.class, "/extensions.json");
         Mockito.when(context.getRealPath(Mockito.contains("extensions.json"))).thenReturn(tempExtensions.getAbsolutePath());
+        Mockito.when(context.getAttribute(ServletContext.TEMPDIR)).thenReturn(TestUtils.getDataDir());
 
         Map<String, byte[]> extras = new HashMap<>();
         // no extra assets needed; bundle name itself is malicious
@@ -408,6 +422,7 @@ public void testUploadAllowsNestedAssets() throws IOException {
         Mockito.when(context.getRealPath(Mockito.contains("extensions.json"))).thenReturn(tempExtensions.getAbsolutePath());
 
         final File tempDist = TestUtils.getDataDir();
+        Mockito.when(context.getAttribute(ServletContext.TEMPDIR)).thenReturn(tempDist);
 
         // Cover both likely extension roots
         Mockito.when(context.getRealPath(Mockito.contains("dist/extensions/"))).thenAnswer(
diff --git a/java/services/src/test/java/it/geosolutions/mapstore/filters/NoCacheFilterTest.java b/java/services/src/test/java/it/geosolutions/mapstore/filters/NoCacheFilterTest.java
index 6807524b1b..5d2012d65d 100644
--- a/java/services/src/test/java/it/geosolutions/mapstore/filters/NoCacheFilterTest.java
+++ b/java/services/src/test/java/it/geosolutions/mapstore/filters/NoCacheFilterTest.java
@@ -3,11 +3,11 @@
 import org.junit.Test;
 
 import java.io.IOException;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.FilterChain;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.http.HttpServletResponse;
 
 import static org.mockito.Mockito.*;
 
diff --git a/java/services/src/test/java/it/geosolutions/mapstore/utils/ResourceUtilsTest.java b/java/services/src/test/java/it/geosolutions/mapstore/utils/ResourceUtilsTest.java
index 3c683b2f49..b15e3f310e 100644
--- a/java/services/src/test/java/it/geosolutions/mapstore/utils/ResourceUtilsTest.java
+++ b/java/services/src/test/java/it/geosolutions/mapstore/utils/ResourceUtilsTest.java
@@ -15,7 +15,7 @@
 import java.io.IOException;
 import java.util.Optional;
 
-import javax.servlet.ServletContext;
+import jakarta.servlet.ServletContext;
 
 import org.junit.Before;
 import org.junit.Test;
diff --git a/java/web/pom.xml b/java/web/pom.xml
index a8adc7748b..279497748c 100644
--- a/java/web/pom.xml
+++ b/java/web/pom.xml
@@ -50,22 +50,12 @@
         </dependency>
         <!-- servlet -->
         <dependency>
-            <groupId>javax.servlet</groupId>
-            <artifactId>javax.servlet-api</artifactId>
+            <groupId>jakarta.servlet</groupId>
+            <artifactId>jakarta.servlet-api</artifactId>
         </dependency>
-        <!-- gzip compression filter -->
         <dependency>
-            <groupId>net.sf.ehcache</groupId>
-            <artifactId>ehcache-web</artifactId>
-        </dependency>
-        <!-- misc -->
-        <dependency>
-            <groupId>commons-pool</groupId>
-            <artifactId>commons-pool</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>javax.xml.ws</groupId>
-            <artifactId>jaxws-api</artifactId>
+            <groupId>jakarta.xml.ws</groupId>
+            <artifactId>jakarta.xml.ws-api</artifactId>
         </dependency>
     </dependencies>
 
diff --git a/java/web/src/main/webapp/WEB-INF/configs-servlet.xml b/java/web/src/main/webapp/WEB-INF/configs-servlet.xml
index 247b9626c2..dceda537f3 100644
--- a/java/web/src/main/webapp/WEB-INF/configs-servlet.xml
+++ b/java/web/src/main/webapp/WEB-INF/configs-servlet.xml
@@ -13,7 +13,7 @@
        http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd
        http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
        http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd">
-    <security:global-method-security secured-annotations="enabled" />
+    <security:method-security secured-enabled="true"/>
     <mvc:annotation-driven/>
     <context:component-scan base-package="it.geosolutions.mapstore.controllers.configs" />
     <!-- TODO: remove these duplucations -->
diff --git a/java/web/src/main/webapp/WEB-INF/extensions-servlet.xml b/java/web/src/main/webapp/WEB-INF/extensions-servlet.xml
index ab32ad3d73..b53c78d8c9 100644
--- a/java/web/src/main/webapp/WEB-INF/extensions-servlet.xml
+++ b/java/web/src/main/webapp/WEB-INF/extensions-servlet.xml
@@ -13,7 +13,7 @@
        http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd
        http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
        http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd">
-    <security:global-method-security secured-annotations="enabled" />
+    <security:method-security secured-enabled="true"/>
     <mvc:annotation-driven/>
     <context:component-scan base-package="it.geosolutions.mapstore.controllers.extensions" />
 <!-- TODO: remove these duplucations -->
diff --git a/java/web/src/main/webapp/WEB-INF/loadAssets-servlet.xml b/java/web/src/main/webapp/WEB-INF/loadAssets-servlet.xml
index c1c1ab9387..a6e59eb1f1 100644
--- a/java/web/src/main/webapp/WEB-INF/loadAssets-servlet.xml
+++ b/java/web/src/main/webapp/WEB-INF/loadAssets-servlet.xml
@@ -13,7 +13,7 @@
        http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd
        http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
        http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd">
-    <security:global-method-security secured-annotations="enabled" />
+    <security:method-security secured-enabled="true"/>
     <mvc:annotation-driven/>
     <context:component-scan base-package="it.geosolutions.mapstore.controllers.rest.config" />
     <!-- TODO: remove these duplucations -->
diff --git a/java/web/src/main/webapp/WEB-INF/web.xml b/java/web/src/main/webapp/WEB-INF/web.xml
index 5da51060fc..b1b3ca7040 100644
--- a/java/web/src/main/webapp/WEB-INF/web.xml
+++ b/java/web/src/main/webapp/WEB-INF/web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<web-app id="WebApp_ID" version="2.4"
+<web-app id="WebApp_ID" version="6.0"
 	xmlns:javaee="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
+	xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_6_0.xsd">
 
 	<!-- pick up all spring application contexts -->
 	<context-param>
@@ -54,23 +54,6 @@
 		<url-pattern>/rest/*</url-pattern>
 	</filter-mapping>
 
-	<!-- GZip compression -->
-	<filter>
-		<filter-name>CompressionFilter</filter-name>
-		<filter-class>net.sf.ehcache.constructs.web.filter.GzipFilter</filter-class>
-	</filter>
-	<filter-mapping>
-		<filter-name>CompressionFilter</filter-name>
-		<url-pattern>*.css</url-pattern>
-	</filter-mapping>
-	<filter-mapping>
-		<filter-name>CompressionFilter</filter-name>
-		<url-pattern>*.html</url-pattern>
-	</filter-mapping>
-	<filter-mapping>
-		<filter-name>CompressionFilter</filter-name>
-		<url-pattern>*.js</url-pattern>
-	</filter-mapping>
     <!-- Cache management -->
     <filter>
         <filter-name>noCacheFilter</filter-name>
diff --git a/pom.xml b/pom.xml
index bb0c9934f5..7fe32f8f12 100644
--- a/pom.xml
+++ b/pom.xml
@@ -13,44 +13,39 @@
 
         <!-- platform BOM versions -->
         <tomcat.port>8080</tomcat.port>
-        <tomcat.version>9.0.116</tomcat.version>
-        <jackson.version>2.16.1</jackson.version>
-        <gt.version>31.3</gt.version>
+        <tomcat.version>10.1.55</tomcat.version>
+        <jackson.version>2.19.4</jackson.version>
         <metrics.version>4.2.12</metrics.version>
         <guava.version>32.0.0-jre</guava.version>
         <maven-resources-plugin.version>2.6</maven-resources-plugin.version>
         <maven-war-plugin.version>3.4.0</maven-war-plugin.version>
 
         <!-- Spring Framework & Security (aligned) -->
-        <spring.version>5.3.39</spring.version>
-        <spring.security.version>5.7.13</spring.security.version>
+        <spring.version>7.0.8</spring.version>
+        <spring.security.version>7.1.0</spring.security.version>
 
         <!-- other dependencies (aligned where applicable) -->
         <commons-collections.version>3.2.2</commons-collections.version>
         <commons-io.version>2.14.0</commons-io.version>
         <commons-logging.version>1.2</commons-logging.version>
-        <commons-pool.version>1.5.4</commons-pool.version>
-        <ehcache-web.version>2.0.4</ehcache-web.version>
-        <httpclient.version>4.5.13</httpclient.version>
-        <javax.servlet-api.version>3.0.1</javax.servlet-api.version>
-        <jaxws-api.version>2.3.1</jaxws-api.version>
+        <jakarta.servlet-api.version>6.0.0</jakarta.servlet-api.version>
+        <jaxws-api.version>4.0.3</jaxws-api.version>
         <json-lib.version>2.4.2-geoserver</json-lib.version>
         <json-patch.version>1.13</json-patch.version>
         <junit.version>4.13.2</junit.version>
-        <log4j.version>2.19.0</log4j.version>
+        <log4j.version>2.26.0</log4j.version>
         <mime-util.version>2.1.3</mime-util.version>
         <mockito-core.version>4.0.0</mockito-core.version>
         <slf4j.version>1.7.25</slf4j.version>
-        <cargo.version>1.10.2</cargo.version>
+        <cargo.version>1.10.27</cargo.version>
 
         <!-- MapStore‑specific -->
-        <geostore-webapp.version>2.6-SNAPSHOT</geostore-webapp.version>
-        <print-lib.version>2.3.5</print-lib.version>
-        <http_proxy.version>1.6-SNAPSHOT</http_proxy.version>
+        <geostore-webapp.version>2.7-SNAPSHOT</geostore-webapp.version>
+        <print-lib.version>2.5-SNAPSHOT</print-lib.version>
+        <http_proxy.version>1.7-SNAPSHOT</http_proxy.version>
 
         <!-- Commons extras -->
-        <commons-lang-version>2.3</commons-lang-version>
-        <commons-lang3.version>3.18.0</commons-lang3.version>
+        <commons-lang3.version>3.20.0</commons-lang3.version>
         <commons-text.version>1.13.0</commons-text.version>
     </properties>
 
@@ -140,13 +135,6 @@
                 </exclusions>
             </dependency>
 
-            <!-- HTTPClient: drop the bundled old HttpCore -->
-            <dependency>
-                <groupId>org.apache.httpcomponents</groupId>
-                <artifactId>httpclient</artifactId>
-                <version>${httpclient.version}</version>
-            </dependency>
-
             <dependency>
                 <groupId>junit</groupId>
                 <artifactId>junit</artifactId>
@@ -160,24 +148,9 @@
                 <scope>test</scope>
             </dependency>
             <dependency>
-                <groupId>javax.servlet</groupId>
-                <artifactId>javax.servlet-api</artifactId>
-                <version>${javax.servlet-api.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>net.sf.ehcache</groupId>
-                <artifactId>ehcache-web</artifactId>
-                <version>${ehcache-web.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>commons-pool</groupId>
-                <artifactId>commons-pool</artifactId>
-                <version>${commons-pool.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>commons-lang</groupId>
-                <artifactId>commons-lang</artifactId>
-                <version>${commons-lang-version}</version>
+                <groupId>jakarta.servlet</groupId>
+                <artifactId>jakarta.servlet-api</artifactId>
+                <version>${jakarta.servlet-api.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.commons</groupId>
@@ -203,8 +176,8 @@
             <!-- JAX‑WS API: keep only the Jakarta SOAP/Activation APIs you want -->
             <!-- 2) Remove old JAX‑WS/JAXB pulls -->
             <dependency>
-                <groupId>javax.xml.ws</groupId>
-                <artifactId>jaxws-api</artifactId>
+                <groupId>jakarta.xml.ws</groupId>
+                <artifactId>jakarta.xml.ws-api</artifactId>
                 <version>${jaxws-api.version}</version>
                 <exclusions>
                     <exclusion>
@@ -223,6 +196,22 @@
                         <groupId>javax.annotation</groupId>
                         <artifactId>javax.annotation-api</artifactId>
                     </exclusion>
+                    <exclusion>
+                        <groupId>jakarta.activation</groupId>
+                        <artifactId>jakarta.activation-api</artifactId>
+                    </exclusion>
+                    <exclusion>
+                        <groupId>jakarta.annotation</groupId>
+                        <artifactId>jakarta.annotation-api</artifactId>
+                    </exclusion>
+                    <exclusion>
+                        <groupId>jakarta.xml.bind</groupId>
+                        <artifactId>jakarta.xml.bind-api</artifactId>
+                    </exclusion>
+                    <exclusion>
+                        <groupId>jakarta.xml.soap</groupId>
+                        <artifactId>jakarta.xml.soap-api</artifactId>
+                    </exclusion>
                 </exclusions>
             </dependency>
 
@@ -264,7 +253,7 @@
                 </exclusions>
             </dependency>
 
-            <!-- GeoStore Webapp: drop all the old Spring 5.3.18 bits -->
+            <!-- GeoStore Webapp -->
             <dependency>
                 <groupId>it.geosolutions.geostore</groupId>
                 <artifactId>geostore-webapp</artifactId>
@@ -359,6 +348,10 @@
                         <groupId>org.apache.httpcomponents</groupId>
                         <artifactId>httpcore</artifactId>
                     </exclusion>
+                    <exclusion>
+                        <groupId>jakarta.xml.bind</groupId>
+                        <artifactId>jakarta.xml.bind-api</artifactId>
+                    </exclusion>
                 </exclusions>
             </dependency>
 
@@ -458,6 +451,30 @@
                 <module>binary</module>
             </modules>
         </profile>
+        <profile>
+            <id>owasp</id>
+            <activation>
+                <property>
+                    <name>owasp</name>
+                </property>
+            </activation>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.owasp</groupId>
+                        <artifactId>dependency-check-maven</artifactId>
+                        <version>12.2.2</version>
+                        <executions>
+                            <execution>
+                                <goals>
+                                    <goal>check</goal>
+                                </goals>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
     </profiles>
 
     <build>
@@ -498,19 +515,6 @@
                     </packagingExcludes>
                 </configuration>
             </plugin>
-            <plugin>
-                <groupId>org.owasp</groupId>
-                <artifactId>dependency-check-maven</artifactId>
-                <version>9.0.9</version>
-                <configuration>
-                    <skip>true</skip>
-                </configuration>
-                <executions>
-                    <execution>
-                        <goals><goal>check</goal></goals>
-                    </execution>
-                </executions>
-            </plugin>
         </plugins>
     </build>
 </project>
diff --git a/product/cargo/logging.properties b/product/cargo/logging.properties
new file mode 100644
index 0000000000..0bee6b30e0
--- /dev/null
+++ b/product/cargo/logging.properties
@@ -0,0 +1,79 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+handlers = 1catalina.org.apache.juli.AsyncFileHandler, 2localhost.org.apache.juli.AsyncFileHandler, 3manager.org.apache.juli.AsyncFileHandler, 4host-manager.org.apache.juli.AsyncFileHandler, java.util.logging.ConsoleHandler
+
+.handlers = 1catalina.org.apache.juli.AsyncFileHandler, java.util.logging.ConsoleHandler
+
+############################################################
+# Handler specific properties.
+# Describes specific configuration info for Handlers.
+############################################################
+
+1catalina.org.apache.juli.AsyncFileHandler.level = ALL
+1catalina.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs
+1catalina.org.apache.juli.AsyncFileHandler.prefix = catalina.
+1catalina.org.apache.juli.AsyncFileHandler.maxDays = 90
+1catalina.org.apache.juli.AsyncFileHandler.encoding = UTF-8
+
+2localhost.org.apache.juli.AsyncFileHandler.level = ALL
+2localhost.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs
+2localhost.org.apache.juli.AsyncFileHandler.prefix = localhost.
+2localhost.org.apache.juli.AsyncFileHandler.maxDays = 90
+2localhost.org.apache.juli.AsyncFileHandler.encoding = UTF-8
+
+3manager.org.apache.juli.AsyncFileHandler.level = ALL
+3manager.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs
+3manager.org.apache.juli.AsyncFileHandler.prefix = manager.
+3manager.org.apache.juli.AsyncFileHandler.maxDays = 90
+3manager.org.apache.juli.AsyncFileHandler.encoding = UTF-8
+
+4host-manager.org.apache.juli.AsyncFileHandler.level = ALL
+4host-manager.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs
+4host-manager.org.apache.juli.AsyncFileHandler.prefix = host-manager.
+4host-manager.org.apache.juli.AsyncFileHandler.maxDays = 90
+4host-manager.org.apache.juli.AsyncFileHandler.encoding = UTF-8
+
+java.util.logging.ConsoleHandler.level = ALL
+java.util.logging.ConsoleHandler.formatter = org.apache.juli.OneLineFormatter
+java.util.logging.ConsoleHandler.encoding = UTF-8
+
+
+############################################################
+# Facility specific properties.
+# Provides extra control for each logger.
+############################################################
+
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = INFO
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = 2localhost.org.apache.juli.AsyncFileHandler
+
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].level = INFO
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = 3manager.org.apache.juli.AsyncFileHandler
+
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].level = INFO
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = 4host-manager.org.apache.juli.AsyncFileHandler
+
+# For example, set the org.apache.catalina.util.LifecycleBase logger to log
+# each component that extends LifecycleBase changing state:
+#org.apache.catalina.util.LifecycleBase.level = FINE
+
+# To see debug messages for HTTP/2 handling, uncomment the following line:
+#org.apache.coyote.http2.level = FINE
+
+# To see debug messages for WebSocket handling, uncomment the following line:
+#org.apache.tomcat.websocket.level = FINE
+
+# MapStore debugging
+#org.apache.catalina.core.StandardContext.level = FINE
diff --git a/product/config/db/geostore-spring-security-db.xml b/product/config/db/geostore-spring-security-db.xml
index 9964684ac3..58f2048f05 100644
--- a/product/config/db/geostore-spring-security-db.xml
+++ b/product/config/db/geostore-spring-security-db.xml
@@ -15,38 +15,54 @@
     <!-- ==================================================================== -->
     <!-- === REST Security ================================================== -->
     <!-- ==================================================================== -->
-    <security:global-method-security secured-annotations="enabled" />
+    <security:method-security secured-enabled="true"/>
 
-    <security:http auto-config="true" create-session="never">
+    <security:http auto-config="true" create-session="never" authentication-manager-ref="authenticationManager">
         <security:http-basic entry-point-ref="restAuthenticationEntryPoint"/>
         <security:csrf disabled="true"/>
         <security:custom-filter ref="authenticationTokenProcessingFilter" before="FORM_LOGIN_FILTER"/>
         <security:custom-filter ref="sessionTokenProcessingFilter" after="FORM_LOGIN_FILTER"/>
         <security:custom-filter ref="compositeOpenIdFilter" before="OPENID_FILTER"/>
         <security:anonymous />
+        <security:intercept-url pattern="/**" access="permitAll" />
     </security:http>
 
+    <bean id="entityManager"
+          class="org.springframework.orm.jpa.support.SharedEntityManagerBean">
+        <property name="entityManagerFactory" ref="geostoreEntityManagerFactory"/>
+        <property name="persistenceUnitName" value="geostore"/>
+    </bean>
+
     <!-- Entry point -->
     <bean id="restAuthenticationEntryPoint" class="it.geosolutions.geostore.services.rest.security.RestAuthenticationEntryPoint">
         <property name="realmName" value="GeoStore"></property>
     </bean>
     <!-- GeoStore Auth Provider -->
-    <bean id="geoStoreUserServiceAuthenticationProvider" class="it.geosolutions.geostore.services.rest.security.UserServiceAuthenticationProvider">
+    <bean id="geoStoreUserServiceAuthenticationProvider"
+          class="it.geosolutions.geostore.services.rest.security.UserServiceAuthenticationProvider"
+          lazy-init="true"
+          depends-on="entityManager">
     </bean>
 
-    <bean class="it.geosolutions.geostore.services.rest.security.UserAttributeTokenAuthenticationFilter" id="authenticationTokenProcessingFilter">
+    <bean id="authenticationTokenProcessingFilter"
+        class="it.geosolutions.geostore.services.rest.security.UserAttributeTokenAuthenticationFilter"
+        lazy-init="true"
+        depends-on="entityManager">
     </bean>
 
-    <bean class="it.geosolutions.geostore.services.rest.security.SessionTokenAuthenticationFilter" id="sessionTokenProcessingFilter">
+    <bean id="sessionTokenProcessingFilter"
+        class="it.geosolutions.geostore.services.rest.security.SessionTokenAuthenticationFilter"
+        lazy-init="true"
+        depends-on="entityManager">
     </bean>
 
     <!-- Inject into the Authentication Manager the GeoStore Auth Provider -->
-    <security:authentication-manager>
+    <security:authentication-manager alias="authenticationManager">
         <security:authentication-provider ref='geoStoreUserServiceAuthenticationProvider' />
     </security:authentication-manager>
 
-
-    <bean id="preauthenticatedAuthenticationProvider" class="it.geosolutions.geostore.services.rest.security.PreAuthenticatedAuthenticationProvider">
+    <bean id="preauthenticatedAuthenticationProvider"
+          class="it.geosolutions.geostore.services.rest.security.PreAuthenticatedAuthenticationProvider">
     </bean>
 
     <context:annotation-config/>
diff --git a/product/config/ldap/geostore-spring-security-ldap.xml b/product/config/ldap/geostore-spring-security-ldap.xml
index fc35f22c8d..b5d16f85a4 100644
--- a/product/config/ldap/geostore-spring-security-ldap.xml
+++ b/product/config/ldap/geostore-spring-security-ldap.xml
@@ -18,7 +18,7 @@
 	<!-- ==================================================================== -->
 	<!-- === REST Security ================================================== -->
 	<!-- ==================================================================== -->
-	<security:global-method-security secured-annotations="enabled" />
+	<security:method-security secured-enabled="true"/>
 
 	<security:http auto-config="true" create-session="never" >
 		<security:http-basic entry-point-ref="restAuthenticationEntryPoint"/>
@@ -27,6 +27,7 @@
 		<security:custom-filter ref="sessionTokenProcessingFilter" after="FORM_LOGIN_FILTER"/>
         <security:custom-filter ref="compositeOpenIdFilter" before="OPENID_FILTER"/>
 		<security:anonymous />
+        <security:intercept-url pattern="/**" access="permitAll" />
 	</security:http>
 	<!-- Entry point -->
 	<bean id="restAuthenticationEntryPoint" class="it.geosolutions.geostore.services.rest.security.RestAuthenticationEntryPoint" >
@@ -37,13 +38,17 @@
 		class="it.geosolutions.geostore.services.rest.security.UserServiceAuthenticationProvider">
 	</bean>
 
-	<bean class="it.geosolutions.geostore.services.rest.security.UserAttributeTokenAuthenticationFilter"
-        id="authenticationTokenProcessingFilter">
-	</bean>
+    <bean id="authenticationTokenProcessingFilter"
+          class="it.geosolutions.geostore.services.rest.security.UserAttributeTokenAuthenticationFilter"
+          lazy-init="true"
+          depends-on="entityManager">
+    </bean>
 
-	<bean class="it.geosolutions.geostore.services.rest.security.SessionTokenAuthenticationFilter"
-        id="sessionTokenProcessingFilter">
-	</bean>
+    <bean id="sessionTokenProcessingFilter"
+          class="it.geosolutions.geostore.services.rest.security.SessionTokenAuthenticationFilter"
+          lazy-init="true"
+          depends-on="entityManager">
+    </bean>
 
 	<security:authentication-manager>
         <security:authentication-provider ref='geoStoreUserServiceAuthenticationProvider' />
diff --git a/product/pom.xml b/product/pom.xml
index c2b79945cc..2c2fdb6c1e 100644
--- a/product/pom.xml
+++ b/product/pom.xml
@@ -276,7 +276,7 @@
                 <version>${cargo.version}</version>
                 <configuration>
                     <container>
-                        <containerId>tomcat9x</containerId>
+                        <containerId>tomcat10x</containerId>
                         <systemProperties>
                             <datadir.location>${datadir.location}</datadir.location>
                             <security.integration>${security.integration}</security.integration>
@@ -297,6 +297,7 @@
                                 ${backend.debug.args}
                                 --add-opens=java.base/java.lang=ALL-UNNAMED
                                 --add-opens=java.base/java.io=ALL-UNNAMED
+                                -Djava.util.logging.config.file=${project.basedir}/cargo/logging.properties
                             </cargo.jvmargs>
                             <cargo.servlet.port>${tomcat.port}</cargo.servlet.port>
                             <cargo.logging>low</cargo.logging>
diff --git a/project/standard/templates/pom.xml b/project/standard/templates/pom.xml
index 15be6ed37d..1273fcf3a8 100644
--- a/project/standard/templates/pom.xml
+++ b/project/standard/templates/pom.xml
@@ -12,27 +12,24 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <!-- platform BOM versions -->
         <tomcat.port>8080</tomcat.port>
-        <tomcat.version>9.0.116</tomcat.version>
+        <tomcat.version>11.0.22</tomcat.version>
         <jackson.version>2.16.1</jackson.version>
         <maven-resources-plugin.version>2.6</maven-resources-plugin.version>
         <maven-war-plugin.version>3.4.0</maven-war-plugin.version>
         <!-- Spring Framework & Security (aligned) -->
-        <spring.security.version>5.7.13</spring.security.version>
-        <spring.version>5.3.39</spring.version>
+        <spring.version>7.0.7</spring.version>
+        <spring.security.version>7.0.5</spring.security.version>
         <!-- other dependencies (aligned where applicable) -->
-        <commons-pool.version>1.5.4</commons-pool.version>
-        <ehcache-web.version>2.0.4</ehcache-web.version>
-        <httpclient.version>4.5.13</httpclient.version>
-        <javax.servlet-api.version>3.0.1</javax.servlet-api.version>
-        <jaxws-api.version>2.3.1</jaxws-api.version>
+        <jakarta.servlet-api.version>6.1.0</jakarta.servlet-api.version>
+        <jaxws-api.version>4.0.3</jaxws-api.version>
         <junit.version>4.13.2</junit.version>
         <mockito-core.version>4.0.0</mockito-core.version>
-        <cargo.version>1.10.2</cargo.version>
+        <cargo.version>1.10.27</cargo.version>
         <!-- MapStore‑specific -->
-        <mapstore-services.version>1.10-SNAPSHOT</mapstore-services.version>
-        <geostore-webapp.version>2.6-SNAPSHOT</geostore-webapp.version>
+        <mapstore-services.version>1.12-SNAPSHOT</mapstore-services.version>
+        <geostore-webapp.version>2.7-SNAPSHOT</geostore-webapp.version>
         <http_proxy.version>1.6-SNAPSHOT</http_proxy.version>
-        <print-lib.version>2.3.5</print-lib.version>
+        <print-lib.version>2.5-SNAPSHOT</print-lib.version>
     </properties>
 
     <build>
diff --git a/project/standard/templates/web/pom.xml b/project/standard/templates/web/pom.xml
index 18b238fd7f..53135dcaa9 100644
--- a/project/standard/templates/web/pom.xml
+++ b/project/standard/templates/web/pom.xml
@@ -61,13 +61,7 @@
     <dependency>
         <groupId>javax.servlet</groupId>
         <artifactId>javax.servlet-api</artifactId>
-        <version>${javax.servlet-api.version}</version>
-    </dependency>
-    <!-- gzip compression filter -->
-    <dependency>
-        <groupId>net.sf.ehcache</groupId>
-        <artifactId>ehcache-web</artifactId>
-        <version>${ehcache-web.version}</version>
+        <version>${jakarta.servlet-api.version}</version>
     </dependency>
     <!-- misc -->
     <dependency>
@@ -494,13 +488,7 @@
                     <dependency>
                         <groupId>javax.servlet</groupId>
                         <artifactId>javax.servlet-api</artifactId>
-                        <version>${javax.servlet-api.version}</version>
-                    </dependency>
-                    <!-- gzip compression filter -->
-                    <dependency>
-                        <groupId>net.sf.ehcache</groupId>
-                        <artifactId>ehcache-web</artifactId>
-                        <version>${ehcache-web.version}</version>
+                        <version>${jakarta.servlet-api.version}</version>
                     </dependency>
                     <!-- misc -->
                     <dependency>
diff --git a/project/standard/templates/web/src/main/webapp/WEB-INF/configs-servlet.xml b/project/standard/templates/web/src/main/webapp/WEB-INF/configs-servlet.xml
index 9eddc99811..9cf39d6c41 100644
--- a/project/standard/templates/web/src/main/webapp/WEB-INF/configs-servlet.xml
+++ b/project/standard/templates/web/src/main/webapp/WEB-INF/configs-servlet.xml
@@ -12,7 +12,7 @@
        http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd
        http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
        http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd">
-    <security:global-method-security secured-annotations="enabled" />
+    <security:method-security secured-enabled="true"/>
     <mvc:annotation-driven/>
     <context:component-scan base-package="it.geosolutions.mapstore.controllers.configs" />
     <!-- TODO: remove these duplucations -->
diff --git a/project/standard/templates/web/src/main/webapp/WEB-INF/extensions-servlet.xml b/project/standard/templates/web/src/main/webapp/WEB-INF/extensions-servlet.xml
index 206c71b8f4..25d0d06bf9 100644
--- a/project/standard/templates/web/src/main/webapp/WEB-INF/extensions-servlet.xml
+++ b/project/standard/templates/web/src/main/webapp/WEB-INF/extensions-servlet.xml
@@ -12,7 +12,7 @@
        http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd
        http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
        http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd">
-    <security:global-method-security secured-annotations="enabled" />
+    <security:method-security secured-enabled="true"/>
     <mvc:annotation-driven/>
     <context:component-scan base-package="it.geosolutions.mapstore.controllers.extensions" />
     <!-- TODO: remove these duplucations -->
diff --git a/project/standard/templates/web/src/main/webapp/WEB-INF/loadAssets-servlet.xml b/project/standard/templates/web/src/main/webapp/WEB-INF/loadAssets-servlet.xml
index 28d407bae1..220ee5b9e5 100644
--- a/project/standard/templates/web/src/main/webapp/WEB-INF/loadAssets-servlet.xml
+++ b/project/standard/templates/web/src/main/webapp/WEB-INF/loadAssets-servlet.xml
@@ -12,7 +12,7 @@
        http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd
        http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
        http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd">
-    <security:global-method-security secured-annotations="enabled" />
+    <security:method-security secured-enabled="true"/>
     <mvc:annotation-driven/>
     <context:component-scan base-package="it.geosolutions.mapstore.controllers.rest.config" />
     <!-- TODO: remove these duplucations -->
diff --git a/project/standard/templates/web/src/main/webapp/WEB-INF/web.xml b/project/standard/templates/web/src/main/webapp/WEB-INF/web.xml
index 03b4a380c0..869be321bf 100644
--- a/project/standard/templates/web/src/main/webapp/WEB-INF/web.xml
+++ b/project/standard/templates/web/src/main/webapp/WEB-INF/web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<web-app id="WebApp_ID" version="2.4"
+<web-app id="WebApp_ID" version="6.0"
 	xmlns:javaee="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
+	xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_6_0.xsd">
 
 	<!-- pick up all spring application contexts -->
 	<context-param>
@@ -54,24 +54,6 @@
 		<url-pattern>/rest/*</url-pattern>
 	</filter-mapping>
 
-	<!-- GZip compression -->
-	<filter>
-		<filter-name>CompressionFilter</filter-name>
-		<filter-class>net.sf.ehcache.constructs.web.filter.GzipFilter</filter-class>
-	</filter>
-	<filter-mapping>
-		<filter-name>CompressionFilter</filter-name>
-		<url-pattern>*.css</url-pattern>
-	</filter-mapping>
-	<filter-mapping>
-		<filter-name>CompressionFilter</filter-name>
-		<url-pattern>*.html</url-pattern>
-	</filter-mapping>
-	<filter-mapping>
-		<filter-name>CompressionFilter</filter-name>
-		<url-pattern>*.js</url-pattern>
-	</filter-mapping>
-
     <!-- Cache management -->
     <filter>
         <filter-name>noCacheFilter</filter-name>
diff --git a/web/src/config/db/geostore-spring-security-db.xml b/web/src/config/db/geostore-spring-security-db.xml
index 994fb4ed9a..926b19ca8a 100644
--- a/web/src/config/db/geostore-spring-security-db.xml
+++ b/web/src/config/db/geostore-spring-security-db.xml
@@ -15,37 +15,54 @@
     <!-- ==================================================================== -->
     <!-- === REST Security ================================================== -->
     <!-- ==================================================================== -->
-    <security:global-method-security secured-annotations="enabled" />
+    <security:method-security secured-enabled="true"/>
 
-    <security:http auto-config="true" create-session="never">
+    <security:http auto-config="true" create-session="never" authentication-manager-ref="authenticationManager">
         <security:http-basic entry-point-ref="restAuthenticationEntryPoint"/>
         <security:csrf disabled="true"/>
         <security:custom-filter ref="authenticationTokenProcessingFilter" before="FORM_LOGIN_FILTER"/>
         <security:custom-filter ref="sessionTokenProcessingFilter" after="FORM_LOGIN_FILTER"/>
         <security:custom-filter ref="compositeOpenIdFilter" before="OPENID_FILTER"/>
         <security:anonymous />
+        <security:intercept-url pattern="/**" access="permitAll" />
     </security:http>
 
+    <bean id="entityManager"
+          class="org.springframework.orm.jpa.support.SharedEntityManagerBean">
+        <property name="entityManagerFactory" ref="geostoreEntityManagerFactory"/>
+        <property name="persistenceUnitName" value="geostore"/>
+    </bean>
+
     <!-- Entry point -->
     <bean id="restAuthenticationEntryPoint" class="it.geosolutions.geostore.services.rest.security.RestAuthenticationEntryPoint">
         <property name="realmName" value="GeoStore"></property>
     </bean>
     <!-- GeoStore Auth Provider -->
-    <bean id="geoStoreUserServiceAuthenticationProvider" class="it.geosolutions.geostore.services.rest.security.UserServiceAuthenticationProvider">
+    <bean id="geoStoreUserServiceAuthenticationProvider"
+          class="it.geosolutions.geostore.services.rest.security.UserServiceAuthenticationProvider"
+          lazy-init="true"
+          depends-on="entityManager">
     </bean>
 
-    <bean class="it.geosolutions.geostore.services.rest.security.UserAttributeTokenAuthenticationFilter" id="authenticationTokenProcessingFilter">
+    <bean id="authenticationTokenProcessingFilter"
+          class="it.geosolutions.geostore.services.rest.security.UserAttributeTokenAuthenticationFilter"
+          lazy-init="true"
+          depends-on="entityManager">
     </bean>
 
-    <bean class="it.geosolutions.geostore.services.rest.security.SessionTokenAuthenticationFilter" id="sessionTokenProcessingFilter">
+    <bean id="sessionTokenProcessingFilter"
+          class="it.geosolutions.geostore.services.rest.security.SessionTokenAuthenticationFilter"
+          lazy-init="true"
+          depends-on="entityManager">
     </bean>
 
     <!-- Inject into the Authentication Manager the GeoStore Auth Provider -->
-    <security:authentication-manager>
+    <security:authentication-manager alias="authenticationManager">
         <security:authentication-provider ref='geoStoreUserServiceAuthenticationProvider' />
     </security:authentication-manager>
 
-    <bean id="preauthenticatedAuthenticationProvider" class="it.geosolutions.geostore.services.rest.security.PreAuthenticatedAuthenticationProvider">
+    <bean id="preauthenticatedAuthenticationProvider"
+          class="it.geosolutions.geostore.services.rest.security.PreAuthenticatedAuthenticationProvider">
     </bean>
 
     <context:annotation-config/>
diff --git a/web/src/config/ldap/geostore-spring-security-ldap.xml b/web/src/config/ldap/geostore-spring-security-ldap.xml
index ff7e73f22a..e158080862 100644
--- a/web/src/config/ldap/geostore-spring-security-ldap.xml
+++ b/web/src/config/ldap/geostore-spring-security-ldap.xml
@@ -18,7 +18,7 @@
 	<!-- ==================================================================== -->
 	<!-- === REST Security ================================================== -->
 	<!-- ==================================================================== -->
-	<security:global-method-security secured-annotations="enabled" />
+    <security:method-security secured-enabled="true"/>
 
 	<security:http auto-config="true" create-session="never" >
 		<security:http-basic entry-point-ref="restAuthenticationEntryPoint"/>
@@ -27,6 +27,7 @@
 		<security:custom-filter ref="sessionTokenProcessingFilter" after="FORM_LOGIN_FILTER"/>
         <security:custom-filter ref="compositeOpenIdFilter" before="OPENID_FILTER"/>
 		<security:anonymous />
+        <security:intercept-url pattern="/**" access="permitAll" />
 	</security:http>
 	<!-- Entry point -->
 	<bean id="restAuthenticationEntryPoint" class="it.geosolutions.geostore.services.rest.security.RestAuthenticationEntryPoint" >
@@ -37,13 +38,17 @@
 		class="it.geosolutions.geostore.services.rest.security.UserServiceAuthenticationProvider">
 	</bean>
 
-	<bean class="it.geosolutions.geostore.services.rest.security.UserAttributeTokenAuthenticationFilter"
-        id="authenticationTokenProcessingFilter">
-	</bean>
+    <bean id="authenticationTokenProcessingFilter"
+          class="it.geosolutions.geostore.services.rest.security.UserAttributeTokenAuthenticationFilter"
+          lazy-init="true"
+          depends-on="entityManager">
+    </bean>
 
-	<bean class="it.geosolutions.geostore.services.rest.security.SessionTokenAuthenticationFilter"
-        id="sessionTokenProcessingFilter">
-	</bean>
+    <bean id="sessionTokenProcessingFilter"
+          class="it.geosolutions.geostore.services.rest.security.SessionTokenAuthenticationFilter"
+          lazy-init="true"
+          depends-on="entityManager">
+    </bean>
 
 	<security:authentication-manager>
         <security:authentication-provider ref='geoStoreUserServiceAuthenticationProvider' />
@@ -108,9 +113,9 @@
                         </constructor-arg>
                     </bean>
                 </property>
-			</bean>
-		</constructor-arg>
-	</bean>
+            </bean>
+        </constructor-arg>
+    </bean>
     <!-- enable direct connection mode
     <bean id="ldapUserDAO" class="it.geosolutions.geostore.core.dao.ldap.impl.UserDAOImpl">
         <constructor-arg ref="contextSource"/>
@@ -135,6 +140,7 @@
     <alias name="externalSecurityDAO" alias="SecurityDAO"/>
     <alias name="ldapUserDAO" alias="userDAO"/>
     -->
+
     <bean id="preauthenticatedAuthenticationProvider" class="it.geosolutions.geostore.services.rest.security.PreAuthenticatedAuthenticationProvider">
     </bean>