diff --git a/RELEASE-NOTES.md b/RELEASE-NOTES.md
index a53a80c0..01b98e47 100644
--- a/RELEASE-NOTES.md
+++ b/RELEASE-NOTES.md
@@ -1,32 +1,26 @@
 #              OpenAS2 Server
-#              Version 4.8.3
+#              Version 4.9.0
 #              RELEASE NOTES
 -----
-The OpenAS2 project is pleased to announce the release of OpenAS2 4.8.3
+The OpenAS2 project is pleased to announce the release of OpenAS2 4.9.0
 
-The release download file is: OpenAS2Server-4.8.3.zip
+The release download file is: OpenAS2Server-4.9.0.zip
 
 The zip file contains a PDF document (OpenAS2HowTo.pdf) providing information on installing and using the application.
 ## NOTE: Testing covers Java 11 to 21.
 ##       Java 8 is NO LONGER SUPPORTED.
 
-Version 4.8.3 - 2026-06-26
+Version 4.9.0 - 2026-07-27
 =======
 
 This is a minor enhancement and bugfix release.
-1. Optimise resend process.
-2. Fix db_ddl.sql: align with authoritative openas2-schema.xml.
-3. Fix container signal handling so the JVM receives SIGTERM for clean shutdown.
-4. Fix flaky tests icausing CI/CD pipeline to fail.
-5. Fix logging of error response body in AS2SenderModule
-6. Fix start-openas2.bat for logging directory setting.
-7. Add poller configuration to API command for partnership.
-8. Change the IOUtil moveFile method to a more intelligent algorithm for non-homogeneous moves.
-9. Add DbPartnershipFactory: partnerships can optionally be stored in a database (Azure SQL, PostgreSQL, MySQL, Oracle or the embedded H2) instead of the partnerships XML file. See the commented example in config.xml. The required tables are included in db_ddl.sql and openas2-schema.xml and are only needed when using the database partnership store.
-10. Add mutual TLS (client certificate) authentication for outbound HTTPS connections using the https_client_keystore, https_client_keystore_password and https_client_cert_alias partnership attributes (or properties for a global client identity). See the commented example in partnerships.xml.
-11. Add JmsPollingModule: an alternative outbound intake that consumes work from an AMQP 1.0 message queue (Azure Service Bus or any AMQP broker via Apache Qpid JMS) instead of polling a directory. An external producer publishes a queue message identifying the sender/receiver AS2 IDs and the file path; the file is sent through the existing pipeline and the broker owns retry/dead-lettering. See the commented example in config.xml.
-12. Add a $msg.hash.<algorithm>$ filename parameter (md5, sha1, sha256, sha512, optionally truncated with _<length>, e.g. $msg.hash.sha256_16$) that hashes the message payload. Include it in a received-file filename template to dedup by name and content: a re-delivery of the same file overwrites, while changed content gets a new name. See the commented example in partnerships.xml.
-13. Record the stored MDN file path in the message tracking database (new mdn_file_path column) and add a messages/mdnpath API command that returns the MDN file path for a message given its payload filename (GET /api/messages/mdnpath/<filename>). If you use the DB tracking module with an existing external database, add the new column: ALTER TABLE msg_metadata ADD COLUMN mdn_file_path LONGVARCHAR (or the equivalent for your database).
+1. Add poller configuration to API command for partnership.
+2. Change the IOUtil moveFile method to a more intelligent algorithm for non-homogeneous moves.
+3. Add DbPartnershipFactory: partnerships can optionally be stored in a database (Azure SQL, PostgreSQL, MySQL, Oracle or the embedded H2) instead of the partnerships XML file. See the commented example in config.xml. The required tables are included in db_ddl.sql and openas2-schema.xml and are only needed when using the database partnership store.
+4. Add mutual TLS (client certificate) authentication for outbound HTTPS connections using the https_client_keystore, https_client_keystore_password and https_client_cert_alias partnership attributes (or properties for a global client identity). See the commented example in partnerships.xml.
+5. Add JmsPollingModule: an alternative outbound intake that consumes work from an AMQP 1.0 message queue (Azure Service Bus or any AMQP broker via Apache Qpid JMS) instead of polling a directory. An external producer publishes a queue message identifying the sender/receiver AS2 IDs and the file path; the file is sent through the existing pipeline and the broker owns retry/dead-lettering. See the commented example in config.xml.
+6. Add a $msg.hash.<algorithm>$ filename parameter (md5, sha1, sha256, sha512, optionally truncated with _<length>, e.g. $msg.hash.sha256_16$) that hashes the message payload. Include it in a received-file filename template to dedup by name and content: a re-delivery of the same file overwrites, while changed content gets a new name. See the commented example in partnerships.xml.
+7. Record the stored MDN file path in the message tracking database (new mdn_file_path column) and add a messages/mdnpath API command that returns the MDN file path for a message given its payload filename (GET /api/messages/mdnpath/<filename>). If you use the DB tracking module with an existing external database, add the new column: ALTER TABLE msg_metadata ADD COLUMN mdn_file_path LONGVARCHAR (or the equivalent for your database).
 
 ## Upgrade Notes
  See the openAS2HowTo appendix for the general process on upgrading OpenAS2.
diff --git a/changes.txt b/changes.txt
index aaae44d2..2e0c9f12 100644
--- a/changes.txt
+++ b/changes.txt
@@ -1,17 +1,16 @@
 **IMPORTANT NOTE**: Please review upgrade notes in the RELEASE-NOTES.md if you are upgrading
 
-Version 4.8.3 - 2026-06-26
+Version 4.9.0 - 2026-07-27
+===========================
 
 This is a minor enhancement and bugfix release.
-1. Optimise resend process.
-2. Fix db_ddl.sql: align with authoritative openas2-schema.xml.
-3. Fix container signal handling so the JVM receives SIGTERM for clean shutdown.
-4. Fix flaky tests icausing CI/CD pipeline to fail.
-5. Fix logging of error response body in AS2SenderModule
-6. Fix start-openas2.bat for logging directory setting.
-7. Add poller configuration to API command for partnership.
-8. Change the IOUtil moveFile method to a more intelligent algorithm for non-homogeneous moves.
-
+1. Add poller configuration to API command for partnership.
+2. Change the IOUtil moveFile method to a more intelligent algorithm for non-homogeneous moves.
+3. Add DbPartnershipFactory: partnerships can optionally be stored in a database (Azure SQL, PostgreSQL, MySQL, Oracle or the embedded H2) instead of the partnerships XML file. See the commented example in config.xml. The required tables are included in db_ddl.sql and openas2-schema.xml and are only needed when using the database partnership store.
+4. Add mutual TLS (client certificate) authentication for outbound HTTPS connections using the https_client_keystore, https_client_keystore_password and https_client_cert_alias partnership attributes (or properties for a global client identity). See the commented example in partnerships.xml.
+5. Add JmsPollingModule: an alternative outbound intake that consumes work from an AMQP 1.0 message queue (Azure Service Bus or any AMQP broker via Apache Qpid JMS) instead of polling a directory. An external producer publishes a queue message identifying the sender/receiver AS2 IDs and the file path; the file is sent through the existing pipeline and the broker owns retry/dead-lettering. See the commented example in config.xml.
+6. Add a $msg.hash.<algorithm>$ filename parameter (md5, sha1, sha256, sha512, optionally truncated with _<length>, e.g. $msg.hash.sha256_16$) that hashes the message payload. Include it in a received-file filename template to dedup by name and content: a re-delivery of the same file overwrites, while changed content gets a new name. See the commented example in partnerships.xml.
+7. Record the stored MDN file path in the message tracking database (new mdn_file_path column) and add a messages/mdnpath API command that returns the MDN file path for a message given its payload filename (GET /api/messages/mdnpath/<filename>). If you use the DB tracking module with an existing external database, add the new column: ALTER TABLE msg_metadata ADD COLUMN mdn_file_path LONGVARCHAR (or the equivalent for your database).
 
 
 Version 4.8.2 - 2026-04-10
diff --git a/pom.xml b/pom.xml
index 5fad7286..9d9dd904 100644
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>net.sf.openas2</groupId>
     <artifactId>OpenAS2</artifactId>
-    <version>4.8.3</version>
+    <version>4.9.0</version>
     <name>OpenAS2</name>
     <packaging>pom</packaging>
 
@@ -51,17 +51,17 @@
             <dependency>
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcjmail-jdk18on</artifactId>
-                <version>1.84</version>
+                <version>1.85</version>
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcpkix-jdk18on</artifactId>
-                <version>1.84</version>
+                <version>1.85</version>
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcprov-jdk18on</artifactId>
-                <version>1.84</version>
+                <version>1.85</version>
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
@@ -71,7 +71,7 @@
             <dependency>
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcpg-jdk18on</artifactId>
-                <version>1.84</version>
+                <version>1.85</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.commons</groupId>
@@ -98,7 +98,7 @@
             <dependency>
                 <groupId>org.apache.qpid</groupId>
                 <artifactId>qpid-jms-client</artifactId>
-                <version>2.6.1</version>
+                <version>2.10.0</version>
             </dependency>
             <!-- Embedded AMQP 1.0 broker for testing the queue module against a real broker. -->
             <dependency>
@@ -166,7 +166,7 @@
 			<dependency>
 			    <groupId>ch.qos.logback</groupId>
 			    <artifactId>logback-classic</artifactId>
-			    <version>1.5.37</version>
+			    <version>1.6.0</version>
 			</dependency>
 			<dependency>
 			    <groupId>jakarta.ws.rs</groupId>
@@ -181,30 +181,30 @@
            <dependency>
                <groupId>org.glassfish.jersey.containers</groupId>
                <artifactId>jersey-container-grizzly2-http</artifactId>
-               <version>3.1.11</version>
+               <version>3.1.1</version>
                <type>jar</type>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-databind</artifactId>
-               <version>2.22.0</version>
+               <version>2.22.1</version>
                <type>jar</type>
            </dependency>
 		   <dependency>
 		        <groupId>com.fasterxml.jackson.module</groupId>
 		        <artifactId>jackson-module-jaxb-annotations</artifactId>
-		        <version>2.22.0</version>
+		        <version>2.22.1</version>
 		   </dependency>
            <dependency>
                <groupId>org.glassfish.jersey.media</groupId>
                <artifactId>jersey-media-json-jackson</artifactId>
-               <version>3.1.11</version>
+               <version>3.1.1</version>
                <type>jar</type>
            </dependency>
    		   <dependency>
    		    <groupId>org.glassfish.jersey.inject</groupId>
    		    <artifactId>jersey-hk2</artifactId>
-   		    <version>3.1.11</version>
+   		    <version>3.1.1</version>
            </dependency>
             <dependency>
                 <groupId>jakarta.xml.bind</groupId>