A number of dependencies that Openfire depends on can be updated:

Parent

jetty -> 9.4.12.v20180830

bouncycastle -> 1.60

slf4j -> 1.7.25

log4j -> 2.11.1

XMPP Server

dom4j -> 2.1.1

rome -> 1.11.1

commons-dbcp2 -> 2.5.0 

commons-pool2 -> 2.6.0

httpclient -> 4.5.6

commons-lang3 -> 3.8.1

commons-text -> 1.6

libidn -> 1.28

ant -> 1.10.5

jsmpp-> 2.3.6

sitemesh -> 2.4.2

commons-fileupload -> 1.3.3

commons-io -> 2.6

hsqldb -> 2.4.1

mysql-connector-java -> 8.0.12

postgresql -> 42.2.5

mssql-jdbc -> 7.0.0.jre8

mockito-core -> 2.23.0

Plugins

Parent pom.xml: jetty -> 9.4.12.v20180830

callbackOnOffline: jersey -> 2.27

candy: json -> 20180813

clientcontrol: commons-fileupload -> 1.3.3

externalservicediscovery: equalsverifier -> 3.0

fastpath: xstream -> 1.4.10-java7

fastpath: lucene-core -> 2.9.4 (NB. Later versions are available but require code changes)

gojara: json -> 20180813

hazelcast: hazelcast -> 3.10.6

inverse: json -> 20180813

jmxweb: quartz -> 2.3.0

jmxweb: itextpdf -> 5.5.13

mucservice: jersey (old-style) ->1.19.4

userImportExport: msv -> 20050913

userservice: jersey (old-style) ->1.19.4

xmldebugger: log4j -> 2.11.1