diff --git a/Dockerfile b/Dockerfile
index 926558d..a9f3ddb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,11 +1,11 @@
-FROM openjdk:11.0.14-jdk-slim as build-keys
+FROM openjdk:11.0.15-jdk-slim as build-keys
 
 WORKDIR /tmp/kf-key-management
 COPY . .
 
 RUN ./mvnw package -DskipTests
 
-FROM openjdk:11.0.14-jre-slim
+FROM openjdk:11.0.15-jdk-slim
 
 RUN mkdir -p /opt/kidsfirst/keys
 COPY --from=build-keys /tmp/kf-key-management/target/keys.jar /opt/kidsfirst/keys/keys.jar
diff --git a/pom.xml b/pom.xml
index 42e9f9b..ae5b202 100644
--- a/pom.xml
+++ b/pom.xml
@@ -50,7 +50,7 @@
         <dependency>
             <groupId>com.nimbusds</groupId>
             <artifactId>oauth2-oidc-sdk</artifactId>
-            <version>9.27</version>
+            <version>11.7.1</version>
         </dependency>
         <dependency>
             <groupId>software.amazon.awssdk</groupId>
@@ -64,14 +64,14 @@
 
             </exclusions>
 
-            <version>2.17.136</version>
+            <version>2.25.18</version>
         </dependency>
 
         <!-- KMS -->
         <dependency>
             <groupId>com.amazonaws</groupId>
             <artifactId>aws-java-sdk-kms</artifactId>
-            <version>1.12.200</version>
+            <version>1.12.730</version>
         </dependency>
 
         <dependency>
@@ -130,7 +130,7 @@
         <dependency>
             <groupId>com.github.tomakehurst</groupId>
             <artifactId>wiremock-jre8</artifactId>
-            <version>2.32.0</version>
+            <version>2.35.1</version>
             <scope>test</scope>
         </dependency>
         <dependency>
diff --git a/src/main/java/io/kidsfirst/web/rest/CavaticaResource.java b/src/main/java/io/kidsfirst/web/rest/CavaticaResource.java
index 6cbbd20..239a41b 100644
--- a/src/main/java/io/kidsfirst/web/rest/CavaticaResource.java
+++ b/src/main/java/io/kidsfirst/web/rest/CavaticaResource.java
@@ -1,9 +1,9 @@
 package io.kidsfirst.web.rest;
 
-import com.nimbusds.jose.shaded.json.JSONObject;
 import io.kidsfirst.core.service.CavaticaService;
 import io.kidsfirst.core.service.SecretService;
 import lombok.val;
+import net.minidev.json.JSONObject;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
diff --git a/src/main/java/io/kidsfirst/web/rest/FenceResource.java b/src/main/java/io/kidsfirst/web/rest/FenceResource.java
index 70e1a97..558184f 100644
--- a/src/main/java/io/kidsfirst/web/rest/FenceResource.java
+++ b/src/main/java/io/kidsfirst/web/rest/FenceResource.java
@@ -1,20 +1,17 @@
 package io.kidsfirst.web.rest;
 
-import com.nimbusds.jose.shaded.json.JSONObject;
 import io.kidsfirst.core.model.Secret;
 import io.kidsfirst.core.service.FenceService;
 import io.kidsfirst.core.service.SecretService;
 import lombok.extern.slf4j.Slf4j;
 import lombok.val;
-import org.apache.http.client.utils.URIBuilder;
+import net.minidev.json.JSONObject;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.util.UriComponentsBuilder;
-import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 
-import java.net.URISyntaxException;
 import java.util.Optional;
 
 @RestController
diff --git a/src/main/java/io/kidsfirst/web/rest/FenceResourceDeprecated.java b/src/main/java/io/kidsfirst/web/rest/FenceResourceDeprecated.java
index 8b13ad7..3db81be 100644
--- a/src/main/java/io/kidsfirst/web/rest/FenceResourceDeprecated.java
+++ b/src/main/java/io/kidsfirst/web/rest/FenceResourceDeprecated.java
@@ -1,14 +1,13 @@
 package io.kidsfirst.web.rest;
 
-import com.nimbusds.jose.shaded.json.JSONObject;
 import io.kidsfirst.core.service.FenceService;
 import io.kidsfirst.core.service.SecretService;
 import lombok.extern.slf4j.Slf4j;
 import lombok.val;
+import net.minidev.json.JSONObject;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
 import org.springframework.web.bind.annotation.*;
-import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 import reactor.util.function.Tuple2;
 
diff --git a/src/main/java/io/kidsfirst/web/rest/KeysResource.java b/src/main/java/io/kidsfirst/web/rest/KeysResource.java
index 0534b15..fb3b3eb 100644
--- a/src/main/java/io/kidsfirst/web/rest/KeysResource.java
+++ b/src/main/java/io/kidsfirst/web/rest/KeysResource.java
@@ -1,10 +1,10 @@
 package io.kidsfirst.web.rest;
 
-import com.nimbusds.jose.shaded.json.JSONObject;
 import io.kidsfirst.core.model.Secret;
 import io.kidsfirst.core.service.SecretService;
 import lombok.extern.slf4j.Slf4j;
 import lombok.val;
+import net.minidev.json.JSONObject;
 import org.springframework.http.MediaType;
 import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
 import org.springframework.web.bind.annotation.*;
diff --git a/src/test/java/io/kidsfirst/keys/CavaticaTests.java b/src/test/java/io/kidsfirst/keys/CavaticaTests.java
index f33864c..6af689b 100644
--- a/src/test/java/io/kidsfirst/keys/CavaticaTests.java
+++ b/src/test/java/io/kidsfirst/keys/CavaticaTests.java
@@ -1,9 +1,9 @@
 package io.kidsfirst.keys;
 
 import com.github.tomakehurst.wiremock.junit5.WireMockExtension;
-import com.nimbusds.jose.shaded.json.JSONObject;
 import lombok.extern.slf4j.Slf4j;
 import lombok.val;
+import net.minidev.json.JSONObject;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
diff --git a/src/test/java/io/kidsfirst/keys/DynamicProxyTests.java b/src/test/java/io/kidsfirst/keys/DynamicProxyTests.java
index 9e7e0fc..02f8314 100644
--- a/src/test/java/io/kidsfirst/keys/DynamicProxyTests.java
+++ b/src/test/java/io/kidsfirst/keys/DynamicProxyTests.java
@@ -1,10 +1,10 @@
 package io.kidsfirst.keys;
 
 import com.github.tomakehurst.wiremock.junit5.WireMockExtension;
-import com.nimbusds.jose.shaded.json.JSONObject;
 import io.kidsfirst.core.model.Secret;
 import lombok.extern.slf4j.Slf4j;
 import lombok.val;
+import net.minidev.json.JSONObject;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
diff --git a/src/test/java/io/kidsfirst/keys/FenceDeprecatedTests.java b/src/test/java/io/kidsfirst/keys/FenceDeprecatedTests.java
index 1a2f766..5b77313 100644
--- a/src/test/java/io/kidsfirst/keys/FenceDeprecatedTests.java
+++ b/src/test/java/io/kidsfirst/keys/FenceDeprecatedTests.java
@@ -1,10 +1,10 @@
 package io.kidsfirst.keys;
 
 import com.github.tomakehurst.wiremock.junit5.WireMockExtension;
-import com.nimbusds.jose.shaded.json.JSONObject;
 import io.kidsfirst.core.model.Secret;
 import lombok.extern.slf4j.Slf4j;
 import lombok.val;
+import net.minidev.json.JSONObject;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
@@ -86,7 +86,7 @@ void testFenceGEN3AuthClientGET() {
                 .exchange()
                 .expectStatus().is2xxSuccessful()
                 .expectBody().jsonPath("$.scope").exists()
-                .json("{\"scope\":\"openid\",\"redirect_uri\":\"https://portal.kidsfirstdrc.org/gen3_redirect/\",\"client_id\":\"gen3_client_id\"}");
+                .json("{\"scope\":\"openid%20user\",\"redirect_uri\":\"https://portal.kidsfirstdrc.org/gen3_redirect/\",\"client_id\":\"gen3_client_id\"}");
     }
 
 
diff --git a/src/test/java/io/kidsfirst/keys/FenceTests.java b/src/test/java/io/kidsfirst/keys/FenceTests.java
index 967c4c1..924eece 100644
--- a/src/test/java/io/kidsfirst/keys/FenceTests.java
+++ b/src/test/java/io/kidsfirst/keys/FenceTests.java
@@ -1,10 +1,10 @@
 package io.kidsfirst.keys;
 
 import com.github.tomakehurst.wiremock.junit5.WireMockExtension;
-import com.nimbusds.jose.shaded.json.JSONObject;
 import io.kidsfirst.core.model.Secret;
 import lombok.extern.slf4j.Slf4j;
 import lombok.val;
+import net.minidev.json.JSONObject;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
diff --git a/src/test/java/io/kidsfirst/keys/KeyStoreTests.java b/src/test/java/io/kidsfirst/keys/KeyStoreTests.java
index 66466f4..5f835ec 100644
--- a/src/test/java/io/kidsfirst/keys/KeyStoreTests.java
+++ b/src/test/java/io/kidsfirst/keys/KeyStoreTests.java
@@ -1,9 +1,9 @@
 package io.kidsfirst.keys;
 
-import com.nimbusds.jose.shaded.json.JSONObject;
 import io.kidsfirst.core.model.Secret;
 import lombok.extern.slf4j.Slf4j;
 import lombok.val;
+import net.minidev.json.JSONObject;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 import org.springframework.http.HttpMethod;