diff --git a/example/pom.xml b/example/pom.xml
index 6f848dcc..59daad1b 100644
--- a/example/pom.xml
+++ b/example/pom.xml
@@ -7,12 +7,12 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>3.5.14</version>
+		<version>3.5.16</version>
 		<relativePath/> <!-- lookup parent from repository -->
 	</parent>
 	<groupId>eu.webeid.example</groupId>
 	<artifactId>web-eid-springboot-example</artifactId>
-	<version>3.2.2</version>
+	<version>3.2.3</version>
 	<name>web-eid-springboot-example</name>
 	<description>Example Spring Boot application that demonstrates how to use Web eID for authentication and digital
 		signing
@@ -20,15 +20,14 @@
 
 	<properties>
 		<java.version>17</java.version>
-		<maven-surefire-plugin.version>3.5.3</maven-surefire-plugin.version>
-		<webeid.version>3.2.1</webeid.version>
-		<digidoc4j.version>6.1.1</digidoc4j.version>
+		<maven-surefire-plugin.version>3.6.0</maven-surefire-plugin.version>
+		<webeid.version>3.2.2</webeid.version>
+		<digidoc4j.version>6.2.0</digidoc4j.version>
+		<bouncycastle.version>1.86</bouncycastle.version> <!-- The explicit bcutil dependency can be removed once DigiDoc4j supports BC 1.86. -->
 		<jmockit.version>1.44</jmockit.version> <!-- Keep version 1.44, otherwise mocking will fail. -->
-		<jib.version>3.5.1</jib.version>
-
-        <!-- Remove in next spring-boot version when tomcat is >= 10.1.55: CVE-2026-4193, CVE-2026-4512, CVE-2026-4315 -->
-        <tomcat.version>10.1.55</tomcat.version>
-    </properties>
+		<jib.version>3.5.2</jib.version>
+		<maven-enforcer-plugin.version>3.6.3</maven-enforcer-plugin.version>
+	</properties>
 
 	<dependencies>
 		<dependency>
@@ -43,26 +42,36 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-thymeleaf</artifactId>
 		</dependency>
-
-		<dependency>
-			<groupId>org.digidoc4j</groupId>
-			<artifactId>digidoc4j</artifactId>
-			<version>${digidoc4j.version}</version>
-		</dependency>
-<!--
-        To use your locally built version of the authtoken-validation library instead of the published release:
-        1. in parent dir change the version of authtoken-validation in pom.xml to next SNAPSHOT:
-           for example 3.1.1 -> 3.1.2-SNAPSHOT
-        2. Execute mvn clean install
-        3. Verify that latest build date is recent, in ~/.m2/repository/eu/webeid/security/authtoken-validation/3.1.2-SNAPSHOT/
-        4. Change the properties webeid.version to 3.1.2-SNAPSHOT
-        5. After each change in authtoken-validation, you need to run mvn clean install
--->
+		<!--
+			To use your locally built version of the authtoken-validation library instead of the published release:
+			1. In parent dir change the version of authtoken-validation in pom.xml to next SNAPSHOT:
+			   for example 3.1.1 -> 3.1.2-SNAPSHOT
+			2. Run mvn clean install
+			3. Verify that latest build date is recent, in ~/.m2/repository/eu/webeid/security/authtoken-validation/3.1.2-SNAPSHOT/
+			4. Change the property webeid.version to 3.1.2-SNAPSHOT above in this pom.xml
+			5. After each change in authtoken-validation, run mvn clean install
+		-->
 		<dependency>
 			<groupId>eu.webeid.security</groupId>
 			<artifactId>authtoken-validation</artifactId>
 			<version>${webeid.version}</version>
 		</dependency>
+		<!--
+			DigiDoc4j 6.2.0 pins Bouncy Castle 1.84 because using BC 1.86 can make invalid PDF/PAdES signatures appear valid.
+			This example does not process PDF/PAdES, so we want to use BC 1.86 to include security fixes missing from 1.84;
+			keep authtoken-validation before digidoc4j and declare bcutil 1.86 directly so all BC modules use 1.86.
+			The explicit bcutil dependency can be removed once DigiDoc4j supports BC 1.86.
+		-->
+		<dependency>
+			<groupId>org.bouncycastle</groupId>
+			<artifactId>bcutil-jdk18on</artifactId>
+			<version>${bouncycastle.version}</version>
+		</dependency>
+		<dependency>
+			<groupId>org.digidoc4j</groupId>
+			<artifactId>digidoc4j</artifactId>
+			<version>${digidoc4j.version}</version>
+		</dependency>
 
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
@@ -109,6 +118,26 @@
 					</from>
 				</configuration>
 			</plugin>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-enforcer-plugin</artifactId>
+				<version>${maven-enforcer-plugin.version}</version>
+				<executions>
+					<execution>
+						<id>enforce-maven</id>
+						<goals>
+							<goal>enforce</goal>
+						</goals>
+						<configuration>
+							<rules>
+								<requireMavenVersion>
+									<version>[3.6.3,)</version>
+								</requireMavenVersion>
+							</rules>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
 		</plugins>
 	</build>
 
diff --git a/pom.xml b/pom.xml
index ff33f906..cc93a16b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -7,7 +7,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>authtoken-validation</artifactId>
     <groupId>eu.webeid.security</groupId>
-    <version>3.2.1</version>
+    <version>3.2.2</version>
     <packaging>jar</packaging>
     <name>authtoken-validation</name>
     <description>Web eID authentication token validation library for Java</description>
@@ -16,16 +16,16 @@
         <java.version>11</java.version>
         <jjwt.version>0.13.0</jjwt.version>
         <bouncycastle.version>1.86</bouncycastle.version>
-        <jackson.version>2.22.1</jackson.version>
-        <slf4j.version>2.0.17</slf4j.version>
+        <jackson.version>2.22.2</jackson.version>
+        <slf4j.version>2.0.19</slf4j.version>
         <junit-jupiter.version>5.14.4</junit-jupiter.version>
         <assertj.version>3.27.7</assertj.version>
         <mockito.version>5.23.0</mockito.version>
-        <maven-surefire-plugin.version>3.5.5</maven-surefire-plugin.version>
+        <maven-surefire-plugin.version>3.6.0</maven-surefire-plugin.version>
         <maven-source-plugin.version>3.4.0</maven-source-plugin.version>
         <maven-javadoc-plugin.version>3.12.0</maven-javadoc-plugin.version>
-        <maven-enforcer-plugin.version>3.6.2</maven-enforcer-plugin.version>
-        <jacoco.version>0.8.14</jacoco.version>
+        <maven-enforcer-plugin.version>3.6.3</maven-enforcer-plugin.version>
+        <jacoco.version>0.8.15</jacoco.version>
         <sonar.coverage.jacoco.xmlReportPaths>
             ${project.basedir}/../jacoco-coverage-report/target/site/jacoco-aggregate/jacoco.xml
         </sonar.coverage.jacoco.xmlReportPaths>