diff --git a/hadoop/hadoop-auth-stable/pom.xml b/hadoop/hadoop-auth-stable/pom.xml
index 48f1247..30851aa 100644
--- a/hadoop/hadoop-auth-stable/pom.xml
+++ b/hadoop/hadoop-auth-stable/pom.xml
@@ -88,14 +88,6 @@
 
   <dependencyManagement>
     <dependencies>
-      <!-- import the original dependency versions -->
-      <dependency>
-        <groupId>org.apache.hadoop</groupId>
-        <artifactId>hadoop-project</artifactId>
-        <version>${hadoop.stable.version}</version>
-        <type>pom</type>
-        <scope>import</scope>
-      </dependency>
       <!-- import dependency version overrides -->
       <dependency>
         <groupId>io.mishmash.apache.hadoop</groupId>
@@ -170,12 +162,6 @@
         <version>9.41.2</version>
         <scope>compile</scope>
       </dependency>
-      <dependency>
-        <groupId>com.google.guava</groupId>
-        <artifactId>guava</artifactId>
-        <version>${guava.version}</version>
-        <scope>test</scope>
-      </dependency>
       <dependency>
         <groupId>org.eclipse.jetty</groupId>
         <artifactId>jetty-util</artifactId>
@@ -370,15 +356,9 @@
       <artifactId>apacheds-core-integ</artifactId>
       <scope>test</scope>
     </dependency>
-    <dependency>
-      <groupId>org.apache.hadoop.thirdparty</groupId>
-      <artifactId>hadoop-shaded-guava</artifactId>
-      <scope>compile</scope>
-    </dependency>
     <dependency>
       <groupId>com.google.guava</groupId>
       <artifactId>guava</artifactId>
-      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.hamcrest</groupId>
@@ -444,6 +424,27 @@
           </execution>
         </executions>
       </plugin>
+      <!-- Unshade the original sources -->
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-antrun-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>unshade-sources</id>
+            <phase>generate-sources</phase>
+            <goals>
+              <goal>run</goal>
+            </goals>
+            <configuration>
+              <target>
+                <replace token="org.apache.hadoop.thirdparty.com.google.common" value="com.google.common" dir="${project.build.directory}/hadoop-rel-release-${hadoop.stable.version}/hadoop-common-project/hadoop-auth/src">
+                  <include name="**/*.java"/>
+                </replace>
+              </target>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
       <!-- Add the original sources for compilation -->
       <plugin>
         <groupId>org.codehaus.mojo</groupId>
diff --git a/hadoop/hadoop-common-stable/pom.xml b/hadoop/hadoop-common-stable/pom.xml
index 991b55b..4671d60 100644
--- a/hadoop/hadoop-common-stable/pom.xml
+++ b/hadoop/hadoop-common-stable/pom.xml
@@ -98,14 +98,6 @@
 
   <dependencyManagement>
     <dependencies>
-      <!-- import the original dependency versions -->
-      <dependency>
-        <groupId>org.apache.hadoop</groupId>
-        <artifactId>hadoop-project-dist</artifactId>
-        <version>${hadoop.stable.version}</version>
-        <type>pom</type>
-        <scope>import</scope>
-      </dependency>
       <!-- import dependency version overrides -->
       <dependency>
         <groupId>io.mishmash.apache.hadoop</groupId>
@@ -116,12 +108,6 @@
       </dependency>
 
       <!-- override deps specific to this artifact only-->
-      <dependency>
-        <groupId>com.google.guava</groupId>
-        <artifactId>guava</artifactId>
-        <version>${guava.version}</version>
-        <scope>compile</scope>
-      </dependency>
       <dependency>
         <groupId>commons-net</groupId>
         <artifactId>commons-net</artifactId>
@@ -300,6 +286,18 @@
         <version>${jersey.version}</version>
         <scope>compile</scope>
       </dependency>
+      <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-math3</artifactId>
+        <version>3.6.1</version>
+        <scope>compile</scope>
+      </dependency>
+      <dependency>
+        <groupId>commons-beanutils</groupId>
+        <artifactId>commons-beanutils</artifactId>
+        <version>1.9.4</version>
+        <scope>compile</scope>
+      </dependency>
     </dependencies>
   </dependencyManagement>
   
@@ -309,7 +307,6 @@
       <artifactId>hadoop-annotations</artifactId>
       <scope>compile</scope>
     </dependency>
-    <!--Guava is required during runtime for curator-->
     <dependency>
       <groupId>com.google.guava</groupId>
       <artifactId>guava</artifactId>
@@ -396,37 +393,6 @@
       <artifactId>jakarta.servlet.jsp-api</artifactId>
       <scope>runtime</scope>
     </dependency>
-    <dependency>
-      <groupId>com.github.pjfanning</groupId>
-      <artifactId>jersey-json</artifactId>
-      <scope>compile</scope>
-      <exclusions>
-        <exclusion>
-          <groupId>com.fasterxml.jackson.core</groupId>
-          <artifactId>jackson-core</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>com.fasterxml.jackson.core</groupId>
-          <artifactId>jackson-databind</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>com.fasterxml.jackson.jaxrs</groupId>
-          <artifactId>jackson-jaxrs-json-provider</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.codehaus.jettison</groupId>
-          <artifactId>jettison</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <!--
-      adding jettison as direct dependency (as jersey-json's jettison dependency is vulnerable with verison 1.1),
-      so those who depends on hadoop-common externally will get the non-vulnerable jettison
-      -->
-      <groupId>org.codehaus.jettison</groupId>
-      <artifactId>jettison</artifactId>
-    </dependency>
     <dependency>
       <groupId>org.glassfish.jersey.containers</groupId>
       <artifactId>jersey-container-servlet</artifactId>
@@ -573,7 +539,7 @@
     </dependency>
     <dependency>
       <groupId>org.apache.curator</groupId>
-      <artifactId>curator-client</artifactId>
+      <artifactId>curator-framework</artifactId>
     </dependency>
     <dependency>
       <groupId>org.apache.curator</groupId>
diff --git a/hadoop/hadoop-minikdc-stable/pom.xml b/hadoop/hadoop-minikdc-stable/pom.xml
index d695685..05a70f2 100644
--- a/hadoop/hadoop-minikdc-stable/pom.xml
+++ b/hadoop/hadoop-minikdc-stable/pom.xml
@@ -83,14 +83,6 @@
 
   <dependencyManagement>
     <dependencies>
-      <!-- import the original dependency versions -->
-      <dependency>
-        <groupId>org.apache.hadoop</groupId>
-        <artifactId>hadoop-project</artifactId>
-        <version>${hadoop.stable.version}</version>
-        <type>pom</type>
-        <scope>import</scope>
-      </dependency>
       <!-- import dependency version overrides -->
       <dependency>
         <groupId>io.mishmash.apache.hadoop</groupId>
diff --git a/hadoop/stable/pom.xml b/hadoop/stable/pom.xml
index 44c9028..ef3b741 100644
--- a/hadoop/stable/pom.xml
+++ b/hadoop/stable/pom.xml
@@ -84,12 +84,18 @@
   <properties>
     <httpcomponents.core.version>5.3</httpcomponents.core.version>
     <httpcomponents.client.version>5.4</httpcomponents.client.version>
-    <javax-servlet.version>4.0.1</javax-servlet.version>
     <curator.version>5.7.1</curator.version>
   </properties>
 
   <dependencyManagement>
     <dependencies>
+      <!-- the following deps are not patched, so, original artifacts are used -->
+      <dependency>
+        <groupId>org.apache.hadoop</groupId>
+        <artifactId>hadoop-annotations</artifactId>
+        <version>${hadoop.stable.version}</version>
+      </dependency>
+
       <dependency>
         <groupId>com.google.guava</groupId>
         <artifactId>guava</artifactId>
@@ -107,12 +113,6 @@
         <version>${httpcomponents.client.version}</version>
         <scope>compile</scope>
       </dependency>
-      <dependency>
-        <groupId>javax.servlet</groupId>
-        <artifactId>javax.servlet-api</artifactId>
-        <version>${javax-servlet.version}</version>
-        <scope>provided</scope>
-      </dependency>
       <dependency>
         <groupId>org.eclipse.jetty</groupId>
         <artifactId>jetty-util</artifactId>
@@ -172,7 +172,6 @@
         <groupId>org.apache.curator</groupId>
         <artifactId>curator-recipes</artifactId>
         <version>${curator.version}</version>
-        <scope>test</scope>
         <exclusions>
           <!-- The following is already provided -->
           <exclusion>
diff --git a/pom.xml b/pom.xml
index 6446955..67f9110 100644
--- a/pom.xml
+++ b/pom.xml
@@ -231,14 +231,26 @@
         </exclusions>
       </dependency>
       <dependency>
-        <groupId>io.netty</groupId>
-        <artifactId>netty-handler</artifactId>
-        <version>${netty.version}</version>
+        <groupId>org.apache.kerby</groupId>
+        <artifactId>kerb-util</artifactId>
+        <version>${kerby.version}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-api</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-log4j12</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>io.netty</groupId>
-        <artifactId>netty-transport-native-epoll</artifactId>
+        <artifactId>netty-bom</artifactId>
         <version>${netty.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
       </dependency>
       <dependency>
         <groupId>org.bouncycastle</groupId>