diff --git a/broker/pom.xml b/broker/pom.xml
index 0df0b09c..2bb98dca 100755
--- a/broker/pom.xml
+++ b/broker/pom.xml
@@ -184,7 +184,7 @@
         <dependency>
             <groupId>com.mchange</groupId>
             <artifactId>c3p0</artifactId>
-            <version>0.9.5.2</version>
+            <version>[0.9.5.3,)</version>
         </dependency>
 
         <!-- needs extra dependencies: objenesis & hamcrest -->
diff --git a/protobuf/protobuf.js/package-lock.json b/protobuf/protobuf.js/package-lock.json
index c685e3e7..cc61cbc0 100755
--- a/protobuf/protobuf.js/package-lock.json
+++ b/protobuf/protobuf.js/package-lock.json
@@ -867,8 +867,8 @@
         "browser-resolve": "^1.11.0",
         "browserify-zlib": "~0.2.0",
         "buffer": "^5.0.2",
-        "cached-path-relative": "^1.0.0",
-        "concat-stream": "^1.6.0",
+          "cached-path-relative": ">=1.0.2",
+          "concat-stream": "^1.6.0",
         "console-browserify": "^1.1.0",
         "constants-browserify": "~1.0.0",
         "crypto-browserify": "^3.0.0",
@@ -1154,8 +1154,8 @@
       }
     },
     "cached-path-relative": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/cached-path-relative/-/cached-path-relative-1.0.1.tgz",
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/cached-path-relative/-/cached-path-relative-1.0.2.tgz",
       "integrity": "sha1-0JxLUoAKpMB44t2BqGmqyQ0uVOc=",
       "dev": true
     },
@@ -4967,8 +4967,8 @@
       "requires": {
         "JSONStream": "^1.0.3",
         "browser-resolve": "^1.7.0",
-        "cached-path-relative": "^1.0.0",
-        "concat-stream": "~1.6.0",
+          "cached-path-relative": ">=1.0.2",
+          "concat-stream": "~1.6.0",
         "defined": "^1.0.0",
         "detective": "^5.0.2",
         "duplexer2": "^0.1.2",