diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 00db9fce4ce..3ccd694972a 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -121,6 +121,9 @@ jobs:
       ##############
       - name: java
         run: mvn --batch-mode --update-snapshots verify -Pprintingbundle
+      # The printing bundle is unpacked over the WAR, so the two are checked together.
+      - name: "checking duplicated libraries"
+        run: python3 utility/build/check_duplicate_jars.py product/target/mapstore.war java/printing/target/mapstore-printing.zip
   build:
     runs-on: ubuntu-latest
     strategy:
diff --git a/binary/bin-war/pom.xml b/binary/bin-war/pom.xml
index 710d1a6fa87..55cf7c10306 100644
--- a/binary/bin-war/pom.xml
+++ b/binary/bin-war/pom.xml
@@ -36,17 +36,6 @@
                 <artifactId>maven-war-plugin</artifactId>
                 <version>${maven-war-plugin.version}</version>
                 <configuration>
-                    <packagingExcludes>
-                        WEB-INF/lib/*spring*5.3.18*.jar,
-                        WEB-INF/lib/json-lib-2.4-jdk15.jar,
-                        WEB-INF/lib/msg-simple-1.1.jar,
-                        WEB-INF/lib/btf-1.2.jar,
-                        WEB-INF/lib/commons-io-2.1.jar,
-                        WEB-INF/lib/commons-beanutils-1.8.0.jar,
-                        WEB-INF/lib/commons-logging-1.1.1.jar,
-                        WEB-INF/lib/jackson-coreutils-1.6.jar,
-                        WEB-INF/lib/stax-ex-1.8.jar
-                    </packagingExcludes>
                     <overlays>
                         <overlay>
                             <groupId>it.geosolutions.mapstore</groupId>
diff --git a/docs/developer-guide/mapstore-migration-guide.md b/docs/developer-guide/mapstore-migration-guide.md
index 2e470429221..8926906f05a 100644
--- a/docs/developer-guide/mapstore-migration-guide.md
+++ b/docs/developer-guide/mapstore-migration-guide.md
@@ -124,7 +124,7 @@ The following changes must be applied to your project (see the updated [project
 -        <tomcat.version>9.0.116</tomcat.version>
 -        <jackson.version>2.16.1</jackson.version>
 +        <tomcat.version>10.1.55</tomcat.version>
-+        <jackson.version>2.19.4</jackson.version>
++        <jackson.version>2.22.3</jackson.version>
          <!-- Spring Framework & Security (aligned) -->
 -        <spring.version>5.3.39</spring.version>
 -        <spring.security.version>5.7.13</spring.security.version>
@@ -236,6 +236,178 @@ Copy the `logging.properties` file from the MapStore repository (`product/cargo/
 
 **CI/CD**: update your build infrastructure to use JDK 17 as the build JDK.
 
+### Duplicated libraries in the WAR
+
+The GeoStore and http-proxy WARs are added to your project as *overlays*: their `WEB-INF/lib` folder is copied as it is into your WAR. Some of those libraries (Jackson, Log4j, SLF4J, Micrometer, commons-io, ...) are also brought by MapStore, often in a different version, so the final WAR contains two versions of the same library, and which one is loaded depends on the servlet container.
+
+The steps below remove the duplicates. They change only two files of your project: `pom.xml` and `web/pom.xml`. The [project templates](https://github.com/geosolutions-it/MapStore2/tree/master/project/standard/templates) contain the final result, if you want to compare.
+
+#### 1. `pom.xml` (in the root folder of your project)
+
+**1.1** In the `<properties>` section, add these two lines right after the `jackson.version` line (updated to `2.22.3` in the previous section):
+
+```diff
+         <jackson.version>2.22.3</jackson.version>
++        <guava.version>32.0.0-jre</guava.version>
++        <jsr305.version>3.0.2</jsr305.version>
+```
+
+**1.2** In the `<dependencyManagement>` section, find the `jackson-bom` dependency and add the two dependencies below right after it (after its closing `</dependency>` tag):
+
+```diff
+             <dependency>
+                 <groupId>com.fasterxml.jackson</groupId>
+                 <artifactId>jackson-bom</artifactId>
+                 <version>${jackson.version}</version>
+                 <type>pom</type>
+                 <scope>import</scope>
+             </dependency>
++            <dependency>
++                <groupId>com.google.guava</groupId>
++                <artifactId>guava</artifactId>
++                <version>${guava.version}</version>
++            </dependency>
++            <dependency>
++                <groupId>com.google.code.findbugs</groupId>
++                <artifactId>jsr305</artifactId>
++                <version>${jsr305.version}</version>
++            </dependency>
+```
+
+#### 2. `web/pom.xml`
+
+**2.1** The servlet API is provided by Tomcat and must not be packaged in the WAR. In the main `<dependencies>` section (at the top of the file), find the `jakarta.servlet-api` dependency and add the `<scope>` line:
+
+```diff
+     <dependency>
+         <groupId>jakarta.servlet</groupId>
+         <artifactId>jakarta.servlet-api</artifactId>
+         <version>${jakarta.servlet-api.version}</version>
++        <scope>provided</scope>
+     </dependency>
+```
+
+**2.2** Find the `maven-war-plugin` plugin. Inside its `<configuration>`, delete the whole `<packagingExcludes>` block: it lists versions that are not used anymore.
+
+```diff
+             <configuration>
+-                <packagingExcludes>
+-                    WEB-INF/lib/*spring*5.3.18*.jar,
+-                    WEB-INF/lib/json-lib-2.4-jdk15.jar,
+-                    WEB-INF/lib/msg-simple-1.1.jar,
+-                    WEB-INF/lib/btf-1.2.jar,
+-                    WEB-INF/lib/commons-io-2.1.jar,
+-                    WEB-INF/lib/commons-beanutils-1.8.0.jar,
+-                    WEB-INF/lib/commons-logging-1.1.1.jar,
+-                    WEB-INF/lib/jackson-coreutils-1.6.jar,
+-                    WEB-INF/lib/stax-ex-1.8.jar
+-                </packagingExcludes>
+                 <overlays>
+```
+
+**2.3** In the same `<configuration>`, inside `<overlays>`, add an `<excludes>` block to each of the two overlays, right after their `<artifactId>` line. If an overlay already has an `<excludes>` block, keep the `<exclude>` lines it has and add the new ones to it.
+
+```diff
+                 <overlays>
+                     <overlay>
+                         <groupId>it.geosolutions.geostore</groupId>
+                         <artifactId>geostore-webapp</artifactId>
++                        <excludes>
++                            <exclude>WEB-INF/lib/commons-io-*.jar</exclude>
++                            <exclude>WEB-INF/lib/jackson-annotations-*.jar</exclude>
++                            <exclude>WEB-INF/lib/jackson-core-*.jar</exclude>
++                            <exclude>WEB-INF/lib/jackson-databind-*.jar</exclude>
++                            <exclude>WEB-INF/lib/log4j-api-*.jar</exclude>
++                            <exclude>WEB-INF/lib/log4j-core-*.jar</exclude>
++                            <exclude>WEB-INF/lib/log4j-slf4j-impl-*.jar</exclude>
++                            <exclude>WEB-INF/lib/slf4j-api-*.jar</exclude>
++                            <exclude>WEB-INF/lib/micrometer-commons-*.jar</exclude>
++                            <exclude>WEB-INF/lib/micrometer-observation-*.jar</exclude>
++                            <exclude>WEB-INF/lib/asm-2.*.jar</exclude>
++                        </excludes>
+                     </overlay>
+                     <overlay>
+                         <groupId>proxy</groupId>
+                         <artifactId>http_proxy</artifactId>
++                        <excludes>
++                            <exclude>WEB-INF/lib/commons-io-*.jar</exclude>
++                            <exclude>WEB-INF/lib/log4j-api-*.jar</exclude>
++                            <exclude>WEB-INF/lib/log4j-core-*.jar</exclude>
++                            <exclude>WEB-INF/lib/log4j-slf4j2-impl-*.jar</exclude>
++                            <exclude>WEB-INF/lib/slf4j-api-*.jar</exclude>
++                            <exclude>WEB-INF/lib/commons-codec-*.jar</exclude>
++                            <exclude>WEB-INF/lib/jetty-*.jar</exclude>
++                        </excludes>
+                     </overlay>
+                 </overlays>
+```
+
+**2.4** Find the `<profile>` with `<id>printing</id>` (near the end of the file). Inside it there is a `<dependencyManagement>` section with another `jakarta.servlet-api` dependency: add the same `<scope>` line as in step 2.1.
+
+```diff
+                     <dependency>
+                         <groupId>jakarta.servlet</groupId>
+                         <artifactId>jakarta.servlet-api</artifactId>
+                         <version>${jakarta.servlet-api.version}</version>
++                        <scope>provided</scope>
+                     </dependency>
+```
+
+**2.5** In the same `printing` profile, find the `print-lib` dependency. In its `<exclusions>`:
+
+- delete the `commons-codec` exclusion:
+
+```diff
+-                        <exclusion>
+-                            <groupId>commons-codec</groupId>
+-                            <artifactId>commons-codec</artifactId>
+-                        </exclusion>
+```
+
+- add these five exclusions before the closing `</exclusions>` tag (JAXB is already shipped by GeoStore, HTTP Client 5 by http-proxy):
+
+```diff
++                        <exclusion>
++                            <groupId>org.glassfish.jaxb</groupId>
++                            <artifactId>jaxb-runtime</artifactId>
++                        </exclusion>
++                        <exclusion>
++                            <groupId>jakarta.xml.bind</groupId>
++                            <artifactId>jakarta.xml.bind-api</artifactId>
++                        </exclusion>
++                        <exclusion>
++                            <groupId>org.apache.httpcomponents.client5</groupId>
++                            <artifactId>httpclient5</artifactId>
++                        </exclusion>
++                        <exclusion>
++                            <groupId>org.apache.httpcomponents.core5</groupId>
++                            <artifactId>httpcore5</artifactId>
++                        </exclusion>
++                        <exclusion>
++                            <groupId>org.apache.httpcomponents.core5</groupId>
++                            <artifactId>httpcore5-h2</artifactId>
++                        </exclusion>
+                     </exclusions>
+```
+
+#### 3. Check the result
+
+From the root folder of your project, build the WAR and run the check script shipped with MapStore (Python 3 is required):
+
+```bash
+mvn clean install
+python3 MapStore2/utility/build/check_duplicate_jars.py web/target/*.war
+```
+
+If you use the printing module, repeat the check with the `printing` profile:
+
+```bash
+mvn clean install -Pprinting
+python3 MapStore2/utility/build/check_duplicate_jars.py web/target/*.war
+```
+
+The script must print `No duplicated libraries`. Otherwise it lists the libraries found in more than one version: if they come from a dependency you added to your project, exclude the older version.
+
 ### New `viewFramingFilter` in `web.xml`
 
 Add the following filter to your project's `web/src/main/webapp/WEB-INF/web.xml`, mapped on `/index.html` (see the updated [project template](https://github.com/geosolutions-it/MapStore2/blob/master/project/standard/templates/web/src/main/webapp/WEB-INF/web.xml) for reference). It relies on `org.apache.catalina.filters.HttpHeaderSecurityFilter`, already available with the Tomcat 10.1 dependency required by the upgrade above:
diff --git a/java/printing/assembly/mapstore-printing.xml b/java/printing/assembly/mapstore-printing.xml
index cdd424ee7dc..a47df766eb7 100644
--- a/java/printing/assembly/mapstore-printing.xml
+++ b/java/printing/assembly/mapstore-printing.xml
@@ -13,67 +13,39 @@
             <directory>${project.build.directory}/mapstore-printing/WEB-INF</directory>
             <includes>
                 <include>**/*.xml</include>
-                <include>**/print-lib*.jar</include>
-                <include>**/aircompressor-*.jar</include>
-                <include>**/apiguardian-api-*.jar</include>
-                <include>**/avalon-*.jar</include>
-                <include>**/batik-*.jar</include>
-                <include>**/bcmail-*.jar</include>
-                <include>**/bcprov-*.jar</include>
-                <include>**/bigint-*.jar</include>
-                <include>**/commons-lang*.jar</include>
-                <include>**/commons-httpclient-*.jar</include>
-                <include>**/commons-io-*.jar</include>
-                <include>**/commons-text-*.jar</include>
-                <include>**/disruptor-*.jar</include>
-                <include>**/ejml-*.jar</include>
-                <include>**/fontbox-*.jar</include>
-                <include>**/fop-*.jar</include>
-                <include>**/GeographicLib-*.jar</include>
-                <include>**/gt-*.jar</include>
-                <include>**/guava-*.jar</include>
-                <include>**/httpclient-*.jar</include>
-                <include>**/httpcore-*.jar</include>
-                <include>**/imageio-*.jar</include>
-                <include>**/indriya-*.jar</include>
-                <include>**/hsqldb-*.jar</include>
-                <include>**/itext-*.jar</include>
-                <include>**/itextpdf-*.jar</include>
-                <include>**/jai*.jar</include>
-                <include>**/jaxb-*.jar</include>
-                <include>**/jaxb-api-*.jar</include>
-                <include>**/jdom2-*.jar</include>
-                <include>**/jempbox-*.jar</include>
-                <include>**/jgridshift-*.jar</include>
-                <include>**/json-20*.jar</include>
-                <include>**/jackson-dataformat-yaml-*.jar</include>
-                <include>**/javax.inject-*.jar</include>
-                <include>**/jts-core-*.jar</include>
-                <include>**/jt-*.jar</include>
-                <include>**/jyaml-*.jar</include>
-                <include>**/metrics-*.jar</include>
-                <include>**/net.opengis.ows-*.jar</include>
-                <include>**/org.eclipse.emf.common-*.jar</include>
-                <include>**/org.eclipse.emf.ecore-*.jar</include>
-                <include>**/org.eclipse.emf.ecore.xmi-*.jar</include>
-                <include>**/org.w3.xlink-*.jar</include>
-                <include>**/openpdf-*.jar</include>
-                <include>**/pdfbox-*.jar</include>
-                <include>**/profiler-*.jar</include>
-                <include>**/re2j-*.jar</include>
-                <include>**/si-*.jar</include>
-                <include>**/slf4j-api-*.jar</include>
-                <include>**/snakeyaml-*.jar</include>
-                <include>**/systems-common-*.jar</include>
-                <include>**/txw2-*.jar</include>
-                <include>**/unit-*.jar</include>
-                <include>**/uom-*.jar</include>
-                <include>xalan-*.jar</include>
-                <include>**/xml-apis-*.jar</include>
-                <include>**/xml-commons-resolver*.jar</include>
-                <include>**/xmlgraphics-commons-*.jar</include>
-                <include>**/xercesImpl-*.jar</include>
             </includes>
         </fileSet>
     </fileSets>
+    <!--
+        print-lib and its runtime dependencies, except the libraries the MapStore WAR already ships:
+        the bundle is unpacked over an existing MapStore and must not add a second version of them
+    -->
+    <dependencySets>
+        <dependencySet>
+            <outputDirectory>/WEB-INF/lib</outputDirectory>
+            <!-- same file names as in the WAR (-SNAPSHOT instead of the timestamped version) -->
+            <outputFileNameMapping>${artifact.artifactId}-${artifact.baseVersion}${dashClassifier?}.${artifact.extension}</outputFileNameMapping>
+            <useProjectArtifact>false</useProjectArtifact>
+            <scope>runtime</scope>
+            <excludes>
+                <exclude>com.fasterxml.jackson.core:*</exclude>
+                <exclude>com.google.code.findbugs:*</exclude>
+                <exclude>com.google.errorprone:*</exclude>
+                <exclude>com.google.guava:*</exclude>
+                <exclude>com.google.j2objc:*</exclude>
+                <exclude>commons-io:*</exclude>
+                <exclude>commons-logging:*</exclude>
+                <exclude>io.micrometer:*</exclude>
+                <exclude>jakarta.activation:*</exclude>
+                <exclude>jakarta.annotation:*</exclude>
+                <exclude>jakarta.inject:*</exclude>
+                <exclude>org.apache.commons:commons-lang3</exclude>
+                <exclude>org.apache.commons:commons-text</exclude>
+                <exclude>org.apache.logging.log4j:*</exclude>
+                <exclude>org.jspecify:*</exclude>
+                <exclude>org.slf4j:*</exclude>
+                <exclude>org.springframework:*</exclude>
+            </excludes>
+        </dependencySet>
+    </dependencySets>
 </assembly>
diff --git a/java/printing/pom.xml b/java/printing/pom.xml
index 50fdb6aa709..a980d6f4413 100644
--- a/java/printing/pom.xml
+++ b/java/printing/pom.xml
@@ -14,41 +14,16 @@
     <url>http://www.geosolutionsgroup.com</url>
 
     <dependencies>
-        <!-- mapfish-print -->
+        <!-- mapfish-print (exclusions in the root dependencyManagement) -->
         <dependency>
             <groupId>org.mapfish.print</groupId>
             <artifactId>print-lib</artifactId>
-            <exclusions>
-                <!-- drop the HTTP Client and Core jar -->
-                <exclusion>
-                    <groupId>org.apache.httpcomponents</groupId>
-                    <artifactId>httpclient</artifactId>
-                </exclusion>
-                <exclusion>
-                    <groupId>org.apache.httpcomponents</groupId>
-                    <artifactId>httpcore</artifactId>
-                </exclusion>
-            </exclusions>
         </dependency>
     </dependencies>
 
     <build>
         <finalName>mapstore-printing</finalName>
         <plugins>
-            <plugin>
-                <artifactId>maven-dependency-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <phase>process-classes</phase>
-                        <goals>
-                            <goal>copy-dependencies</goal>
-                        </goals>
-                        <configuration>
-                            <outputDirectory>${project.build.directory}/mapstore-printing/WEB-INF/lib</outputDirectory>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
             <plugin>
                 <artifactId>maven-resources-plugin</artifactId>
                 <version>${maven-resources-plugin.version}</version>
diff --git a/java/web/pom.xml b/java/web/pom.xml
index 6f2053debeb..5b2dd757eca 100644
--- a/java/web/pom.xml
+++ b/java/web/pom.xml
@@ -67,26 +67,47 @@
                 <artifactId>maven-war-plugin</artifactId>
                 <version>${maven-war-plugin.version}</version>
                 <configuration>
-                    <packagingExcludes>
-                        WEB-INF/lib/*spring*5.3.18*.jar,
-                        WEB-INF/lib/json-lib-2.4-jdk15.jar,
-                        WEB-INF/lib/msg-simple-1.1.jar,
-                        WEB-INF/lib/btf-1.2.jar,
-                        WEB-INF/lib/commons-io-2.1.jar,
-                        WEB-INF/lib/commons-beanutils-1.8.0.jar,
-                        WEB-INF/lib/commons-logging-1.1.1.jar,
-                        WEB-INF/lib/jackson-coreutils-1.6.jar,
-                        WEB-INF/lib/stax-ex-1.8.jar
-                    </packagingExcludes>
+                    <!--
+                        Overlays copy their WEB-INF/lib as they are, so a library also managed here
+                        would end up twice in the WAR, in two versions. Drop the overlay copy of those
+                        libraries and keep the version managed by MapStore.
+                    -->
                     <overlays>
                         <overlay>
                             <groupId>it.geosolutions.geostore</groupId>
                             <artifactId>geostore-webapp</artifactId>
-                            <excludes>WEB-INF/classes/geostore-spring-security.xml</excludes>
+                            <excludes>
+                                <exclude>WEB-INF/classes/geostore-spring-security.xml</exclude>
+                                <exclude>WEB-INF/lib/commons-io-*.jar</exclude>
+                                <exclude>WEB-INF/lib/jackson-annotations-*.jar</exclude>
+                                <exclude>WEB-INF/lib/jackson-core-*.jar</exclude>
+                                <exclude>WEB-INF/lib/jackson-databind-*.jar</exclude>
+                                <exclude>WEB-INF/lib/log4j-api-*.jar</exclude>
+                                <exclude>WEB-INF/lib/log4j-core-*.jar</exclude>
+                                <exclude>WEB-INF/lib/log4j-slf4j-impl-*.jar</exclude>
+                                <exclude>WEB-INF/lib/slf4j-api-*.jar</exclude>
+                                <!-- the versions required by Spring Security -->
+                                <exclude>WEB-INF/lib/micrometer-commons-*.jar</exclude>
+                                <exclude>WEB-INF/lib/micrometer-observation-*.jar</exclude>
+                                <!-- legacy asm:asm, same packages as org.ow2.asm:asm 9.x shipped next to it -->
+                                <exclude>WEB-INF/lib/asm-2.*.jar</exclude>
+                            </excludes>
                         </overlay>
                         <overlay>
                             <groupId>proxy</groupId>
                             <artifactId>http_proxy</artifactId>
+                            <excludes>
+                                <exclude>WEB-INF/lib/commons-io-*.jar</exclude>
+                                <exclude>WEB-INF/lib/log4j-api-*.jar</exclude>
+                                <exclude>WEB-INF/lib/log4j-core-*.jar</exclude>
+                                <!-- SLF4J 2 binding: MapStore and GeoStore use SLF4J 1.7 with log4j-slf4j-impl -->
+                                <exclude>WEB-INF/lib/log4j-slf4j2-impl-*.jar</exclude>
+                                <exclude>WEB-INF/lib/slf4j-api-*.jar</exclude>
+                                <!-- not used by the proxy, GeoStore ships its own -->
+                                <exclude>WEB-INF/lib/commons-codec-*.jar</exclude>
+                                <!-- embedded server of the proxy standalone launcher, not used in a webapp -->
+                                <exclude>WEB-INF/lib/jetty-*.jar</exclude>
+                            </excludes>
                         </overlay>
                     </overlays>
                 </configuration>
diff --git a/pom.xml b/pom.xml
index 1872c59eb22..e8dcecf2e8a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -26,12 +26,13 @@
 
         <!-- other dependencies (aligned where applicable) -->
         <commons-collections.version>3.2.2</commons-collections.version>
-        <commons-io.version>2.14.0</commons-io.version>
+        <commons-io.version>2.22.0</commons-io.version>
         <commons-logging.version>1.2</commons-logging.version>
         <jakarta.servlet-api.version>6.0.0</jakarta.servlet-api.version>
         <jaxws-api.version>4.0.3</jaxws-api.version>
         <json-lib.version>2.4.2-geoserver</json-lib.version>
         <json-patch.version>1.13</json-patch.version>
+        <jsr305.version>3.0.2</jsr305.version>
         <junit.version>4.13.2</junit.version>
         <log4j.version>2.26.1</log4j.version>
         <mime-util.version>2.1.3</mime-util.version>
@@ -88,11 +89,12 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
-            <!-- Guava BOM -->
+            <!-- Guava: same version GeoStore ships, so print-lib does not add a second one -->
             <!-- 1) Strip Checker‑Qual from Guava -->
             <dependency>
                 <groupId>com.google.guava</groupId>
                 <artifactId>guava</artifactId>
+                <version>${guava.version}</version>
                 <exclusions>
                     <exclusion>
                         <groupId>org.checkerframework</groupId>
@@ -100,6 +102,11 @@
                     </exclusion>
                 </exclusions>
             </dependency>
+            <dependency>
+                <groupId>com.google.code.findbugs</groupId>
+                <artifactId>jsr305</artifactId>
+                <version>${jsr305.version}</version>
+            </dependency>
 
             <!-- managed versions for standalone artifacts -->
             <!-- JSON‑lib: drop the old Commons‑Lang/Beanutils/Logging/Ezmorph -->
@@ -147,10 +154,12 @@
                 <version>${mockito-core.version}</version>
                 <scope>test</scope>
             </dependency>
+            <!-- provided by the servlet container, never packaged in the WAR -->
             <dependency>
                 <groupId>jakarta.servlet</groupId>
                 <artifactId>jakarta.servlet-api</artifactId>
                 <version>${jakarta.servlet-api.version}</version>
+                <scope>provided</scope>
             </dependency>
             <dependency>
                 <groupId>org.apache.commons</groupId>
@@ -248,55 +257,14 @@
                 </exclusions>
             </dependency>
 
-            <!-- GeoStore Webapp -->
+            <!-- GeoStore Webapp: a WAR overlay brings its WEB-INF/lib as files, so dependency
+                 exclusions have no effect here; the overlay excludes live in java/web/pom.xml -->
             <dependency>
                 <groupId>it.geosolutions.geostore</groupId>
                 <artifactId>geostore-webapp</artifactId>
                 <version>${geostore-webapp.version}</version>
                 <type>war</type>
                 <scope>runtime</scope>
-                <exclusions>
-                    <exclusion>
-                        <groupId>org.springframework</groupId>
-                        <artifactId>spring-aop</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.springframework</groupId>
-                        <artifactId>spring-beans</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.springframework</groupId>
-                        <artifactId>spring-context</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.springframework</groupId>
-                        <artifactId>spring-core</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.springframework</groupId>
-                        <artifactId>spring-expression</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.springframework</groupId>
-                        <artifactId>spring-jcl</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.springframework</groupId>
-                        <artifactId>spring-jdbc</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.springframework</groupId>
-                        <artifactId>spring-orm</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.springframework</groupId>
-                        <artifactId>spring-tx</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.springframework</groupId>
-                        <artifactId>spring-web</artifactId>
-                    </exclusion>
-                </exclusions>
             </dependency>
 
             <dependency>
@@ -306,33 +274,20 @@
                 <type>war</type>
                 <scope>runtime</scope>
             </dependency>
-            <!-- MapFish‑Print: strip out all of the old JAXB & FastInfoset bits -->
+            <!-- MapFish‑Print: drop what the MapStore WAR already ships (JAXB from GeoStore,
+                 HTTP Client 4 from GeoStore, HTTP Client 5 from http_proxy) -->
             <dependency>
                 <groupId>org.mapfish.print</groupId>
                 <artifactId>print-lib</artifactId>
                 <version>${print-lib.version}</version>
                 <exclusions>
-                    <!-- old JAX‑B 2.1/2.3 -->
-                    <exclusion>
-                        <groupId>javax.xml.bind</groupId>
-                        <artifactId>jaxb-api</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>com.sun.xml.bind</groupId>
-                        <artifactId>jaxb-impl</artifactId>
-                    </exclusion>
                     <exclusion>
                         <groupId>org.glassfish.jaxb</groupId>
                         <artifactId>jaxb-runtime</artifactId>
                     </exclusion>
                     <exclusion>
-                        <groupId>org.glassfish.jaxb</groupId>
-                        <artifactId>txw2</artifactId>
-                    </exclusion>
-                    <!-- FastInfoset from FOP -->
-                    <exclusion>
-                        <groupId>com.sun.xml.fastinfoset</groupId>
-                        <artifactId>FastInfoset</artifactId>
+                        <groupId>jakarta.xml.bind</groupId>
+                        <artifactId>jakarta.xml.bind-api</artifactId>
                     </exclusion>
                     <!-- drop the HTTP Client and Core jar -->
                     <exclusion>
@@ -344,8 +299,16 @@
                         <artifactId>httpcore</artifactId>
                     </exclusion>
                     <exclusion>
-                        <groupId>jakarta.xml.bind</groupId>
-                        <artifactId>jakarta.xml.bind-api</artifactId>
+                        <groupId>org.apache.httpcomponents.client5</groupId>
+                        <artifactId>httpclient5</artifactId>
+                    </exclusion>
+                    <exclusion>
+                        <groupId>org.apache.httpcomponents.core5</groupId>
+                        <artifactId>httpcore5</artifactId>
+                    </exclusion>
+                    <exclusion>
+                        <groupId>org.apache.httpcomponents.core5</groupId>
+                        <artifactId>httpcore5-h2</artifactId>
                     </exclusion>
                 </exclusions>
             </dependency>
@@ -372,12 +335,6 @@
                 <groupId>org.apache.logging.log4j</groupId>
                 <artifactId>log4j-slf4j-impl</artifactId>
                 <version>${log4j.version}</version>
-                <exclusions>
-                    <exclusion>
-                        <groupId>org.slf4j</groupId>
-                        <artifactId>slf4j-api</artifactId>
-                    </exclusion>
-                </exclusions>
             </dependency>
         </dependencies>
     </dependencyManagement>
@@ -488,28 +445,12 @@
                     <artifactId>maven-antrun-plugin</artifactId>
                     <version>3.1.0</version>
                 </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-war-plugin</artifactId>
+                    <version>${maven-war-plugin.version}</version>
+                </plugin>
             </plugins>
         </pluginManagement>
-        <plugins>
-            <!-- Strip out old duplicate jars and legacy from the WAR -->
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-war-plugin</artifactId>
-                <version>3.4.0</version>
-                <configuration>
-                    <packagingExcludes>
-                        WEB-INF/lib/*spring*5.3.18*.jar,
-                        WEB-INF/lib/json-lib-2.4-jdk15.jar,
-                        WEB-INF/lib/msg-simple-1.1.jar,
-                        WEB-INF/lib/btf-1.2.jar,
-                        WEB-INF/lib/commons-io-2.1.jar,
-                        WEB-INF/lib/commons-beanutils-1.8.0.jar,
-                        WEB-INF/lib/commons-logging-1.1.1.jar,
-                        WEB-INF/lib/jackson-coreutils-1.6.jar,
-                        WEB-INF/lib/stax-ex-1.8.jar
-                    </packagingExcludes>
-                </configuration>
-            </plugin>
-        </plugins>
     </build>
 </project>
diff --git a/product/pom.xml b/product/pom.xml
index b18c751322d..9d17544a56a 100644
--- a/product/pom.xml
+++ b/product/pom.xml
@@ -251,17 +251,6 @@
                 <artifactId>maven-war-plugin</artifactId>
                 <version>${maven-war-plugin.version}</version>
                 <configuration>
-                    <packagingExcludes>
-                        WEB-INF/lib/*spring*5.3.18*.jar,
-                        WEB-INF/lib/json-lib-2.4-jdk15.jar,
-                        WEB-INF/lib/msg-simple-1.1.jar,
-                        WEB-INF/lib/btf-1.2.jar,
-                        WEB-INF/lib/commons-io-2.1.jar,
-                        WEB-INF/lib/commons-beanutils-1.8.0.jar,
-                        WEB-INF/lib/commons-logging-1.1.1.jar,
-                        WEB-INF/lib/jackson-coreutils-1.6.jar,
-                        WEB-INF/lib/stax-ex-1.8.jar
-                    </packagingExcludes>
                     <overlays>
                         <overlay>
                             <groupId>it.geosolutions.mapstore</groupId>
@@ -362,15 +351,11 @@
             </build>
 
             <dependencies>
-                <!-- mapfish-print -->
+                <!-- mapfish-print (more exclusions in the root dependencyManagement) -->
                 <dependency>
                     <groupId>org.mapfish.print</groupId>
                     <artifactId>print-lib</artifactId>
                     <exclusions>
-                        <exclusion>
-                            <groupId>commons-codec</groupId>
-                            <artifactId>commons-codec</artifactId>
-                        </exclusion>
                         <exclusion>
                             <groupId>com.fasterxml.jackson.core</groupId>
                             <artifactId>jackson-annotations</artifactId>
@@ -391,15 +376,6 @@
                             <groupId>org.springframework</groupId>
                             <artifactId>spring-context</artifactId>
                         </exclusion>
-                        <!-- drop the HTTP Client and Core jar -->
-                        <exclusion>
-                            <groupId>org.apache.httpcomponents</groupId>
-                            <artifactId>httpclient</artifactId>
-                        </exclusion>
-                        <exclusion>
-                            <groupId>org.apache.httpcomponents</groupId>
-                            <artifactId>httpcore</artifactId>
-                        </exclusion>
                     </exclusions>
                 </dependency>
             </dependencies>
diff --git a/project/standard/templates/pom.xml b/project/standard/templates/pom.xml
index 19a73a052e7..d5481b93cb1 100644
--- a/project/standard/templates/pom.xml
+++ b/project/standard/templates/pom.xml
@@ -13,7 +13,9 @@
         <!-- platform BOM versions -->
         <tomcat.port>8080</tomcat.port>
         <tomcat.version>10.1.55</tomcat.version>
-        <jackson.version>2.19.4</jackson.version>
+        <jackson.version>2.22.3</jackson.version>
+        <guava.version>32.0.0-jre</guava.version>
+        <jsr305.version>3.0.2</jsr305.version>
         <backend.debug.args>-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=8989</backend.debug.args>
         <maven-resources-plugin.version>2.6</maven-resources-plugin.version>
         <maven-war-plugin.version>3.4.0</maven-war-plugin.version>
@@ -48,6 +50,17 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <!-- same versions GeoStore ships, so print-lib and json-patch do not add a second one -->
+            <dependency>
+                <groupId>com.google.guava</groupId>
+                <artifactId>guava</artifactId>
+                <version>${guava.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>com.google.code.findbugs</groupId>
+                <artifactId>jsr305</artifactId>
+                <version>${jsr305.version}</version>
+            </dependency>
             </dependencies>
     </dependencyManagement>
     <modules>
diff --git a/project/standard/templates/web/pom.xml b/project/standard/templates/web/pom.xml
index b05476a443e..b43317774f9 100644
--- a/project/standard/templates/web/pom.xml
+++ b/project/standard/templates/web/pom.xml
@@ -57,11 +57,12 @@
       <version>${mockito-core.version}</version>
       <scope>test</scope>
     </dependency>
-    <!-- servlet -->
+    <!-- servlet (provided by the servlet container, never packaged in the WAR) -->
     <dependency>
         <groupId>jakarta.servlet</groupId>
         <artifactId>jakarta.servlet-api</artifactId>
         <version>${jakarta.servlet-api.version}</version>
+        <scope>provided</scope>
     </dependency>
   </dependencies>
   <build>
@@ -351,25 +352,46 @@
             <artifactId>maven-war-plugin</artifactId>
             <version>${maven-war-plugin.version}</version>
             <configuration>
-                <packagingExcludes>
-                    WEB-INF/lib/*spring*5.3.18*.jar,
-                    WEB-INF/lib/json-lib-2.4-jdk15.jar,
-                    WEB-INF/lib/msg-simple-1.1.jar,
-                    WEB-INF/lib/btf-1.2.jar,
-                    WEB-INF/lib/commons-io-2.1.jar,
-                    WEB-INF/lib/commons-beanutils-1.8.0.jar,
-                    WEB-INF/lib/commons-logging-1.1.1.jar,
-                    WEB-INF/lib/jackson-coreutils-1.6.jar,
-                    WEB-INF/lib/stax-ex-1.8.jar
-                </packagingExcludes>
+                <!--
+                    Overlays copy their WEB-INF/lib as they are, so a library also coming from
+                    mapstore-services would end up twice in the WAR, in two versions. Drop the overlay
+                    copy of those libraries and keep the version brought by mapstore-services.
+                -->
                 <overlays>
                     <overlay>
                         <groupId>it.geosolutions.geostore</groupId>
                         <artifactId>geostore-webapp</artifactId>
+                        <excludes>
+                            <exclude>WEB-INF/lib/commons-io-*.jar</exclude>
+                            <exclude>WEB-INF/lib/jackson-annotations-*.jar</exclude>
+                            <exclude>WEB-INF/lib/jackson-core-*.jar</exclude>
+                            <exclude>WEB-INF/lib/jackson-databind-*.jar</exclude>
+                            <exclude>WEB-INF/lib/log4j-api-*.jar</exclude>
+                            <exclude>WEB-INF/lib/log4j-core-*.jar</exclude>
+                            <exclude>WEB-INF/lib/log4j-slf4j-impl-*.jar</exclude>
+                            <exclude>WEB-INF/lib/slf4j-api-*.jar</exclude>
+                            <!-- the versions required by Spring Security -->
+                            <exclude>WEB-INF/lib/micrometer-commons-*.jar</exclude>
+                            <exclude>WEB-INF/lib/micrometer-observation-*.jar</exclude>
+                            <!-- legacy asm:asm, same packages as org.ow2.asm:asm 9.x shipped next to it -->
+                            <exclude>WEB-INF/lib/asm-2.*.jar</exclude>
+                        </excludes>
                     </overlay>
                     <overlay>
                         <groupId>proxy</groupId>
                         <artifactId>http_proxy</artifactId>
+                        <excludes>
+                            <exclude>WEB-INF/lib/commons-io-*.jar</exclude>
+                            <exclude>WEB-INF/lib/log4j-api-*.jar</exclude>
+                            <exclude>WEB-INF/lib/log4j-core-*.jar</exclude>
+                            <!-- SLF4J 2 binding: MapStore and GeoStore use SLF4J 1.7 with log4j-slf4j-impl -->
+                            <exclude>WEB-INF/lib/log4j-slf4j2-impl-*.jar</exclude>
+                            <exclude>WEB-INF/lib/slf4j-api-*.jar</exclude>
+                            <!-- not used by the proxy, GeoStore ships its own -->
+                            <exclude>WEB-INF/lib/commons-codec-*.jar</exclude>
+                            <!-- embedded server of the proxy standalone launcher, not used in a webapp -->
+                            <exclude>WEB-INF/lib/jetty-*.jar</exclude>
+                        </excludes>
                     </overlay>
                 </overlays>
             </configuration>
@@ -479,6 +501,7 @@
                         <groupId>jakarta.servlet</groupId>
                         <artifactId>jakarta.servlet-api</artifactId>
                         <version>${jakarta.servlet-api.version}</version>
+                        <scope>provided</scope>
                     </dependency>
                     <dependency>
                         <groupId>jakarta.xml.ws</groupId>
@@ -488,16 +511,12 @@
                 </dependencies>
             </dependencyManagement>
             <dependencies>
-                <!-- mapfish-print -->
+                <!-- mapfish-print: drop what the WAR already ships from mapstore-services, GeoStore and http_proxy -->
                 <dependency>
                     <groupId>org.mapfish.print</groupId>
                     <artifactId>print-lib</artifactId>
                     <version>${print-lib.version}</version>
                     <exclusions>
-                        <exclusion>
-                            <groupId>commons-codec</groupId>
-                            <artifactId>commons-codec</artifactId>
-                        </exclusion>
                         <exclusion>
                             <groupId>com.fasterxml.jackson.core</groupId>
                             <artifactId>jackson-annotations</artifactId>
@@ -518,6 +537,14 @@
                             <groupId>org.springframework</groupId>
                             <artifactId>spring-context</artifactId>
                         </exclusion>
+                        <exclusion>
+                            <groupId>org.glassfish.jaxb</groupId>
+                            <artifactId>jaxb-runtime</artifactId>
+                        </exclusion>
+                        <exclusion>
+                            <groupId>jakarta.xml.bind</groupId>
+                            <artifactId>jakarta.xml.bind-api</artifactId>
+                        </exclusion>
                         <!-- drop the HTTP Client and Core jar -->
                         <exclusion>
                             <groupId>org.apache.httpcomponents</groupId>
@@ -527,6 +554,18 @@
                             <groupId>org.apache.httpcomponents</groupId>
                             <artifactId>httpcore</artifactId>
                         </exclusion>
+                        <exclusion>
+                            <groupId>org.apache.httpcomponents.client5</groupId>
+                            <artifactId>httpclient5</artifactId>
+                        </exclusion>
+                        <exclusion>
+                            <groupId>org.apache.httpcomponents.core5</groupId>
+                            <artifactId>httpcore5</artifactId>
+                        </exclusion>
+                        <exclusion>
+                            <groupId>org.apache.httpcomponents.core5</groupId>
+                            <artifactId>httpcore5-h2</artifactId>
+                        </exclusion>
                     </exclusions>
                 </dependency>
             </dependencies>
diff --git a/utility/build/check_duplicate_jars.py b/utility/build/check_duplicate_jars.py
new file mode 100644
index 00000000000..abfb5c8e9e1
--- /dev/null
+++ b/utility/build/check_duplicate_jars.py
@@ -0,0 +1,118 @@
+"""
+check_duplicate_jars.py
+
+Fails when the given WAR or ZIP archives, deployed together, put two versions of
+the same library in WEB-INF/lib. Which of the two the servlet container loads
+first depends on the environment, so such a WAR must not be released.
+
+The archives are merged the way they are deployed: the printing bundle is
+unpacked over the MapStore WAR, so a jar with the same file name in both is
+the same file, not a duplicate.
+
+A library is identified by the jar file name without its version
+(e.g. log4j-api-2.26.1.jar -> log4j-api). Two jars with the same name are
+reported only when they contain at least one class in common: this keeps apart
+libraries that share an artifactId but not their packages, such as Jackson 2
+(com.fasterxml.jackson.core:jackson-core) and Jackson 3
+(tools.jackson.core:jackson-core).
+
+Usage example:
+  python utility/build/check_duplicate_jars.py \\
+      product/target/mapstore.war \\
+      java/printing/target/mapstore-printing.zip
+
+Exit status: 0 when no library is duplicated, 1 otherwise.
+"""
+
+import argparse
+import io
+import os
+import re
+import sys
+import zipfile
+from collections import defaultdict
+
+LIB_ENTRY = re.compile(r"^WEB-INF/lib/([^/]+\.jar)$")
+# the name ends before the first "-<digit>": guava-32.0.0-jre.jar -> guava
+JAR_NAME = re.compile(r"^(.+?)-\d.*\.jar$")
+
+
+def library_name(jar_file_name):
+    match = JAR_NAME.match(jar_file_name)
+    return match.group(1) if match else jar_file_name[: -len(".jar")]
+
+
+def class_entries(jar_bytes):
+    with zipfile.ZipFile(io.BytesIO(jar_bytes)) as jar:
+        return {
+            name
+            for name in jar.namelist()
+            if name.endswith(".class")
+            and not name.startswith("META-INF/")
+            and not name.endswith("module-info.class")
+        }
+
+
+def collect_jars(archives):
+    """Returns {jar file name: (archive path, jar bytes)}, merged as deployed."""
+    jars = {}
+    for archive in archives:
+        with zipfile.ZipFile(archive) as zipped:
+            for entry in zipped.namelist():
+                match = LIB_ENTRY.match(entry)
+                if match:
+                    jars[match.group(1)] = (archive, zipped.read(entry))
+    return jars
+
+
+def find_duplicates(jars):
+    by_name = defaultdict(list)
+    for jar_file_name in jars:
+        by_name[library_name(jar_file_name)].append(jar_file_name)
+
+    duplicates = []
+    for name, jar_file_names in sorted(by_name.items()):
+        if len(jar_file_names) < 2:
+            continue
+        classes = {jar: class_entries(jars[jar][1]) for jar in jar_file_names}
+        clashing = sorted(
+            jar
+            for jar in jar_file_names
+            if any(classes[jar] & classes[other] for other in jar_file_names if other != jar)
+        )
+        if clashing:
+            duplicates.append((name, clashing))
+    return duplicates
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Fail when WAR/ZIP archives deployed together contain two versions of the same jar."
+    )
+    parser.add_argument("archives", nargs="+", help="WAR or ZIP archives, in deploy order")
+    args = parser.parse_args()
+
+    for archive in args.archives:
+        if not os.path.isfile(archive):
+            parser.error(f"archive not found: {archive}")
+
+    jars = collect_jars(args.archives)
+    duplicates = find_duplicates(jars)
+    checked = ", ".join(args.archives)
+
+    if not duplicates:
+        print(f"No duplicated libraries among {len(jars)} jars in {checked}")
+        return 0
+
+    in_github_actions = os.environ.get("GITHUB_ACTIONS") == "true"
+    print(f"Libraries packaged in more than one version in {checked}:")
+    for name, jar_file_names in duplicates:
+        found = ", ".join(f"{jar} ({jars[jar][0]})" for jar in jar_file_names)
+        print(f"  {name}: {found}")
+        if in_github_actions:
+            print(f"::error title=Duplicated library {name}::{found}")
+    return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())