diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 389361a..b691463 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -12,19 +12,19 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2  
+    - uses: actions/checkout@v4
 
-    - name: Set up JDK 8
-      uses: actions/setup-java@v2
+    - name: Set up JDK 17
+      uses: actions/setup-java@v4
       with:
-        java-version: '8'
+        java-version: '17'
         distribution: 'zulu'
 
     - name: Cache local Maven repository
-      uses: actions/cache@v2.1.6
+      uses: actions/cache@v4
       with:
         path: ~/.m2/
-        key: ${{ runner.os }}-maven-${{ hashFiles('pom.xml') }} 
+        key: ${{ runner.os }}-maven-${{ hashFiles('pom.xml') }}
 
     - name: Build with Maven
       run: mvn clean verify
diff --git a/pom.xml b/pom.xml
index bafdf14..7cd5196 100644
--- a/pom.xml
+++ b/pom.xml
@@ -34,19 +34,20 @@
 
 	<properties>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-		<maven.compiler.target>1.7</maven.compiler.target>
-		<maven.compiler.source>1.7</maven.compiler.source>
-		<java.version>1.7</java.version>
+		<!-- bytecode 1.8 para não quebrar consumidores em Java 8; o build roda tanto em JDK 8 quanto em 17 -->
+		<maven.compiler.target>1.8</maven.compiler.target>
+		<maven.compiler.source>1.8</maven.compiler.source>
+		<java.version>1.8</java.version>
 
-		<lombok.version>1.16.6</lombok.version>
+		<lombok.version>1.18.34</lombok.version>
 		<apache.http.version>4.4.1</apache.http.version>
 	</properties>
 
 	<dependencies>
 		<dependency>
 			<groupId>org.mockito</groupId>
-			<artifactId>mockito-all</artifactId>
-			<version>1.9.5</version>
+			<artifactId>mockito-core</artifactId>
+			<version>4.11.0</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
@@ -55,10 +56,12 @@
 			<version>4.12</version>
 			<scope>test</scope>
 		</dependency>
+		<!-- provided: o Lombok só existe em tempo de compilação (anotações são @Retention(SOURCE)) -->
 		<dependency>
 			<groupId>org.projectlombok</groupId>
 			<artifactId>lombok</artifactId>
 			<version>${lombok.version}</version>
+			<scope>provided</scope>
 		</dependency>
 		<dependency>
 			<groupId>org.apache.commons</groupId>
@@ -94,26 +97,38 @@
 
 
 
+		<!--
+			saaj-impl (e não só a saaj-api): até o Java 8 a JDK embutia uma implementação SAAJ
+			(com.sun.xml.internal.messaging.saaj), removida pela JEP 320 no Java 11. Sem a impl
+			explícita, MessageFactory.newInstance() falha em runtime a partir do Java 11.
+			A 1.5.x ainda usa o namespace javax.xml.soap; a 2.x/3.x migra para jakarta.
+		-->
 		<dependency>
-			<groupId>javax.xml.soap</groupId>
-			<artifactId>saaj-api</artifactId>
-			<version>1.3.5</version>
+			<groupId>com.sun.xml.messaging.saaj</groupId>
+			<artifactId>saaj-impl</artifactId>
+			<version>1.5.3</version>
 		</dependency>
+		<!--
+			Só a API: biblioteca não declara binding de log, senão colide com o binding do
+			consumidor no classpath. Escolher a implementação é responsabilidade de quem usa.
+		-->
 		<dependency>
 			<groupId>org.slf4j</groupId>
-			<artifactId>slf4j-log4j12</artifactId>
+			<artifactId>slf4j-api</artifactId>
 			<version>1.7.21</version>
 		</dependency>
-
 		<dependency>
-			<groupId>javax.xml.bind</groupId>
-			<artifactId>jaxb-api</artifactId>
-			<version>2.2.7</version>
+			<groupId>org.slf4j</groupId>
+			<artifactId>slf4j-log4j12</artifactId>
+			<version>1.7.21</version>
+			<scope>test</scope>
 		</dependency>
+
+		<!-- jaxb-runtime traz api + impl + activation; o jaxb-impl 2.2.6 depende de javax.activation, removido no Java 11 -->
 		<dependency>
-			<groupId>com.sun.xml.bind</groupId>
-			<artifactId>jaxb-impl</artifactId>
-			<version>2.2.6</version>
+			<groupId>org.glassfish.jaxb</groupId>
+			<artifactId>jaxb-runtime</artifactId>
+			<version>2.3.9</version>
 		</dependency>
 	</dependencies>
 
@@ -137,7 +152,7 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-source-plugin</artifactId>
-				<version>2.2.1</version>
+				<version>3.3.0</version>
 				<executions>
 				  <execution>
 				    <id>attach-sources</id>
@@ -151,7 +166,10 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-javadoc-plugin</artifactId>
-				<version>2.9.1</version>
+				<version>3.6.3</version>
+				<configuration>
+					<doclint>none</doclint>
+				</configuration>
 				<executions>
 				  <execution>
 				    <id>attach-javadocs</id>
diff --git a/src/test/java/br/ufsc/bridge/soap/http/SoapHttpClientTest.java b/src/test/java/br/ufsc/bridge/soap/http/SoapHttpClientTest.java
index c1fb533..1e21117 100644
--- a/src/test/java/br/ufsc/bridge/soap/http/SoapHttpClientTest.java
+++ b/src/test/java/br/ufsc/bridge/soap/http/SoapHttpClientTest.java
@@ -24,7 +24,7 @@
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
-import org.mockito.Matchers;
+import org.mockito.ArgumentMatchers;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 
@@ -58,13 +58,13 @@ public class SoapHttpClientTest {
 
 	@Before
 	public void init() throws ClientProtocolException, IOException {
-		MockitoAnnotations.initMocks(this);
+		MockitoAnnotations.openMocks(this);
 
 		this.headers = new Header[2];
 		this.headers[0] = new BasicHeader(HttpHeaders.CONTENT_TYPE, " application/soap+xml");
 		this.headers[1] = new BasicHeader("MIME-Version", "1.0");
 
-		when(this.httpClient.execute(Matchers.any(HttpPost.class))).thenReturn(this.response);
+		when(this.httpClient.execute(ArgumentMatchers.any(HttpPost.class))).thenReturn(this.response);
 
 		when(this.response.getStatusLine()).thenReturn(this.status);
 		when(this.response.getEntity()).thenReturn(this.entity);
@@ -159,7 +159,7 @@ public void responseClosedAndEntityConsumedOnOtherErrors() throws ClientProtocol
 	@Test
 	@SuppressWarnings("unchecked")
 	public void ioExcpetion() throws ClientProtocolException, IOException, SoapHttpResponseException {
-		when(this.httpClient.execute(Matchers.any(HttpHost.class), Matchers.any(HttpPost.class)))
+		when(this.httpClient.execute(ArgumentMatchers.any(HttpHost.class), ArgumentMatchers.any(HttpPost.class)))
 				.thenThrow(ConnectionClosedException.class,
 						ConnectTimeoutException.class,
 						ConnectException.class);
diff --git a/src/test/java/br/ufsc/bridge/soap/http/SoapMessageBuilderTest.java b/src/test/java/br/ufsc/bridge/soap/http/SoapMessageBuilderTest.java
new file mode 100644
index 0000000..a531e29
--- /dev/null
+++ b/src/test/java/br/ufsc/bridge/soap/http/SoapMessageBuilderTest.java
@@ -0,0 +1,75 @@
+package br.ufsc.bridge.soap.http;
+
+import java.io.ByteArrayInputStream;
+
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlRootElement;
+import javax.xml.parsers.DocumentBuilderFactory;
+
+import org.junit.Assert;
+import org.junit.Test;
+import org.w3c.dom.Document;
+
+import br.ufsc.bridge.soap.jaxb.JAXBMessageBuilder;
+import br.ufsc.bridge.soap.string.StringMessageBuilder;
+import br.ufsc.bridge.soap.xpath.XPathFactoryAssist;
+
+/**
+ * Exercita o caminho SAAJ (MessageFactory/SOAPFactory), que não é coberto pelos outros testes.
+ * Até o Java 8 a implementação SAAJ vinha embutida na JDK; a partir do Java 11 ela depende do
+ * saaj-impl declarado no pom, e a falha só aparece em runtime. Sem este teste o build fica verde
+ * mesmo com a lib incapaz de montar um envelope.
+ */
+public class SoapMessageBuilderTest {
+
+	private static final String WSSE = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";
+
+	private static final String BODY = "<t:Ping xmlns:t=\"urn:teste\"><t:valor>42</t:valor></t:Ping>";
+
+	@XmlRootElement(name = "Ping", namespace = "urn:teste")
+	@XmlAccessorType(XmlAccessType.FIELD)
+	public static class Ping {
+		@XmlElement(namespace = "urn:teste")
+		private String valor = "42";
+	}
+
+	private XPathFactoryAssist envelope(byte[] message) throws Exception {
+		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		factory.setNamespaceAware(true);
+		Document document = factory.newDocumentBuilder().parse(new ByteArrayInputStream(message));
+		return new XPathFactoryAssist(document);
+	}
+
+	@Test
+	public void stringBuilderComCredencialGeraUsernameToken() throws Exception {
+		byte[] message = new StringMessageBuilder(new SoapCredential("usuario", "senha")).createMessage(BODY);
+
+		XPathFactoryAssist x = this.envelope(message);
+		Assert.assertEquals(WSSE, x.getString("namespace-uri(//*[local-name()='Security'])"));
+		Assert.assertEquals("usuario", x.getString("//*[local-name()='Username']"));
+		Assert.assertEquals("senha", x.getString("//*[local-name()='Password']"));
+		Assert.assertEquals("UsernameToken-2", x.getString("//*[local-name()='UsernameToken']/@*[local-name()='Id']"));
+		Assert.assertEquals("42", x.getString("//*[local-name()='Body']//*[local-name()='valor']"));
+	}
+
+	@Test
+	public void stringBuilderSemCredencialNaoGeraSecurity() throws Exception {
+		byte[] message = new StringMessageBuilder(null).createMessage(BODY);
+
+		XPathFactoryAssist x = this.envelope(message);
+		Assert.assertEquals(Long.valueOf(0), x.count("//*[local-name()='Security']"));
+		Assert.assertEquals("42", x.getString("//*[local-name()='Body']//*[local-name()='valor']"));
+	}
+
+	@Test
+	public void jaxbBuilderMarshallaOBody() throws Exception {
+		byte[] message = new JAXBMessageBuilder<Ping>(new SoapCredential("usuario", "senha")).createMessage(new Ping());
+
+		XPathFactoryAssist x = this.envelope(message);
+		Assert.assertEquals("usuario", x.getString("//*[local-name()='Username']"));
+		Assert.assertEquals("urn:teste", x.getString("namespace-uri(//*[local-name()='Body']/*)"));
+		Assert.assertEquals("42", x.getString("//*[local-name()='Body']//*[local-name()='valor']"));
+	}
+}