diff --git a/CHANGES.md b/CHANGES.md
index 525aca85b..ffe5227bc 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,3 +1,9 @@
+Airbase 89
+
+* Dependency updates:
+  - validation-api 2.0.1 (from 1.1.0)
+  - BVal 2.0.0 (from 1.1.1)
+
 Airbase 88
 
 * Replace dependency-versions-check with Enforcer requireUpperBoundDeps
diff --git a/airbase/pom.xml b/airbase/pom.xml
index cf2a19d29..fd85f3981 100644
--- a/airbase/pom.xml
+++ b/airbase/pom.xml
@@ -169,8 +169,9 @@
         <dep.slf4j.version>1.7.25</dep.slf4j.version>
         <dep.logback.version>1.2.3</dep.logback.version>
         <dep.javax-inject.version>1</dep.javax-inject.version>
-        <dep.javax-validation.version>1.1.0.Final</dep.javax-validation.version>
+        <dep.javax-validation.version>2.0.1.Final</dep.javax-validation.version>
         <dep.javax-servlet.version>3.1.0</dep.javax-servlet.version>
+        <dep.bval.version>2.0.0</dep.bval.version>
         <dep.jackson.version>2.9.7</dep.jackson.version>
         <dep.jmxutils.version>1.19</dep.jmxutils.version>
         <dep.cglib.version>3.2.5</dep.cglib.version>
@@ -1126,28 +1127,10 @@
             </dependency>
 
             <!-- misc stuff -->
-
-            <!-- bval 1.1.1 depends on commons-lang3 3.3.2, which is incompatible with Java 9 -->
-            <dependency>
-                <groupId>org.apache.commons</groupId>
-                <artifactId>commons-lang3</artifactId>
-                <version>3.4</version>
-            </dependency>
-
             <dependency>
                 <groupId>org.apache.bval</groupId>
                 <artifactId>bval-jsr</artifactId>
-                <version>1.1.1</version>
-                <exclusions>
-                    <exclusion>
-                        <groupId>junit</groupId>
-                        <artifactId>junit</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>commons-logging</groupId>
-                        <artifactId>commons-logging</artifactId>
-                    </exclusion>
-                </exclusions>
+                <version>${dep.bval.version}</version>
             </dependency>
 
             <dependency>