diff --git a/WORKSPACE b/WORKSPACE
index 00087271c6..f660cf4679 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -288,8 +288,8 @@ maven_jar(
 # When upgrading commons-compress, also upgrade tukaani-xz
 maven_jar(
     name = "commons_compress",
-    artifact = "org.apache.commons:commons-compress:1.13",
-    sha1 = "15c5e9584200122924e50203ae210b57616b75ee",
+    artifact = "org.apache.commons:commons-compress:1.15",
+    sha1 = "b686cd04abaef1ea7bc5e143c080563668eec17e",
 )
 
 maven_jar(
@@ -429,8 +429,8 @@ maven_jar(
 # Transitive dependency of commons-compress
 maven_jar(
     name = "tukaani_xz",
-    artifact = "org.tukaani:xz:1.4",
-    sha1 = "18a9a2ce6abf32ea1b5fd31dae5210ad93f4e5e3",
+    artifact = "org.tukaani:xz:1.6",
+    sha1 = "05b6f921f1810bdf90e25471968f741f87168b64",
 )
 
 # When upgrading Lucene, make sure it's compatible with Elasticsearch
diff --git a/lib/jgit/jgit.bzl b/lib/jgit/jgit.bzl
index 43c11b28d2..7bee9e347e 100644
--- a/lib/jgit/jgit.bzl
+++ b/lib/jgit/jgit.bzl
@@ -1,12 +1,12 @@
 load("//tools/bzl:maven_jar.bzl", "GERRIT", "MAVEN_LOCAL", "MAVEN_CENTRAL", "maven_jar")
 
-_JGIT_VERS = "4.10.0.201712302008-r"
+_JGIT_VERS = "4.10.0.201712302008-r.24-gf3bb0e268"
 
-_DOC_VERS = _JGIT_VERS  # Set to _JGIT_VERS unless using a snapshot
+_DOC_VERS = "4.10.0.201712302008-r"  # Set to _JGIT_VERS unless using a snapshot
 
 JGIT_DOC_URL = "http://download.eclipse.org/jgit/site/" + _DOC_VERS + "/apidocs"
 
-_JGIT_REPO = MAVEN_CENTRAL  # Leave here even if set to MAVEN_CENTRAL.
+_JGIT_REPO = GERRIT  # Leave here even if set to MAVEN_CENTRAL.
 
 # set this to use a local version.
 # "/home/<user>/projects/jgit"
@@ -26,28 +26,28 @@ def jgit_maven_repos():
         name = "jgit_lib",
         artifact = "org.eclipse.jgit:org.eclipse.jgit:" + _JGIT_VERS,
         repository = _JGIT_REPO,
-        sha1 = "61bda423283956d35117a0c1f993e752d12f3132",
-        src_sha1 = "6695024ae412511a5563b68b0df5dde3f765af77",
+        sha1 = "1813447ae544b38e36bda9f1599df5f7cff6cfac",
+        src_sha1 = "f0bb1ac954ff529b4e1e01e65ceb0d46d949da9e",
         unsign = True,
     )
     maven_jar(
         name = "jgit_servlet",
         artifact = "org.eclipse.jgit:org.eclipse.jgit.http.server:" + _JGIT_VERS,
         repository = _JGIT_REPO,
-        sha1 = "dadd8545b42c47fa1aaa2a53797cb36fa6c91e59",
+        sha1 = "f7a88c3744f864587d50096ab99a58e09e4afd95",
         unsign = True,
     )
     maven_jar(
         name = "jgit_archive",
         artifact = "org.eclipse.jgit:org.eclipse.jgit.archive:" + _JGIT_VERS,
         repository = _JGIT_REPO,
-        sha1 = "8a666fd481124ae34c11dd51955fc0b58644ab4a",
+        sha1 = "af579bcc932fa26f3c4d4ae00e812dc50d50a355",
     )
     maven_jar(
         name = "jgit_junit",
         artifact = "org.eclipse.jgit:org.eclipse.jgit.junit:" + _JGIT_VERS,
         repository = _JGIT_REPO,
-        sha1 = "57f3e31ee3d8ac90d5cd46359111cbb3a4167ebc",
+        sha1 = "b5fc2330bf0418e3a0f773925c57497131f13380",
         unsign = True,
     )