diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 3d032a6..e728221 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -13,16 +13,16 @@
 java = "21"
 
 # Build / quality
-spotless = "8.8.0"
+spotless = "8.9.0"
 errorprone-plugin = "5.1.0"
 errorprone-core = "2.50.0"
 google-java-format = "1.25.2"
-jspecify = "1.0.0"
+jspecify = "1.0.1"
 
 # Runtime — core / serialization / observability (pinned to pk-auth)
 # Jackson 3 ("tools.jackson") — java.time and JDK 8 datatype support is built into databind 3,
 # so we do not pull jackson-datatype-jdk8 / jackson-datatype-jsr310 separately.
-jackson = "3.2.1"
+jackson = "3.2.2"
 jackson-annotations = "2.22"
 caffeine = "3.2.4"
 micrometer = "1.17.0"
@@ -50,13 +50,13 @@ testcontainers = "1.21.4"
 
 # OpenAPI parsing — validates the committed velocity-api spec is well-formed OpenAPI 3.1 in a test
 # (velocity-api OpenApiSpecTest). velocity-only; tracks the current latest 2.1.x.
-swagger-parser = "2.1.22"
+swagger-parser = "2.1.46"
 
 # Test bundle (wired in the test convention plugin). Pinned to pk-auth.
-junit-jupiter = "6.1.2"
+junit-jupiter = "6.1.3"
 assertj = "3.27.7"
 mockito = "5.23.0"
-logback = "1.5.38"
+logback = "1.6.3"
 
 # Security floors for transitive dependencies (see the "Transitive security floors" block in
 # velocity.java-conventions). None of these are direct dependencies of ours — they arrive
@@ -64,11 +64,11 @@ logback = "1.5.38"
 # Testcontainers, rhino via swagger-parser). Each value is the first patched release for the
 # corresponding Dependabot advisory; it is applied as a *floor*, not a pin, so a higher version
 # on any resolution path still wins. Dependabot keeps these current on its weekly gradle run.
-netty = "4.2.15.Final"          # netty-handler / netty-resolver-dns advisories (GHSA, high)
-jackson2 = "2.21.5"             # jackson-databind 2.x case-insensitive @JsonIgnoreProperties bypass
-commons-compress = "1.26.0"     # Pack200 OOM + corrupted-DUMP infinite-loop DoS
-commons-lang3 = "3.18.0"        # uncontrolled recursion on long inputs
-rhino = "1.7.14.1"              # toFixed() high-CPU DoS
+netty = "4.2.17.Final"          # netty-handler / netty-resolver-dns advisories (GHSA, high)
+jackson2 = "2.22.1"             # jackson-databind 2.x case-insensitive @JsonIgnoreProperties bypass
+commons-compress = "1.28.0"     # Pack200 OOM + corrupted-DUMP infinite-loop DoS
+commons-lang3 = "3.20.0"        # uncontrolled recursion on long inputs
+rhino = "1.9.1"              # toFixed() high-CPU DoS
 
 [libraries]
 jspecify = { module = "org.jspecify:jspecify", version.ref = "jspecify" }
diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
index b1b8ef5..eddabd2 100644
Binary files a/gradle/wrapper/gradle-wrapper.jar and b/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index dbe66e1..84c5a9c 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=9c0f7faeeb306cb14e4279a3e084ca6b596894089a0638e68a07c945a32c9e14
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
+distributionSha256Sum=84fbba45c7f4c64abc77460e1c00f541e9f960e3c7ed2538f1ede19eacd873ae
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.7.0-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500