diff --git a/dependencyCheckSuppression.xml b/dependencyCheckSuppression.xml
index ef6f4e3ee4..e5cbc4ce1d 100644
--- a/dependencyCheckSuppression.xml
+++ b/dependencyCheckSuppression.xml
@@ -479,4 +479,31 @@
         <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/.*@.*$</packageUrl>
         <cve>CVE-2026-53914</cve>
     </suppress>
+
+    <!--
+    [FP]: 'dev.cel/protobuf' collides with other protobuf libraries
+    https://github.com/dependency-check/DependencyCheck/issues/8735
+    -->
+    <suppress>
+        <notes><![CDATA[
+    file name: protobuf-0.13.0.jar
+    ]]></notes>
+        <packageUrl regex="true">^pkg:maven/dev\.cel/protobuf@.*$</packageUrl>
+        <cpe>cpe:/a:google:protobuf</cpe>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: protobuf-0.13.0.jar
+    ]]></notes>
+        <packageUrl regex="true">^pkg:maven/dev\.cel/protobuf@.*$</packageUrl>
+        <cpe>cpe:/a:google:protobuf-java</cpe>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: protobuf-0.13.0.jar
+    ]]></notes>
+        <packageUrl regex="true">^pkg:maven/dev\.cel/protobuf@.*$</packageUrl>
+        <cpe>cpe:/a:protobuf:protobuf</cpe>
+    </suppress>
+
 </suppressions>
diff --git a/gradle.properties b/gradle.properties
index 7e1076902b..925e353af0 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -57,7 +57,7 @@ windowsProteomicsBinariesVersion=1.0
 artifactoryPluginVersion=5.2.5
 gradleNodePluginVersion=7.1.0
 gradlePluginsVersion=9.2.0
-owaspDependencyCheckPluginVersion=12.2.2
+owaspDependencyCheckPluginVersion=13.0.0
 
 # Versions of node and npm to use during the build. If set, these versions
 # will be downloaded and used. If not set, the existing local installations will be used
@@ -103,7 +103,7 @@ apacheTomcatVersion=11.0.24
 # (mothership) -> json-path -> json-smart -> accessor-smart
 # (core) -> graalvm
 # tika
-asmVersion=9.10
+asmVersion=9.10.1
 
 awsSdkVersion=2.29.50
 
@@ -114,8 +114,8 @@ azureIdentityVersion=1.18.4
 batikVersion=1.19
 
 # sync with Tika version (or later)
-bouncycastlePgpVersion=1.84
-bouncycastleVersion=1.84
+bouncycastlePgpVersion=1.85
+bouncycastleVersion=1.85
 
 cglibNodepVersion=2.2.3
 
@@ -126,7 +126,7 @@ commonmarkVersion=0.29.0
 # the beanutils version is not the default version brought from commons-validator and/or commons-digester
 # in the :server:api module but is required for some of our code to compile
 commonsBeanutilsVersion=1.11.0
-commonsCodecVersion=1.22.0
+commonsCodecVersion=1.22.1
 commonsCollections4Version=4.5.0
 commonsCollectionsVersion=3.2.2
 commonsCompressVersion=1.28.0
@@ -140,10 +140,10 @@ commonsLoggingVersion=1.4.0
 commonsMath3Version=3.6.1
 commonsPoolVersion=1.6
 commonsTextVersion=1.15.0
-commonsValidatorVersion=1.10.1
+commonsValidatorVersion=1.11.0
 commonsVfs2Version=2.10.0
 
-datadogVersion=1.63.2
+datadogVersion=1.65.0
 
 dom4jVersion=2.2.0
 
@@ -162,12 +162,12 @@ googleApiVersion=2.47.0
 googleAuthVersion=1.40.0
 googleAutoValueAnnotationsVersion=1.10.4
 googleErrorProneAnnotationsVersion=2.50.0
-googleHttpClientVersion=2.1.1
+googleHttpClientVersion=2.2.0
 googleOauthClientVersion=1.39.0
 googleProtocolBufVersion=3.25.9
 
 graphSupportVersion=1.5.2
-grpcVersion=1.82.1
+grpcVersion=1.83.1
 
 # Cloud and SequenceAnalysis bring gson in as a transitive dependency.
 # We resolve to the later version here to keep things consistent
@@ -203,7 +203,7 @@ jacksonJaxrsBaseVersion=2.21.5
 jacksonAnnotationsVersion=2.21
 
 # Spring Boot brings in a transitive dependency on Jackson 3.x. It has changed package names and can coexist with Jackson 2.x.
-jackson3Version=3.1.4
+jackson3Version=3.1.5
 
 # The Jakarta Activation API version that Angus Activation implements. Keep in sync with angusActivationVersion (above).
 jakartaActivationApiVersion=2.1.4
@@ -234,14 +234,14 @@ jmockVersion=2.6.0
 # Transitive dependency via azure-identity and docker; force for consistency
 jnaVersion=5.18.1
 
-jodaTimeVersion=2.14.2
+jodaTimeVersion=2.14.3
 
 # brought in transitively by Cloud, FileTransfer, SequenceAnalysis, etc. Need to resolve consistently
 jsr305Version=3.0.2
 
-orgJsonVersion=20260522
+orgJsonVersion=20260719
 
-jsoupVersion=1.22.2
+jsoupVersion=1.23.1
 
 junitVersion=4.13.2
 
@@ -256,12 +256,12 @@ lombokVersion=1.18.46
 luceneVersion=10.5.0
 
 # Microsoft library for sending OAuth2-authenticated notification emails via the Microsoft Graph API
-microsoftGraphVersion=6.65.0
+microsoftGraphVersion=6.67.0
 
 mssqlJdbcVersion=13.4.0.jre11
 
-# Netty - transitive dependency via azure-core-http-netty; force for CVE-2026-33871, CVE-2026-33870, CVE-2026-45674, CVE-2026-47691 (and 20 related) fixed in 4.2.15.Final, plus CVE-2026-44891, CVE-2026-55831, CVE-2026-55833 fixed in 4.2.16.Final
-nettyVersion=4.2.16.Final
+# Netty - transitive dependency via azure-core-http-netty; force for CVE fixes
+nettyVersion=4.2.17.Final
 # Reactor - transitive dependency via azure-core; force for version consistency across modules
 reactorCoreVersion=3.8.1
 
@@ -272,14 +272,14 @@ opencsvVersion=2.3
 openTracingVersion=0.33.0
 
 # sync with version Tika ships
-pdfboxVersion=3.0.7
+pdfboxVersion=3.0.8
 
 # sync with version Tika ships
 poiVersion=5.5.1
 
 pollingWatchVersion=0.2.0
 
-postgresqlDriverVersion=42.7.12
+postgresqlDriverVersion=42.7.13
 
 quartzVersion=2.5.2
 
@@ -307,7 +307,7 @@ springBootVersion=4.1.0
 springVersion=7.0.8
 springAiVersion=2.0.0
 
-sqliteJdbcVersion=3.53.2.0
+sqliteJdbcVersion=3.53.2.1
 
 # SAML brings stax2-api in as a transitive dependency. We force the latest version.
 stax2ApiVersion=4.2.2
@@ -315,7 +315,7 @@ stax2ApiVersion=4.2.2
 thumbnailatorVersion=0.4.21
 
 # used for tika-core in API and tika-parsers in search
-tikaVersion=3.3.1
+tikaVersion=3.3.2
 
 # sync with Tika
 tukaaniXZVersion=1.12
@@ -323,7 +323,7 @@ tukaaniXZVersion=1.12
 validationApiVersion=1.1.0.Final
 
 # SAML brings woodstox-core in as a transitive dependency. We force the latest version.
-woodstoxCoreVersion=7.2.0
+woodstoxCoreVersion=7.2.2
 
 # sync with Tika
 xercesImplVersion=2.12.2