diff --git a/pom.xml b/pom.xml
index 3e5aeb5..e94b168 100644
--- a/pom.xml
+++ b/pom.xml
@@ -122,7 +122,7 @@ SPDX-License-Identifier: Apache-2.0
             <dependency>
                 <groupId>org.slf4j</groupId>
                 <artifactId>slf4j-api</artifactId>
-                <version>2.0.18</version>
+                <version>2.0.19</version>
             </dependency>
             <!--
                 The SLF4J binding shipped inside srcmorph-cli's fat jar. It is slf4j-simple, not
@@ -140,7 +140,7 @@ SPDX-License-Identifier: Apache-2.0
             <dependency>
                 <groupId>org.slf4j</groupId>
                 <artifactId>slf4j-simple</artifactId>
-                <version>2.0.18</version>
+                <version>2.0.19</version>
             </dependency>
             <!--
                 Pin logback-classic for the TEST scope only: AiFieldGenerationSupportTest attaches a
@@ -198,7 +198,7 @@ SPDX-License-Identifier: Apache-2.0
                 org.checkerframework.framework.qual.DoesNotUnrefineReceiver". Processor and
                 qualifiers must share a major version.
 
-                Scope `provided` satisfies both constraints at once: 4.2.2 on the compile classpath
+                Scope `provided` satisfies both constraints at once: 4.2.3 on the compile classpath
                 where the checker needs it, and excluded from consumers' transitive graph AND from
                 the fat jar (jar-with-dependencies takes scope runtime), so no checker-qual class of
                 any version reaches a consumer's JVM. <optional>true</optional> alone would not have
@@ -212,7 +212,7 @@ SPDX-License-Identifier: Apache-2.0
             <dependency>
                 <groupId>org.checkerframework</groupId>
                 <artifactId>checker-qual</artifactId>
-                <version>4.2.2</version>
+                <version>4.2.3</version>
                 <scope>provided</scope>
             </dependency>
         </dependencies>
diff --git a/srcmorph-cli/pom.xml b/srcmorph-cli/pom.xml
index f9e8a46..efac4c3 100644
--- a/srcmorph-cli/pom.xml
+++ b/srcmorph-cli/pom.xml
@@ -48,17 +48,17 @@ SPDX-License-Identifier: Apache-2.0
         <junit.version>6.1.3</junit.version>
         <hamcrest.version>3.0</hamcrest.version>
         <errorprone.version>2.50.0</errorprone.version>
-        <nullaway.version>0.14.0</nullaway.version>
+        <nullaway.version>0.14.1</nullaway.version>
         <!-- checker.version also drives the org.checkerframework:checker annotation-processor
              artifact below; the checker-qual dependency version itself is managed by the
              parent's <dependencyManagement> (see comment above <dependencies>). -->
-        <checker.version>4.2.2</checker.version>
+        <checker.version>4.2.3</checker.version>
         <archunit.version>1.5.0</archunit.version>
-        <spotbugs.version>4.10.4.0</spotbugs.version>
-        <lombok.version>1.18.46</lombok.version>
+        <spotbugs.version>4.10.4.1</spotbugs.version>
+        <lombok.version>1.18.48</lombok.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
         <findsecbugs.version>1.14.0</findsecbugs.version>
-        <spotless.version>3.10.1</spotless.version>
+        <spotless.version>3.10.2</spotless.version>
         <palantir-java-format.version>2.97.0</palantir-java-format.version>
 
         <project.build.outputTimestamp>2026-09-01T07:56:35Z</project.build.outputTimestamp>
@@ -182,7 +182,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>io.github.git-commit-id</groupId>
                     <artifactId>git-commit-id-maven-plugin</artifactId>
-                    <version>10.0.0</version>
+                    <version>10.0.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
@@ -192,7 +192,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-compiler-plugin</artifactId>
-                    <version>3.15.0</version>
+                    <version>3.16.0</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
@@ -222,7 +222,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>3.5.6</version>
+                    <version>3.6.0</version>
                     <configuration>
                         <!--
                             argLine starts with @{argLine} so the JaCoCo agent (placed into the
diff --git a/srcmorph-maven-plugin/pom.xml b/srcmorph-maven-plugin/pom.xml
index c60487e..3224b59 100644
--- a/srcmorph-maven-plugin/pom.xml
+++ b/srcmorph-maven-plugin/pom.xml
@@ -84,20 +84,20 @@ SPDX-License-Identifier: Apache-2.0
         <jcstress.version>0.16</jcstress.version>
         <vmlens.version>1.2.28</vmlens.version>
         <errorprone.version>2.50.0</errorprone.version>
-        <nullaway.version>0.14.0</nullaway.version>
+        <nullaway.version>0.14.1</nullaway.version>
         <!-- checker.version also drives the org.checkerframework:checker annotation-processor
              artifact below; the checker-qual dependency version itself is managed by the
              parent's <dependencyManagement> (see comment above <dependencies>). -->
-        <checker.version>4.2.2</checker.version>
+        <checker.version>4.2.3</checker.version>
         <!-- jqwik / Lincheck are no longer dependencies of this module (both moved to srcmorph
              with the config package's tests); see srcmorph/pom.xml for the jqwik "DO NOT UPGRADE
              past 1.9.3" policy note (CLAUDE.md "jqwik prompt-injection in test output"). -->
         <archunit.version>1.5.0</archunit.version>
-        <spotbugs.version>4.10.4.0</spotbugs.version>
-        <lombok.version>1.18.46</lombok.version>
+        <spotbugs.version>4.10.4.1</spotbugs.version>
+        <lombok.version>1.18.48</lombok.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
         <findsecbugs.version>1.14.0</findsecbugs.version>
-        <spotless.version>3.10.1</spotless.version>
+        <spotless.version>3.10.2</spotless.version>
         <palantir-java-format.version>2.97.0</palantir-java-format.version>
 
         <ai.index.output.directory>${project.basedir}/src/site/ai</ai.index.output.directory>
@@ -266,12 +266,12 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>io.github.git-commit-id</groupId>
                     <artifactId>git-commit-id-maven-plugin</artifactId>
-                    <version>10.0.0</version>
+                    <version>10.0.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-compiler-plugin</artifactId>
-                    <version>3.15.0</version>
+                    <version>3.16.0</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
@@ -306,7 +306,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>3.5.6</version>
+                    <version>3.6.0</version>
                     <configuration>
                         <!--
                             argLine starts with @{argLine} so the JaCoCo agent (placed into the
diff --git a/srcmorph/pom.xml b/srcmorph/pom.xml
index c8b135b..755a7b2 100644
--- a/srcmorph/pom.xml
+++ b/srcmorph/pom.xml
@@ -72,11 +72,11 @@ SPDX-License-Identifier: Apache-2.0
         <hamcrest.version>3.0</hamcrest.version>
         <lincheck.version>3.7</lincheck.version>
         <errorprone.version>2.50.0</errorprone.version>
-        <nullaway.version>0.14.0</nullaway.version>
+        <nullaway.version>0.14.1</nullaway.version>
         <!-- checker.version also drives the org.checkerframework:checker annotation-processor
              artifact below; the checker-qual dependency version itself is managed by the
              parent's <dependencyManagement> (see comment above <dependencies>). -->
-        <checker.version>4.2.2</checker.version>
+        <checker.version>4.2.3</checker.version>
         <!-- DO NOT UPGRADE jqwik past 1.9.3. jqwik 1.10.0 added a deliberate
              anti-AI prompt-injection string to test stdout; the 1.10.1 user
              guide states the library "is not meant to be used by any 'AI'
@@ -86,11 +86,11 @@ SPDX-License-Identifier: Apache-2.0
              section "jqwik prompt-injection in test output" for full context. -->
         <jqwik.version>1.9.3</jqwik.version>
         <archunit.version>1.5.0</archunit.version>
-        <spotbugs.version>4.10.4.0</spotbugs.version>
-        <lombok.version>1.18.46</lombok.version>
+        <spotbugs.version>4.10.4.1</spotbugs.version>
+        <lombok.version>1.18.48</lombok.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
         <findsecbugs.version>1.14.0</findsecbugs.version>
-        <spotless.version>3.10.1</spotless.version>
+        <spotless.version>3.10.2</spotless.version>
         <palantir-java-format.version>2.97.0</palantir-java-format.version>
 
         <project.build.outputTimestamp>2026-09-01T07:56:35Z</project.build.outputTimestamp>
@@ -229,12 +229,12 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>io.github.git-commit-id</groupId>
                     <artifactId>git-commit-id-maven-plugin</artifactId>
-                    <version>10.0.0</version>
+                    <version>10.0.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-compiler-plugin</artifactId>
-                    <version>3.15.0</version>
+                    <version>3.16.0</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
@@ -264,7 +264,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>3.5.6</version>
+                    <version>3.6.0</version>
                     <configuration>
                         <!--
                             argLine starts with @{argLine} so the JaCoCo agent (placed into the