diff --git a/build.gradle b/build.gradle
@@ -12,7 +12,7 @@ plugins {
     id "io.spring.nohttp" version "0.0.11"
     id "checkstyle"
     id "jacoco"
-    id "net.ltgt.errorprone" version "4.2.0"
+    id "net.ltgt.errorprone" version "4.4.0"
     id 'maven-publish'
 }
 
@@ -262,8 +262,8 @@ configure(subprojects.findAll {it.name != 'bom'}) {
 
     dependencies {
         checkstyle files("$rootDir/config/checkstyle/lib/methodchecker-1.0.0.jar")
-        checkstyle 'com.puppycrawl.tools:checkstyle:9.0'
-        errorprone "com.google.errorprone:error_prone_core:2.43.0"
+        checkstyle 'com.puppycrawl.tools:checkstyle:9.3'
+        errorprone "com.google.errorprone:error_prone_core:2.50.0"
     }
 
     checkstyle {

diff --git a/core/build.gradle b/core/build.gradle
@@ -1,8 +1,8 @@
 apply plugin: 'application'
 
 dependencies {
-    implementation group: 'org.openjdk.jmh', name: 'jmh-core', version: '1.33'
-    annotationProcessor group: 'org.openjdk.jmh', name: 'jmh-generator-annprocess', version: '1.33'
+    implementation group: 'org.openjdk.jmh', name: 'jmh-core', version: '1.37'
+    annotationProcessor group: 'org.openjdk.jmh', name: 'jmh-generator-annprocess', version: '1.37'
 }
 application {
     mainClass.set("org.bouncycastle.crypto.fpe.SP80038GMicroBenchmark")

diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.1.0-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.0-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

diff --git a/gradlew b/gradlew
diff --git a/gradlew.bat b/gradlew.bat
diff --git a/jmail/build.gradle b/jmail/build.gradle
@@ -1,6 +1,6 @@
 
 plugins {
-  id "biz.aQute.bnd.builder" version "7.1.0"
+  id "biz.aQute.bnd.builder" version "7.4.0"
 }
 
 jar.archiveBaseName = "bcjmail-$vmrange"
@@ -25,8 +25,8 @@ dependencies {
     implementation project(':util')
     implementation project(':pkix')
 
-    implementation group: 'jakarta.mail', name: 'jakarta.mail-api', version: '2.0.1'
-    implementation group: 'jakarta.activation', name: 'jakarta.activation-api', version: '2.0.0'
+    implementation group: 'jakarta.mail', name: 'jakarta.mail-api', version: '2.1.5'
+    implementation group: 'jakarta.activation', name: 'jakarta.activation-api', version: '2.1.4'
 
     java9Implementation files(sourceSets.main.output.classesDirs) {
         builtBy compileJava
@@ -63,7 +63,7 @@ compileJava9Java {
     def pkix_jar="${project(":pkix").jar.outputs.files.getFiles().getAt(0)}"
 
     options.compilerArgs += [
-            '--module-path', "$prov_jar${File.pathSeparator}$util_jar${File.pathSeparator}$pkix_jar${File.pathSeparator}${rootProject.projectDir}/libs/jakarta.mail-2.0.1.jar${File.pathSeparator}${rootProject.projectDir}/libs/jakarta.activation-api-2.0.0.jar"
+            '--module-path', "$prov_jar${File.pathSeparator}$util_jar${File.pathSeparator}$pkix_jar${File.pathSeparator}${rootProject.projectDir}/libs/jakarta.mail-2.1.5.jar${File.pathSeparator}${rootProject.projectDir}/libs/jakarta.activation-api-2.1.4.jar"
     ]
     options.sourcepath = files(['build/src/main/java', 'src/main/jdk1.9'])
     options.compilerArgs << '-implicit:none'  // avoid recompiling every baseline class implicitly loaded via sourcepath

diff --git a/mail/build.gradle b/mail/build.gradle
@@ -1,5 +1,5 @@
 plugins {
-  id "biz.aQute.bnd.builder" version "7.1.0"
+  id "biz.aQute.bnd.builder" version "7.4.0"
 }
 
 jar.archiveBaseName = "bcmail-$vmrange"
@@ -21,11 +21,11 @@ dependencies {
     implementation project(':util')
     implementation project(':pkix')
 
-    implementation group: 'javax.mail', name: 'mail', version: '1.4'
+    implementation group: 'javax.mail', name: 'mail', version: '1.4.7'
     // javax.mail:mail:1.4 pulls in javax.activation:activation:1.1 transitively - both are
     // needed as automatic modules ("mail", "activation") on the module-info.java compile path,
     // since neither javax.mail nor javax.activation is a JDK-bundled module on Java 11+.
-    mailModulePath group: 'javax.mail', name: 'mail', version: '1.4'
+    mailModulePath group: 'javax.mail', name: 'mail', version: '1.4.7'
 
     java9Implementation files(sourceSets.main.output.classesDirs) {
         builtBy compileJava

diff --git a/misc/build.gradle b/misc/build.gradle
@@ -10,7 +10,7 @@ plugins {
     // published mls module because it is a test tool for the RFC 9420 interoperability runner,
     // not library API: shipping it in bcmls put classes needing io.grpc and com.google.protobuf
     // into a published jar whose POM and OSGi manifest declared neither.
-    id 'com.google.protobuf' version '0.9.4'
+    id 'com.google.protobuf' version '0.10.0'
 }
 
 apply plugin: 'com.google.protobuf'
@@ -19,7 +19,7 @@ apply plugin: 'com.google.protobuf'
 // and CVE-2025-55163 (the MadeYouReset HTTP/2 DDoS, fixed in 1.75.0). protobuf-java arrives
 // transitively from grpc-protobuf; protocVersion below tracks it so the generated code and the
 // runtime agree, and is past 3.25.5, which fixed CVE-2024-7254 (recursion on unknown fields).
-def grpcVersion = '1.83.1'
+def grpcVersion = '1.84.0'
 def protocVersion = '3.25.9'
 
 jar.archiveBaseName = "bcmisc-$vmrange"
@@ -42,7 +42,7 @@ dependencies {
     implementation project(':tls')
     implementation project(':mls')
 
-    implementation group: 'javax.mail', name: 'mail', version: '1.4'
+    implementation group: 'javax.mail', name: 'mail', version: '1.4.7'
 
     // The MLS interop harness only, and by coordinate rather than as hand-placed jars under
     // test/libs, which were invisible both to Dependabot (see the note on files()/fileTree()

diff --git a/mls/build.gradle b/mls/build.gradle
@@ -1,7 +1,7 @@
 
 plugins {
 // OSGI
-    id "biz.aQute.bnd.builder" version "7.1.0"
+    id "biz.aQute.bnd.builder" version "7.4.0"
 //     Generate IntelliJ IDEA's .idea & .iml project files
 //    id 'idea'
 }

diff --git a/pg/build.gradle b/pg/build.gradle
@@ -1,6 +1,6 @@
 
 plugins {
-  id "biz.aQute.bnd.builder" version "7.1.0"
+  id "biz.aQute.bnd.builder" version "7.4.0"
 }
 
 sourceSets {