diff --git a/CLAUDE.md b/CLAUDE.md
index 1c8c858..6464004 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -398,9 +398,9 @@ assume it has already been updated.
 | Dependency | Version | Used by |
 |---|---|---|
 | `net.ladenthin:llama` | 5.2.0 | `srcmorph` (`provider` package only) — llama.cpp JNI binding; its own SLF4J binding is excluded transitively (see "Java 8 bytecode floor") |
-| `org.slf4j:slf4j-api` | 2.0.19 (converged in the parent) | `srcmorph`, `srcmorph-cli`, the plugin |
-| `org.slf4j:slf4j-simple` | 2.0.19 (converged in the parent) | `srcmorph-cli` (runtime binding) |
-| `ch.qos.logback:logback-classic` | 1.6.3 (converged in the parent) | `srcmorph` (**test scope only** — `ListAppender` capture) |
+| `org.slf4j:slf4j-api` | 2.0.20 (converged in the parent) | `srcmorph`, `srcmorph-cli`, the plugin |
+| `org.slf4j:slf4j-simple` | 2.0.20 (converged in the parent) | `srcmorph-cli` (runtime binding) |
+| `ch.qos.logback:logback-classic` | 1.6.4 (converged in the parent) | `srcmorph` (**test scope only** — `ListAppender` capture) |
 | `com.fasterxml.jackson.core:jackson-databind` | pinned in parent | `srcmorph-cli` (JSON config) |
 | `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` | pinned in parent | `srcmorph-cli` (YAML config) |
 | `org.apache.maven:maven-plugin-api` | 3.9.16 | `srcmorph-maven-plugin` (provided) |
diff --git a/TODO.md b/TODO.md
index 4159af5..7ad1c22 100644
--- a/TODO.md
+++ b/TODO.md
@@ -39,6 +39,14 @@ everything below is genuinely still open.
   `origin/main` tree, so it is not an artefact of the dependency sweep. Fix the code or add a
   justified suppression per `../workspace/policies/spotbugs-suppressions.md` in the same change
   that unblocks the pin.
+- **Third latent red behind the pin: 4 `LlamaCppJniProviderSupportTest` failures against the 5.2.0
+  core.** Found 2026-09-27 the same way (`-Dllama.version=5.2.0-SNAPSHOT verify`), reproduced on the
+  unmodified tree. `buildInferenceParameters_zeroWindows_sendsBothAsZero`,
+  `_configuredWindows_arePassedThrough`, `_zeroSeed_isStillSent` and
+  `_configuredDrySequenceBreakers_arePassedThrough` assert on `InferenceParameters.toString()` as if
+  it were the request JSON. In java-llama.cpp 5.2.0 `toString()` is a redacted debug view that is
+  deliberately not valid JSON, and `toJson()` renders the request body — so those assertions need to
+  read `toJson()`. Fix together with the pin; the rest of the reactor is green (634 / 39 / 33 tests).
 - **The sixteen GPU classifier fat jars are verified structurally, never launched.** Since 1.2.0
   `.github/verify-classifier-fatjars.sh` asserts each is the artifact its name claims (one jar per
   classifier, a native for the promised OS/arch, a native set that differs from the default jar's, so
diff --git a/pom.xml b/pom.xml
index e94b168..9166ef3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -78,7 +78,7 @@ SPDX-License-Identifier: Apache-2.0
             parent POM, so the version used by both jackson dependencyManagement entries must live
             at this level. srcmorph-cli/pom.xml does not redeclare it.
         -->
-        <jackson.version>2.22.2</jackson.version>
+        <jackson.version>2.22.3</jackson.version>
         <!--
             SonarCloud requires sonar.organization on the project the scanner executes, which is
             this reactor root (srcmorph-parent) — child-module properties are not visible to the
@@ -122,7 +122,7 @@ SPDX-License-Identifier: Apache-2.0
             <dependency>
                 <groupId>org.slf4j</groupId>
                 <artifactId>slf4j-api</artifactId>
-                <version>2.0.19</version>
+                <version>2.0.20</version>
             </dependency>
             <!--
                 The SLF4J binding shipped inside srcmorph-cli's fat jar. It is slf4j-simple, not
@@ -140,7 +140,7 @@ SPDX-License-Identifier: Apache-2.0
             <dependency>
                 <groupId>org.slf4j</groupId>
                 <artifactId>slf4j-simple</artifactId>
-                <version>2.0.19</version>
+                <version>2.0.20</version>
             </dependency>
             <!--
                 Pin logback-classic for the TEST scope only: AiFieldGenerationSupportTest attaches a
@@ -152,7 +152,7 @@ SPDX-License-Identifier: Apache-2.0
             <dependency>
                 <groupId>ch.qos.logback</groupId>
                 <artifactId>logback-classic</artifactId>
-                <version>1.6.3</version>
+                <version>1.6.4</version>
             </dependency>
             <!--
                 JSON/YAML binding for srcmorph-cli's CConfiguration. Both artifacts are pinned to the
diff --git a/srcmorph-cli/pom.xml b/srcmorph-cli/pom.xml
index 6220fa3..4af4dad 100644
--- a/srcmorph-cli/pom.xml
+++ b/srcmorph-cli/pom.xml
@@ -48,18 +48,18 @@ SPDX-License-Identifier: Apache-2.0
         <junit.version>6.1.3</junit.version>
         <hamcrest.version>3.0</hamcrest.version>
         <errorprone.version>2.50.0</errorprone.version>
-        <nullaway.version>0.14.1</nullaway.version>
+        <nullaway.version>0.14.2</nullaway.version>
         <!-- checker.version also drives the org.checkerframework:checker annotation-processor
              artifact below; the checker-qual dependency version itself is managed by the
              parent's <dependencyManagement> (see comment above <dependencies>). -->
         <checker.version>4.2.3</checker.version>
-        <archunit.version>1.5.0</archunit.version>
+        <archunit.version>1.5.1</archunit.version>
         <spotbugs.version>4.10.4.1</spotbugs.version>
         <lombok.version>1.18.48</lombok.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
         <findsecbugs.version>1.14.0</findsecbugs.version>
-        <spotless.version>3.10.2</spotless.version>
-        <palantir-java-format.version>2.98.0</palantir-java-format.version>
+        <spotless.version>3.10.3</spotless.version>
+        <palantir-java-format.version>2.99.0</palantir-java-format.version>
 
         <project.build.outputTimestamp>2026-09-01T07:56:35Z</project.build.outputTimestamp>
     </properties>
diff --git a/srcmorph-maven-plugin/pom.xml b/srcmorph-maven-plugin/pom.xml
index f8c312f..0cbf511 100644
--- a/srcmorph-maven-plugin/pom.xml
+++ b/srcmorph-maven-plugin/pom.xml
@@ -84,7 +84,7 @@ SPDX-License-Identifier: Apache-2.0
         <jcstress.version>0.16</jcstress.version>
         <vmlens.version>1.2.28</vmlens.version>
         <errorprone.version>2.50.0</errorprone.version>
-        <nullaway.version>0.14.1</nullaway.version>
+        <nullaway.version>0.14.2</nullaway.version>
         <!-- checker.version also drives the org.checkerframework:checker annotation-processor
              artifact below; the checker-qual dependency version itself is managed by the
              parent's <dependencyManagement> (see comment above <dependencies>). -->
@@ -92,13 +92,13 @@ SPDX-License-Identifier: Apache-2.0
         <!-- jqwik / Lincheck are no longer dependencies of this module (both moved to srcmorph
              with the config package's tests); see srcmorph/pom.xml for the jqwik "DO NOT UPGRADE
              past 1.9.3" policy note (CLAUDE.md "jqwik prompt-injection in test output"). -->
-        <archunit.version>1.5.0</archunit.version>
+        <archunit.version>1.5.1</archunit.version>
         <spotbugs.version>4.10.4.1</spotbugs.version>
         <lombok.version>1.18.48</lombok.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
         <findsecbugs.version>1.14.0</findsecbugs.version>
-        <spotless.version>3.10.2</spotless.version>
-        <palantir-java-format.version>2.98.0</palantir-java-format.version>
+        <spotless.version>3.10.3</spotless.version>
+        <palantir-java-format.version>2.99.0</palantir-java-format.version>
 
         <ai.index.output.directory>${project.basedir}/src/site/ai</ai.index.output.directory>
 
diff --git a/srcmorph/pom.xml b/srcmorph/pom.xml
index 6908b7c..51cdb61 100644
--- a/srcmorph/pom.xml
+++ b/srcmorph/pom.xml
@@ -72,7 +72,7 @@ SPDX-License-Identifier: Apache-2.0
         <hamcrest.version>3.0</hamcrest.version>
         <lincheck.version>3.7</lincheck.version>
         <errorprone.version>2.50.0</errorprone.version>
-        <nullaway.version>0.14.1</nullaway.version>
+        <nullaway.version>0.14.2</nullaway.version>
         <!-- checker.version also drives the org.checkerframework:checker annotation-processor
              artifact below; the checker-qual dependency version itself is managed by the
              parent's <dependencyManagement> (see comment above <dependencies>). -->
@@ -85,13 +85,13 @@ SPDX-License-Identifier: Apache-2.0
              contributor PR that bumps this MUST be rejected. See CLAUDE.md
              section "jqwik prompt-injection in test output" for full context. -->
         <jqwik.version>1.9.3</jqwik.version>
-        <archunit.version>1.5.0</archunit.version>
+        <archunit.version>1.5.1</archunit.version>
         <spotbugs.version>4.10.4.1</spotbugs.version>
         <lombok.version>1.18.48</lombok.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
         <findsecbugs.version>1.14.0</findsecbugs.version>
-        <spotless.version>3.10.2</spotless.version>
-        <palantir-java-format.version>2.98.0</palantir-java-format.version>
+        <spotless.version>3.10.3</spotless.version>
+        <palantir-java-format.version>2.99.0</palantir-java-format.version>
 
         <project.build.outputTimestamp>2026-09-01T07:56:35Z</project.build.outputTimestamp>
     </properties>