diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2b5b6eb037f..fcbb872bb1c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,7 +13,7 @@ on:
 jobs:
     pre-commit:
         name: Pre-commit check
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         steps:
             -   name: Checkout git repository
                 uses: actions/checkout@v7
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index df66b8d7034..4cc788bf246 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -52,7 +52,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: "Login to dockerhub"
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.7.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
diff --git a/Dockerfile_desktop b/Dockerfile_desktop
index 6d30206ba10..663cfdf4b7b 100644
--- a/Dockerfile_desktop
+++ b/Dockerfile_desktop
@@ -1,5 +1,5 @@
 # Builder stage to download OWASP ZAP once per version
-FROM alpine:3.24.2 AS zap
+FROM alpine:3.24.3 AS zap
 ARG ZAP_VERSION=2.17.0
 RUN apk add --no-cache curl tar \
   && set -eux; \
@@ -9,7 +9,7 @@ RUN apk add --no-cache curl tar \
      rm -f /tmp/zap.tgz
 
 # Builder stage to fetch a JRE suited for the target architecture
-FROM alpine:3.24.2 AS jre
+FROM alpine:3.24.3 AS jre
 ARG JAVA_MAJOR=25
 ARG JAVA_FULL=25.0.3.0
 ARG TARGETARCH
diff --git a/pom.xml b/pom.xml
index 45fc6d9ef4b..641a5a2ddc7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -86,7 +86,7 @@
     <maven-jar-plugin.version>3.5.0</maven-jar-plugin.version>
     <maven-javadoc-plugin.version>3.12.0</maven-javadoc-plugin.version>
     <maven-source-plugin.version>3.4.0</maven-source-plugin.version>
-    <maven-surefire-plugin.version>3.6.0</maven-surefire-plugin.version>
+    <maven-surefire-plugin.version>3.6.1</maven-surefire-plugin.version>
     <maven.compiler.proc>full</maven.compiler.proc>
     <maven.compiler.source>${java.version}</maven.compiler.source>
     <maven.compiler.target>${java.version}</maven.compiler.target>
@@ -96,7 +96,7 @@
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
     <!-- rest-assured is no longer managed by the Spring Boot 4 BOM; 6.x is built for the
          Groovy 5 that Spring Boot 4 ships (5.x targets Groovy 4 and fails at runtime). -->
-    <rest-assured.version>6.0.1</rest-assured.version>
+    <rest-assured.version>6.2.0</rest-assured.version>
     <spotless-maven-plugin.version>3.10.3</spotless-maven-plugin.version>
     <waittimeForServerStart>60</waittimeForServerStart>
     <webdriver.version>6.4.0</webdriver.version>
@@ -171,7 +171,7 @@
       <dependency>
         <groupId>com.auth0</groupId>
         <artifactId>java-jwt</artifactId>
-        <version>4.6.1</version>
+        <version>4.6.2</version>
       </dependency>
       <dependency>
         <groupId>com.google.guava</groupId>