diff --git a/.github/actions/setup-and-build-fineract/action.yml b/.github/actions/setup-and-build-fineract/action.yml
index 43a840bdddc..8b7833c7715 100644
--- a/.github/actions/setup-and-build-fineract/action.yml
+++ b/.github/actions/setup-and-build-fineract/action.yml
@@ -29,7 +29,7 @@ runs:
         distribution: 'zulu'
 
     - name: Setup Gradle and Validate Wrapper
-      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+      uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
       with:
         validate-wrappers: true
         cache-read-only: ${{ inputs.cache-read-only }}
diff --git a/.github/workflows/build-core.yml b/.github/workflows/build-core.yml
index 43c5f50e7dd..9b05f7a531c 100644
--- a/.github/workflows/build-core.yml
+++ b/.github/workflows/build-core.yml
@@ -42,7 +42,7 @@ jobs:
           tar --use-compress-program='gzip -9' -cf "${RUNNER_TEMP}/fineract-workspace.tar" -C "${GITHUB_WORKSPACE}" .
 
       - name: Upload workspace
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fineract-workspace-${{ github.run_id }}
           path: ${{ runner.temp }}/fineract-workspace.tar
@@ -51,7 +51,7 @@ jobs:
 
       - name: Archive test results
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-results-build-core
           path: '**/build/reports/'
diff --git a/.github/workflows/build-cucumber.yml b/.github/workflows/build-cucumber.yml
index f58a9f93665..85d7713b1f9 100644
--- a/.github/workflows/build-cucumber.yml
+++ b/.github/workflows/build-cucumber.yml
@@ -33,7 +33,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -73,7 +73,7 @@ jobs:
 
       - name: Archive test results
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-results-cucumber
           path: '**/build/reports/'
diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index 95547f35b02..fbce6937eaf 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -43,7 +43,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -119,7 +119,7 @@ jobs:
 
       - name: Upload Docker logs
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: docker-logs-${{ matrix.db_type }}-attempt-${{ github.run_attempt }}
           path: ci-logs/
diff --git a/.github/workflows/build-documentation.yml b/.github/workflows/build-documentation.yml
index e37bc28a450..6847db19997 100644
--- a/.github/workflows/build-documentation.yml
+++ b/.github/workflows/build-documentation.yml
@@ -20,7 +20,7 @@ jobs:
           distribution: 'zulu'
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -52,7 +52,7 @@ jobs:
           max-heap: '4g'
           workers-max: '2'
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
       - name: Configure vega-cli
diff --git a/.github/workflows/build-e2e-tests.yml b/.github/workflows/build-e2e-tests.yml
index 0f1efe5a283..c0365e99d8b 100644
--- a/.github/workflows/build-e2e-tests.yml
+++ b/.github/workflows/build-e2e-tests.yml
@@ -53,7 +53,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -207,7 +207,7 @@ jobs:
 
       - name: Upload test results
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: allure-results-shard-${{ matrix.shard_index }}-attempt-${{ github.run_attempt }}
           path: |
@@ -222,7 +222,7 @@ jobs:
 
       - name: Upload Allure Report
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: allure-report-shard-${{ matrix.shard_index }}-attempt-${{ github.run_attempt }}
           path: allure-report-shard-${{ matrix.shard_index }}
@@ -232,7 +232,7 @@ jobs:
 
       - name: Upload logs
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: logs-shard-${{ matrix.shard_index }}-attempt-${{ github.run_attempt }}
           path: |
diff --git a/.github/workflows/build-mariadb.yml b/.github/workflows/build-mariadb.yml
index 351ad28a8ca..b93a53d0aa8 100644
--- a/.github/workflows/build-mariadb.yml
+++ b/.github/workflows/build-mariadb.yml
@@ -51,7 +51,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -216,7 +216,7 @@ jobs:
 
       - name: Archive test results
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-results-mariadb-shard-${{ matrix.shard_index }}-attempt-${{ github.run_attempt }}
           path: '**/build/reports/'
@@ -242,7 +242,7 @@ jobs:
 
       - name: Archive server logs
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: server-logs-mariadb-shard-${{ matrix.shard_index }}-attempt-${{ github.run_attempt }}
           path: |
diff --git a/.github/workflows/build-mysql.yml b/.github/workflows/build-mysql.yml
index 2bf91161a04..57318716c49 100644
--- a/.github/workflows/build-mysql.yml
+++ b/.github/workflows/build-mysql.yml
@@ -51,7 +51,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -216,7 +216,7 @@ jobs:
 
       - name: Archive test results
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-results-mysql-shard-${{ matrix.shard_index }}-attempt-${{ github.run_attempt }}
           path: '**/build/reports/'
@@ -242,7 +242,7 @@ jobs:
 
       - name: Archive server logs
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: server-logs-mysql-shard-${{ matrix.shard_index }}-attempt-${{ github.run_attempt }}
           path: |
diff --git a/.github/workflows/build-postgresql.yml b/.github/workflows/build-postgresql.yml
index 557f7b060d3..01f6138878c 100644
--- a/.github/workflows/build-postgresql.yml
+++ b/.github/workflows/build-postgresql.yml
@@ -51,7 +51,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -213,7 +213,7 @@ jobs:
 
       - name: Archive test results
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-results-postgresql-shard-${{ matrix.shard_index }}-attempt-${{ github.run_attempt }}
           path: '**/build/reports/'
@@ -239,7 +239,7 @@ jobs:
 
       - name: Archive server logs
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: server-logs-postgresql-shard-${{ matrix.shard_index }}-attempt-${{ github.run_attempt }}
           path: |
diff --git a/.github/workflows/build-progressive-loan.yml b/.github/workflows/build-progressive-loan.yml
index 4c94bac8730..eb1fb6203d4 100644
--- a/.github/workflows/build-progressive-loan.yml
+++ b/.github/workflows/build-progressive-loan.yml
@@ -33,7 +33,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -89,7 +89,7 @@ jobs:
 
       - name: Archive test results
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-results-build-progressive-loan
           path: |
diff --git a/.github/workflows/build-quality-checks.yml b/.github/workflows/build-quality-checks.yml
index 4b392869c9a..66920a56da6 100644
--- a/.github/workflows/build-quality-checks.yml
+++ b/.github/workflows/build-quality-checks.yml
@@ -33,7 +33,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -73,7 +73,7 @@ jobs:
 
       - name: Archive Javadoc reports
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: javadoc-reports-quality-checks
           path: '**/build/docs/javadoc/'
@@ -98,7 +98,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -138,7 +138,7 @@ jobs:
 
       - name: Archive Checkstyle reports
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: checkstyle-reports-quality-checks
           path: '**/build/reports/checkstyle/'
@@ -163,7 +163,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -203,7 +203,7 @@ jobs:
 
       - name: Archive RAT reports
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rat-reports-quality-checks
           path: '**/build/reports/rat/'
@@ -228,7 +228,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -268,7 +268,7 @@ jobs:
 
       - name: Archive SpotBugs reports
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: spotbugs-reports-quality-checks
           path: '**/build/reports/spotbugs/'
@@ -293,7 +293,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -375,7 +375,7 @@ jobs:
 
       - name: Archive license reports
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: license-reports-quality-checks
           path: |
@@ -432,7 +432,7 @@ jobs:
 
       - name: Archive license reports
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: license-artifact-reports-quality-checks
           path: |
diff --git a/.github/workflows/build-war-smoke.yml b/.github/workflows/build-war-smoke.yml
index e38013e897a..fc7f1b13f6d 100644
--- a/.github/workflows/build-war-smoke.yml
+++ b/.github/workflows/build-war-smoke.yml
@@ -52,7 +52,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -114,7 +114,7 @@ jobs:
 
       - name: Archive test results
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-results-war-smoke-attempt-${{ github.run_attempt }}
           retention-days: 5
@@ -141,7 +141,7 @@ jobs:
 
       - name: Archive server logs
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: server-logs-war-smoke-attempt-${{ github.run_attempt }}
           retention-days: 5
diff --git a/.github/workflows/liquibase-only-postgresql.yml b/.github/workflows/liquibase-only-postgresql.yml
index 76969c45eed..58dc6ae4d39 100644
--- a/.github/workflows/liquibase-only-postgresql.yml
+++ b/.github/workflows/liquibase-only-postgresql.yml
@@ -16,7 +16,7 @@ jobs:
 
     services:
       postgresql:
-        image: postgres:18.3
+        image: postgres:18.6
         ports:
           - 5432:5432
         env:
@@ -37,7 +37,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
diff --git a/.github/workflows/publish-dockerhub.yml b/.github/workflows/publish-dockerhub.yml
index c7a22a972da..cd7412180bf 100644
--- a/.github/workflows/publish-dockerhub.yml
+++ b/.github/workflows/publish-dockerhub.yml
@@ -35,7 +35,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
diff --git a/.github/workflows/regression-safety-db-changes.yml b/.github/workflows/regression-safety-db-changes.yml
index 9155a388746..de40c77ec59 100644
--- a/.github/workflows/regression-safety-db-changes.yml
+++ b/.github/workflows/regression-safety-db-changes.yml
@@ -24,7 +24,7 @@ jobs:
     steps:
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -81,7 +81,7 @@ jobs:
 
     services:
       postgresql:
-        image: postgres:18.3
+        image: postgres:18.6
         ports:
           - 5432:5432
         env:
@@ -142,7 +142,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -491,7 +491,7 @@ jobs:
 
       - name: Upload test results
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: regression-safety-results
           path: |
diff --git a/.github/workflows/run-integration-test-sequentially-postgresql.yml b/.github/workflows/run-integration-test-sequentially-postgresql.yml
index 30c1a2b3ac8..44efe96edf4 100644
--- a/.github/workflows/run-integration-test-sequentially-postgresql.yml
+++ b/.github/workflows/run-integration-test-sequentially-postgresql.yml
@@ -50,7 +50,7 @@ jobs:
           distribution: 'zulu'
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -165,7 +165,7 @@ jobs:
 
       - name: Archive test results
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-results
           retention-days: 5
@@ -195,7 +195,7 @@ jobs:
 
       - name: Archive server logs
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: server-logs
           retention-days: 5
diff --git a/.github/workflows/smoke-messaging.yml b/.github/workflows/smoke-messaging.yml
index b26f60d0c2c..27ccc554ab8 100644
--- a/.github/workflows/smoke-messaging.yml
+++ b/.github/workflows/smoke-messaging.yml
@@ -43,7 +43,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -131,7 +131,7 @@ jobs:
 
       - name: Upload Docker logs
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: docker-logs-${{ matrix.messaging }}-attempt-${{ github.run_attempt }}
           path: ci-logs/
diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml
index c18c0dce85c..5eb7f8c14fc 100644
--- a/.github/workflows/sonarqube.yml
+++ b/.github/workflows/sonarqube.yml
@@ -45,7 +45,7 @@ jobs:
           distribution: 'zulu'
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
diff --git a/.github/workflows/verify-api-backward-compatibility.yml b/.github/workflows/verify-api-backward-compatibility.yml
index 3aeb6e64c8b..7a0a62b5ba3 100644
--- a/.github/workflows/verify-api-backward-compatibility.yml
+++ b/.github/workflows/verify-api-backward-compatibility.yml
@@ -218,7 +218,7 @@ jobs:
 
       - name: Archive breaking change report
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: api-compatibility-report
           path: current/fineract-provider/build/swagger-brake/
diff --git a/.github/workflows/verify-generated-client-api-method-compatibility.yml b/.github/workflows/verify-generated-client-api-method-compatibility.yml
index 441816ff1af..d47d4ef8f8a 100644
--- a/.github/workflows/verify-generated-client-api-method-compatibility.yml
+++ b/.github/workflows/verify-generated-client-api-method-compatibility.yml
@@ -95,7 +95,7 @@ jobs:
 
       - name: Archive generated client compatibility report
         if: ${{ failure() || inputs.upload_artifacts }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: generated-client-method-compatibility-report
           path: generated-client-method-compatibility-report.md
diff --git a/.github/workflows/verify-liquibase-backward-compatibility.yml b/.github/workflows/verify-liquibase-backward-compatibility.yml
index a2838786e6d..572d8400520 100644
--- a/.github/workflows/verify-liquibase-backward-compatibility.yml
+++ b/.github/workflows/verify-liquibase-backward-compatibility.yml
@@ -17,7 +17,7 @@ jobs:
 
     services:
       postgresql:
-        image: postgres:18.3
+        image: postgres:18.6
         ports:
           - 5432:5432
         env:
@@ -53,7 +53,7 @@ jobs:
 
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
diff --git a/.github/workflows/verify-liquibase-ddl-safety.yml b/.github/workflows/verify-liquibase-ddl-safety.yml
index 01d5032dd28..ba82a7d903b 100644
--- a/.github/workflows/verify-liquibase-ddl-safety.yml
+++ b/.github/workflows/verify-liquibase-ddl-safety.yml
@@ -24,7 +24,7 @@ jobs:
     steps:
       - name: Download workspace
         id: download-workspace
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true
         with:
           name: fineract-workspace-${{ github.run_id }}
@@ -118,7 +118,7 @@ jobs:
 
       - name: Archive report
         if: ${{ (failure() || inputs.upload_artifacts) && steps.changes.outputs.has_changes == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ddl-safety-report
           path: ${{ runner.temp }}/ddl-safety-report/
diff --git a/build.gradle b/build.gradle
index ad03703afbb..9ac8c093a99 100644
--- a/build.gradle
+++ b/build.gradle
@@ -107,28 +107,28 @@ buildscript {
 }
 
 plugins {
-    id "org.barfuin.gradle.taskinfo" version "3.0.2"
+    id "org.barfuin.gradle.taskinfo" version "3.1.0"
     id 'com.adarshr.test-logger' version '4.0.0'
-    id 'com.diffplug.spotless' version '8.10.2' apply false
-    id 'org.nosphere.apache.rat' version '0.8.1' apply false
+    id 'com.diffplug.spotless' version '8.10.4' apply false
+    id 'org.nosphere.apache.rat' version '0.11.0' apply false
     id 'com.github.jk1.dependency-license-report' version '3.1.4' apply false
-    id 'org.zeroturnaround.gradle.jrebel' version '1.2.2' apply false
-    id 'org.springframework.boot' version '4.1.0' apply false
+    id 'org.zeroturnaround.gradle.jrebel' version '1.2.3' apply false
+    id 'org.springframework.boot' version '4.1.1' apply false
     id 'net.ltgt.errorprone' version '4.4.0' apply false
-    id 'io.swagger.core.v3.swagger-gradle-plugin' version '2.2.49' apply false
+    id 'io.swagger.core.v3.swagger-gradle-plugin' version '2.2.55' apply false
     id 'com.gorylenko.gradle-git-properties' version '2.5.7' apply false
     id 'org.asciidoctor.jvm.convert' version '4.0.5' apply false
     id 'org.asciidoctor.jvm.pdf' version '4.0.5' apply false
     id 'com.google.cloud.tools.jib' version '3.5.4' apply false
     id 'org.sonarqube' version '6.3.1.5724'
-    id 'com.github.andygoossens.modernizer' version '1.13.0' apply false
-    id 'com.github.spotbugs' version '6.5.4' apply false
+    id 'com.github.andygoossens.modernizer' version '1.15.0' apply false
+    id 'com.github.spotbugs' version '6.5.13' apply false
     id 'se.thinkcode.cucumber-runner' version '0.0.14' apply false
     id "com.github.davidmc24.gradle.plugin.avro-base" version "1.9.1" apply false
-    id 'org.openapi.generator' version '7.22.0' apply false
-    id 'com.gradleup.shadow' version '9.4.1' apply false
+    id 'org.openapi.generator' version '7.26.0' apply false
+    id 'com.gradleup.shadow' version '9.6.1' apply false
     id 'me.champeau.jmh' version '0.7.3' apply false
-    id 'org.cyclonedx.bom' version '3.4.1' apply false
+    id 'org.cyclonedx.bom' version '3.5.1' apply false
     id 'com.docktape.swagger-brake' version '2.7.0' apply false
     id 'io.github.usekylis.java-architecture-metrics' version '0.1.1' apply false
 }
diff --git a/buildSrc/build.gradle b/buildSrc/build.gradle
index a43394b2d54..f32d9b25277 100644
--- a/buildSrc/build.gradle
+++ b/buildSrc/build.gradle
@@ -44,7 +44,7 @@ repositories {
 configurations.all {
     resolutionStrategy {
         dependencySubstitution {
-            substitute module('org.lz4:lz4-java') using module('at.yawk.lz4:lz4-java:1.11.4')
+            substitute module('org.lz4:lz4-java') using module('at.yawk.lz4:lz4-java:1.12.0')
         }
     }
 }
diff --git a/buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle b/buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle
index 918a84e32f4..6791c77eecb 100644
--- a/buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle
+++ b/buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle
@@ -31,20 +31,20 @@ ext['httpclient5.version'] = '5.6.4'
 dependencyManagement {
     imports {
         mavenBom 'com.squareup.okhttp3:okhttp-bom:4.12.0'
-        mavenBom 'org.slf4j:slf4j-bom:2.0.17'
-        mavenBom 'io.micrometer:micrometer-bom:1.16.5'
-        mavenBom 'org.springframework.boot:spring-boot-dependencies:4.1.0'
-        mavenBom 'io.awspring.cloud:spring-cloud-aws-dependencies:4.0.2'
-        mavenBom 'io.opentelemetry:opentelemetry-bom:1.62.0'
-        mavenBom 'org.jetbrains.kotlin:kotlin-bom:2.3.21'
-        mavenBom 'org.junit:junit-bom:6.0.3'
+        mavenBom 'org.slf4j:slf4j-bom:2.0.20'
+        mavenBom 'io.micrometer:micrometer-bom:1.17.1'
+        mavenBom 'org.springframework.boot:spring-boot-dependencies:4.1.1'
+        mavenBom 'io.awspring.cloud:spring-cloud-aws-dependencies:4.2.0'
+        mavenBom 'io.opentelemetry:opentelemetry-bom:1.67.0'
+        mavenBom 'org.jetbrains.kotlin:kotlin-bom:2.4.21'
+        mavenBom 'org.junit:junit-bom:6.1.3'
         mavenBom 'com.fasterxml.jackson:jackson-bom:2.22.3'
-        mavenBom 'io.cucumber:cucumber-bom:7.34.3'
-        mavenBom 'org.mockito:mockito-bom:5.23.0'
-        mavenBom 'software.amazon.awssdk:bom:2.44.4'
+        mavenBom 'io.cucumber:cucumber-bom:7.34.9'
+        mavenBom 'org.mockito:mockito-bom:5.24.0'
+        mavenBom 'software.amazon.awssdk:bom:2.55.14'
         mavenBom 'io.github.resilience4j:resilience4j-bom:2.4.0'
         mavenBom 'org.testcontainers:testcontainers-bom:1.21.4'
-        mavenBom 'org.glassfish.jersey:jersey-bom:4.0.2'
+        mavenBom 'org.glassfish.jersey:jersey-bom:4.0.3'
     }
 
     dependencies {
@@ -52,19 +52,19 @@ dependencyManagement {
         // We do not use :+ to get the latest available version available on Maven Central, as that could suddenly break things.
         // We use the Renovate Bot to automatically propose Pull Requests (PRs) when upgrades for all of these versions are available.
 
-        dependency 'ch.qos.logback:logback-core:1.5.35'
-        dependency 'ch.qos.logback:logback-classic:1.5.35'
+        dependency 'ch.qos.logback:logback-core:1.6.5'
+        dependency 'ch.qos.logback:logback-classic:1.6.5'
         dependency 'ch.qos.logback.contrib:logback-json-classic:0.1.5'
         dependency 'ch.qos.logback.contrib:logback-jackson:0.1.5'
         dependency 'org.codehaus.janino:janino:3.1.12'
 
         dependency 'org.eclipse.persistence:org.eclipse.persistence.jpa:5.0.2'
-        dependency 'com.google.guava:guava:33.6.0-jre'
+        dependency 'com.google.guava:guava:33.7.2-jre'
         dependency 'com.google.code.gson:gson:2.14.0'
-        dependency 'com.google.googlejavaformat:google-java-format:1.35.0'
-        dependency 'org.apache.commons:commons-collections4:4.5.0'
+        dependency 'com.google.googlejavaformat:google-java-format:1.37.0'
+        dependency 'org.apache.commons:commons-collections4:4.6.0'
         dependency 'org.apache.commons:commons-compress:1.28.0'
-        dependency ('software.amazon.msk:aws-msk-iam-auth:2.3.6') {
+        dependency ('software.amazon.msk:aws-msk-iam-auth:2.3.9') {
             exclude 'commons-logging:commons-logging:'
         }
         dependency ('org.apache.commons:commons-email:1.6.0') {
@@ -72,7 +72,7 @@ dependencyManagement {
             exclude 'javax.activation:activation'
         }
         dependency 'commons-io:commons-io:2.22.0'
-        dependency 'com.github.librepdf:openpdf:3.0.4'
+        dependency 'com.github.librepdf:openpdf:3.0.5'
         dependency ('org.mnode.ical4j:ical4j:3.2.19') {
             exclude 'com.sun.mail:javax.mail'
             exclude 'org.codehaus.groovy:groovy'
@@ -82,10 +82,10 @@ dependencyManagement {
         dependency 'org.ehcache:ehcache:3.12.0'
         dependency 'com.github.spullara.mustache.java:compiler:0.9.14'
         dependency 'com.jayway.jsonpath:json-path:3.0.0'
-        dependency ('org.apache.tika:tika-core:3.3.0') {
+        dependency ('org.apache.tika:tika-core:3.3.2') {
             exclude 'commons-logging:commons-logging'
         }
-        dependency ('org.apache.tika:tika-parser-miscoffice-module:3.3.0') {
+        dependency ('org.apache.tika:tika-parser-miscoffice-module:3.3.2') {
             exclude 'org.bouncycastle:bcprov-jdk15on'
             exclude 'org.bouncycastle:bcjmail-jdk15on'
             exclude 'org.bouncycastle:bcprov-jdk18on'
@@ -102,7 +102,7 @@ dependencyManagement {
             exclude 'org.apache.commons:commons-compress'
             exclude 'xml-apis:xml-apis'
         }
-        dependency ('org.apache.tika:tika-parser-microsoft-module:3.3.0') {
+        dependency ('org.apache.tika:tika-parser-microsoft-module:3.3.2') {
             exclude 'org.bouncycastle:bcprov-jdk15on'
             exclude 'org.bouncycastle:bcjmail-jdk15on'
             exclude 'org.bouncycastle:bcprov-jdk18on'
@@ -119,7 +119,7 @@ dependencyManagement {
             exclude 'org.apache.commons:commons-compress'
             exclude 'xml-apis:xml-apis'
         }
-        dependency ('org.apache.tika:tika-parser-image-module:3.3.0') {
+        dependency ('org.apache.tika:tika-parser-image-module:3.3.2') {
             exclude 'org.bouncycastle:bcprov-jdk15on'
             exclude 'org.bouncycastle:bcjmail-jdk15on'
             exclude 'org.bouncycastle:bcprov-jdk18on'
@@ -145,12 +145,12 @@ dependencyManagement {
         dependency 'jakarta.jms:jakarta.jms-api:3.1.0'
         dependency 'jakarta.ws.rs:jakarta.ws.rs-api:3.1.0'
         dependency 'org.glassfish.jaxb:jaxb-runtime:2.3.6' // Swagger needs exactly this version
-        dependency 'joda-time:joda-time:2.14.2'
+        dependency 'joda-time:joda-time:2.15.0'
 
-        dependency 'io.github.classgraph:classgraph:4.8.184'
-        dependency 'com.github.spotbugs:spotbugs-annotations:4.9.8'
+        dependency 'io.github.classgraph:classgraph:4.8.198'
+        dependency 'com.github.spotbugs:spotbugs-annotations:4.10.5'
         dependency 'javax.cache:cache-api:1.1.1'
-        dependency 'org.mock-server:mockserver-junit-jupiter:5.14.0'
+        dependency 'org.mock-server:mockserver-junit-jupiter:5.15.0'
         dependency 'org.webjars:webjars-locator-core:0.59'
         dependency 'com.icegreen:greenmail-junit5:2.0.1'
 
@@ -170,36 +170,36 @@ dependencyManagement {
         dependency 'io.reactivex.rxjava2:rxjava:2.2.21'
         dependency "io.gsonfire:gson-fire:1.9.0"
         dependency "com.google.code.findbugs:jsr305:3.0.2"
-        dependency "commons-codec:commons-codec:1.22.0"
-        dependency "org.projectlombok:lombok:1.18.46"
+        dependency "commons-codec:commons-codec:1.23.0"
+        dependency "org.projectlombok:lombok:1.18.48"
 
-        dependency 'org.bouncycastle:bcpkix-jdk18on:1.84'
-        dependency 'org.bouncycastle:bcprov-jdk18on:1.84'
-        dependency 'org.bouncycastle:bcutil-jdk18on:1.84'
-        dependency 'org.bouncycastle:bcpg-jdk18on:1.84'
+        dependency 'org.bouncycastle:bcpkix-jdk18on:1.86'
+        dependency 'org.bouncycastle:bcprov-jdk18on:1.86'
+        dependency 'org.bouncycastle:bcutil-jdk18on:1.86'
+        dependency 'org.bouncycastle:bcpg-jdk18on:1.86'
 
-        dependency 'org.eclipse.jgit:org.eclipse.jgit:7.6.0.202603022253-r'
-        dependency 'org.eclipse.jgit:org.eclipse.jgit.gpg.bc:7.6.0.202603022253-r'
-        dependency 'org.eclipse.jgit:org.eclipse.jgit.ssh.apache:7.6.0.202603022253-r'
-        dependency 'org.apache.maven:maven-artifact:3.9.16'
+        dependency 'org.eclipse.jgit:org.eclipse.jgit:7.8.0.202609011348-r'
+        dependency 'org.eclipse.jgit:org.eclipse.jgit.gpg.bc:7.8.0.202609011348-r'
+        dependency 'org.eclipse.jgit:org.eclipse.jgit.ssh.apache:7.8.0.202609011348-r'
+        dependency 'org.apache.maven:maven-artifact:3.10.0'
 
         dependency ('com.tmatesoft.svnkit:svnkit:1.10.13')
         dependency 'com.vdurmont:semver4j:3.1.0'
         dependency 'org.beryx:text-io:3.4.1'
 
-        dependency ('org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.3') {
+        dependency ('org.springdoc:springdoc-openapi-starter-webmvc-ui:3.1.1') {
             exclude 'io.swagger.core.v3:swagger-core'
         }
 
-        dependency ('org.apache.activemq:activemq-client:6.2.5') {
+        dependency ('org.apache.activemq:activemq-client:6.3.2') {
             exclude 'javax.annotation:javax.annotation-api'
         }
 
-        dependency 'io.swagger.core.v3:swagger-annotations-jakarta:2.2.49'
-        dependency ('io.swagger.core.v3:swagger-jaxrs2-jakarta:2.2.49') {
+        dependency 'io.swagger.core.v3:swagger-annotations-jakarta:2.2.55'
+        dependency ('io.swagger.core.v3:swagger-jaxrs2-jakarta:2.2.55') {
             exclude 'jakarta.activation:jakarta.activation-api'
         }
-        dependency ('io.swagger.core.v3:swagger-core-jakarta:2.2.49') {
+        dependency ('io.swagger.core.v3:swagger-core-jakarta:2.2.55') {
             exclude 'jakarta.activation:jakarta.activation-api'
         }
 
@@ -213,7 +213,7 @@ dependencyManagement {
             exclude 'jakarta.activation:jakarta.activation-api'
         }
         dependency 'jakarta.validation:jakarta.validation-api:3.1.1'
-        dependency 'org.hibernate.validator:hibernate-validator:9.1.0.Final'
+        dependency 'org.hibernate.validator:hibernate-validator:9.1.4.Final'
 
         dependency ('org.liquibase:liquibase-core:4.33.0') {
             exclude 'javax.xml.bind:jaxb-api'
@@ -235,7 +235,7 @@ dependencyManagement {
             entry 'poi-ooxml'
         }
 
-        dependencySet(group: 'io.rest-assured', version: '6.0.1') {
+        dependencySet(group: 'io.rest-assured', version: '6.1.0') {
             entry 'rest-assured'
             entry 'json-path'
             entry 'xml-path'
@@ -244,13 +244,13 @@ dependencyManagement {
         dependency 'org.mapstruct:mapstruct:1.6.3'
         dependency 'org.mapstruct:mapstruct-processor:1.6.3'
 
-        dependency "org.apache.avro:avro:1.12.1"
+        dependency "org.apache.avro:avro:1.12.2"
 
-        dependency ('org.mariadb.jdbc:mariadb-java-client:3.5.8') {
+        dependency ('org.mariadb.jdbc:mariadb-java-client:3.5.10') {
             exclude 'org.slf4j:jcl-over-slf4j'
             exclude 'org.slf4j:slf4j-api'
         }
-        dependency 'org.postgresql:postgresql:42.7.13'
+        dependency 'org.postgresql:postgresql:42.7.14'
 
         dependency 'com.mysql:mysql-connector-j:9.7.0'
 
@@ -260,13 +260,13 @@ dependencyManagement {
         dependency 'commons-beanutils:commons-beanutils:1.11.0'
 
         dependency 'org.wiremock:wiremock-standalone:3.13.2'
-        dependency 'org.apache.sshd:sshd-common:2.17.1'
-        dependency 'org.apache.sshd:sshd-core:2.17.1'
+        dependency 'org.apache.sshd:sshd-common:2.20.0'
+        dependency 'org.apache.sshd:sshd-core:2.20.0'
 
-        dependency 'io.cucumber:cucumber-java:7.34.3'
-        dependency 'io.cucumber:cucumber-java8:7.34.3'
-        dependency 'io.cucumber:cucumber-junit-platform-engine:7.34.3'
-        dependency 'io.cucumber:cucumber-spring:7.34.3'
+        dependency 'io.cucumber:cucumber-java:7.34.9'
+        dependency 'io.cucumber:cucumber-java8:7.34.9'
+        dependency 'io.cucumber:cucumber-junit-platform-engine:7.34.9'
+        dependency 'io.cucumber:cucumber-spring:7.34.9'
 
         dependency 'org.reflections:reflections:0.10.2'
 
@@ -285,29 +285,29 @@ dependencyManagement {
 
         dependency 'com.ibm.icu:icu4j:78.3'
         dependency 'org.yakworks:spring-icu4j:0.5.2'
-        dependency 'org.apache.commons:commons-lang3:3.20.0'
-        dependency 'com.nimbusds:nimbus-jose-jwt:10.9'
+        dependency 'org.apache.commons:commons-lang3:3.21.0'
+        dependency 'com.nimbusds:nimbus-jose-jwt:10.10'
         // spring-core & spring-security-core now come from the Spring Boot 4 BOM (Spring Framework 7 / Security 7)
         // resilience4j-bom does not manage the spring-boot4 starter variant — pin it explicitly:
         dependency 'io.github.resilience4j:resilience4j-spring-boot4:2.4.0'
         // Keep Netty on the 4.1 line for MockServer compatibility.
-        dependency 'io.netty:netty-buffer:4.1.138.Final'
-        dependency 'io.netty:netty-common:4.1.138.Final'
-        dependency 'io.netty:netty-codec:4.1.138.Final'
-        dependency 'io.netty:netty-codec-base:4.1.138.Final'
-        dependency 'io.netty:netty-codec-compression:4.1.138.Final'
-        dependency 'io.netty:netty-codec-http:4.1.138.Final'
-        dependency 'io.netty:netty-codec-http2:4.1.138.Final'
-        dependency 'io.netty:netty-codec-marshalling:4.1.138.Final'
-        dependency 'io.netty:netty-codec-protobuf:4.1.138.Final'
-        dependency 'io.netty:netty-codec-socks:4.1.138.Final'
-        dependency 'io.netty:netty-handler:4.1.138.Final'
-        dependency 'io.netty:netty-handler-proxy:4.1.138.Final'
-        dependency 'io.netty:netty-resolver:4.1.138.Final'
-        dependency 'io.netty:netty-transport:4.1.138.Final'
-        dependency 'io.netty:netty-transport-classes-epoll:4.1.138.Final'
-        dependency 'io.netty:netty-transport-native-unix-common:4.1.138.Final'
-        dependency 'at.yawk.lz4:lz4-java:1.11.4'
+        dependency 'io.netty:netty-buffer:4.2.19.Final'
+        dependency 'io.netty:netty-common:4.2.19.Final'
+        dependency 'io.netty:netty-codec:4.2.19.Final'
+        dependency 'io.netty:netty-codec-base:4.2.19.Final'
+        dependency 'io.netty:netty-codec-compression:4.2.19.Final'
+        dependency 'io.netty:netty-codec-http:4.2.19.Final'
+        dependency 'io.netty:netty-codec-http2:4.2.19.Final'
+        dependency 'io.netty:netty-codec-marshalling:4.2.19.Final'
+        dependency 'io.netty:netty-codec-protobuf:4.2.19.Final'
+        dependency 'io.netty:netty-codec-socks:4.2.19.Final'
+        dependency 'io.netty:netty-handler:4.2.19.Final'
+        dependency 'io.netty:netty-handler-proxy:4.2.19.Final'
+        dependency 'io.netty:netty-resolver:4.2.19.Final'
+        dependency 'io.netty:netty-transport:4.2.19.Final'
+        dependency 'io.netty:netty-transport-classes-epoll:4.2.19.Final'
+        dependency 'io.netty:netty-transport-native-unix-common:4.2.19.Final'
+        dependency 'at.yawk.lz4:lz4-java:1.12.0'
         dependency 'org.springframework.retry:spring-retry:2.0.13'
         dependency 'org.jsoup:jsoup:1.23.2'
         // thymeleaf + thymeleaf-spring7 and Tomcat 11 embed now come from the Spring Boot 4 BOM
diff --git a/docker-compose-mariadb-test.yml b/docker-compose-mariadb-test.yml
index e4e15081c98..eafc1600d13 100644
--- a/docker-compose-mariadb-test.yml
+++ b/docker-compose-mariadb-test.yml
@@ -23,7 +23,7 @@ services:
       service: mariadb
 
   localstack:
-    image: localstack/localstack:2.1
+    image: localstack/localstack:2.3
     ports:
       - "4566:4566"
       - "4510-4559:4510-4559"
diff --git a/docker-compose-mariadb.yml b/docker-compose-mariadb.yml
index 38fcda9181d..85506788f4b 100644
--- a/docker-compose-mariadb.yml
+++ b/docker-compose-mariadb.yml
@@ -20,7 +20,7 @@
 services:
   mariadb:
     container_name: mariadb
-    image: mariadb:12.2
+    image: mariadb:12.3
     volumes:
       - ./config/docker/mysql/conf.d/server_collation.cnf:/etc/mysql/conf.d/server_collation.cnf:ro
       - ./config/docker/mariadb/conf.d/mariadb_compat.cnf:/etc/mysql/conf.d/mariadb_compat.cnf:ro
diff --git a/docker-compose-mysql-test.yml b/docker-compose-mysql-test.yml
index 06364ac3d3c..4c273ed87be 100644
--- a/docker-compose-mysql-test.yml
+++ b/docker-compose-mysql-test.yml
@@ -23,7 +23,7 @@ services:
       service: mysql
 
   localstack:
-    image: localstack/localstack:2.1
+    image: localstack/localstack:2.3
     ports:
       - "4566:4566"
       - "4510-4559:4510-4559"
diff --git a/docker-compose-postgresql-kafka.yml b/docker-compose-postgresql-kafka.yml
index 81b833e1c44..ed430d9c8fb 100644
--- a/docker-compose-postgresql-kafka.yml
+++ b/docker-compose-postgresql-kafka.yml
@@ -20,7 +20,7 @@
 version: "3.7"
 services:
   kafka:
-    image: "apache/kafka:4.2.0-rc2"
+    image: "apache/kafka:4.4.0-rc2"
     ports:
       - "9092:9092"
     env_file:
diff --git a/docker-compose-postgresql-test.yml b/docker-compose-postgresql-test.yml
index 4d0593ffab7..2ef0b273fc8 100644
--- a/docker-compose-postgresql-test.yml
+++ b/docker-compose-postgresql-test.yml
@@ -23,7 +23,7 @@ services:
       service: postgresql
 
   localstack:
-    image: localstack/localstack:2.1
+    image: localstack/localstack:2.3
     ports:
       - "4566:4566"
       - "4510-4559:4510-4559"
diff --git a/docker-compose-war-test.yml b/docker-compose-war-test.yml
index 54c4547c3c2..d7916bf8c2b 100644
--- a/docker-compose-war-test.yml
+++ b/docker-compose-war-test.yml
@@ -37,7 +37,7 @@ services:
     # Same Tomcat major as the servlet API the WAR is built against, on the JDK the project targets.
     # Pinned to an exact patch version, like every other image the repo pulls, so a Tomcat release
     # cannot silently change what this job tests.
-    image: tomcat:10.1.59-jdk25-temurin
+    image: tomcat:10.1.60-jdk25-temurin
     extra_hosts:
       - "host.docker.internal:host-gateway"
     volumes:
diff --git a/fineract-e2e-tests-runner/build.gradle b/fineract-e2e-tests-runner/build.gradle
index e3077e70e42..ba1dda182d9 100644
--- a/fineract-e2e-tests-runner/build.gradle
+++ b/fineract-e2e-tests-runner/build.gradle
@@ -19,7 +19,7 @@
 
 plugins {
     id 'se.thinkcode.cucumber-runner' version '0.0.14'
-    id 'io.qameta.allure' version '4.1.0'
+    id 'io.qameta.allure' version '4.3.0'
 }
 
 apply plugin: 'java'
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 60f3b911e01..4d61434f488 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.7.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.1-bin.zip
 networkTimeout=10000
 retries=3
 retryBackOffMs=500