diff --git a/build.gradle b/build.gradle
index 5693fc7d94..6fd6e99d0b 100644
--- a/build.gradle
+++ b/build.gradle
@@ -12,7 +12,7 @@ plugins {
     id "io.spring.nohttp" version "0.0.11"
     id "checkstyle"
     id "jacoco"
-    id "net.ltgt.errorprone" version "4.2.0"
+    id "net.ltgt.errorprone" version "4.4.0"
     id 'maven-publish'
 }
 
@@ -258,8 +258,8 @@ configure(subprojects.findAll {it.name != 'bom'}) {
 
     dependencies {
         checkstyle files("$rootDir/config/checkstyle/lib/methodchecker-1.0.0.jar")
-        checkstyle 'com.puppycrawl.tools:checkstyle:9.0'
-        errorprone "com.google.errorprone:error_prone_core:2.43.0"
+        checkstyle 'com.puppycrawl.tools:checkstyle:9.3'
+        errorprone "com.google.errorprone:error_prone_core:2.50.0"
     }
 
     checkstyle {
diff --git a/core/build.gradle b/core/build.gradle
index 9e14ac98cd..ca819bf022 100644
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -1,8 +1,8 @@
 apply plugin: 'application'
 
 dependencies {
-    implementation group: 'org.openjdk.jmh', name: 'jmh-core', version: '1.33'
-    annotationProcessor group: 'org.openjdk.jmh', name: 'jmh-generator-annprocess', version: '1.33'
+    implementation group: 'org.openjdk.jmh', name: 'jmh-core', version: '1.37'
+    annotationProcessor group: 'org.openjdk.jmh', name: 'jmh-generator-annprocess', version: '1.37'
 }
 application {
     mainClass.set("org.bouncycastle.crypto.fpe.SP80038GMicroBenchmark")
diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
index 8bdaf60c75..eddabd2eef 100644
Binary files a/gradle/wrapper/gradle-wrapper.jar and b/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 2e1113280e..1e922f4074 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.1.0-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.7.0-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
diff --git a/gradlew b/gradlew
index ef07e0162b..249efbb032 100755
--- a/gradlew
+++ b/gradlew
@@ -20,7 +20,7 @@
 
 ##############################################################################
 #
-#   Gradle start up script for POSIX generated by Gradle.
+#   gradlew start up script for POSIX generated by Gradle.
 #
 #   Important for running:
 #
@@ -29,7 +29,7 @@
 #       bash, then to run this script, type that shell name before the whole
 #       command line, like:
 #
-#           ksh Gradle
+#           ksh gradlew
 #
 #       Busybox and similar reduced shells will NOT work, because this script
 #       requires all of these POSIX shell features:
@@ -57,7 +57,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/3d91ce3b8caaf77ad09f381f43615b715b53f72c/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.
@@ -114,7 +114,6 @@ case "$( uname )" in                #(
   NONSTOP* )        nonstop=true ;;
 esac
 
-CLASSPATH="\\\"\\\""
 
 
 # Determine the Java command to use to start the JVM.
@@ -172,7 +171,6 @@ fi
 # For Cygwin or MSYS, switch paths to Windows format before running java
 if "$cygwin" || "$msys" ; then
     APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
-    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
 
     JAVACMD=$( cygpath --unix "$JAVACMD" )
 
@@ -212,7 +210,6 @@ DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \
-        -classpath "$CLASSPATH" \
         -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
         "$@"
 
diff --git a/gradlew.bat b/gradlew.bat
index db3a6ac207..8508ef684d 100644
--- a/gradlew.bat
+++ b/gradlew.bat
@@ -1,94 +1,82 @@
-@rem
-@rem Copyright 2015 the original author or authors.
-@rem
-@rem Licensed under the Apache License, Version 2.0 (the "License");
-@rem you may not use this file except in compliance with the License.
-@rem You may obtain a copy of the License at
-@rem
-@rem      https://www.apache.org/licenses/LICENSE-2.0
-@rem
-@rem Unless required by applicable law or agreed to in writing, software
-@rem distributed under the License is distributed on an "AS IS" BASIS,
-@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-@rem See the License for the specific language governing permissions and
-@rem limitations under the License.
-@rem
-@rem SPDX-License-Identifier: Apache-2.0
-@rem
-
-@if "%DEBUG%"=="" @echo off
-@rem ##########################################################################
-@rem
-@rem  Gradle startup script for Windows
-@rem
-@rem ##########################################################################
-
-@rem Set local scope for the variables with windows NT shell
-if "%OS%"=="Windows_NT" setlocal
-
-set DIRNAME=%~dp0
-if "%DIRNAME%"=="" set DIRNAME=.
-@rem This is normally unused
-set APP_BASE_NAME=%~n0
-set APP_HOME=%DIRNAME%
-
-@rem Resolve any "." and ".." in APP_HOME to make it shorter.
-for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
-
-@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
-
-@rem Find java.exe
-if defined JAVA_HOME goto findJavaFromJavaHome
-
-set JAVA_EXE=java.exe
-%JAVA_EXE% -version >NUL 2>&1
-if %ERRORLEVEL% equ 0 goto execute
-
-echo. 1>&2
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
-echo. 1>&2
-echo Please set the JAVA_HOME variable in your environment to match the 1>&2
-echo location of your Java installation. 1>&2
-
-goto fail
-
-:findJavaFromJavaHome
-set JAVA_HOME=%JAVA_HOME:"=%
-set JAVA_EXE=%JAVA_HOME%/bin/java.exe
-
-if exist "%JAVA_EXE%" goto execute
-
-echo. 1>&2
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
-echo. 1>&2
-echo Please set the JAVA_HOME variable in your environment to match the 1>&2
-echo location of your Java installation. 1>&2
-
-goto fail
-
-:execute
-@rem Setup the command line
-
-set CLASSPATH=
-
-
-@rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
-
-:end
-@rem End local scope for the variables with windows NT shell
-if %ERRORLEVEL% equ 0 goto mainEnd
-
-:fail
-rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
-rem the _cmd.exe /c_ return code!
-set EXIT_CODE=%ERRORLEVEL%
-if %EXIT_CODE% equ 0 set EXIT_CODE=1
-if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
-exit /b %EXIT_CODE%
-
-:mainEnd
-if "%OS%"=="Windows_NT" endlocal
-
-:omega
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  gradlew startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables, and ensure extensions are enabled
+setlocal EnableExtensions
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+"%COMSPEC%" /c exit 1
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+"%COMSPEC%" /c exit 1
+
+:execute
+@rem Setup the command line
+
+
+
+@rem Execute gradlew
+@rem endlocal doesn't take effect until after the line is parsed and variables are expanded
+@rem which allows us to clear the local environment before executing the java command
+endlocal & "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %* & call :exitWithErrorLevel
+
+:exitWithErrorLevel
+@rem Use "%COMSPEC%" /c exit to allow operators to work properly in scripts
+"%COMSPEC%" /c exit %ERRORLEVEL%
diff --git a/jmail/build.gradle b/jmail/build.gradle
index 4be328057c..e046506937 100644
--- a/jmail/build.gradle
+++ b/jmail/build.gradle
@@ -1,6 +1,6 @@
 
 plugins {
-  id "biz.aQute.bnd.builder" version "7.1.0"
+  id "biz.aQute.bnd.builder" version "7.3.0"
 }
 
 jar.archiveBaseName = "bcjmail-$vmrange"
@@ -25,8 +25,8 @@ dependencies {
     implementation project(':util')
     implementation project(':pkix')
 
-    implementation group: 'jakarta.mail', name: 'jakarta.mail-api', version: '2.0.1'
-    implementation group: 'jakarta.activation', name: 'jakarta.activation-api', version: '2.0.0'
+    implementation group: 'jakarta.mail', name: 'jakarta.mail-api', version: '2.1.5'
+    implementation group: 'jakarta.activation', name: 'jakarta.activation-api', version: '2.1.4'
 
     java9Implementation files(sourceSets.main.output.classesDirs) {
         builtBy compileJava
@@ -63,7 +63,7 @@ compileJava9Java {
     def pkix_jar="${project(":pkix").jar.outputs.files.getFiles().getAt(0)}"
 
     options.compilerArgs += [
-            '--module-path', "$prov_jar${File.pathSeparator}$util_jar${File.pathSeparator}$pkix_jar${File.pathSeparator}${rootProject.projectDir}/libs/jakarta.mail-2.0.1.jar${File.pathSeparator}${rootProject.projectDir}/libs/jakarta.activation-api-2.0.0.jar"
+            '--module-path', "$prov_jar${File.pathSeparator}$util_jar${File.pathSeparator}$pkix_jar${File.pathSeparator}${rootProject.projectDir}/libs/jakarta.mail-2.1.5.jar${File.pathSeparator}${rootProject.projectDir}/libs/jakarta.activation-api-2.1.4.jar"
     ]
     options.sourcepath = files(['build/src/main/java', 'src/main/jdk1.9'])
 
diff --git a/mail/build.gradle b/mail/build.gradle
index f4d0666faa..651fa89e9d 100644
--- a/mail/build.gradle
+++ b/mail/build.gradle
@@ -1,5 +1,5 @@
 plugins {
-  id "biz.aQute.bnd.builder" version "7.1.0"
+  id "biz.aQute.bnd.builder" version "7.3.0"
 }
 
 jar.archiveBaseName = "bcmail-$vmrange"
@@ -21,11 +21,11 @@ dependencies {
     implementation project(':util')
     implementation project(':pkix')
 
-    implementation group: 'javax.mail', name: 'mail', version: '1.4'
+    implementation group: 'javax.mail', name: 'mail', version: '1.4.7'
     // javax.mail:mail:1.4 pulls in javax.activation:activation:1.1 transitively - both are
     // needed as automatic modules ("mail", "activation") on the module-info.java compile path,
     // since neither javax.mail nor javax.activation is a JDK-bundled module on Java 11+.
-    mailModulePath group: 'javax.mail', name: 'mail', version: '1.4'
+    mailModulePath group: 'javax.mail', name: 'mail', version: '1.4.7'
 
     java9Implementation files(sourceSets.main.output.classesDirs) {
         builtBy compileJava
diff --git a/misc/build.gradle b/misc/build.gradle
index d08ea090c0..ce26f5d158 100644
--- a/misc/build.gradle
+++ b/misc/build.gradle
@@ -14,7 +14,7 @@ dependencies {
     implementation project(':mail')
     implementation project(':tls')
 
-    implementation group: 'javax.mail', name: 'mail', version: '1.4'
+    implementation group: 'javax.mail', name: 'mail', version: '1.4.7'
 
     // The example smoke tests (src/test) drive the S/MIME and OpenPGP examples
     // via their main() methods; they need JUnit and the same javax.mail runtime
diff --git a/mls/build.gradle b/mls/build.gradle
index e22d75908d..c3b03ff767 100644
--- a/mls/build.gradle
+++ b/mls/build.gradle
@@ -1,10 +1,10 @@
 
 plugins {
 // OSGI
-    id "biz.aQute.bnd.builder" version "7.1.0"
+    id "biz.aQute.bnd.builder" version "7.3.0"
 //     Provide convenience executables for trying out the examples.
     id 'application'
-    id 'com.google.protobuf' version '0.9.4'
+    id 'com.google.protobuf' version '0.10.0'
 //     Generate IntelliJ IDEA's .idea & .iml project files
 //    id 'idea'
 }
@@ -68,8 +68,8 @@ evaluationDependsOn(":prov")
 evaluationDependsOn(":util")
 evaluationDependsOn(":pkix")
 
-def grpcVersion = '1.58.0' // CURRENT_GRPC_VERSION
-def protocVersion = '3.22.3'
+def grpcVersion = '1.83.1' // CURRENT_GRPC_VERSION
+def protocVersion = '3.25.9'
 
 
 checkstyleMain {
diff --git a/pg/build.gradle b/pg/build.gradle
index 07c5a57b52..c424981150 100644
--- a/pg/build.gradle
+++ b/pg/build.gradle
@@ -1,6 +1,6 @@
 
 plugins {
-  id "biz.aQute.bnd.builder" version "7.1.0"
+  id "biz.aQute.bnd.builder" version "7.3.0"
 }
 
 sourceSets {
diff --git a/pgsc/build.gradle b/pgsc/build.gradle
index ec9b199a79..736f3ee081 100644
--- a/pgsc/build.gradle
+++ b/pgsc/build.gradle
@@ -1,6 +1,6 @@
 
 plugins {
-    id "biz.aQute.bnd.builder" version "7.1.0"
+    id "biz.aQute.bnd.builder" version "7.3.0"
 }
 
 dependencies {
@@ -15,11 +15,11 @@ dependencies {
     // without YubiKit; an application that wants the YubiKey backend adds
     //   com.yubico.yubikit:openpgp   and   com.yubico.yubikit:desktop
     // to its own classpath, and gets a NoClassDefFoundError from the yubikey package if it does not.
-    compileOnly group: 'com.yubico.yubikit', name: 'openpgp', version: '3.1.0'
-    compileOnly group: 'com.yubico.yubikit', name: 'desktop', version: '3.1.0'
+    compileOnly group: 'com.yubico.yubikit', name: 'openpgp', version: '3.2.0'
+    compileOnly group: 'com.yubico.yubikit', name: 'desktop', version: '3.2.0'
 
-    testImplementation group: 'com.yubico.yubikit', name: 'openpgp', version: '3.1.0'
-    testImplementation group: 'com.yubico.yubikit', name: 'desktop', version: '3.1.0'
+    testImplementation group: 'com.yubico.yubikit', name: 'openpgp', version: '3.2.0'
+    testImplementation group: 'com.yubico.yubikit', name: 'desktop', version: '3.2.0'
     testImplementation group: 'junit', name: 'junit', version: '4.13.2'
 }
 
diff --git a/pkix/build.gradle b/pkix/build.gradle
index 032a3501de..0dc26917b1 100644
--- a/pkix/build.gradle
+++ b/pkix/build.gradle
@@ -1,6 +1,6 @@
 
 plugins {
-  id "biz.aQute.bnd.builder" version "7.1.0"
+  id "biz.aQute.bnd.builder" version "7.3.0"
 }
 
 sourceSets {
diff --git a/prov/build.gradle b/prov/build.gradle
index 8a4ee366c9..7d9cbf2bfb 100644
--- a/prov/build.gradle
+++ b/prov/build.gradle
@@ -1,5 +1,5 @@
 plugins {
-  id "biz.aQute.bnd.builder" version "7.1.0"
+  id "biz.aQute.bnd.builder" version "7.3.0"
 }
 
 dependencies {
diff --git a/test/build.gradle b/test/build.gradle
index 62e12a040f..0de1ef389b 100644
--- a/test/build.gradle
+++ b/test/build.gradle
@@ -7,6 +7,6 @@ dependencies {
   implementation project(":pkix")
   implementation project(":prov")
   implementation project(":tls")
-  testImplementation group: 'junit', name: 'junit', version: '4.11'
+  testImplementation group: 'junit', name: 'junit', version: '4.13.2'
 }
 
diff --git a/tls-klog/build.gradle b/tls-klog/build.gradle
index aa82a37a10..93442ce4bc 100644
--- a/tls-klog/build.gradle
+++ b/tls-klog/build.gradle
@@ -1,5 +1,5 @@
 plugins {
-  id "biz.aQute.bnd.builder" version "7.1.0"
+  id "biz.aQute.bnd.builder" version "7.3.0"
 }
 
 // bctls-klog is the RFC 9850 (SSLKEYLOGFILE) key-logging build of the TLS API: bctls with the
diff --git a/tls/build.gradle b/tls/build.gradle
index fdd7996a59..68e3b56d38 100644
--- a/tls/build.gradle
+++ b/tls/build.gradle
@@ -1,6 +1,6 @@
 
 plugins {
-  id "biz.aQute.bnd.builder" version "7.1.0"
+  id "biz.aQute.bnd.builder" version "7.3.0"
 }
 
 jar.archiveBaseName = "bctls-$vmrange"
diff --git a/util/build.gradle b/util/build.gradle
index 097d7a25c2..fd0f58946b 100644
--- a/util/build.gradle
+++ b/util/build.gradle
@@ -1,6 +1,6 @@
 
 plugins {
-  id "biz.aQute.bnd.builder" version "7.1.0"
+  id "biz.aQute.bnd.builder" version "7.3.0"
 }
 
 jar.archiveBaseName = "bcutil-$vmrange"
@@ -20,7 +20,7 @@ dependencies {
 
     implementation project(':prov')
 
-    testImplementation group: 'junit', name: 'junit', version: '4.11'
+    testImplementation group: 'junit', name: 'junit', version: '4.13.2'
 
     java9Implementation files([sourceSets.main.output.classesDirs]) {
         builtBy compileJava