diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7411ee4..0be3544 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -108,7 +108,7 @@ jobs:
       - name: Optional local session lookup benchmark
         if: github.event_name == 'workflow_dispatch' && inputs.benchmark
         run: mise run check:java:benchmark
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: verification-java${{ matrix.java }}-${{ matrix.database }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7c51cdd..3d45396 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -28,10 +28,10 @@ jobs:
         with:
           version: 2026.8.10
           cache: false
-      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           languages: java-kotlin
           build-mode: manual
       - name: Compile library and standalone application for analysis
         run: mise run codeql:build
-      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 44a579b..44c624b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
       - run: mise run check:repo
       - run: mise run check:java
       - run: mise run check:java:release
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: unsigned-release-rehearsal
           path: target/ogiri-unsigned-bundle.zip
diff --git a/README.md b/README.md
index 88faf9c..6891564 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ In your application's POM (with `spring-boot-starter-parent` 4.1.1):
 ```xml
 <properties>
   <jackson-bom.version>3.1.7</jackson-bom.version>
-  <tomcat.version>11.0.26</tomcat.version>
+  <tomcat.version>11.0.27</tomcat.version>
 </properties>
 <dependencyManagement>
   <dependencies>
diff --git a/examples/spring-app/pom.xml b/examples/spring-app/pom.xml
index 9ed0b35..5374c5d 100644
--- a/examples/spring-app/pom.xml
+++ b/examples/spring-app/pom.xml
@@ -2,8 +2,8 @@
   <modelVersion>4.0.0</modelVersion>
   <parent><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-parent</artifactId><version>4.1.1</version><relativePath/></parent>
   <groupId>com.quantipixels.ogiri.examples</groupId><artifactId>spring-app</artifactId><version>0.1.0</version>
-  <properties><java.version>17</java.version><tomcat.version>11.0.26</tomcat.version><jackson-bom.version>3.1.7</jackson-bom.version></properties>
-  <!-- Boot 4.1.1 ships Tomcat 11.0.24 and Jackson 3.1.5, both with known advisories; keep Ogiri's patched 11.0.26 and 3.1.7 baseline. -->
+  <properties><java.version>17</java.version><tomcat.version>11.0.27</tomcat.version><jackson-bom.version>3.1.7</jackson-bom.version></properties>
+  <!-- Boot 4.1.1 ships Tomcat 11.0.24 and Jackson 3.1.5, both with known advisories; keep Ogiri's patched 11.0.27 and 3.1.7 baseline. -->
   <dependencyManagement><dependencies>
     <dependency><groupId>com.quantipixels.ogiri</groupId><artifactId>ogiri-bom</artifactId><version>0.1.0</version><type>pom</type><scope>import</scope></dependency>
   </dependencies></dependencyManagement>
diff --git a/ogiri/.mvn/wrapper/maven-wrapper.properties b/ogiri/.mvn/wrapper/maven-wrapper.properties
index c0bcafe..bb58b3c 100644
--- a/ogiri/.mvn/wrapper/maven-wrapper.properties
+++ b/ogiri/.mvn/wrapper/maven-wrapper.properties
@@ -1,3 +1,3 @@
 wrapperVersion=3.3.4
 distributionType=only-script
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.11/apache-maven-3.9.11-bin.zip
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.10.0/apache-maven-3.10.0-bin.zip
diff --git a/ogiri/pom.xml b/ogiri/pom.xml
index d1c77cf..49d4078 100644
--- a/ogiri/pom.xml
+++ b/ogiri/pom.xml
@@ -17,7 +17,7 @@
     <dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-config</artifactId></dependency>
     <dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-web</artifactId></dependency>
     <dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId></dependency>
-    <dependency><groupId>org.jspecify</groupId><artifactId>jspecify</artifactId><version>1.0.0</version></dependency>
+    <dependency><groupId>org.jspecify</groupId><artifactId>jspecify</artifactId><version>1.0.1</version></dependency>
     <dependency><groupId>jakarta.servlet</groupId><artifactId>jakarta.servlet-api</artifactId><scope>provided</scope></dependency>
     <dependency><groupId>jakarta.mail</groupId><artifactId>jakarta.mail-api</artifactId></dependency>
     <dependency><groupId>jakarta.validation</groupId><artifactId>jakarta.validation-api</artifactId></dependency>
diff --git a/pom.xml b/pom.xml
index ed6ab72..7ec4317 100644
--- a/pom.xml
+++ b/pom.xml
@@ -18,7 +18,7 @@
     <!-- Runtime compatibility: Spring Boot 4.x, Java 17+, Jackson 3. Build tools require Java 21+. -->
     <spring-boot.version>4.1.1</spring-boot.version>
     <jackson.version>3.1.7</jackson.version><ogiri.test.jvm>${java.home}/bin/java</ogiri.test.jvm>
-    <tomcat.version>11.0.26</tomcat.version>
+    <tomcat.version>11.0.27</tomcat.version>
     <postgresql.version>42.7.13</postgresql.version>
   </properties>
   <dependencyManagement><dependencies>
@@ -40,13 +40,13 @@
       <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED</arg><arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED</arg>
       <arg>-J--add-opens=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED</arg><arg>-J--add-opens=jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED</arg></compilerArgs>
       <annotationProcessorPaths><path><groupId>com.google.errorprone</groupId><artifactId>error_prone_core</artifactId><version>2.50.0</version></path><path><groupId>com.uber.nullaway</groupId><artifactId>nullaway</artifactId><version>0.14.2</version></path></annotationProcessorPaths></configuration></plugin>
-    <plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-surefire-plugin</artifactId><version>3.5.6</version><configuration><jvm>${ogiri.test.jvm}</jvm><failIfNoTests>false</failIfNoTests><excludedGroups>${ogiri.excludedGroups}</excludedGroups></configuration></plugin>
+    <plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-surefire-plugin</artifactId><version>3.6.0</version><configuration><jvm>${ogiri.test.jvm}</jvm><failIfNoTests>false</failIfNoTests><excludedGroups>${ogiri.excludedGroups}</excludedGroups></configuration></plugin>
     <plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-jar-plugin</artifactId><version>3.5.1</version></plugin>
     <plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-source-plugin</artifactId><version>3.4.0</version><executions><execution><id>sources</id><goals><goal>jar-no-fork</goal></goals></execution></executions></plugin>
     <plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-javadoc-plugin</artifactId><version>3.12.0</version><configuration><doclint>all,-missing</doclint><failOnWarnings>true</failOnWarnings></configuration><executions><execution><id>javadoc</id><goals><goal>jar</goal></goals></execution></executions></plugin>
 
     <plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-enforcer-plugin</artifactId><version>3.6.3</version><executions><execution><goals><goal>enforce</goal></goals><configuration><rules><requireJavaVersion><version>[21,)</version></requireJavaVersion><requireMavenVersion><version>[3.9,)</version></requireMavenVersion></rules></configuration></execution></executions></plugin>
-    <plugin><groupId>com.diffplug.spotless</groupId><artifactId>spotless-maven-plugin</artifactId><version>3.10.3</version><configuration><java><includes><include>src/main/java/**/*.java</include><include>src/test/java/**/*.java</include><include>examples/spring-app/src/**/*.java</include></includes><googleJavaFormat><version>1.33.0</version><style>AOSP</style></googleJavaFormat><removeUnusedImports/></java></configuration><executions><execution><phase>validate</phase><goals><goal>check</goal></goals></execution></executions></plugin>
+    <plugin><groupId>com.diffplug.spotless</groupId><artifactId>spotless-maven-plugin</artifactId><version>3.10.4</version><configuration><java><includes><include>src/main/java/**/*.java</include><include>src/test/java/**/*.java</include><include>examples/spring-app/src/**/*.java</include></includes><googleJavaFormat><version>1.33.0</version><style>AOSP</style></googleJavaFormat><removeUnusedImports/></java></configuration><executions><execution><phase>validate</phase><goals><goal>check</goal></goals></execution></executions></plugin>
     <plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-checkstyle-plugin</artifactId><version>3.6.0</version><configuration><configLocation>${ogiri.checks.dir}/checkstyle.xml</configLocation><failOnViolation>true</failOnViolation><consoleOutput>true</consoleOutput></configuration><executions><execution><phase>validate</phase><goals><goal>check</goal></goals></execution></executions></plugin>
     <plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-pmd-plugin</artifactId><version>3.28.0</version><configuration><rulesets><ruleset>${ogiri.checks.dir}/pmd.xml</ruleset></rulesets><failOnViolation>true</failOnViolation><printFailingErrors>true</printFailingErrors></configuration><executions><execution><phase>verify</phase><goals><goal>check</goal></goals></execution></executions></plugin>
     <plugin><groupId>com.github.spotbugs</groupId><artifactId>spotbugs-maven-plugin</artifactId><version>4.9.8.5</version><configuration><effort>Max</effort><threshold>Medium</threshold><failOnError>true</failOnError><excludeFilterFile>${ogiri.checks.dir}/spotbugs.xml</excludeFilterFile><plugins><plugin><groupId>com.h3xstream.findsecbugs</groupId><artifactId>findsecbugs-plugin</artifactId><version>1.14.0</version></plugin></plugins></configuration><executions><execution><phase>verify</phase><goals><goal>check</goal></goals></execution></executions></plugin>