diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index bce2dc92..edf452cf 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,10 +1,17 @@
 version: 2
 updates:
-  # Gradle dependencies. org.json is declared separately in sdk-java, app-java
-  # and app-javafx; Dependabot opens one PR per module, so check that a bump
-  # lands everywhere before closing the others.
+  # Gradle dependencies. org.json is declared separately in sdk-java, sdk-java-ui,
+  # app-java and app-javafx; Dependabot opens one PR per module, so check that a
+  # bump lands everywhere before closing the others. A bump of a published
+  # dependency also has to update .github/release-contract/, or the release
+  # checks fail.
+  #
+  # Releases are tagged on staging, so version updates target staging; master
+  # receives them with the next release. Security updates still open against
+  # master, so merge master into staging after taking one.
   - package-ecosystem: gradle
     directory: "/"
+    target-branch: staging
     schedule:
       interval: weekly
       day: monday
@@ -16,6 +23,7 @@ updates:
 
   - package-ecosystem: github-actions
     directory: "/"
+    target-branch: staging
     schedule:
       interval: monthly
     labels:
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 3e166662..56b73566 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -44,13 +44,13 @@ jobs:
           fetch-depth: 0
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           java-version: '17'
           distribution: 'corretto'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       # The task deliberately lets tests fail so a flake cannot block the report. The report
       # itself carries the failure count, and gradle.yml is what actually gates on tests.
@@ -146,7 +146,7 @@ jobs:
 
       - name: Upload the coverage reports
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: coverage-reports
           path: |
diff --git a/.github/workflows/cross-platform-tests.yml b/.github/workflows/cross-platform-tests.yml
index b3bed7bc..034b03b9 100644
--- a/.github/workflows/cross-platform-tests.yml
+++ b/.github/workflows/cross-platform-tests.yml
@@ -37,13 +37,13 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           java-version: '17'
           distribution: 'corretto'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       # bash on both platforms so one command works everywhere; Git Bash ships on the Windows runner.
       - name: Run the core SDK tests
@@ -69,7 +69,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-results-${{ matrix.os }}
           path: |
diff --git a/.github/workflows/dependency-security.yml b/.github/workflows/dependency-security.yml
index 6f2393f6..e171c855 100644
--- a/.github/workflows/dependency-security.yml
+++ b/.github/workflows/dependency-security.yml
@@ -43,13 +43,13 @@ jobs:
       # dependencies -- exactly the blind spot that let a known org.json CVE sit in the demo
       # modules after sdk-java had been fixed.
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           java-version: '17'
           distribution: 'corretto'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Resolve dependencies for every module
         run: |
@@ -128,7 +128,7 @@ jobs:
 
       - name: Upload dependency list
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: resolved-dependencies
           path: |
@@ -150,12 +150,12 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v6
         with:
           java-version: '17'
           distribution: 'corretto'
       - name: Submit resolved dependency graph to GitHub
-        uses: gradle/actions/dependency-submission@v4
+        uses: gradle/actions/dependency-submission@v6
 
   dependency-review:
     name: Review dependency changes
diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index 3a9cad6d..0b34e564 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -24,7 +24,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up JDK 8
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v6
         with:
           java-version: '8'
           distribution: 'corretto'
diff --git a/.github/workflows/publishing.yml b/.github/workflows/publishing.yml
deleted file mode 100644
index 5daee1da..00000000
--- a/.github/workflows/publishing.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-name: Publish the Java SDK
-on:
-  workflow_dispatch:
-    inputs:
-      deploy:
-        description: 'Deploy?'
-        required: true
-        type: boolean
-jobs:
-  build:
-    name: Build and Test
-    if:  ${{ inputs.deploy }} 
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up JDK 8
-        uses: actions/setup-java@v3
-        with:
-          java-version: '8'
-          distribution: 'corretto'
-
-      - name: Build and Test with Gradle
-        run: ./gradlew build
-
-      - name: Publish SDK Library to Maven Central
-        run: ./gradlew publishAllPublicationsToMavenCentralRepository --no-configuration-cache
-        env:
-          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_USERNAME }}
-          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_PASSWORD }}
-          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.GPG_KEY }}
-          ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.GPG_KEY_ID }}
-          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.GPG_KEY_PASSWORD }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d95216c3..49951bad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -101,7 +101,7 @@ jobs:
         run: |
           echo '### JDK, Java 8 runtime and Maven' >> "$GITHUB_STEP_SUMMARY"
           { java -version; "$JAVA_HOME_8_X64/bin/java" -version; mvn -v; } 2>&1 | sed 's/^/    /' >> "$GITHUB_STEP_SUMMARY"
-      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
         with:
           cache-disabled: true
       - name: Make sure a virtual display for the JavaFX tests exists
@@ -233,7 +233,7 @@ jobs:
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_RELEASE }}
       - name: Discord
-        uses: sarisia/actions-status-discord@9904e3130b8905d5b973df25623f17672dcb3466 # v1.13.0
+        uses: sarisia/actions-status-discord@eb045afee445dc055c18d3d90bd0f244fd062708 # v1.16.0
         with:
           webhook: ${{ secrets.DISCORD_WEBHOOK_URL }}
           nodetail: true