diff --git a/src/Rotula.App/Rotula.App.csproj b/src/Rotula.App/Rotula.App.csproj
index 5449ed4..3001581 100644
--- a/src/Rotula.App/Rotula.App.csproj
+++ b/src/Rotula.App/Rotula.App.csproj
@@ -10,7 +10,7 @@
 
   <ItemGroup>
     <!-- CommunityToolkit.Mvvm: MIT. -->
-    <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.0" />
+    <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.2" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Rotula.Cli/Rotula.Cli.csproj b/src/Rotula.Cli/Rotula.Cli.csproj
index 54b26bd..ddd4e65 100644
--- a/src/Rotula.Cli/Rotula.Cli.csproj
+++ b/src/Rotula.Cli/Rotula.Cli.csproj
@@ -33,9 +33,9 @@
 
   <ItemGroup>
     <!-- OpenAPI document of the REST server (MIT). -->
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.13" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.15" />
     <!-- Runs "rotula serve" as a Windows service (MIT); does nothing when started from a console. -->
-    <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="10.0.13" />
+    <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="10.0.14" />
   </ItemGroup>
 
 </Project>
diff --git a/src/Rotula.Data.Pack.DuckDb/Rotula.Data.Pack.DuckDb.csproj b/src/Rotula.Data.Pack.DuckDb/Rotula.Data.Pack.DuckDb.csproj
index fb274d5..2cfd199 100644
--- a/src/Rotula.Data.Pack.DuckDb/Rotula.Data.Pack.DuckDb.csproj
+++ b/src/Rotula.Data.Pack.DuckDb/Rotula.Data.Pack.DuckDb.csproj
@@ -13,7 +13,7 @@
 
   <ItemGroup>
     <!-- MIT. The "Full" variant bundles the native DuckDB library; a win-x64 publish keeps only that platform's copy. -->
-    <PackageReference Include="DuckDB.NET.Data.Full" Version="1.5.6" />
+    <PackageReference Include="DuckDB.NET.Data.Full" Version="1.5.6.1" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Rotula.Data.Pack.Oracle/Rotula.Data.Pack.Oracle.csproj b/src/Rotula.Data.Pack.Oracle/Rotula.Data.Pack.Oracle.csproj
index 8ddeea0..4f35e85 100644
--- a/src/Rotula.Data.Pack.Oracle/Rotula.Data.Pack.Oracle.csproj
+++ b/src/Rotula.Data.Pack.Oracle/Rotula.Data.Pack.Oracle.csproj
@@ -17,14 +17,14 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Oracle.ManagedDataAccess.Core" Version="23.26.301" />
+    <PackageReference Include="Oracle.ManagedDataAccess.Core" Version="23.26.400" />
     <!-- Oracle pulls System.Security.Cryptography.ProtectedData 8.0.0 (through its configuration dependency) while Rotula.Data is built against 10.x;
          naming the newer MIT package here settles the version conflict (MSB3277) instead of hiding the warning. -->
-    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.12" />
+    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.14" />
     <!-- Oracle also pulls System.Security.Cryptography.Pkcs 8.0.1, which has published advisories (GHSA-846f-f764-76mx high,
          GHSA-2fmv-rv2c-59x7 moderate) that NuGet audit turns into build errors. The patched MIT package is named here; the Oracle
          library itself stays unmodified. -->
-    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.14" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Rotula.Data/Rotula.Data.csproj b/src/Rotula.Data/Rotula.Data.csproj
index a8b5dcd..9d22bd9 100644
--- a/src/Rotula.Data/Rotula.Data.csproj
+++ b/src/Rotula.Data/Rotula.Data.csproj
@@ -28,15 +28,16 @@
          "Distributable Code" licence terms, not a permissive licence. The owner accepted those terms on
          2026-10-10 (see docs/decisions.md); the notice is listed in THIRD-PARTY-NOTICES.md. -->
 
-    <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.12" />
+    <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.14" />
     <PackageReference Include="MySqlConnector" Version="2.6.2" />
     <PackageReference Include="Npgsql" Version="10.0.3" />
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.14" />
     <PackageReference Include="System.Data.Odbc" Version="10.0.12" />
-    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.12" />
+    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.14" />
     <!-- Not used directly. Microsoft.Data.SqlClient 7.1.1 brings System.Security.Cryptography.Pkcs 9.0.18, which has published
          advisories (GHSA-846f-f764-76mx high, GHSA-2fmv-rv2c-59x7 moderate). NuGet audit turns them into build errors here, so
          the patched version is pinned until SqlClient depends on it. -->
-    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.14" />
   </ItemGroup>
 
 </Project>
diff --git a/src/Rotula.Mcp/Rotula.Mcp.csproj b/src/Rotula.Mcp/Rotula.Mcp.csproj
index 8e7ed38..2054f35 100644
--- a/src/Rotula.Mcp/Rotula.Mcp.csproj
+++ b/src/Rotula.Mcp/Rotula.Mcp.csproj
@@ -41,9 +41,9 @@
 
   <ItemGroup>
     <!-- Official C# MCP SDK: MIT. -->
-    <PackageReference Include="ModelContextProtocol" Version="2.2.0" />
+    <PackageReference Include="ModelContextProtocol" Version="2.4.0" />
     <!-- Generic host (MIT): runs the MCP stdio transport and gives dependency injection. -->
-    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.14" />
   </ItemGroup>
 
 </Project>
diff --git a/src/Rotula.Rendering/Rotula.Rendering.csproj b/src/Rotula.Rendering/Rotula.Rendering.csproj
index 1e224a8..0eb0cd6 100644
--- a/src/Rotula.Rendering/Rotula.Rendering.csproj
+++ b/src/Rotula.Rendering/Rotula.Rendering.csproj
@@ -19,7 +19,7 @@
 
   <ItemGroup>
     <!-- SkiaSharp: MIT. Pulls the Windows native assets transitively. -->
-    <PackageReference Include="SkiaSharp" Version="4.153.1" />
+    <PackageReference Include="SkiaSharp" Version="4.155.0" />
     <!-- ZXing.Net: Apache-2.0. Used only as a barcode ENCODER (bit matrices); drawing is done by us. -->
     <PackageReference Include="ZXing.Net" Version="0.16.11" />
   </ItemGroup>
diff --git a/tests/Rotula.Data.Integration/Rotula.Data.Integration.csproj b/tests/Rotula.Data.Integration/Rotula.Data.Integration.csproj
index fa04426..2fa1945 100644
--- a/tests/Rotula.Data.Integration/Rotula.Data.Integration.csproj
+++ b/tests/Rotula.Data.Integration/Rotula.Data.Integration.csproj
@@ -13,7 +13,7 @@
          coverage gate, and a second project that loads Rotula.Core with almost no coverage must not be picked. -->
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/Rotula.Data.Packs.Tests/Rotula.Data.Packs.Tests.csproj b/tests/Rotula.Data.Packs.Tests/Rotula.Data.Packs.Tests.csproj
index 34ad70b..ca09580 100644
--- a/tests/Rotula.Data.Packs.Tests/Rotula.Data.Packs.Tests.csproj
+++ b/tests/Rotula.Data.Packs.Tests/Rotula.Data.Packs.Tests.csproj
@@ -21,7 +21,7 @@
          failed depending on which report's folder name sorted first. -->
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/Rotula.Data.SamplePack/Rotula.Data.SamplePack.csproj b/tests/Rotula.Data.SamplePack/Rotula.Data.SamplePack.csproj
index 067b251..03f2ca1 100644
--- a/tests/Rotula.Data.SamplePack/Rotula.Data.SamplePack.csproj
+++ b/tests/Rotula.Data.SamplePack/Rotula.Data.SamplePack.csproj
@@ -21,7 +21,7 @@
     <ProjectReference Include="..\..\src\Rotula.Data\Rotula.Data.csproj" Private="false" ExcludeAssets="runtime" />
     <ProjectReference Include="..\Rotula.Data.SamplePack.Dep\Rotula.Data.SamplePack.Dep.csproj" />
     <!-- Apache-2.0, already a Rotula dependency; here it only supplies a native library for the loader tests. -->
-    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.14" />
     <None Include="pack.json" CopyToOutputDirectory="PreserveNewest" />
     <None Include="NOTICES.txt" CopyToOutputDirectory="PreserveNewest" />
   </ItemGroup>
diff --git a/tests/Rotula.Tests/Rotula.Tests.csproj b/tests/Rotula.Tests/Rotula.Tests.csproj
index 9c0fca5..783ec57 100644
--- a/tests/Rotula.Tests/Rotula.Tests.csproj
+++ b/tests/Rotula.Tests/Rotula.Tests.csproj
@@ -12,10 +12,10 @@
     <PackageReference Include="coverlet.collector" Version="6.0.4" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
     <PackageReference Include="ZXing.Net" Version="0.16.11" />
     <!-- In-memory server for the print engine's REST API tests (MIT). -->
-    <PackageReference Include="Microsoft.AspNetCore.TestHost" Version="10.0.13" />
+    <PackageReference Include="Microsoft.AspNetCore.TestHost" Version="10.0.14" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tools/brand/Rotula.Brand.csproj b/tools/brand/Rotula.Brand.csproj
index 7e91eba..39ebd7f 100644
--- a/tools/brand/Rotula.Brand.csproj
+++ b/tools/brand/Rotula.Brand.csproj
@@ -18,7 +18,7 @@
 
   <ItemGroup>
     <!-- SkiaSharp: MIT. Same version as Rotula.Rendering. -->
-    <PackageReference Include="SkiaSharp" Version="4.153.1" />
+    <PackageReference Include="SkiaSharp" Version="4.155.0" />
   </ItemGroup>
 
 </Project>