diff --git a/embedded-tests/pom.xml b/embedded-tests/pom.xml
index 8548bd7668af..ea2b4567da75 100644
--- a/embedded-tests/pom.xml
+++ b/embedded-tests/pom.xml
@@ -546,7 +546,6 @@
     <dependency>
       <groupId>org.apache.httpcomponents.client5</groupId>
       <artifactId>httpclient5</artifactId>
-      <version>5.5</version>
       <scope>test</scope>
     </dependency>
 
diff --git a/indexing-service/pom.xml b/indexing-service/pom.xml
index 3b21a710fb95..a3169677c930 100644
--- a/indexing-service/pom.xml
+++ b/indexing-service/pom.xml
@@ -260,7 +260,6 @@
         <dependency>
             <groupId>com.google.api.grpc</groupId>
             <artifactId>proto-google-common-protos</artifactId>
-            <version>2.48.0</version>
             <scope>test</scope>
         </dependency>
     </dependencies>
diff --git a/pom.xml b/pom.xml
index e0e7cdb73c85..e4d3146ae156 100644
--- a/pom.xml
+++ b/pom.xml
@@ -81,7 +81,7 @@
         <apache.ranger.version>2.7.0</apache.ranger.version>
         <antlr4.version>4.5.3</antlr4.version>
         <gson.version>2.12.0</gson.version>
-        <scala.library.version>2.13.14</scala.library.version>
+        <scala.library.version>2.13.16</scala.library.version>
         <avatica.version>1.27.0</avatica.version>
         <avro.version>1.11.4</avro.version>
         <bytebuddy.version>1.18.3</bytebuddy.version>
@@ -95,7 +95,7 @@
         <datasketches.memory.version>2.2.0</datasketches.memory.version>
         <derby.version>10.14.2.0</derby.version>
         <dropwizard.metrics.version>4.2.22</dropwizard.metrics.version>
-        <errorprone.version>2.35.1</errorprone.version>
+        <errorprone.version>2.36.0</errorprone.version>
         <fabric8.version>7.5.2</fabric8.version>
         <fastutil.version>8.5.4</fastutil.version>
         <guava.version>32.1.3-jre</guava.version>
@@ -109,7 +109,7 @@
         <mysql.version>8.2.0</mysql.version>
         <mariadb.version>2.7.3</mariadb.version>
         <netty3.version>3.10.6.Final</netty3.version>
-        <netty4.version>4.2.6.Final</netty4.version>
+        <netty4.version>4.2.7.Final</netty4.version>
         <postgresql.version>42.7.2</postgresql.version>
         <protobuf.version>3.25.8</protobuf.version>
         <resilience4j.version>1.3.1</resilience4j.version>
@@ -120,16 +120,16 @@
         <graaljs.version>22.3.5</graaljs.version>
         <mockito.version>5.14.2</mockito.version>
         <aws.sdk.version>1.12.784</aws.sdk.version>
-        <caffeine.version>2.8.0</caffeine.version>
-        <jacoco.version>0.8.14</jacoco.version>
+        <caffeine.version>2.9.3</caffeine.version>
+        <jacoco.version>0.8.12</jacoco.version>
         <testcontainers.version>2.0.3</testcontainers.version>
         <hibernate-validator.version>6.2.5.Final</hibernate-validator.version>
-        <httpclient.version>4.5.13</httpclient.version>
+        <httpclient.version>4.5.14</httpclient.version>
         <!-- When upgrading ZK, edit docs and integration tests as well (integration-tests/docker-base/setup.sh) -->
         <zookeeper.version>3.8.4</zookeeper.version>
         <checkerframework.version>3.48.1</checkerframework.version>
         <com.google.apis.client.version>2.2.0</com.google.apis.client.version>
-        <com.google.http.client.apis.version>1.42.3</com.google.http.client.apis.version>
+        <com.google.http.client.apis.version>1.43.3</com.google.http.client.apis.version>
         <com.google.apis.compute.version>v1-rev20230606-2.0.0</com.google.apis.compute.version>
         <com.google.cloud.storage.version>2.29.1</com.google.cloud.storage.version>
         <jdk.strong.encapsulation.argLine>
@@ -317,12 +317,12 @@
             <dependency>
                 <groupId>commons-codec</groupId>
                 <artifactId>commons-codec</artifactId>
-                <version>1.17.1</version>
+                <version>1.19.0</version>
             </dependency>
             <dependency>
                 <groupId>commons-io</groupId>
                 <artifactId>commons-io</artifactId>
-                <version>2.17.0</version>
+                <version>2.21.0</version>
             </dependency>
             <dependency>
                 <groupId>commons-logging</groupId>
@@ -414,9 +414,9 @@
                 <version>1.9.25</version>
             </dependency>
             <dependency>
-                <groupId>org.jetbrains</groupId>
-                <artifactId>annotations</artifactId>
-                <version>26.0.2</version>
+                <groupId>org.jetbrains.kotlin</groupId>
+                <artifactId>kotlin-stdlib-jdk8</artifactId>
+                <version>1.9.25</version>
             </dependency>
             <!-- Transitive dependency of kubernetes-client-java in kubernetes-extension,
             schema-repo in avro-extensions, and com.google.caliper:caliper in druid-server
@@ -432,7 +432,24 @@
             <dependency>
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcpkix-jdk18on</artifactId>
-                <version>1.81</version>
+                <version>1.82</version>
+            </dependency>
+            <!-- Transitive dependency of docker-java and jetty -->
+            <dependency>
+                <groupId>jakarta.activation</groupId>
+                <artifactId>jakarta.activation-api</artifactId>
+                <version>1.2.2</version>
+            </dependency>
+            <!-- Transitive dependency of docker-java-transport-httpclient5 -->
+            <dependency>
+                <groupId>org.apache.httpcomponents.client5</groupId>
+                <artifactId>httpclient5</artifactId>
+                <version>5.5.1</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.httpcomponents.core5</groupId>
+                <artifactId>httpcore5</artifactId>
+                <version>5.3.6</version>
             </dependency>
             <!-- Transitive dependency of hive-common in druid-kerberos, druid-ranger-security and
             druid-iceberg-extension  -->
@@ -610,7 +627,7 @@
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-compress</artifactId>
-                <version>1.27.0</version>
+                <version>1.28.0</version>
             </dependency>
             <dependency>
                 <groupId>org.tukaani</groupId>
@@ -620,7 +637,7 @@
             <dependency>
                 <groupId>com.github.luben</groupId>
                 <artifactId>zstd-jni</artifactId>
-                <version>1.5.2-3</version>
+                <version>1.5.6-6</version>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson</groupId>
@@ -930,6 +947,11 @@
                 <artifactId>protobuf-java</artifactId>
                 <version>${protobuf.version}</version>
             </dependency>
+            <dependency>
+                <groupId>com.google.api.grpc</groupId>
+                <artifactId>proto-google-common-protos</artifactId>
+                <version>2.48.0</version>
+            </dependency>
             <dependency>
                 <groupId>io.tesla.aether</groupId>
                 <artifactId>tesla-aether</artifactId>
@@ -1060,7 +1082,7 @@
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-collections4</artifactId>
-                <version>4.2</version>
+                <version>4.4</version>
             </dependency>
             <dependency>
                 <groupId>io.dropwizard.metrics</groupId>
@@ -1775,45 +1797,35 @@
                                 </bannedDependencies>
                                 <requireUpperBoundDeps>
                                     <excludes>
-                                       <!-- upgrading these later -->
+                                       <!-- Zookeeper 3.9.x is needed by Curator 5.8.0 but requires careful testing -->
                                        <exclude>org.apache.zookeeper:zookeeper</exclude>
+                                       <!-- Guava 33.x is needed by google-cloud libraries; major version bump -->
                                        <exclude>com.google.guava:guava</exclude>
-                                       <exclude>org.apache.commons:commons-collections4</exclude>
-                                       <exclude>com.github.ben-manes.caffeine:caffeine</exclude>
+                                       <!-- Jackson 2.20.x is needed by docker-java 3.7.0 and fabric8; pending upgrade -->
                                        <exclude>com.fasterxml.jackson.core:jackson-annotations</exclude>
                                        <exclude>com.fasterxml.jackson.core:jackson-databind</exclude>
                                        <exclude>com.fasterxml.jackson.core:jackson-core</exclude>
                                        <exclude>com.fasterxml.jackson.datatype:jackson-datatype-jsr310</exclude>
                                        <exclude>com.fasterxml.jackson.dataformat:jackson-dataformat-yaml</exclude>
-                                       <exclude>jakarta.activation:jakarta.activation-api</exclude>
+                                       <!-- Guice 7.0.0 is needed by fabric8; major version bump -->
                                        <exclude>com.google.inject.extensions:guice-assistedinject</exclude>
-                                       <exclude>com.fasterxml.jackson.module:jackson-module-guice</exclude>
                                        <exclude>com.google.inject:guice</exclude>
+                                       <!-- jedis-mock 1.1.12 requires jedis 7.0.0; major version bump -->
                                        <exclude>redis.clients:jedis</exclude>
+                                       <!-- Calcite test dependency wants reflections 0.10.2; API changes -->
                                        <exclude>org.reflections:reflections</exclude>
+                                       <!-- Hadoop pulls RoaringBitmap 1.2.0; major version bump -->
                                        <exclude>org.roaringbitmap:RoaringBitmap</exclude>
+                                       <!-- Hadoop/Parquet pulls aircompressor 2.0.2; major version bump -->
                                        <exclude>io.airlift:aircompressor</exclude>
+                                       <!-- OkHttp/OkIO 3.x is needed; major version bump from 2.x -->
                                        <exclude>com.squareup.okio:okio</exclude>
-                                       <exclude>org.apache.httpcomponents.client5:httpclient5</exclude>
+                                       <!-- Jakarta Activation 2.x is Jakarta EE 9; major version bump -->
                                        <exclude>com.sun.activation:jakarta.activation</exclude>
-                                       <exclude>org.apache.commons:commons-compress</exclude>
+                                       <!-- Confluent uses its own snakeyaml/kafka-clients versions -->
                                        <exclude>org.yaml:snakeyaml</exclude>
-                                       <exclude>io.netty:netty-transport-native-kqueue</exclude>
-                                       <exclude>io.netty:netty-transport-native-epoll</exclude>
-                                       <exclude>io.netty:netty-handler-proxy</exclude>
-                                       <exclude>io.netty:netty-handler</exclude>
-                                       <exclude>com.google.http-client:google-http-client-jackson2</exclude>
-                                       <exclude>com.google.http-client:google-http-client</exclude>
-                                       <exclude>com.google.api.grpc:proto-google-common-protos</exclude>
-                                       <exclude>commons-io:commons-io</exclude>
-                                       <exclude>com.github.luben:zstd-jni</exclude>
-                                       <exclude>org.scala-lang:scala-library</exclude>
-                                       <exclude>org.bouncycastle:bcpkix-jdk18on</exclude>
-                                       <exclude>org.jetbrains.kotlin:kotlin-stdlib-jdk8</exclude>
-                                       <exclude>io.netty:netty-codec-http</exclude>
                                        <exclude>io.confluent:kafka-schema-registry-client</exclude>
                                        <exclude>org.apache.kafka:kafka-clients</exclude>
-                                       <exclude>com.google.errorprone:error_prone_annotations</exclude>
                                     </excludes>
                                     <excludedScopes>
                                        <excludedScope>provided</excludedScope>