diff --git a/.github/workflows/auto-merge-dependabot.yml b/.github/workflows/auto-merge-dependabot.yml
index 82876722..86539adf 100644
--- a/.github/workflows/auto-merge-dependabot.yml
+++ b/.github/workflows/auto-merge-dependabot.yml
@@ -17,7 +17,7 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2.4.0
+        uses: dependabot/fetch-metadata@v3.1.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 
diff --git a/.github/workflows/project-auto-add.yml b/.github/workflows/project-auto-add.yml
index 0ce738cb..fbd6f475 100644
--- a/.github/workflows/project-auto-add.yml
+++ b/.github/workflows/project-auto-add.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
       - name: Generate token
         id: generate_token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.GRAPHBOT_APP_ID }}
           private-key: ${{ secrets.GRAPHBOT_APP_PEM }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index abbdd556..75da478e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -29,7 +29,7 @@ jobs:
       - name: Build package
         run: python -m build
       - name: Publish package
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
         with:
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }}
diff --git a/.github/workflows/release-please-gha.yml b/.github/workflows/release-please-gha.yml
index d4cf74c3..0b19b78d 100644
--- a/.github/workflows/release-please-gha.yml
+++ b/.github/workflows/release-please-gha.yml
@@ -23,13 +23,13 @@ jobs:
 
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ vars.RELEASE_PLEASE_TOKEN_PROVIDER_APP_ID }}
           private-key: ${{ secrets.RELEASE_PLEASE_TOKEN_PROVIDER_PEM }}
 
       - name: Release Please
-        uses: googleapis/release-please-action@v4
+        uses: googleapis/release-please-action@v5
         with:
           token: ${{ steps.app-token.outputs.token }}
           config-file: release-please-config.json
diff --git a/requirements-dev.txt b/requirements-dev.txt
index d2fba17d..b150d558 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -32,11 +32,11 @@ dill==0.4.0 ; python_version < '3.11'
 
 exceptiongroup==1.3.0 ; python_version < '3.11'
 
-idna==3.10 ; python_version >= '3.5'
+idna==3.15 ; python_version >= '3.5'
 
 importlib-metadata==7.1.0 ; python_version >= '3.7'
 
-iniconfig==2.1.0 ; python_version >= '3.7'
+iniconfig==2.3.0 ; python_version >= '3.7'
 
 isort==6.0.1
 
@@ -50,7 +50,7 @@ mccabe==0.7.0 ; python_version >= '3.6'
 
 mock==5.2.0 ; python_version >= '3.6'
 
-msal==1.33.0
+msal==1.36.0
 
 msal-extensions==1.3.1
 
@@ -72,9 +72,9 @@ portalocker==2.10.1 ; python_version >= '3.5' and platform_system == 'Windows'
 
 pycparser==2.23
 
-pyjwt[crypto]==2.9.0 ; python_version >= '3.7'
+pyjwt[crypto]==2.12.0 ; python_version >= '3.7'
 
-pylint==3.3.8
+pylint==4.0.5
 
 pyproject-hooks==1.2.0 ; python_version >= '3.7'
 
@@ -92,7 +92,7 @@ pytest-asyncio==1.3.0
 
 pywin32==311 ; platform_system == 'Windows'
 
-requests==2.32.5 ; python_version >= '3.7'
+requests==2.33.0 ; python_version >= '3.7'
 
 setuptools==80.9.0
 
@@ -110,7 +110,7 @@ tomlkit==0.13.3 ; python_version >= '3.7'
 
 trio==0.31.0
 
-types-python-dateutil==2.9.0.20250822
+types-python-dateutil==2.9.0.20260518
 
 types-requests==2.32.4.20250809; python_version >= '3.7'
 urllib3==2.7.0 ; python_version >= '3.7'
@@ -121,9 +121,9 @@ wrapt==1.17.3 ; python_version < '3.11'
 
 yapf==0.43.0
 
-zipp==3.23.0 ; python_version >= '3.7'
+zipp==4.1.0 ; python_version >= '3.7'
 
-aiohttp==3.13.4 ; python_version >= '3.6'
+aiohttp==3.13.5 ; python_version >= '3.6'
 
 aiosignal==1.4.0 ; python_version >= '3.7'
 
@@ -131,7 +131,7 @@ anyio==4.10.0 ; python_version >= '3.7'
 
 async-timeout==5.0.1 ; python_version >= '3.6'
 
-frozenlist==1.7.0 ; python_version >= '3.7'
+frozenlist==1.8.0 ; python_version >= '3.7'
 
 h11==0.16.0 ; python_version >= '3.7'
 
@@ -157,8 +157,8 @@ multidict==6.6.4 ; python_version >= '3.7'
 
 uritemplate==4.2.0 ; python_version >= '3.6'
 
-yarl==1.20.1 ; python_version >= '3.7'
+yarl==1.24.2 ; python_version >= '3.7'
 
 deprecated==1.2.18
 
-types-Deprecated==1.2.15.20250304
+types-Deprecated==1.3.1.20260519