diff --git a/pom.xml b/pom.xml
index 74d55273a..9d76c541d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -37,42 +37,41 @@
   </modules>
 
   <properties>
-    <aws.sdk2.version>2.29.7</aws.sdk2.version>
+    <aws.sdk2.version>2.29.48</aws.sdk2.version>
     <braintree.version>3.37.0</braintree.version>
     <commons-csv.version>1.12.0</commons-csv.version>
-    <commons-io.version>2.17.0</commons-io.version>
-    <dropwizard.version>4.0.10</dropwizard.version>
+    <commons-io.version>2.18.0</commons-io.version>
+    <dropwizard.version>4.0.11</dropwizard.version>
     <dropwizard-metrics-datadog.version>1.1.13</dropwizard-metrics-datadog.version>
     <!-- can be updated to latest version with Dropwizard 5 (Jetty 12); will then need to disable telemetry -->
     <dynamodblocal.version>2.2.1</dynamodblocal.version>
-    <google-cloud-libraries.version>26.50.0</google-cloud-libraries.version>
-    <grpc.version>1.61.1</grpc.version> <!-- should be kept in sync with the value from Google libraries-bom -->
+    <google-cloud-libraries.version>26.52.0</google-cloud-libraries.version>
+    <grpc.version>1.69.0</grpc.version> <!-- should be kept in sync with the value from Google libraries-bom -->
     <gson.version>2.11.0</gson.version>
     <!-- several libraries (AWS, Google Cloud) use Apache http components transitively, and we need to align them -->
     <httpcore.version>4.4.16</httpcore.version>
     <httpclient.version>4.5.14</httpclient.version>
-    <jackson.version>2.18.1</jackson.version>
+    <jackson.version>2.18.2</jackson.version>
     <jaxb.version>2.3.1</jaxb.version>
     <junit-pioneer.version>2.3.0</junit-pioneer.version>
     <jsr305.version>3.0.2</jsr305.version>
-    <kotlin.version>1.9.24</kotlin.version>
-    <kotlinx-serialization.version>1.5.1</kotlinx-serialization.version>
+    <kotlin.version>1.9.25</kotlin.version>
     <lettuce.version>6.5.1.RELEASE</lettuce.version>
-    <libphonenumber.version>8.13.50</libphonenumber.version>
+    <libphonenumber.version>8.13.52</libphonenumber.version>
     <logstash.logback.version>7.3</logstash.logback.version>
-    <log4j-bom.version>2.23.1</log4j-bom.version>
-    <luajava.version>3.4.0</luajava.version>
-    <micrometer.version>1.13.6</micrometer.version>
-    <netty.version>4.1.111.Final</netty.version>
+    <log4j-bom.version>2.24.3</log4j-bom.version>
+    <luajava.version>3.5.0</luajava.version>
+    <micrometer.version>1.14.2</micrometer.version>
+    <netty.version>4.1.116.Final</netty.version>
     <protobuf.version>3.25.5</protobuf.version> <!-- must be greater than or equal to the value from Google libraries-bom, see https://protobuf.dev/support/cross-version-runtime-guarantee/ -->
     <pushy.version>0.15.4</pushy.version>
     <reactive.grpc.version>1.2.4</reactive.grpc.version>
-    <reactor-bom.version>2023.0.11</reactor-bom.version> <!-- 3.6.x, see https://github.com/reactor/reactor#bom-versioning-scheme -->
+    <reactor-bom.version>2024.0.1</reactor-bom.version> <!-- 3.7.1, see https://github.com/reactor/reactor#bom-versioning-scheme -->
     <resilience4j.version>2.2.0</resilience4j.version>
     <semver4j.version>3.1.0</semver4j.version>
-    <slf4j.version>2.0.13</slf4j.version>
+    <slf4j.version>2.0.16</slf4j.version>
     <stripe.version>23.10.0</stripe.version>
-    <swagger.version>2.2.25</swagger.version>
+    <swagger.version>2.2.27</swagger.version>
 
     <!-- eclipse-temurin:21.0.5_11-jre-jammy (note: always use the multi-arch manifest *LIST* here) -->
     <docker.image.sha256>5f8358c9d5615c18e95728e8b8528bda7ff40a7a5da2ac9a35b7a01f5d9b231a</docker.image.sha256>
diff --git a/service/pom.xml b/service/pom.xml
index 50eb2b9c9..debda1675 100644
--- a/service/pom.xml
+++ b/service/pom.xml
@@ -11,11 +11,11 @@
   <artifactId>service</artifactId>
 
   <properties>
-    <firebase-admin.version>9.4.1</firebase-admin.version>
+    <firebase-admin.version>9.4.2</firebase-admin.version>
     <java-uuid-generator.version>5.1.0</java-uuid-generator.version>
-    <google-androidpublisher.version>v3-rev20241016-2.0.0</google-androidpublisher.version>
+    <google-androidpublisher.version>v3-rev20250102-2.0.0</google-androidpublisher.version>
     <storekit.version>3.2.0</storekit.version>
-    <webauthn4j.version>0.28.0.RELEASE</webauthn4j.version>
+    <webauthn4j.version>0.28.4.RELEASE</webauthn4j.version>
   </properties>
 
   <dependencies>
@@ -229,13 +229,13 @@
     <dependency>
       <groupId>org.apache.commons</groupId>
       <artifactId>commons-compress</artifactId>
-      <version>1.26.0</version>
+      <version>1.27.1</version>
     </dependency>
 
     <dependency>
       <groupId>com.maxmind.geoip2</groupId>
       <artifactId>geoip2</artifactId>
-      <version>4.2.0</version>
+      <version>4.2.1</version>
     </dependency>
 
     <dependency>
@@ -251,13 +251,13 @@
     <dependency>
       <groupId>io.opentelemetry.semconv</groupId>
       <artifactId>opentelemetry-semconv</artifactId>
-      <version>1.25.0-alpha</version>
+      <version>1.27.0-alpha</version>
     </dependency>
     <!-- resolve opentelemetry-semconv conflict from lower in firebase-admin dependency tree -->
     <dependency>
       <groupId>com.google.cloud</groupId>
       <artifactId>google-cloud-firestore</artifactId>
-      <version>3.28.0</version>
+      <version>3.30.2</version>
       <exclusions>
         <exclusion>
           <groupId>io.opentelemetry.semconv</groupId>
@@ -368,7 +368,7 @@
     <dependency>
       <groupId>com.amazonaws</groupId>
       <artifactId>dynamodb-lock-client</artifactId>
-      <version>1.2.0</version>
+      <version>1.3.0</version>
     </dependency>
 
     <dependency>
@@ -410,7 +410,7 @@
     <dependency>
       <groupId>com.googlecode.libphonenumber</groupId>
       <artifactId>geocoder</artifactId>
-      <version>2.234</version>
+      <version>2.246</version>
     </dependency>
 
     <dependency>