diff --git a/.trivyignore b/.trivyignore
index 7902316..d3ff6b8 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -2,6 +2,10 @@
 # See https://aquasecurity.github.io/trivy/v0.35/docs/vulnerability/examples/filter/ 
 # for more details
 
-# UID2-6837
-# plexus-utils directory traversal - comes from Maven installation in base image (maven:3.9.11-eclipse-temurin-21), not from our code dependencies. Not exploitable at runtime.
-CVE-2025-67030 exp:2026-10-01
\ No newline at end of file
+# CVE-2025-67030 — plexus-utils (HIGH). Not vulnerable.
+# See: UID2-8296
+CVE-2025-67030 exp:2027-05-10
+
+# CVE-2026-102554 — guava (HIGH). Not vulnerable.
+# See: UID2-8295
+CVE-2026-102554
diff --git a/pom.xml b/pom.xml
index 47dc00b..f327908 100644
--- a/pom.xml
+++ b/pom.xml
@@ -13,7 +13,9 @@
         <maven.compiler.target>21</maven.compiler.target>
         <vertx.version>4.5.21</vertx.version>
         <uid2-shared.version>11.4.16</uid2-shared.version>
-        <netty.version>4.1.132.Final</netty.version>
+        <netty.version>4.1.137.Final</netty.version>
+        <jackson.version>2.18.11</jackson.version>
+        <micrometer.version>1.15.12</micrometer.version>
     </properties>
 
     <repositories>
@@ -44,6 +46,17 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <!-- Transitive dependencies of vertx-core and vertx-micrometer-metrics, pinned to patched versions -->
+            <dependency>
+                <groupId>com.fasterxml.jackson.core</groupId>
+                <artifactId>jackson-core</artifactId>
+                <version>${jackson.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>io.micrometer</groupId>
+                <artifactId>micrometer-core</artifactId>
+                <version>${micrometer.version}</version>
+            </dependency>
             <dependency>
                 <groupId>org.junit</groupId>
                 <artifactId>junit-bom</artifactId>
@@ -94,12 +107,12 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.14.2</version>
+            <version>${jackson.version}</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.datatype</groupId>
             <artifactId>jackson-datatype-jsr310</artifactId>
-            <version>2.14.2</version>
+            <version>${jackson.version}</version>
         </dependency>
         <dependency>
             <groupId>com.uid2</groupId>
@@ -109,7 +122,7 @@
         <dependency>
             <groupId>org.assertj</groupId>
             <artifactId>assertj-core</artifactId>
-            <version>3.26.3</version>
+            <version>3.27.7</version>
             <scope>test</scope>
         </dependency>
         <dependency>
@@ -147,7 +160,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.0.0-M6</version>
+                <version>3.5.6</version>
                 <configuration>
                     <includes>
                         <include>**/suite.E2EPublicOperatorTestSuite.java</include>
@@ -155,10 +168,15 @@
                     </includes>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-resources-plugin</artifactId>
+                <version>3.5.0</version>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>3.8.0</version>
+                <version>3.16.0</version>
                 <configuration>
                     <source>21</source>
                     <target>21</target>