diff --git a/.github/workflows/create_release.yml b/.github/workflows/create_release.yml
index 7ecea3659..cc1b6c0a5 100644
--- a/.github/workflows/create_release.yml
+++ b/.github/workflows/create_release.yml
@@ -14,18 +14,18 @@ jobs:
     runs-on: ubuntu-24.04  # newest available distribution, aka noble
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # Prevent use of implicit GitHub Actions read-only token GITHUB_TOKEN. We don't deploy on
           # the tag MAJOR.MINOR.PATCH event, but we still need to deploy the maven-release-plugin master commit.
           token: ${{ secrets.GH_TOKEN }}
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '11'  # earliest LTS and last that can compile the 1.6 release profile.
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 0cd1e8659..e18cbca31 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -29,19 +29,19 @@ jobs:
             deploy_script: build-bin/deploy_bom
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # Prevent use of implicit GitHub Actions read-only token GITHUB_TOKEN.
           # We push Javadocs to the gh-pages branch on commit.
           token: ${{ secrets.GH_TOKEN }}
           fetch-depth: 0  # build-bin/javadoc_to_gh_pages checks out gh-pages
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '11'  # earliest LTS and last that can compile the 1.6 release profile.
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index ce8345e77..d94ea653a 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -28,15 +28,15 @@ jobs:
     if: "!contains(github.event.head_commit.message, 'maven-release-plugin')"
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
-      - uses: actions/cache@v4
+        uses: actions/checkout@v6
+      - uses: actions/cache@v5
         name: Cache Trivy Database
         with:
           path: .trivy
           key: ${{ runner.os }}-trivy
           restore-keys: ${{ runner.os }}-trivy
       - name: Run Trivy vulnerability and secret scanner
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@v0.35.0
         id: trivy
         with:
           scan-type: 'fs'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2af2be0a8..78406cb4f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -22,14 +22,14 @@ jobs:
     if: "!contains(github.event.head_commit.message, 'maven-release-plugin')"
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '11'  # earliest LTS and last that can compile the 1.6 release profile.
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-jdk-11-maven-${{ hashFiles('**/pom.xml') }}
@@ -47,17 +47,17 @@ jobs:
         include:
           - java_version: 11  # Last that can compile brave to 1.6
             maven_args: -Prelease -Dgpg.skip -Dmaven.javadoc.skip=true
-          - java_version: 21  # Most recent LTS
+          - java_version: 25  # Most recent LTS
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: ${{ matrix.java_version }}
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-jdk-${{ matrix.java_version }}-maven-${{ hashFiles('**/pom.xml') }}
diff --git a/.mvn/wrapper/maven-wrapper.jar b/.mvn/wrapper/maven-wrapper.jar
index 7967f30dd..eebc3c18b 100644
Binary files a/.mvn/wrapper/maven-wrapper.jar and b/.mvn/wrapper/maven-wrapper.jar differ
diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties
index 9548abd8e..203e10885 100644
--- a/.mvn/wrapper/maven-wrapper.properties
+++ b/.mvn/wrapper/maven-wrapper.properties
@@ -1,20 +1,4 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-wrapperVersion=3.3.2
+wrapperVersion=3.3.4
 distributionType=bin
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip
-wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.14/apache-maven-3.9.14-bin.zip
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar
diff --git a/instrumentation/benchmarks/pom.xml b/instrumentation/benchmarks/pom.xml
index 8fda0c0d6..971a326c0 100644
--- a/instrumentation/benchmarks/pom.xml
+++ b/instrumentation/benchmarks/pom.xml
@@ -19,7 +19,7 @@
     <main.basedir>${project.basedir}/../..</main.basedir>
     <jmh.version>1.37</jmh.version>
     <!-- Note: versions above 2.2 move to jakarta package -->
-    <undertow-servlet.version>2.2.31.Final</undertow-servlet.version>
+    <undertow-servlet.version>2.2.39.Final</undertow-servlet.version>
   </properties>
 
   <!-- All dependencies are marked test, because benchmarks are a form of test.
diff --git a/instrumentation/dubbo/pom.xml b/instrumentation/dubbo/pom.xml
index 022101efd..0b73d3d63 100644
--- a/instrumentation/dubbo/pom.xml
+++ b/instrumentation/dubbo/pom.xml
@@ -21,7 +21,7 @@
 
     <main.basedir>${project.basedir}/../..</main.basedir>
 
-    <dubbo.version>3.3.0-beta.2</dubbo.version>
+    <dubbo.version>3.3.6</dubbo.version>
     <!-- add opens to avoid below in JRE 21:
          com.alibaba.com.caucho.hessian.io.JavaSerializer -->
     <maven-failsafe-plugin.argLine>
diff --git a/instrumentation/grpc/pom.xml b/instrumentation/grpc/pom.xml
index 05d56630a..a6ddfd2f6 100644
--- a/instrumentation/grpc/pom.xml
+++ b/instrumentation/grpc/pom.xml
@@ -30,7 +30,7 @@
     <!-- disable mutability warning as TagContextBinaryMarshaller intentionally returns mixed -->
     <errorprone.args>-Xep:MixedMutabilityReturnType:OFF</errorprone.args>
 
-    <build-helper-maven-plugin.version>3.5.0</build-helper-maven-plugin.version>
+    <build-helper-maven-plugin.version>3.6.1</build-helper-maven-plugin.version>
   </properties>
 
   <dependencies>
diff --git a/instrumentation/httpclient5/pom.xml b/instrumentation/httpclient5/pom.xml
index dd4b0940a..7ec6e905b 100644
--- a/instrumentation/httpclient5/pom.xml
+++ b/instrumentation/httpclient5/pom.xml
@@ -24,7 +24,8 @@
     <main.basedir>${project.basedir}/../..</main.basedir>
 
     <!-- To obey the integration tests, we need to use the version >= 5.2 -->
-    <httpclient5.version>5.4.1</httpclient5.version>
+    <!-- TODO: 5.6 changed error propagation in interceptors -->
+    <httpclient5.version>5.5.2</httpclient5.version>
   </properties>
 
   <dependencies>
diff --git a/instrumentation/jdbi3/pom.xml b/instrumentation/jdbi3/pom.xml
index 575ddcc6a..052d11ca2 100644
--- a/instrumentation/jdbi3/pom.xml
+++ b/instrumentation/jdbi3/pom.xml
@@ -22,7 +22,8 @@
 
     <main.basedir>${project.basedir}/../..</main.basedir>
 
-    <jdbi3.version>3.49.1</jdbi3.version>
+    <!-- 3.50+ is Java 17 bytecode, can't use until we floor JDK 17 -->
+    <jdbi3.version>3.49.6</jdbi3.version>
   </properties>
 
   <dependencies>
@@ -45,7 +46,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
diff --git a/instrumentation/jdbi3/src/test/java/brave/jdbi3/MySQLContainer.java b/instrumentation/jdbi3/src/test/java/brave/jdbi3/MySQLContainer.java
index 589bf0205..f15124390 100644
--- a/instrumentation/jdbi3/src/test/java/brave/jdbi3/MySQLContainer.java
+++ b/instrumentation/jdbi3/src/test/java/brave/jdbi3/MySQLContainer.java
@@ -21,7 +21,7 @@ final class MySQLContainer extends GenericContainer<MySQLContainer> {
 
   MySQLContainer() {
     // Use OpenZipkin's small test image, which is multi-arch and doesn't consume Docker Hub quota
-    super(parse("ghcr.io/openzipkin/zipkin-mysql:3.4.3"));
+    super(parse("ghcr.io/openzipkin/zipkin-mysql:3.6.0"));
     if ("true".equals(System.getProperty("docker.skip"))) {
       throw new TestAbortedException("${docker.skip} == true");
     }
diff --git a/instrumentation/kafka-clients/pom.xml b/instrumentation/kafka-clients/pom.xml
index 08032ff42..21e2b9c67 100644
--- a/instrumentation/kafka-clients/pom.xml
+++ b/instrumentation/kafka-clients/pom.xml
@@ -55,7 +55,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
diff --git a/instrumentation/kafka-clients/src/it/kafka_floor/pom.xml b/instrumentation/kafka-clients/src/it/kafka_floor/pom.xml
index 815f98424..cb6f0931e 100644
--- a/instrumentation/kafka-clients/src/it/kafka_floor/pom.xml
+++ b/instrumentation/kafka-clients/src/it/kafka_floor/pom.xml
@@ -77,7 +77,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>@testcontainers.version@</version>
     </dependency>
   </dependencies>
diff --git a/instrumentation/kafka-clients/src/test/java/brave/kafka/clients/KafkaContainer.java b/instrumentation/kafka-clients/src/test/java/brave/kafka/clients/KafkaContainer.java
index ca8e7bec9..82153df29 100644
--- a/instrumentation/kafka-clients/src/test/java/brave/kafka/clients/KafkaContainer.java
+++ b/instrumentation/kafka-clients/src/test/java/brave/kafka/clients/KafkaContainer.java
@@ -23,7 +23,7 @@ final class KafkaContainer extends GenericContainer<KafkaContainer> {
   static final int KAFKA_PORT = 19092;
 
   KafkaContainer() {
-    super(parse("ghcr.io/openzipkin/zipkin-kafka:3.4.3"));
+    super(parse("ghcr.io/openzipkin/zipkin-kafka:3.6.0"));
     waitStrategy = Wait.forHealthcheck();
     // Kafka broker listener port (19092) needs to be exposed for test cases to access it.
     addFixedExposedPort(KAFKA_PORT, KAFKA_PORT, InternetProtocol.TCP);
diff --git a/instrumentation/kafka-streams/pom.xml b/instrumentation/kafka-streams/pom.xml
index 406f32274..1ee3084f3 100644
--- a/instrumentation/kafka-streams/pom.xml
+++ b/instrumentation/kafka-streams/pom.xml
@@ -55,7 +55,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
diff --git a/instrumentation/kafka-streams/src/test/java/brave/kafka/streams/KafkaContainer.java b/instrumentation/kafka-streams/src/test/java/brave/kafka/streams/KafkaContainer.java
index 54094506d..1c38d96e9 100644
--- a/instrumentation/kafka-streams/src/test/java/brave/kafka/streams/KafkaContainer.java
+++ b/instrumentation/kafka-streams/src/test/java/brave/kafka/streams/KafkaContainer.java
@@ -23,7 +23,7 @@ final class KafkaContainer extends GenericContainer<KafkaContainer> {
   static final int KAFKA_PORT = 19092;
 
   KafkaContainer() {
-    super(parse("ghcr.io/openzipkin/zipkin-kafka:3.4.3"));
+    super(parse("ghcr.io/openzipkin/zipkin-kafka:3.6.0"));
     waitStrategy = Wait.forHealthcheck();
     // Kafka broker listener port (19092) needs to be exposed for test cases to access it.
     addFixedExposedPort(KAFKA_PORT, KAFKA_PORT, InternetProtocol.TCP);
diff --git a/instrumentation/mongodb/pom.xml b/instrumentation/mongodb/pom.xml
index ede635ce7..ae79eb994 100644
--- a/instrumentation/mongodb/pom.xml
+++ b/instrumentation/mongodb/pom.xml
@@ -22,8 +22,8 @@
 
     <main.basedir>${project.basedir}/../..</main.basedir>
 
-    <mongodb-driver.version>5.3.1</mongodb-driver.version>
-    <mongodb-driver3.version>3.11.0</mongodb-driver3.version>
+    <mongodb-driver.version>5.6.4</mongodb-driver.version>
+    <mongodb-driver3.version>3.11.3</mongodb-driver3.version>
   </properties>
 
   <dependencies>
@@ -47,7 +47,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
diff --git a/instrumentation/mongodb/src/it/mongodb_floor/pom.xml b/instrumentation/mongodb/src/it/mongodb_floor/pom.xml
index 8e276a7d4..388ec7ef9 100644
--- a/instrumentation/mongodb/src/it/mongodb_floor/pom.xml
+++ b/instrumentation/mongodb/src/it/mongodb_floor/pom.xml
@@ -66,7 +66,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>@testcontainers.version@</version>
     </dependency>
   </dependencies>
diff --git a/instrumentation/mongodb/src/test/java/brave/mongodb/MongoDBContainer.java b/instrumentation/mongodb/src/test/java/brave/mongodb/MongoDBContainer.java
index a629b306e..76b111a5f 100644
--- a/instrumentation/mongodb/src/test/java/brave/mongodb/MongoDBContainer.java
+++ b/instrumentation/mongodb/src/test/java/brave/mongodb/MongoDBContainer.java
@@ -30,13 +30,14 @@ final class MongoDBContainer extends GenericContainer<MongoDBContainer> {
   static final int MONGODB_PORT = 27017;
 
   MongoDBContainer() {
-    // Use OpenZipkin's small test image, which is multi-arch and doesn't consume Docker Hub quota
-    super(parse("ghcr.io/openzipkin/mongodb-alpine:4.0.5"));
+    // Mirrored image to avoid docker.io pulls:
+    // docker buildx imagetools create --tag ghcr.io/openzipkin/mongo:8.2.6-noble mongo:8.2.6-noble
+    super(parse("ghcr.io/openzipkin/mongo:8.2.6-noble"));
     if ("true".equals(System.getProperty("docker.skip"))) {
       throw new TestAbortedException("${docker.skip} == true");
     }
     withExposedPorts(MONGODB_PORT);
-    waitStrategy = Wait.forLogMessage(".*waiting for connections.*", 1);
+    waitStrategy = Wait.forLogMessage(".*[wW]aiting for connections.*", 1);
     withStartupTimeout(Duration.ofSeconds(60));
     withLogConsumer(new Slf4jLogConsumer(LOGGER));
   }
diff --git a/instrumentation/okhttp3/pom.xml b/instrumentation/okhttp3/pom.xml
index 6e37c1632..3f8304d5b 100644
--- a/instrumentation/okhttp3/pom.xml
+++ b/instrumentation/okhttp3/pom.xml
@@ -23,7 +23,7 @@
     <main.basedir>${project.basedir}/../..</main.basedir>
     <!-- Last version before Call.timeout was added -->
     <floor-okhttp.version>3.11.0</floor-okhttp.version>
-    <retrofit.version>2.11.0</retrofit.version>
+    <retrofit.version>2.12.0</retrofit.version>
   </properties>
 
   <dependencies>
diff --git a/instrumentation/rocketmq-client/pom.xml b/instrumentation/rocketmq-client/pom.xml
index 9a0b90dcc..32f0409b9 100644
--- a/instrumentation/rocketmq-client/pom.xml
+++ b/instrumentation/rocketmq-client/pom.xml
@@ -43,7 +43,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
diff --git a/instrumentation/rocketmq-client/src/test/java/brave/rocketmq/client/RocketMQContainer.java b/instrumentation/rocketmq-client/src/test/java/brave/rocketmq/client/RocketMQContainer.java
index d69690c10..d2c75953e 100644
--- a/instrumentation/rocketmq-client/src/test/java/brave/rocketmq/client/RocketMQContainer.java
+++ b/instrumentation/rocketmq-client/src/test/java/brave/rocketmq/client/RocketMQContainer.java
@@ -18,7 +18,7 @@ final class RocketMQContainer extends GenericContainer<RocketMQContainer> {
   static final int BROKER_PORT = 10911;
 
   RocketMQContainer() {
-    super(DockerImageName.parse("apache/rocketmq:5.3.1"));
+    super(DockerImageName.parse("apache/rocketmq:5.4.0"));
     List<String> portBindings = new ArrayList<>();
     portBindings.add(String.format("%d:%d", NAMESERVER_PORT, NAMESERVER_PORT));
     portBindings.add(String.format("%d:%d", BROKER_PORT, BROKER_PORT));
diff --git a/instrumentation/spring-rabbit/pom.xml b/instrumentation/spring-rabbit/pom.xml
index 00eb0030b..8764339d3 100644
--- a/instrumentation/spring-rabbit/pom.xml
+++ b/instrumentation/spring-rabbit/pom.xml
@@ -66,7 +66,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
diff --git a/instrumentation/spring-rabbit/src/test/java/brave/spring/rabbit/ITSpringRabbit.java b/instrumentation/spring-rabbit/src/test/java/brave/spring/rabbit/ITSpringRabbit.java
index 9531d92bc..f86d41d52 100644
--- a/instrumentation/spring-rabbit/src/test/java/brave/spring/rabbit/ITSpringRabbit.java
+++ b/instrumentation/spring-rabbit/src/test/java/brave/spring/rabbit/ITSpringRabbit.java
@@ -15,8 +15,8 @@
 import java.util.List;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
-import org.junit.Rule;
 import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.extension.RegisterExtension;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Timeout;
@@ -88,7 +88,7 @@ abstract class ITSpringRabbit extends ITRemote {
 
   static final class RabbitMQContainer extends GenericContainer<RabbitMQContainer> {
     RabbitMQContainer() {
-      super(parse("ghcr.io/openzipkin/zipkin-rabbitmq:3.4.3"));
+      super(parse("ghcr.io/openzipkin/zipkin-rabbitmq:3.6.0"));
       withExposedPorts(RABBIT_PORT);
       waitStrategy = Wait.forLogMessage(".*Server startup complete.*", 1);
       withStartupTimeout(Duration.ofSeconds(60));
@@ -121,8 +121,8 @@ static final class RabbitMQContainer extends GenericContainer<RabbitMQContainer>
     }
   }
 
-  @Rule public IntegrationTestSpanHandler producerSpanHandler = new IntegrationTestSpanHandler();
-  @Rule public IntegrationTestSpanHandler consumerSpanHandler = new IntegrationTestSpanHandler();
+  @RegisterExtension IntegrationTestSpanHandler producerSpanHandler = new IntegrationTestSpanHandler();
+  @RegisterExtension IntegrationTestSpanHandler consumerSpanHandler = new IntegrationTestSpanHandler();
 
   SamplerFunction<MessagingRequest> producerSampler = SamplerFunctions.deferDecision();
   SamplerFunction<MessagingRequest> consumerSampler = SamplerFunctions.deferDecision();
diff --git a/mvnw b/mvnw
index 5e9618cac..1ddd97b9e 100755
--- a/mvnw
+++ b/mvnw
@@ -19,7 +19,7 @@
 # ----------------------------------------------------------------------------
 
 # ----------------------------------------------------------------------------
-# Apache Maven Wrapper startup batch script, version 3.3.2
+# Apache Maven Wrapper startup batch script, version 3.3.4
 #
 # Required ENV vars:
 # ------------------
@@ -201,6 +201,14 @@ MAVEN_PROJECTBASEDIR=${MAVEN_BASEDIR:-"$BASE_DIR"}
 export MAVEN_PROJECTBASEDIR
 log "$MAVEN_PROJECTBASEDIR"
 
+trim() {
+  # MWRAPPER-139:
+  #   Trims trailing and leading whitespace, carriage returns, tabs, and linefeeds.
+  #   Needed for removing poorly interpreted newline sequences when running in more
+  #   exotic environments such as mingw bash on Windows.
+  printf "%s" "${1}" | tr -d '[:space:]'
+}
+
 ##########################################################################################
 # Extension to allow automatically downloading the maven-wrapper.jar from Maven-central
 # This allows using the maven wrapper in projects that prohibit checking in binary data.
@@ -212,15 +220,13 @@ else
   log "Couldn't find $wrapperJarPath, downloading it ..."
 
   if [ -n "$MVNW_REPOURL" ]; then
-    wrapperUrl="$MVNW_REPOURL/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
+    wrapperUrl="$MVNW_REPOURL/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar"
   else
-    wrapperUrl="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
+    wrapperUrl="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar"
   fi
   while IFS="=" read -r key value; do
-    # Remove '\r' from value to allow usage on windows as IFS does not consider '\r' as a separator ( considers space, tab, new line ('\n'), and custom '=' )
-    safeValue=$(echo "$value" | tr -d '\r')
     case "$key" in wrapperUrl)
-      wrapperUrl="$safeValue"
+      wrapperUrl=$(trim "${value-}")
       break
       ;;
     esac
@@ -235,17 +241,17 @@ else
     log "Found wget ... using wget"
     [ "$MVNW_VERBOSE" = true ] && QUIET="" || QUIET="--quiet"
     if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then
-      wget $QUIET "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
+      wget ${QUIET:+"$QUIET"} "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
     else
-      wget $QUIET --http-user="$MVNW_USERNAME" --http-password="$MVNW_PASSWORD" "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
+      wget ${QUIET:+"$QUIET"} --http-user="$MVNW_USERNAME" --http-password="$MVNW_PASSWORD" "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
     fi
   elif command -v curl >/dev/null; then
     log "Found curl ... using curl"
     [ "$MVNW_VERBOSE" = true ] && QUIET="" || QUIET="--silent"
     if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then
-      curl $QUIET -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
+      curl ${QUIET:+"$QUIET"} -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
     else
-      curl $QUIET --user "$MVNW_USERNAME:$MVNW_PASSWORD" -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
+      curl ${QUIET:+"$QUIET"} --user "$MVNW_USERNAME:$MVNW_PASSWORD" -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
     fi
   else
     log "Falling back to using Java to download"
@@ -276,7 +282,7 @@ fi
 wrapperSha256Sum=""
 while IFS="=" read -r key value; do
   case "$key" in wrapperSha256Sum)
-    wrapperSha256Sum=$value
+    wrapperSha256Sum=$(trim "${value-}")
     break
     ;;
   esac
@@ -284,7 +290,7 @@ done <"$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.properties"
 if [ -n "$wrapperSha256Sum" ]; then
   wrapperSha256Result=false
   if command -v sha256sum >/dev/null; then
-    if echo "$wrapperSha256Sum  $wrapperJarPath" | sha256sum -c >/dev/null 2>&1; then
+    if echo "$wrapperSha256Sum  $wrapperJarPath" | sha256sum -c - >/dev/null 2>&1; then
       wrapperSha256Result=true
     fi
   elif command -v shasum >/dev/null; then
diff --git a/mvnw.cmd b/mvnw.cmd
index 1204076a9..c453424c6 100644
--- a/mvnw.cmd
+++ b/mvnw.cmd
@@ -18,7 +18,7 @@
 @REM ----------------------------------------------------------------------------
 
 @REM ----------------------------------------------------------------------------
-@REM Apache Maven Wrapper startup batch script, version 3.3.2
+@REM Apache Maven Wrapper startup batch script, version 3.3.4
 @REM
 @REM Required ENV vars:
 @REM JAVA_HOME - location of a JDK home dir
@@ -119,7 +119,7 @@ SET MAVEN_JAVA_EXE="%JAVA_HOME%\bin\java.exe"
 set WRAPPER_JAR="%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.jar"
 set WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain
 
-set WRAPPER_URL="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
+set WRAPPER_URL="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar"
 
 FOR /F "usebackq tokens=1,2 delims==" %%A IN ("%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.properties") DO (
     IF "%%A"=="wrapperUrl" SET WRAPPER_URL=%%B
@@ -133,7 +133,7 @@ if exist %WRAPPER_JAR% (
     )
 ) else (
     if not "%MVNW_REPOURL%" == "" (
-        SET WRAPPER_URL="%MVNW_REPOURL%/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
+        SET WRAPPER_URL="%MVNW_REPOURL%/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar"
     )
     if "%MVNW_VERBOSE%" == "true" (
         echo Couldn't find %WRAPPER_JAR%, downloading it ...
diff --git a/pom.xml b/pom.xml
index dc36715af..a6a24ee08 100755
--- a/pom.xml
+++ b/pom.xml
@@ -71,7 +71,7 @@
 
     <!-- override to set exclusions per-project -->
     <errorprone.args />
-    <errorprone.version>2.36.0</errorprone.version>
+    <errorprone.version>2.48.0</errorprone.version>
 
     <!-- Used for Generated annotations -->
     <javax-annotation-api.version>1.3.2</javax-annotation-api.version>
@@ -87,26 +87,27 @@
     <spring3.version>3.2.18.RELEASE</spring3.version>
 
     <!-- Apis used, but not in Jetty 7.6* imply duplication in servlet25 test fixtures -->
-    <jetty.version>9.4.57.v20241219</jetty.version>
+    <jetty.version>9.4.58.v20250814</jetty.version>
     <floor-jetty.version>7.6.21.v20160908</floor-jetty.version>
     <resteasy.version>3.15.6.Final</resteasy.version>
 
     <!-- Jakarta -->
-    <jetty11.version>11.0.25</jetty11.version>
+    <jetty11.version>11.0.26</jetty11.version>
     <!-- Compatible with Jetty11   -->
     <jersey3.version>3.0.17</jersey3.version>
     <jakarta.servlet>5.0.0</jakarta.servlet>
 
-    <kafka.version>3.9.0</kafka.version>
-    <activemq.version>5.18.6</activemq.version>
-    <activemq.artemis.version>2.33.0</activemq.artemis.version>
+    <kafka.version>3.9.2</kafka.version>
+    <activemq.version>5.19.2</activemq.version>
+    <!-- 2.39+ is Java 17 bytecode, can't use until we floor JDK 17 -->
+    <activemq.artemis.version>2.38.0</activemq.artemis.version>
     <!-- TODO: reflection drift after this version. Make changes as necessary
          and add an invoker test that 2.3.6 still works. -->
     <spring-rabbit.version>2.3.6</spring-rabbit.version>
 
     <!-- TODO: update and fix drift or remove the FinagleContextInteropTest -->
     <finagle.version>20.12.0</finagle.version>
-    <log4j2.version>2.24.3</log4j2.version>
+    <log4j2.version>2.25.3</log4j2.version>
     <log4j1.version>1.2.17</log4j1.version>
     <okhttp4.version>4.12.0</okhttp4.version>
     <httpclient.version>4.5.14</httpclient.version>
@@ -117,21 +118,21 @@
     <grpc.version>1.57.2</grpc.version>
     <protobuf.version>3.25.5</protobuf.version>
     <!-- latest netty 4.1 that works with our version of grpc -->
-    <netty.version>4.1.121.Final</netty.version>
+    <netty.version>4.1.131.Final</netty.version>
 
     <httpasyncclient.version>4.1.5</httpasyncclient.version>
 
     <!-- msql connector used for mysql8 instrumentation, and test of jdbi3 instrumentation -->
     <!-- mysql-connector-java 8+ requires Java 8 -->
-    <mysql-connector-j8.version>8.3.0</mysql-connector-j8.version>
+    <mysql-connector-j8.version>8.4.0</mysql-connector-j8.version>
 
     <!-- Test only dependencies -->
-    <junit-jupiter.version>5.12.2</junit-jupiter.version>
-    <assertj.version>3.27.3</assertj.version>
-    <mockito.version>5.17.0</mockito.version>
-    <jersey.version>2.42</jersey.version>
-    <testcontainers.version>1.20.6</testcontainers.version>
-    <rocketmq-client.version>5.3.2</rocketmq-client.version>
+    <junit-jupiter.version>5.14.3</junit-jupiter.version>
+    <assertj.version>3.27.7</assertj.version>
+    <mockito.version>5.23.0</mockito.version>
+    <jersey.version>2.47</jersey.version>
+    <testcontainers.version>2.0.4</testcontainers.version>
+    <rocketmq-client.version>5.4.0</rocketmq-client.version>
 
     <license.skip>${skipTests}</license.skip>
     <maven-surefire-plugin.argLine />
@@ -140,22 +141,23 @@
     <go-offline-maven-plugin.version>1.2.8</go-offline-maven-plugin.version>
     <!-- TODO: cleanup any redundant ignores now also in the 4.0 release (once final) -->
     <license-maven-plugin.version>5.0.0</license-maven-plugin.version>
-    <maven-assembly-plugin.version>3.7.1</maven-assembly-plugin.version>
+    <maven-assembly-plugin.version>3.8.0</maven-assembly-plugin.version>
+    <!-- 6.x depends on bndlib 7.0 which is Java 17 bytecode -->
     <maven-bundle-plugin.version>5.1.9</maven-bundle-plugin.version>
-    <maven-compiler-plugin.version>3.13.0</maven-compiler-plugin.version>
+    <maven-compiler-plugin.version>3.15.0</maven-compiler-plugin.version>
     <!-- Use same version as https://github.com/openzipkin/docker-java -->
-    <maven-dependency-plugin.version>3.8.1</maven-dependency-plugin.version>
-    <maven-deploy-plugin.version>3.1.3</maven-deploy-plugin.version>
-    <maven-enforcer-plugin.version>3.5.0</maven-enforcer-plugin.version>
+    <maven-dependency-plugin.version>3.10.0</maven-dependency-plugin.version>
+    <maven-deploy-plugin.version>3.1.4</maven-deploy-plugin.version>
+    <maven-enforcer-plugin.version>3.6.2</maven-enforcer-plugin.version>
     <!-- Use same version as https://github.com/openzipkin/docker-java -->
     <maven-help-plugin.version>3.5.1</maven-help-plugin.version>
-    <maven-install-plugin.version>3.1.3</maven-install-plugin.version>
-    <maven-invoker-plugin.version>3.9.0</maven-invoker-plugin.version>
-    <maven-javadoc-plugin.version>3.11.2</maven-javadoc-plugin.version>
-    <maven-jar-plugin.version>3.4.2</maven-jar-plugin.version>
-    <maven-release-plugin.version>3.1.1</maven-release-plugin.version>
-    <maven-source-plugin.version>3.3.1</maven-source-plugin.version>
-    <maven-surefire-plugin.version>3.5.3</maven-surefire-plugin.version>
+    <maven-install-plugin.version>3.1.4</maven-install-plugin.version>
+    <maven-invoker-plugin.version>3.9.1</maven-invoker-plugin.version>
+    <maven-javadoc-plugin.version>3.12.0</maven-javadoc-plugin.version>
+    <maven-jar-plugin.version>3.5.0</maven-jar-plugin.version>
+    <maven-release-plugin.version>3.3.1</maven-release-plugin.version>
+    <maven-source-plugin.version>3.4.0</maven-source-plugin.version>
+    <maven-surefire-plugin.version>3.5.5</maven-surefire-plugin.version>
     <central-publishing-maven-plugin.version>0.10.0</central-publishing-maven-plugin.version>
   </properties>
 
@@ -201,14 +203,6 @@
       <groupId>org.assertj</groupId>
       <artifactId>assertj-core</artifactId>
       <version>${assertj.version}</version>
-      <exclusions>
-        <!-- Use newer bytebuddy from mockito, which is JRE 21 compatible.
-             TODO: remove when assertj releases a new version -->
-        <exclusion>
-          <groupId>net.bytebuddy</groupId>
-          <artifactId>*</artifactId>
-        </exclusion>
-      </exclusions>
       <scope>test</scope>
     </dependency>
     <!-- Main code uses jul and tests log with log4j -->
@@ -460,7 +454,7 @@
                 <requireJavaVersion>
                   <!-- Change this to control LTS JDK versions allowed to build
                        the project. Keep in sync with .github/workflows -->
-                  <version>[11,12),[17,18),[21,22)</version>
+                  <version>[11,12),[25,26)</version>
                 </requireJavaVersion>
               </rules>
             </configuration>
@@ -601,10 +595,10 @@
     </profile>
 
     <profile>
-      <id>error-prone-17+</id>
+      <id>error-prone-21+</id>
       <activation>
-        <!-- Only LTS versions that work with errorprone -->
-        <jdk>[17,18),[21,22)</jdk>
+        <!-- ErrorProne 2.48+ requires JDK 21+ -->
+        <jdk>[21,)</jdk>
       </activation>
       <build>
         <plugins>
@@ -630,6 +624,7 @@
                     <arg>-XDcompilePolicy=simple</arg>
                     <arg>--should-stop=ifError=FLOW</arg>
                     <arg>-Xplugin:ErrorProne ${errorprone.args}</arg>
+                    <arg>-XDaddTypeAnnotationsToSymbol=true</arg>
                     <!-- below needed per https://errorprone.info/docs/installation -->
                     <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED</arg>
                     <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED</arg>
@@ -674,7 +669,7 @@
 
           <plugin>
             <artifactId>maven-gpg-plugin</artifactId>
-            <version>3.2.2</version>
+            <version>3.2.8</version>
             <executions>
               <execution>
                 <id>sign-artifacts</id>