diff --git a/src/SuavoAgent.Adapters.ComputerRx/SuavoAgent.Adapters.ComputerRx.csproj b/src/SuavoAgent.Adapters.ComputerRx/SuavoAgent.Adapters.ComputerRx.csproj
index ccf5aad5..611f6824 100644
--- a/src/SuavoAgent.Adapters.ComputerRx/SuavoAgent.Adapters.ComputerRx.csproj
+++ b/src/SuavoAgent.Adapters.ComputerRx/SuavoAgent.Adapters.ComputerRx.csproj
@@ -10,7 +10,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.2" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.3" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/SuavoAgent.Adapters.PioneerRx/SuavoAgent.Adapters.PioneerRx.csproj b/src/SuavoAgent.Adapters.PioneerRx/SuavoAgent.Adapters.PioneerRx.csproj
index 8a7e4b43..d3b4eb34 100644
--- a/src/SuavoAgent.Adapters.PioneerRx/SuavoAgent.Adapters.PioneerRx.csproj
+++ b/src/SuavoAgent.Adapters.PioneerRx/SuavoAgent.Adapters.PioneerRx.csproj
@@ -10,8 +10,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Data.SqlClient" Version="5.2.2" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.2" />
+    <PackageReference Include="Microsoft.Data.SqlClient" Version="5.2.3" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.9" />
+    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="9.0.17" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/SuavoAgent.Analyzers/SuavoAgent.Analyzers.csproj b/src/SuavoAgent.Analyzers/SuavoAgent.Analyzers.csproj
index 5c7f2fd3..b4beb239 100644
--- a/src/SuavoAgent.Analyzers/SuavoAgent.Analyzers.csproj
+++ b/src/SuavoAgent.Analyzers/SuavoAgent.Analyzers.csproj
@@ -19,7 +19,7 @@
          Using 4.11.0+ here causes the analyzer DLL to fail loading silently
          (CS9057 warning "analyzer references newer compiler version"), so the
          gate doesn't fire on actual builds. Bump when the dev SDK upgrades. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.8.0" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.14.0" PrivateAssets="all" />
   </ItemGroup>
 
 </Project>
diff --git a/src/SuavoAgent.Broker/SuavoAgent.Broker.csproj b/src/SuavoAgent.Broker/SuavoAgent.Broker.csproj
index e6d72dfc..b2c63b0d 100644
--- a/src/SuavoAgent.Broker/SuavoAgent.Broker.csproj
+++ b/src/SuavoAgent.Broker/SuavoAgent.Broker.csproj
@@ -10,16 +10,16 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="8.0.0" />
+    <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="8.0.1" />
     <PackageReference Include="Serilog.Extensions.Hosting" Version="8.0.0" />
-    <PackageReference Include="Serilog.Sinks.Console" Version="6.0.0" />
+    <PackageReference Include="Serilog.Sinks.Console" Version="6.1.1" />
     <PackageReference Include="Serilog.Sinks.File" Version="6.0.0" />
     <!-- Direct pin overrides transitive 8.0.0 (GHSA-hh2w-p6rv-4g7w + GHSA-8g4q-xg66-9fp4, both HIGH DoS). -->
-    <PackageReference Include="System.Text.Json" Version="8.0.5" />
+    <PackageReference Include="System.Text.Json" Version="9.0.8" />
     <!-- Honeytoken ETW attribution oracle (Windows-only at runtime; managed lib builds cross-platform, all
          ETW calls guarded by OperatingSystem.IsWindows()). Native KernelTraceControl bits ride the win-x64
          self-contained publish (IncludeNativeLibrariesForSelfExtract above). -->
-    <PackageReference Include="Microsoft.Diagnostics.Tracing.TraceEvent" Version="3.1.16" />
+    <PackageReference Include="Microsoft.Diagnostics.Tracing.TraceEvent" Version="3.2.4" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/SuavoAgent.Core/SuavoAgent.Core.csproj b/src/SuavoAgent.Core/SuavoAgent.Core.csproj
index 4971ae0d..f8e9eb85 100644
--- a/src/SuavoAgent.Core/SuavoAgent.Core.csproj
+++ b/src/SuavoAgent.Core/SuavoAgent.Core.csproj
@@ -19,8 +19,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Data.SqlClient" Version="5.2.2" />
-    <PackageReference Include="Microsoft.Data.Sqlite.Core" Version="10.0.5" />
+    <PackageReference Include="Microsoft.Data.SqlClient" Version="5.2.3" />
+    <PackageReference Include="Microsoft.Data.Sqlite.Core" Version="10.0.9" />
     <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="8.0.1" />
     <PackageReference Include="Serilog.Extensions.Hosting" Version="8.0.0" />
     <PackageReference Include="Serilog.Sinks.File" Version="5.0.0" />
@@ -29,8 +29,8 @@
     <PackageReference Include="Stateless" Version="5.20.1" />
     <!-- ClosedXML (MIT) replaces EPPlus (NonCommercial in v7). Commercial pilot cannot ship
          EPPlus under its free license; re-evaluation only if ClosedXML perf blocks a workflow. -->
-    <PackageReference Include="ClosedXML" Version="0.104.2" />
-    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="9.0.4" />
+    <PackageReference Include="ClosedXML" Version="0.105.0" />
+    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="9.0.17" />
     <PackageReference Include="YamlDotNet" Version="16.3.0" />
     <!-- Managed LLamaSharp binding only. Native llama.cpp backend (llama.dll,
          ggml.dll) is NOT shipped by default — its presence would be a vendor
@@ -42,7 +42,7 @@
          3->5 per AVX folder (ggml.dll + ggml-base.dll + ggml-cpu.dll + llama.dll + llava_shared.dll) —
          the operator-provided NativeLibraryPath on the box MUST carry all 5 (see live-box-validation runbook).
          Backend pin (LLamaSharp.Backend.Cpu, in Helper.Tests) MUST equal this version exactly. -->
-    <PackageReference Include="LLamaSharp" Version="0.24.0" />
+    <PackageReference Include="LLamaSharp" Version="0.27.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/SuavoAgent.Diagnostics/SuavoAgent.Diagnostics.csproj b/src/SuavoAgent.Diagnostics/SuavoAgent.Diagnostics.csproj
index b419ce2e..5b21a695 100644
--- a/src/SuavoAgent.Diagnostics/SuavoAgent.Diagnostics.csproj
+++ b/src/SuavoAgent.Diagnostics/SuavoAgent.Diagnostics.csproj
@@ -32,13 +32,13 @@
          AppDomain/UnobservedTask hooks). -->
     <PackageReference Include="JsonCanonicalizer" Version="1.0.0" />
     <PackageReference Include="Sentry" Version="4.13.0" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.2" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.9" />
     <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" Version="8.0.1" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="8.0.0" />
     <!-- JsonSchema.Net for build-time + runtime ruleset-v1 validation.
          Runtime path is loaded-from-embedded-resource only; the runtime
          crash reporter does NOT depend on this package (AOT compat). -->
-    <PackageReference Include="JsonSchema.Net" Version="7.2.3" />
+    <PackageReference Include="JsonSchema.Net" Version="7.4.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/SuavoAgent.Setup/SuavoAgent.Setup.csproj b/src/SuavoAgent.Setup/SuavoAgent.Setup.csproj
index 75ef3875..606ab8d3 100644
--- a/src/SuavoAgent.Setup/SuavoAgent.Setup.csproj
+++ b/src/SuavoAgent.Setup/SuavoAgent.Setup.csproj
@@ -54,11 +54,11 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Avalonia" Version="11.2.0" />
-    <PackageReference Include="Avalonia.Desktop" Version="11.2.0" />
-    <PackageReference Include="Avalonia.Themes.Fluent" Version="11.2.0" />
-    <PackageReference Include="Avalonia.Fonts.Inter" Version="11.2.0" />
-    <PackageReference Include="Avalonia.Diagnostics" Version="11.2.0" Condition="'$(Configuration)' == 'Debug'" />
+    <PackageReference Include="Avalonia" Version="11.3.18" />
+    <PackageReference Include="Avalonia.Desktop" Version="11.3.18" />
+    <PackageReference Include="Avalonia.Themes.Fluent" Version="11.3.18" />
+    <PackageReference Include="Avalonia.Fonts.Inter" Version="11.3.18" />
+    <PackageReference Include="Avalonia.Diagnostics" Version="11.3.18" Condition="'$(Configuration)' == 'Debug'" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/SuavoAgent.Watchdog/SuavoAgent.Watchdog.csproj b/src/SuavoAgent.Watchdog/SuavoAgent.Watchdog.csproj
index 2f52642c..752dc160 100644
--- a/src/SuavoAgent.Watchdog/SuavoAgent.Watchdog.csproj
+++ b/src/SuavoAgent.Watchdog/SuavoAgent.Watchdog.csproj
@@ -14,9 +14,9 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="8.0.0" />
+    <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="8.0.1" />
     <PackageReference Include="Serilog.Extensions.Hosting" Version="8.0.0" />
-    <PackageReference Include="Serilog.Sinks.Console" Version="6.0.0" />
+    <PackageReference Include="Serilog.Sinks.Console" Version="6.1.1" />
     <PackageReference Include="Serilog.Sinks.File" Version="6.0.0" />
     <!-- Direct pin overrides transitive 8.0.0 (GHSA-hh2w-p6rv-4g7w + GHSA-8g4q-xg66-9fp4, both HIGH DoS). -->
     <PackageReference Include="System.Text.Json" Version="8.0.5" />
diff --git a/tests/SuavoAgent.Adapters.ComputerRx.Tests/SuavoAgent.Adapters.ComputerRx.Tests.csproj b/tests/SuavoAgent.Adapters.ComputerRx.Tests/SuavoAgent.Adapters.ComputerRx.Tests.csproj
index 9d9ffdc5..d2fd4261 100644
--- a/tests/SuavoAgent.Adapters.ComputerRx.Tests/SuavoAgent.Adapters.ComputerRx.Tests.csproj
+++ b/tests/SuavoAgent.Adapters.ComputerRx.Tests/SuavoAgent.Adapters.ComputerRx.Tests.csproj
@@ -10,9 +10,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.2" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
   </ItemGroup>
 
diff --git a/tests/SuavoAgent.Adapters.PioneerRx.Tests/SuavoAgent.Adapters.PioneerRx.Tests.csproj b/tests/SuavoAgent.Adapters.PioneerRx.Tests/SuavoAgent.Adapters.PioneerRx.Tests.csproj
index 259e8dfc..58a1fb3e 100644
--- a/tests/SuavoAgent.Adapters.PioneerRx.Tests/SuavoAgent.Adapters.PioneerRx.Tests.csproj
+++ b/tests/SuavoAgent.Adapters.PioneerRx.Tests/SuavoAgent.Adapters.PioneerRx.Tests.csproj
@@ -10,9 +10,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.2" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
   </ItemGroup>
 
diff --git a/tests/SuavoAgent.Analyzers.Tests/SuavoAgent.Analyzers.Tests.csproj b/tests/SuavoAgent.Analyzers.Tests/SuavoAgent.Analyzers.Tests.csproj
index f5a63425..77c3fc32 100644
--- a/tests/SuavoAgent.Analyzers.Tests/SuavoAgent.Analyzers.Tests.csproj
+++ b/tests/SuavoAgent.Analyzers.Tests/SuavoAgent.Analyzers.Tests.csproj
@@ -11,17 +11,17 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <!-- Pin Microsoft.CodeAnalysis.CSharp to match the analyzer (4.11.0).
          We invoke the analyzer directly via CompilationWithAnalyzers rather than
          going through Microsoft.CodeAnalysis.CSharp.Analyzer.Testing.XUnit —
          that wrapper has known constructor incompatibilities between its
          assertion call sites and xunit 2.5+. Direct invocation is simpler. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" />
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.8.0" />
-    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.14.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.14.0" />
+    <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
-    <PackageReference Include="coverlet.collector" Version="6.0.2" />
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/SuavoAgent.Broker.Tests/SuavoAgent.Broker.Tests.csproj b/tests/SuavoAgent.Broker.Tests/SuavoAgent.Broker.Tests.csproj
index 8e929e32..7f8c1079 100644
--- a/tests/SuavoAgent.Broker.Tests/SuavoAgent.Broker.Tests.csproj
+++ b/tests/SuavoAgent.Broker.Tests/SuavoAgent.Broker.Tests.csproj
@@ -11,7 +11,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.2" />
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.2" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
     <PackageReference Include="xunit" Version="2.9.2" />
diff --git a/tests/SuavoAgent.Contracts.Tests/SuavoAgent.Contracts.Tests.csproj b/tests/SuavoAgent.Contracts.Tests/SuavoAgent.Contracts.Tests.csproj
index a0c05bca..2373e5a0 100644
--- a/tests/SuavoAgent.Contracts.Tests/SuavoAgent.Contracts.Tests.csproj
+++ b/tests/SuavoAgent.Contracts.Tests/SuavoAgent.Contracts.Tests.csproj
@@ -10,9 +10,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.2" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
   </ItemGroup>
 
diff --git a/tests/SuavoAgent.Core.Tests/SuavoAgent.Core.Tests.csproj b/tests/SuavoAgent.Core.Tests/SuavoAgent.Core.Tests.csproj
index 7453c1ba..ba64e676 100644
--- a/tests/SuavoAgent.Core.Tests/SuavoAgent.Core.Tests.csproj
+++ b/tests/SuavoAgent.Core.Tests/SuavoAgent.Core.Tests.csproj
@@ -10,11 +10,11 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.2" />
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="8.0.1" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.5" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.9" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
   </ItemGroup>
 
diff --git a/tests/SuavoAgent.Diagnostics.Tests/SuavoAgent.Diagnostics.Tests.csproj b/tests/SuavoAgent.Diagnostics.Tests/SuavoAgent.Diagnostics.Tests.csproj
index 3f12f17e..84bf126c 100644
--- a/tests/SuavoAgent.Diagnostics.Tests/SuavoAgent.Diagnostics.Tests.csproj
+++ b/tests/SuavoAgent.Diagnostics.Tests/SuavoAgent.Diagnostics.Tests.csproj
@@ -11,7 +11,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.2" />
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
     <PackageReference Include="xunit" Version="2.9.2" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
diff --git a/tests/SuavoAgent.Helper.Tests/SuavoAgent.Helper.Tests.csproj b/tests/SuavoAgent.Helper.Tests/SuavoAgent.Helper.Tests.csproj
index 0dfdeda8..0bf6ee01 100644
--- a/tests/SuavoAgent.Helper.Tests/SuavoAgent.Helper.Tests.csproj
+++ b/tests/SuavoAgent.Helper.Tests/SuavoAgent.Helper.Tests.csproj
@@ -9,8 +9,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
   </ItemGroup>
 
diff --git a/tests/SuavoAgent.Setup.Tests/SuavoAgent.Setup.Tests.csproj b/tests/SuavoAgent.Setup.Tests/SuavoAgent.Setup.Tests.csproj
index 1981e90b..e176604c 100644
--- a/tests/SuavoAgent.Setup.Tests/SuavoAgent.Setup.Tests.csproj
+++ b/tests/SuavoAgent.Setup.Tests/SuavoAgent.Setup.Tests.csproj
@@ -11,9 +11,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.2" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
     <!--
       Avalonia headless test infrastructure (Mesh PR 3). Catches Bug 24's
@@ -21,8 +21,8 @@
       ship green without a UI smoke check. Versions track SuavoAgent.Setup's
       Avalonia 11.2.0 PackageReferences.
     -->
-    <PackageReference Include="Avalonia.Headless" Version="11.2.0" />
-    <PackageReference Include="Avalonia.Headless.XUnit" Version="11.2.0" />
+    <PackageReference Include="Avalonia.Headless" Version="11.3.18" />
+    <PackageReference Include="Avalonia.Headless.XUnit" Version="11.3.18" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/SuavoAgent.Watchdog.Tests/SuavoAgent.Watchdog.Tests.csproj b/tests/SuavoAgent.Watchdog.Tests/SuavoAgent.Watchdog.Tests.csproj
index 6c2fcc3e..b3280780 100644
--- a/tests/SuavoAgent.Watchdog.Tests/SuavoAgent.Watchdog.Tests.csproj
+++ b/tests/SuavoAgent.Watchdog.Tests/SuavoAgent.Watchdog.Tests.csproj
@@ -11,7 +11,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.2" />
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
     <!-- Bumped to 8.0.2 to match SuavoAgent.Diagnostics's transitive
          requirement (NU1605 downgrade guard). Diagnostics is referenced
          by Watchdog from Mesh PR 4b entry-point integration. -->