diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
index 76ca931b..d3d30fbb 100644
--- a/.config/dotnet-tools.json
+++ b/.config/dotnet-tools.json
@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "dotnet-ef": {
-      "version": "8.0.10",
+      "version": "8.0.31",
       "commands": [
         "dotnet-ef"
       ],
diff --git a/backend/admin-api/AdminApi/AdminApi.csproj b/backend/admin-api/AdminApi/AdminApi.csproj
index 899bb822..3f63a6da 100644
--- a/backend/admin-api/AdminApi/AdminApi.csproj
+++ b/backend/admin-api/AdminApi/AdminApi.csproj
@@ -9,9 +9,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Asp.Versioning.Mvc" Version="8.1.0" />
-    <PackageReference Include="Serilog.AspNetCore" Version="8.0.1" />
-    <PackageReference Include="Swashbuckle.AspNetCore" Version="6.6.2" />
+    <PackageReference Include="Asp.Versioning.Mvc" Version="8.1.1" />
+    <PackageReference Include="Serilog.AspNetCore" Version="8.0.3" />
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="6.9.0" />
     <!-- Task #393: pins a transitive dependency up past GHSA-hh2w-p6rv-4g7w
          (High). Nothing here calls System.Text.Json directly - this is only
          to float the version ASP.NET Core's own model binding resolves. -->
diff --git a/backend/consumer-api/ConsumerApi/ConsumerApi.csproj b/backend/consumer-api/ConsumerApi/ConsumerApi.csproj
index 551e8cae..72604c18 100644
--- a/backend/consumer-api/ConsumerApi/ConsumerApi.csproj
+++ b/backend/consumer-api/ConsumerApi/ConsumerApi.csproj
@@ -9,13 +9,13 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Asp.Versioning.Mvc" Version="8.1.0" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.10">
+    <PackageReference Include="Asp.Versioning.Mvc" Version="8.1.1" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.31">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Serilog.AspNetCore" Version="8.0.1" />
-    <PackageReference Include="Swashbuckle.AspNetCore" Version="6.6.2" />
+    <PackageReference Include="Serilog.AspNetCore" Version="8.0.3" />
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="6.9.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/backend/provider-api/ProviderApi/ProviderApi.csproj b/backend/provider-api/ProviderApi/ProviderApi.csproj
index f0c4cc28..ba7d111a 100644
--- a/backend/provider-api/ProviderApi/ProviderApi.csproj
+++ b/backend/provider-api/ProviderApi/ProviderApi.csproj
@@ -9,9 +9,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Asp.Versioning.Mvc" Version="8.1.0" />
-    <PackageReference Include="Serilog.AspNetCore" Version="8.0.1" />
-    <PackageReference Include="Swashbuckle.AspNetCore" Version="6.6.2" />
+    <PackageReference Include="Asp.Versioning.Mvc" Version="8.1.1" />
+    <PackageReference Include="Serilog.AspNetCore" Version="8.0.3" />
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="6.9.0" />
     <!-- Task #393: pins a transitive dependency up past GHSA-hh2w-p6rv-4g7w
          (High). Nothing here calls System.Text.Json directly - this is only
          to float the version ASP.NET Core's own model binding resolves. -->
diff --git a/backend/shared/Application/Application.csproj b/backend/shared/Application/Application.csproj
index 68ec6c7e..fc7c2059 100644
--- a/backend/shared/Application/Application.csproj
+++ b/backend/shared/Application/Application.csproj
@@ -8,10 +8,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="FluentValidation" Version="11.9.2" />
-    <PackageReference Include="FluentValidation.DependencyInjectionExtensions" Version="11.9.2" />
-    <PackageReference Include="MediatR" Version="12.4.1" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.1" />
+    <PackageReference Include="FluentValidation" Version="11.12.0" />
+    <PackageReference Include="FluentValidation.DependencyInjectionExtensions" Version="11.12.0" />
+    <PackageReference Include="MediatR" Version="12.5.0" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.3" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/backend/shared/Infrastructure/Infrastructure.csproj b/backend/shared/Infrastructure/Infrastructure.csproj
index bf23f0fc..9a7bd299 100644
--- a/backend/shared/Infrastructure/Infrastructure.csproj
+++ b/backend/shared/Infrastructure/Infrastructure.csproj
@@ -21,24 +21,27 @@
     <PackageReference Include="AspNetCore.HealthChecks.Redis" Version="8.0.1" />
     <PackageReference Include="EFCore.NamingConventions" Version="8.0.3" />
     <PackageReference Include="FirebaseAdmin" Version="3.6.0" />
+    <PackageReference Include="FluentValidation" Version="11.12.0" />
+    <PackageReference Include="FluentValidation.DependencyInjectionExtensions" Version="11.12.0" />
     <PackageReference Include="MailKit" Version="4.17.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.10" />
+    <PackageReference Include="MediatR" Version="12.5.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.31" />
     <PackageReference Include="Hangfire.AspNetCore" Version="1.8.24" />
-    <PackageReference Include="Hangfire.PostgreSql" Version="1.20.12" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="8.0.10" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.10">
+    <PackageReference Include="Hangfire.PostgreSql" Version="1.21.1" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="8.0.31" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.31">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="8.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="8.0.31" />
     <!-- Task #393: 8.0.10 pulled in MessagePack 2.5.108, which carries
          GHSA-4qm4-8hg2-g2xm (2 High + 10 Moderate). Bumped alone, ahead of
          the rest of this project's 8.0.10-pinned Microsoft.* packages, to
          float the transitive MessagePack version past the fix. -->
     <PackageReference Include="Microsoft.AspNetCore.SignalR.StackExchangeRedis" Version="8.0.30" />
-    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="8.0.10" />
+    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="8.0.11" />
     <PackageReference Include="OpenTelemetry.Exporter.Prometheus.AspNetCore" Version="1.17.0-beta.1" />
-    <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
+    <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.18.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/backend/tests/Catalog.Tests/Catalog.Tests.csproj b/backend/tests/Catalog.Tests/Catalog.Tests.csproj
index 5f1153e9..c9e57fe1 100644
--- a/backend/tests/Catalog.Tests/Catalog.Tests.csproj
+++ b/backend/tests/Catalog.Tests/Catalog.Tests.csproj
@@ -9,14 +9,14 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
     <!-- Pinned to 7.x: FluentAssertions 8.0 requires a paid licence for commercial use. -->
-    <PackageReference Include="FluentAssertions" Version="7.2.0" />
+    <PackageReference Include="FluentAssertions" Version="7.2.2" />
     <!--
       SQLite rather than the EF in-memory provider: these tests assert on
       unique-index enforcement, and the in-memory provider ignores indexes
diff --git a/backend/tests/CustomerManagement.Tests/CustomerManagement.Tests.csproj b/backend/tests/CustomerManagement.Tests/CustomerManagement.Tests.csproj
index 76e762b7..65de9b6b 100644
--- a/backend/tests/CustomerManagement.Tests/CustomerManagement.Tests.csproj
+++ b/backend/tests/CustomerManagement.Tests/CustomerManagement.Tests.csproj
@@ -9,8 +9,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
@@ -20,7 +20,7 @@
       paid licence for commercial use, and Nestly is a commercial product.
       7.2.0 is the last Apache-2.0 release.
     -->
-    <PackageReference Include="FluentAssertions" Version="7.2.0" />
+    <PackageReference Include="FluentAssertions" Version="7.2.2" />
     <!--
       SQLite rather than the EF in-memory provider: same rationale as
       Identity.Tests/TestDatabase.cs - real relational behaviour (unique
diff --git a/backend/tests/Identity.Tests/Identity.Tests.csproj b/backend/tests/Identity.Tests/Identity.Tests.csproj
index 8541b2e6..cc84006e 100644
--- a/backend/tests/Identity.Tests/Identity.Tests.csproj
+++ b/backend/tests/Identity.Tests/Identity.Tests.csproj
@@ -9,8 +9,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
@@ -20,7 +20,7 @@
       paid licence for commercial use, and Nestly is a commercial product.
       7.2.0 is the last Apache-2.0 release.
     -->
-    <PackageReference Include="FluentAssertions" Version="7.2.0" />
+    <PackageReference Include="FluentAssertions" Version="7.2.2" />
     <PackageReference Include="Moq" Version="4.20.72" />
     <!--
       SQLite rather than the EF in-memory provider: these tests assert on
diff --git a/backend/tests/Performance.Tests/Performance.Tests.csproj b/backend/tests/Performance.Tests/Performance.Tests.csproj
index 9e2f4cf2..d1ddae32 100644
--- a/backend/tests/Performance.Tests/Performance.Tests.csproj
+++ b/backend/tests/Performance.Tests/Performance.Tests.csproj
@@ -9,14 +9,14 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
     <!-- Pinned to 7.x: FluentAssertions 8.0 requires a paid licence for commercial use (see Catalog.Tests.csproj). -->
-    <PackageReference Include="FluentAssertions" Version="7.2.0" />
+    <PackageReference Include="FluentAssertions" Version="7.2.2" />
     <!--
       SQLite rather than the EF in-memory provider: these are concurrency/load
       tests that assert on real relational behaviour (unique-index