diff --git a/workspaces/arborist/package.json b/workspaces/arborist/package.json
index 89cbffce6da8a..da3e1ddf88b01 100644
--- a/workspaces/arborist/package.json
+++ b/workspaces/arborist/package.json
@@ -6,13 +6,13 @@
     "@isaacs/string-locale-compare": "^1.1.0",
     "@npmcli/installed-package-contents": "^2.0.0",
     "@npmcli/map-workspaces": "^3.0.0",
-    "@npmcli/metavuln-calculator": "^5.0.0",
+    "@npmcli/metavuln-calculator": "^7.0.0",
     "@npmcli/move-file": "^3.0.0",
     "@npmcli/name-from-folder": "^1.0.1",
     "@npmcli/node-gyp": "^3.0.0",
     "@npmcli/package-json": "^3.0.0",
     "@npmcli/query": "^3.0.0",
-    "@npmcli/run-script": "^5.0.0",
+    "@npmcli/run-script": "^7.0.2",
     "bin-links": "^4.0.1",
     "cacache": "^17.0.1",
     "common-ancestor-path": "^1.0.1",
@@ -23,9 +23,9 @@
     "npm-install-checks": "^6.0.0",
     "npm-package-arg": "^10.0.0",
     "npm-pick-manifest": "^8.0.1",
-    "npm-registry-fetch": "^14.0.2",
+    "npm-registry-fetch": "^15.0.0",
     "npmlog": "^7.0.0",
-    "pacote": "^15.0.2",
+    "pacote": "^17.0.4",
     "parse-conflict-json": "^3.0.0",
     "proc-log": "^3.0.0",
     "promise-all-reject-late": "^1.0.0",