diff --git a/eng/skill-validator/src/SkillValidator.csproj b/eng/skill-validator/src/SkillValidator.csproj
index ae1bb7a..2396e8f 100644
--- a/eng/skill-validator/src/SkillValidator.csproj
+++ b/eng/skill-validator/src/SkillValidator.csproj
@@ -42,16 +42,16 @@
     <PackageReference Include="Microsoft.ML.Tokenizers.Data.Cl100kBase" Version="2.0.0" />
     <PackageReference Include="System.CommandLine" Version="2.0.7" />
     <!-- external -->
-    <PackageReference Include="GitHub.Copilot.SDK" Version="0.3.0" />
-    <PackageReference Include="YamlDotNet" Version="17.1.0" />
-    <PackageReference Include="Vecc.YamlDotNet.Analyzers.StaticGenerator" Version="17.0.0" />
+    <PackageReference Include="GitHub.Copilot.SDK" Version="1.0.11" />
+    <PackageReference Include="YamlDotNet" Version="18.1.0" />
+    <PackageReference Include="Vecc.YamlDotNet.Analyzers.StaticGenerator" Version="18.1.0" />
 
     <!--
       Transitive pin: GitHub.Copilot.SDK still drags in Nerdbank.MessagePack
       1.0.2 which has a known high-severity vulnerability (GHSA-2cwq-pwfr-wcw3).
       Fixed in 1.1.62.  Drop this once the upstream chain bumps past 1.1.62.
     -->
-    <PackageReference Include="Nerdbank.MessagePack" Version="1.1.62" />
+    <PackageReference Include="Nerdbank.MessagePack" Version="1.2.36" />
   </ItemGroup>
 
 </Project>
diff --git a/eng/skill-validator/tests/SkillValidator.Tests.csproj b/eng/skill-validator/tests/SkillValidator.Tests.csproj
index 9ad4d44..d2b89ad 100644
--- a/eng/skill-validator/tests/SkillValidator.Tests.csproj
+++ b/eng/skill-validator/tests/SkillValidator.Tests.csproj
@@ -5,7 +5,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="xunit.v3.mtp-v2" Version="3.2.2" />
+    <PackageReference Include="xunit.v3.mtp-v2" Version="4.0.0" />
   </ItemGroup>
 
   <ItemGroup>