diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index add32073a..59d510175 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,6 +8,17 @@ updates:
       dependencies:
         patterns:
           - "*"
+    ignore:
+      - dependency-name: "com.google.errorprone:error_prone_core"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "com.uber.nullaway:nullaway"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "org.junit:junit-bom"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "org.apache.tomcat.embed:tomcat-embed-core"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "org.mockito:mockito-core"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: "github-actions"
     directory: "/"
diff --git a/client/pom.xml b/client/pom.xml
index 5d4dede3f..62470646b 100644
--- a/client/pom.xml
+++ b/client/pom.xml
@@ -30,12 +30,12 @@
     <properties>
         <javaModuleName>org.asynchttpclient.client</javaModuleName>
 
-        <jetty.version>11.0.24</jetty.version>
+        <jetty.version>11.0.26</jetty.version>
         <tomcat.version>10.1.50</tomcat.version>
-        <commons-io.version>2.18.0</commons-io.version>
+        <commons-io.version>2.21.0</commons-io.version>
         <mockito.version>4.11.0</mockito.version>
         <hamcrest.version>3.0</hamcrest.version>
-        <kerby.version>2.1.0</kerby.version>
+        <kerby.version>2.1.1</kerby.version>
     </properties>
 
     <developers>
@@ -50,7 +50,7 @@
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-fileupload2-jakarta-servlet5</artifactId>
-            <version>2.0.0-M2</version>
+            <version>2.0.0-M5</version>
             <scope>test</scope>
         </dependency>
 
@@ -246,6 +246,16 @@
                 </plugins>
             </build>
         </profile>
+        <!-- JDK 17+: use Tomcat 11 (requires JDK 17+) -->
+        <profile>
+            <id>jdk17+-tomcat</id>
+            <activation>
+                <jdk>[17,)</jdk>
+            </activation>
+            <properties>
+                <tomcat.version>11.0.18</tomcat.version>
+            </properties>
+        </profile>
         <profile>
             <id>no-docker-tests</id>
             <activation>
diff --git a/pom.xml b/pom.xml
index 3efe9e26e..c102d8a67 100644
--- a/pom.xml
+++ b/pom.xml
@@ -45,14 +45,19 @@
         <maven.compiler.target>11</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
-        <netty.version>4.2.9.Final</netty.version>
-        <brotli4j.version>1.18.0</brotli4j.version>
-        <slf4j.version>2.0.16</slf4j.version>
-        <zstd-jni.version>1.5.7-2</zstd-jni.version>
+        <netty.version>4.2.10.Final</netty.version>
+        <brotli4j.version>1.20.0</brotli4j.version>
+        <slf4j.version>2.0.17</slf4j.version>
+        <zstd-jni.version>1.5.7-7</zstd-jni.version>
         <activation.version>2.0.1</activation.version>
-        <logback.version>1.5.18</logback.version>
-        <jetbrains-annotations.version>26.0.2</jetbrains-annotations.version>
-        <testcontainers.version>2.0.1</testcontainers.version>
+        <logback.version>1.5.32</logback.version>
+        <jetbrains-annotations.version>26.1.0</jetbrains-annotations.version>
+        <testcontainers.version>2.0.3</testcontainers.version>
+
+        <!-- Versions with JDK-specific overrides in profiles below -->
+        <junit-bom.version>5.13.0</junit-bom.version>
+        <errorprone.version>2.31.0</errorprone.version>
+        <nullaway.version>0.12.6</nullaway.version>
     </properties>
 
     <developers>
@@ -102,7 +107,7 @@
             <dependency>
                 <groupId>org.junit</groupId>
                 <artifactId>junit-bom</artifactId>
-                <version>5.13.0</version>
+                <version>${junit-bom.version}</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
@@ -296,7 +301,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>3.14.1</version>
+                <version>3.15.0</version>
                 <configuration>
                     <source>11</source>
                     <target>11</target>
@@ -325,14 +330,13 @@
                         <path>
                             <groupId>com.google.errorprone</groupId>
                             <artifactId>error_prone_core</artifactId>
-                            <version>2.31.0</version>
+                            <version>${errorprone.version}</version>
                         </path>
                         <path>
                             <groupId>com.uber.nullaway</groupId>
                             <artifactId>nullaway</artifactId>
-                            <version>0.12.6</version>
+                            <version>${nullaway.version}</version>
                         </path>
-                        <!-- Other annotation processors go here -->
                     </annotationProcessorPaths>
                 </configuration>
             </plugin>
@@ -340,7 +344,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.5.2</version>
+                <version>3.5.5</version>
                 <configuration>
                     <argLine>
                         @{argLine} --add-exports java.base/jdk.internal.misc=ALL-UNNAMED
@@ -351,7 +355,7 @@
             <plugin>
                 <groupId>org.jacoco</groupId>
                 <artifactId>jacoco-maven-plugin</artifactId>
-                <version>0.8.12</version>
+                <version>0.8.14</version>
                 <executions>
                     <execution>
                         <goals>
@@ -371,7 +375,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-source-plugin</artifactId>
-                <version>3.2.1</version>
+                <version>3.4.0</version>
                 <executions>
                     <execution>
                         <goals>
@@ -384,7 +388,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-javadoc-plugin</artifactId>
-                <version>3.11.1</version>
+                <version>3.12.0</version>
                 <executions>
                     <execution>
                         <id>attach-javadocs</id>
@@ -398,7 +402,7 @@
             <plugin>
                 <groupId>org.sonatype.central</groupId>
                 <artifactId>central-publishing-maven-plugin</artifactId>
-                <version>0.8.0</version>
+                <version>0.10.0</version>
                 <extensions>true</extensions>
                 <configuration>
                     <publishingServerId>central</publishingServerId>
@@ -408,7 +412,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-gpg-plugin</artifactId>
-                <version>3.2.7</version>
+                <version>3.2.8</version>
                 <executions>
                     <execution>
                         <id>sign-artifacts</id>
@@ -431,12 +435,12 @@
             <plugin>
                 <groupId>org.revapi</groupId>
                 <artifactId>revapi-maven-plugin</artifactId>
-                <version>0.15.0</version>
+                <version>0.15.1</version>
                 <dependencies>
                     <dependency>
                         <groupId>org.revapi</groupId>
                         <artifactId>revapi-java</artifactId>
-                        <version>0.28.1</version>
+                        <version>0.28.4</version>
                     </dependency>
                 </dependencies>
                 <configuration>
@@ -482,11 +486,27 @@
     </build>
 
     <profiles>
+        <!-- JDK 17+: use JUnit 6 (requires JDK 17+) -->
         <profile>
-            <id>errorprone-jdk25</id>
+            <id>jdk17+</id>
             <activation>
-                <jdk>[25,)</jdk>
+                <jdk>[17,)</jdk>
             </activation>
+            <properties>
+                <junit-bom.version>6.0.3</junit-bom.version>
+            </properties>
+        </profile>
+
+        <!-- JDK 21+: use Error Prone 2.48.0 and NullAway 0.13.1 (require JDK 21+) -->
+        <profile>
+            <id>jdk21+</id>
+            <activation>
+                <jdk>[21,)</jdk>
+            </activation>
+            <properties>
+                <errorprone.version>2.48.0</errorprone.version>
+                <nullaway.version>0.13.1</nullaway.version>
+            </properties>
             <build>
                 <plugins>
                     <plugin>
@@ -495,19 +515,8 @@
                         <configuration>
                             <compilerArgs combine.children="append">
                                 <arg>--should-stop=ifError=FLOW</arg>
+                                <arg>-XDaddTypeAnnotationsToSymbol=true</arg>
                             </compilerArgs>
-                            <annotationProcessorPaths combine.self="override">
-                                <path>
-                                    <groupId>com.google.errorprone</groupId>
-                                    <artifactId>error_prone_core</artifactId>
-                                    <version>2.48.0</version>
-                                </path>
-                                <path>
-                                    <groupId>com.uber.nullaway</groupId>
-                                    <artifactId>nullaway</artifactId>
-                                    <version>0.13.1</version>
-                                </path>
-                            </annotationProcessorPaths>
                         </configuration>
                     </plugin>
                 </plugins>