diff --git a/docker/test-images/zipkin-eureka/pom.xml b/docker/test-images/zipkin-eureka/pom.xml
index 93725d32fa..413c723b59 100644
--- a/docker/test-images/zipkin-eureka/pom.xml
+++ b/docker/test-images/zipkin-eureka/pom.xml
@@ -29,7 +29,7 @@
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
-        <version>3.3.2</version>
+        <version>3.3.4</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
diff --git a/pom.xml b/pom.xml
index e21b85fe16..316fa70032 100755
--- a/pom.xml
+++ b/pom.xml
@@ -49,20 +49,20 @@
     <armeria.groupId>com.linecorp.armeria</armeria.groupId>
     <armeria.version>1.29.4</armeria.version>
     <!-- Match Armeria version to avoid conflicts including running tests in the IDE -->
-    <netty.version>4.1.112.Final</netty.version>
+    <netty.version>4.1.113.Final</netty.version>
 
     <!-- It's easy for Jackson dependencies to get misaligned, so we manage it ourselves. -->
     <jackson.version>2.17.2</jackson.version>
 
     <java-driver.version>4.18.1</java-driver.version>
-    <micrometer.version>1.13.3</micrometer.version>
+    <micrometer.version>1.13.4</micrometer.version>
 
     <!-- Used for Generated annotations -->
     <javax-annotation-api.version>1.3.2</javax-annotation-api.version>
 
     <!-- update together -->
-    <spring-boot.version>3.3.3</spring-boot.version>
-    <spring.version>6.1.12</spring.version>
+    <spring-boot.version>3.3.4</spring-boot.version>
+    <spring.version>6.1.13</spring.version>
 
     <!-- MySQL connector is GPL, even if it has an OSS exception.
          https://www.mysql.com/about/legal/licensing/foss-exception/
diff --git a/zipkin-lens/package-lock.json b/zipkin-lens/package-lock.json
index aa39c3884f..37805ec013 100644
--- a/zipkin-lens/package-lock.json
+++ b/zipkin-lens/package-lock.json
@@ -6051,7 +6051,7 @@
         "glob-to-regexp": "^0.4.0",
         "is-subset": "^0.1.1",
         "lodash.isequal": "^4.5.0",
-        "path-to-regexp": "^2.2.1",
+        "path-to-regexp": "^3.3.0",
         "querystring": "^0.2.0",
         "whatwg-url": "^6.5.0"
       },