diff --git a/plugin/RemoteCI.Plugin/RemoteCI.Plugin.csproj b/plugin/RemoteCI.Plugin/RemoteCI.Plugin.csproj
index 6935b3c..f079a59 100644
--- a/plugin/RemoteCI.Plugin/RemoteCI.Plugin.csproj
+++ b/plugin/RemoteCI.Plugin/RemoteCI.Plugin.csproj
@@ -33,7 +33,7 @@
       <ExcludeAssets>runtime; native</ExcludeAssets>
     </PackageReference>
     <!-- ClassIsland SDK 经 Avalonia 传入的 0.21.2 存在 GHSA-xrw6-gwf8-vvr9；固定到兼容分支的修复版。 -->
-    <PackageReference Include="Tmds.DBus.Protocol" Version="0.21.3">
+    <PackageReference Include="Tmds.DBus.Protocol" Version="0.95.2">
       <ExcludeAssets>runtime; native</ExcludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
@@ -49,9 +49,9 @@
       <ExcludeAssets>runtime; native</ExcludeAssets>
     </PackageReference>
     <!-- NAudio.Wasapi：通过 Windows Core Audio 读取和控制默认播放设备的主音量。 -->
-    <PackageReference Include="NAudio.Wasapi" Version="2.3.0" />
+    <PackageReference Include="NAudio.Wasapi" Version="2.4.0" />
     <!-- DPAPI（Windows 数据保护接口）：加密插件长期凭据；非 Windows 时按明文回退。 -->
-    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="8.0.0" />
+    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.14" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/plugin/tests/RemoteCI.Plugin.Tests/RemoteCI.Plugin.Tests.csproj b/plugin/tests/RemoteCI.Plugin.Tests/RemoteCI.Plugin.Tests.csproj
index 1c50553..674a2d5 100644
--- a/plugin/tests/RemoteCI.Plugin.Tests/RemoteCI.Plugin.Tests.csproj
+++ b/plugin/tests/RemoteCI.Plugin.Tests/RemoteCI.Plugin.Tests.csproj
@@ -12,10 +12,10 @@
   <ItemGroup>
     <PackageReference Include="ClassIsland.PluginSdk" Version="2.1.0.1" />
     <!-- 与插件项目保持同一安全覆盖版本，避免测试依赖图回退到有漏洞的 0.21.2。 -->
-    <PackageReference Include="Tmds.DBus.Protocol" Version="0.21.3" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
+    <PackageReference Include="Tmds.DBus.Protocol" Version="0.95.2" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.1" />
     <!-- 只读程序集元数据，用于 PluginApiCompatibilityTests 核对插件对新版宿主的二进制引用。 -->
     <PackageReference Include="Mono.Cecil" Version="0.11.6" PrivateAssets="all" />
   </ItemGroup>
diff --git a/server/RemoteCI.Server/RemoteCI.Server.csproj b/server/RemoteCI.Server/RemoteCI.Server.csproj
index 0ef7340..d35cf29 100644
--- a/server/RemoteCI.Server/RemoteCI.Server.csproj
+++ b/server/RemoteCI.Server/RemoteCI.Server.csproj
@@ -31,14 +31,14 @@
 
   <ItemGroup>
     <PackageReference Include="ClosedXML" Version="0.105.1" />
-    <PackageReference Include="Markdig" Version="1.4.0" />
+    <PackageReference Include="Markdig" Version="1.5.1" />
     <!-- Identity、SQLite provider 和 Design 保持同一 EF Core 补丁版本，避免测试依赖图出现 CS1705。 -->
-    <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.13" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.13" />
-    <PackageReference Include="QRCoder" Version="1.7.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.14" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.14" />
+    <PackageReference Include="QRCoder" Version="1.8.1" />
     <!-- 显式引用（≥ 2.1.12）覆盖 EF 的易受攻击传递版本 2.1.11。 -->
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.13" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.13">
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.5" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.14">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
diff --git a/server/tests/RemoteCI.Server.Tests/RemoteCI.Server.Tests.csproj b/server/tests/RemoteCI.Server.Tests/RemoteCI.Server.Tests.csproj
index 9c8688a..054f5b1 100644
--- a/server/tests/RemoteCI.Server.Tests/RemoteCI.Server.Tests.csproj
+++ b/server/tests/RemoteCI.Server.Tests/RemoteCI.Server.Tests.csproj
@@ -10,10 +10,10 @@
 
   <ItemGroup>
     <PackageReference Include="ClosedXML" Version="0.105.1" />
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.13" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.14" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.1" />
   </ItemGroup>
 
   <ItemGroup>