diff --git a/.github/workflows/build-upstream.yml b/.github/workflows/build-upstream.yml
index b1ffeb032..880dde336 100644
--- a/.github/workflows/build-upstream.yml
+++ b/.github/workflows/build-upstream.yml
@@ -6,9 +6,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: 22
       # libgbm-dev is required by Puppeteer 3+
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8c5522493..b96db777f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -35,9 +35,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     continue-on-error: ${{ matrix.experimental }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Set up Node
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v5
       with:
         node-version: 22
     # libgbm-dev is required by Puppeteer 3+
@@ -63,9 +63,9 @@ jobs:
       matrix:
         asciidoctor-core-version: [v2.0.23, main]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: 22
       - name: Install dependencies
diff --git a/.github/workflows/documentation-notify.yml b/.github/workflows/documentation-notify.yml
index d8e8f8592..e78a1c456 100644
--- a/.github/workflows/documentation-notify.yml
+++ b/.github/workflows/documentation-notify.yml
@@ -13,7 +13,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Notify Netlify
         env:
           NETLIFY_WEBHOOK_URL: ${{ secrets.NETLIFY_WEBHOOK_URL }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5b5800f12..ad04b2bbc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,8 +10,8 @@ jobs:
     if: github.repository_owner == 'asciidoctor'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
       # libgbm-dev is required by Puppeteer 3+
@@ -34,8 +34,8 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org/
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index 253f0c5d2..f8143b4f4 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -8,9 +8,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@v5.0.0
       - name: Self-hosted Renovate
-        uses: renovatebot/github-action@v39.2.4
+        uses: renovatebot/github-action@v43.0.16
         with:
           configurationFile: renovate.json
           token: ${{ secrets.RENOVATE_TOKEN }}
diff --git a/package-lock.json b/package-lock.json
index 432d08d50..697934ae3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -12,7 +12,7 @@
         "pacote": "12.0.3",
         "prettier": "3.5.3",
         "semver": "7.7.2",
-        "sinon": "20.0.0"
+        "sinon": "21.0.0"
       },
       "engines": {
         "node": ">=22"
@@ -1633,9 +1633,9 @@
       "license": "ISC"
     },
     "node_modules/sinon": {
-      "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/sinon/-/sinon-20.0.0.tgz",
-      "integrity": "sha512-+FXOAbdnj94AQIxH0w1v8gzNxkawVvNqE3jUzRLptR71Oykeu2RrQXXl/VQjKay+Qnh73fDt/oDfMo6xMeDQbQ==",
+      "version": "21.0.0",
+      "resolved": "https://registry.npmjs.org/sinon/-/sinon-21.0.0.tgz",
+      "integrity": "sha512-TOgRcwFPbfGtpqvZw+hyqJDvqfapr1qUlOizROIk4bBLjlsjlB00Pg6wMFXNtJRpu+eCZuVOaLatG7M8105kAw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
diff --git a/package.json b/package.json
index 961f5450d..ecd314978 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,7 @@
     "pacote": "12.0.3",
     "prettier": "3.5.3",
     "semver": "7.7.2",
-    "sinon": "20.0.0"
+    "sinon": "21.0.0"
   },
   "volta": {
     "node": "22.14.0"
diff --git a/packages/core/package.json b/packages/core/package.json
index d4fa4516a..3004c99f2 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -87,27 +87,27 @@
     "unxhr": "1.2.0"
   },
   "devDependencies": {
-    "@rollup/plugin-commonjs": "25.0.7",
+    "@rollup/plugin-commonjs": "28.0.6",
     "@rollup/plugin-json": "6.1.0",
-    "@rollup/plugin-replace": "5.0.5",
-    "@types/node": "20.11.17",
+    "@rollup/plugin-replace": "6.0.2",
+    "@types/node": "24.7.1",
     "@types/nunjucks": "3.2.6",
-    "@typescript-eslint/eslint-plugin": "6.21.0",
-    "@typescript-eslint/parser": "6.21.0",
+    "@typescript-eslint/eslint-plugin": "8.46.0",
+    "@typescript-eslint/parser": "8.46.0",
     "bestikk-download": "1.0.0",
     "bestikk-fs": "1.0.0",
     "bestikk-log": "0.1.0",
     "bestikk-uglify": "3.0.1",
-    "chai": "4.4.1",
-    "cross-env": "7.0.3",
+    "chai": "6.2.0",
+    "cross-env": "10.1.0",
     "dirty-chai": "2.0.1",
     "documentation": "^14.0.0",
     "dot": "1.1.3",
     "ejs": "3.1.9",
-    "eslint": "8.56.0",
+    "eslint": "9.37.0",
     "handlebars": "4.7.8",
     "http-server": "14.1.1",
-    "mocha": "10.3.0",
+    "mocha": "11.7.4",
     "mock-http-server": "1.4.5",
     "module-alias": "2.2.3",
     "nunjucks": "3.2.4",
@@ -117,7 +117,7 @@
     "puppeteer": "24.8.2",
     "rollup": "~4.10.0",
     "rollup-plugin-dts": "^6.1.0",
-    "sinon": "17.0.1",
+    "sinon": "21.0.0",
     "standard": "17.1.0",
     "tsd": "0.30.4",
     "typescript": "5.3.3"