diff --git a/.github/workflows/create_release.yml b/.github/workflows/create_release.yml
index a7958d8f..972f6f18 100644
--- a/.github/workflows/create_release.yml
+++ b/.github/workflows/create_release.yml
@@ -10,21 +10,21 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   create_release:
-    runs-on: ubuntu-22.04  # newest available distribution, aka jellyfish
+    runs-on: ubuntu-24.04  # newest available distribution, aka noble
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # Prevent use of implicit GitHub Actions read-only GITHUB_TOKEN
           # because maven-release-plugin pushes commits to master.
           token: ${{ secrets.GH_TOKEN }}
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '11'  # last that can compile the 1.6 release profile
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-jdk-11-maven-${{ hashFiles('**/pom.xml') }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 41704b49..8c0656b5 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -16,7 +16,7 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   deploy:
     name: deploy (${{ matrix.name }})
-    runs-on: ubuntu-22.04  # newest available distribution, aka jellyfish
+    runs-on: ubuntu-24.04  # newest available distribution, aka noble
     strategy:
       fail-fast: false  # don't fail fast as we can re-run one job that failed
       matrix:
@@ -29,14 +29,14 @@ jobs:
             deploy_script: build-bin/deploy_bom
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '11'  # last that can compile the 1.6 release profile
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-jdk-11-maven-${{ hashFiles('**/pom.xml') }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index fe58404d..fcb7330f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -24,12 +24,12 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   lint:
     name: lint
-    runs-on: ubuntu-22.04  # newest available distribution, aka jellyfish
+    runs-on: ubuntu-24.04  # newest available distribution, aka noble
     # skip commits made by the release plugin
     if: "!contains(github.event.head_commit.message, 'maven-release-plugin')"
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Lint
         run: |
           build-bin/configure_lint
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index a7847fc8..d94ea653 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -23,20 +23,20 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   security:
     name: security
-    runs-on: ubuntu-22.04  # newest available distribution, aka jellyfish
+    runs-on: ubuntu-24.04  # newest available distribution, aka noble
     # skip commits made by the release plugin
     if: "!contains(github.event.head_commit.message, 'maven-release-plugin')"
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
-      - uses: actions/cache@v4
+        uses: actions/checkout@v6
+      - uses: actions/cache@v5
         name: Cache Trivy Database
         with:
           path: .trivy
           key: ${{ runner.os }}-trivy
           restore-keys: ${{ runner.os }}-trivy
       - name: Run Trivy vulnerability and secret scanner
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@v0.35.0
         id: trivy
         with:
           scan-type: 'fs'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a9c1ff9e..5a9ff7b1 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -23,7 +23,7 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   test:
     name: test (JDK ${{ matrix.java_version }})
-    runs-on: ubuntu-22.04  # newest available distribution, aka jellyfish
+    runs-on: ubuntu-24.04  # newest available distribution, aka noble
     # skip commits made by the release plugin
     if: "!contains(github.event.head_commit.message, 'maven-release-plugin')"
     strategy:
@@ -32,17 +32,17 @@ jobs:
         include:
           - java_version: '11'  # last that can compile the 1.6 release profile
             maven_args: -Prelease -Dgpg.skip
-          - java_version: '21'  # Most recent LTS
+          - java_version: '25'  # Most recent LTS
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: ${{ matrix.java_version }}
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           # yamllint disable-line rule:line-length
diff --git a/.mvn/wrapper/maven-wrapper.jar b/.mvn/wrapper/maven-wrapper.jar
index 7967f30d..eebc3c18 100644
Binary files a/.mvn/wrapper/maven-wrapper.jar and b/.mvn/wrapper/maven-wrapper.jar differ
diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties
index 9548abd8..203e1088 100644
--- a/.mvn/wrapper/maven-wrapper.properties
+++ b/.mvn/wrapper/maven-wrapper.properties
@@ -1,20 +1,4 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-wrapperVersion=3.3.2
+wrapperVersion=3.3.4
 distributionType=bin
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip
-wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.14/apache-maven-3.9.14-bin.zip
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar
diff --git a/activemq-client/pom.xml b/activemq-client/pom.xml
index 487a184a..93d6fee7 100644
--- a/activemq-client/pom.xml
+++ b/activemq-client/pom.xml
@@ -24,7 +24,7 @@
     <!-- Be conscious about a 6.x upgrade: 5.x and 6.x types are incompatible
          as the former uses javax.jms and latter jakarta.jms. It could be
          better to make an activemq-client6 module. -->
-    <activemq.version>5.18.7</activemq.version>
+    <activemq.version>5.19.2</activemq.version>
   </properties>
 
   <dependencies>
@@ -50,7 +50,7 @@
 
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
diff --git a/activemq-client/src/test/java/zipkin2/reporter/activemq/ActiveMQContainer.java b/activemq-client/src/test/java/zipkin2/reporter/activemq/ActiveMQContainer.java
index eeb808de..da2e729f 100644
--- a/activemq-client/src/test/java/zipkin2/reporter/activemq/ActiveMQContainer.java
+++ b/activemq-client/src/test/java/zipkin2/reporter/activemq/ActiveMQContainer.java
@@ -19,7 +19,7 @@ final class ActiveMQContainer extends GenericContainer<ActiveMQContainer> {
   static final int ACTIVEMQ_PORT = 61616;
 
   ActiveMQContainer() {
-    super(parse("ghcr.io/openzipkin/zipkin-activemq:3.4.3"));
+    super(parse("ghcr.io/openzipkin/zipkin-activemq:3.6.0"));
     withExposedPorts(ACTIVEMQ_PORT);
     waitStrategy = Wait.forListeningPorts(ACTIVEMQ_PORT);
     withStartupTimeout(Duration.ofSeconds(60));
diff --git a/amqp-client/pom.xml b/amqp-client/pom.xml
index 53dd8274..2eec5c99 100644
--- a/amqp-client/pom.xml
+++ b/amqp-client/pom.xml
@@ -22,7 +22,7 @@
     <module.name>zipkin2.reporter.amqp</module.name>
 
     <main.basedir>${project.basedir}/..</main.basedir>
-    <amqp-client.version>5.25.0</amqp-client.version>
+    <amqp-client.version>5.29.0</amqp-client.version>
     <!-- Last pre-1.8 version -->
     <floor-amqp-client.version>4.12.0</floor-amqp-client.version>
   </properties>
@@ -50,7 +50,7 @@
 
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
diff --git a/amqp-client/src/it/amqp_v4/pom.xml b/amqp-client/src/it/amqp_v4/pom.xml
index acf42ac2..989449df 100644
--- a/amqp-client/src/it/amqp_v4/pom.xml
+++ b/amqp-client/src/it/amqp_v4/pom.xml
@@ -63,7 +63,7 @@
 
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>@testcontainers.version@</version>
     </dependency>
 
diff --git a/amqp-client/src/test/java/zipkin2/reporter/amqp/RabbitMQContainer.java b/amqp-client/src/test/java/zipkin2/reporter/amqp/RabbitMQContainer.java
index bd9f91fd..1077cd7f 100644
--- a/amqp-client/src/test/java/zipkin2/reporter/amqp/RabbitMQContainer.java
+++ b/amqp-client/src/test/java/zipkin2/reporter/amqp/RabbitMQContainer.java
@@ -20,7 +20,7 @@ final class RabbitMQContainer extends GenericContainer<RabbitMQContainer> {
   static final int RABBIT_PORT = 5672;
 
   RabbitMQContainer() {
-    super(parse("ghcr.io/openzipkin/zipkin-rabbitmq:3.4.3"));
+    super(parse("ghcr.io/openzipkin/zipkin-rabbitmq:3.6.0"));
     withExposedPorts(RABBIT_PORT);
     waitStrategy = Wait.forLogMessage(".*Server startup complete.*", 1);
     withStartupTimeout(Duration.ofSeconds(60));
diff --git a/benchmarks/pom.xml b/benchmarks/pom.xml
index 4e9bafce..517d9fd7 100644
--- a/benchmarks/pom.xml
+++ b/benchmarks/pom.xml
@@ -99,13 +99,13 @@
       <groupId>com.linecorp.armeria</groupId>
       <artifactId>armeria</artifactId>
       <!-- match Zipkin version to avoid classpath problems -->
-      <version>1.31.3</version>
+      <version>1.37.0</version>
       <scope>test</scope>
     </dependency>
 
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
diff --git a/benchmarks/src/test/java/zipkin2/reporter/KafkaSenderBenchmarks.java b/benchmarks/src/test/java/zipkin2/reporter/KafkaSenderBenchmarks.java
index 5d638cdb..08d31ea8 100644
--- a/benchmarks/src/test/java/zipkin2/reporter/KafkaSenderBenchmarks.java
+++ b/benchmarks/src/test/java/zipkin2/reporter/KafkaSenderBenchmarks.java
@@ -33,7 +33,7 @@ public class KafkaSenderBenchmarks extends SenderBenchmarks {
 
   static final class KafkaContainer extends GenericContainer<KafkaContainer> {
     KafkaContainer() {
-      super(parse("ghcr.io/openzipkin/zipkin-kafka:3.4.3"));
+      super(parse("ghcr.io/openzipkin/zipkin-kafka:3.6.0"));
       waitStrategy = Wait.forHealthcheck();
       // Kafka broker listener port (19092) needs to be exposed for test cases to access it.
       addFixedExposedPort(KAFKA_PORT, KAFKA_PORT, InternetProtocol.TCP);
diff --git a/benchmarks/src/test/java/zipkin2/reporter/PulsarSenderBenchmarks.java b/benchmarks/src/test/java/zipkin2/reporter/PulsarSenderBenchmarks.java
index d76f8f2c..29ea8147 100644
--- a/benchmarks/src/test/java/zipkin2/reporter/PulsarSenderBenchmarks.java
+++ b/benchmarks/src/test/java/zipkin2/reporter/PulsarSenderBenchmarks.java
@@ -34,7 +34,7 @@ static final class PulsarContainer extends GenericContainer<PulsarContainer> {
     static final int BROKER_HTTP_PORT = 8080;
 
     PulsarContainer() {
-      super(parse("ghcr.io/openzipkin/zipkin-pulsar:3.4.3"));
+      super(parse("ghcr.io/openzipkin/zipkin-pulsar:3.6.0"));
       withExposedPorts(BROKER_PORT, BROKER_HTTP_PORT);
       String cmd = "/pulsar/bin/apply-config-from-env.py /pulsar/conf/standalone.conf " +
           "&& bin/pulsar standalone " +
diff --git a/build-bin/configure_lint b/build-bin/configure_lint
index 9273e529..a6ce8d11 100755
--- a/build-bin/configure_lint
+++ b/build-bin/configure_lint
@@ -5,4 +5,4 @@
 markdown-link-check -V || npm install -g markdown-link-check@3.12.2
 
 # Attempt to install yamllint if absent
-yamllint || pip install --user yamllint
+yamllint -v || pip install --user yamllint
diff --git a/kafka/pom.xml b/kafka/pom.xml
index 20592e79..90bb1903 100644
--- a/kafka/pom.xml
+++ b/kafka/pom.xml
@@ -43,12 +43,12 @@
       <groupId>org.apache.kafka</groupId>
       <artifactId>kafka-clients</artifactId>
       <!-- recent clients can talk to old 0.10 brokers -->
-      <version>3.9.1</version>
+      <version>3.9.2</version>
     </dependency>
 
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
diff --git a/kafka/src/test/java/zipkin2/reporter/kafka/KafkaContainer.java b/kafka/src/test/java/zipkin2/reporter/kafka/KafkaContainer.java
index 5612325f..aeda43ff 100644
--- a/kafka/src/test/java/zipkin2/reporter/kafka/KafkaContainer.java
+++ b/kafka/src/test/java/zipkin2/reporter/kafka/KafkaContainer.java
@@ -28,7 +28,7 @@ final class KafkaContainer extends GenericContainer<KafkaContainer> {
   static final int KAFKA_PORT = 19092;
 
   KafkaContainer() {
-    super(parse("ghcr.io/openzipkin/zipkin-kafka:3.4.3"));
+    super(parse("ghcr.io/openzipkin/zipkin-kafka:3.6.0"));
     waitStrategy = Wait.forHealthcheck();
     // Kafka broker listener port (19092) needs to be exposed for test cases to access it.
     addFixedExposedPort(KAFKA_PORT, KAFKA_PORT, InternetProtocol.TCP);
diff --git a/libthrift/pom.xml b/libthrift/pom.xml
index e9e78b68..2bcd85ae 100644
--- a/libthrift/pom.xml
+++ b/libthrift/pom.xml
@@ -47,12 +47,12 @@
            common in libthrift and lead to rev-lock. As scribe is a deprecated
            transport in Zipkin, it is ok to update this to a signature breaking
            version on minor, but increment to the next minor in the PR. -->
-      <version>0.21.0</version>
+      <version>0.22.0</version>
     </dependency>
 
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
diff --git a/libthrift/src/test/java/zipkin2/reporter/libthrift/ZipkinContainer.java b/libthrift/src/test/java/zipkin2/reporter/libthrift/ZipkinContainer.java
index ff25ed29..12c21924 100644
--- a/libthrift/src/test/java/zipkin2/reporter/libthrift/ZipkinContainer.java
+++ b/libthrift/src/test/java/zipkin2/reporter/libthrift/ZipkinContainer.java
@@ -22,7 +22,7 @@ final class ZipkinContainer extends GenericContainer<ZipkinContainer> {
   static final int HTTP_PORT = 9411;
 
   ZipkinContainer() {
-    super(parse("ghcr.io/openzipkin/zipkin:3.4.3"));
+    super(parse("ghcr.io/openzipkin/zipkin:3.6.0"));
     // zipkin-server disables scribe by default.
     withEnv("COLLECTOR_SCRIBE_ENABLED", "true");
     withExposedPorts(SCRIBE_PORT, HTTP_PORT);
diff --git a/metrics-micrometer/pom.xml b/metrics-micrometer/pom.xml
index 2c1e8f95..6442a466 100644
--- a/metrics-micrometer/pom.xml
+++ b/metrics-micrometer/pom.xml
@@ -22,7 +22,7 @@
     <module.name>zipkin2.reporter.metrics.micrometer</module.name>
 
     <main.basedir>${project.basedir}/..</main.basedir>
-    <micrometer.version>1.14.7</micrometer.version>
+    <micrometer.version>1.16.4</micrometer.version>
   </properties>
 
   <dependencies>
diff --git a/mvnw b/mvnw
index 5e9618ca..1ddd97b9 100755
--- a/mvnw
+++ b/mvnw
@@ -19,7 +19,7 @@
 # ----------------------------------------------------------------------------
 
 # ----------------------------------------------------------------------------
-# Apache Maven Wrapper startup batch script, version 3.3.2
+# Apache Maven Wrapper startup batch script, version 3.3.4
 #
 # Required ENV vars:
 # ------------------
@@ -201,6 +201,14 @@ MAVEN_PROJECTBASEDIR=${MAVEN_BASEDIR:-"$BASE_DIR"}
 export MAVEN_PROJECTBASEDIR
 log "$MAVEN_PROJECTBASEDIR"
 
+trim() {
+  # MWRAPPER-139:
+  #   Trims trailing and leading whitespace, carriage returns, tabs, and linefeeds.
+  #   Needed for removing poorly interpreted newline sequences when running in more
+  #   exotic environments such as mingw bash on Windows.
+  printf "%s" "${1}" | tr -d '[:space:]'
+}
+
 ##########################################################################################
 # Extension to allow automatically downloading the maven-wrapper.jar from Maven-central
 # This allows using the maven wrapper in projects that prohibit checking in binary data.
@@ -212,15 +220,13 @@ else
   log "Couldn't find $wrapperJarPath, downloading it ..."
 
   if [ -n "$MVNW_REPOURL" ]; then
-    wrapperUrl="$MVNW_REPOURL/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
+    wrapperUrl="$MVNW_REPOURL/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar"
   else
-    wrapperUrl="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
+    wrapperUrl="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar"
   fi
   while IFS="=" read -r key value; do
-    # Remove '\r' from value to allow usage on windows as IFS does not consider '\r' as a separator ( considers space, tab, new line ('\n'), and custom '=' )
-    safeValue=$(echo "$value" | tr -d '\r')
     case "$key" in wrapperUrl)
-      wrapperUrl="$safeValue"
+      wrapperUrl=$(trim "${value-}")
       break
       ;;
     esac
@@ -235,17 +241,17 @@ else
     log "Found wget ... using wget"
     [ "$MVNW_VERBOSE" = true ] && QUIET="" || QUIET="--quiet"
     if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then
-      wget $QUIET "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
+      wget ${QUIET:+"$QUIET"} "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
     else
-      wget $QUIET --http-user="$MVNW_USERNAME" --http-password="$MVNW_PASSWORD" "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
+      wget ${QUIET:+"$QUIET"} --http-user="$MVNW_USERNAME" --http-password="$MVNW_PASSWORD" "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
     fi
   elif command -v curl >/dev/null; then
     log "Found curl ... using curl"
     [ "$MVNW_VERBOSE" = true ] && QUIET="" || QUIET="--silent"
     if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then
-      curl $QUIET -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
+      curl ${QUIET:+"$QUIET"} -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
     else
-      curl $QUIET --user "$MVNW_USERNAME:$MVNW_PASSWORD" -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
+      curl ${QUIET:+"$QUIET"} --user "$MVNW_USERNAME:$MVNW_PASSWORD" -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
     fi
   else
     log "Falling back to using Java to download"
@@ -276,7 +282,7 @@ fi
 wrapperSha256Sum=""
 while IFS="=" read -r key value; do
   case "$key" in wrapperSha256Sum)
-    wrapperSha256Sum=$value
+    wrapperSha256Sum=$(trim "${value-}")
     break
     ;;
   esac
@@ -284,7 +290,7 @@ done <"$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.properties"
 if [ -n "$wrapperSha256Sum" ]; then
   wrapperSha256Result=false
   if command -v sha256sum >/dev/null; then
-    if echo "$wrapperSha256Sum  $wrapperJarPath" | sha256sum -c >/dev/null 2>&1; then
+    if echo "$wrapperSha256Sum  $wrapperJarPath" | sha256sum -c - >/dev/null 2>&1; then
       wrapperSha256Result=true
     fi
   elif command -v shasum >/dev/null; then
diff --git a/mvnw.cmd b/mvnw.cmd
index 1204076a..c453424c 100644
--- a/mvnw.cmd
+++ b/mvnw.cmd
@@ -18,7 +18,7 @@
 @REM ----------------------------------------------------------------------------
 
 @REM ----------------------------------------------------------------------------
-@REM Apache Maven Wrapper startup batch script, version 3.3.2
+@REM Apache Maven Wrapper startup batch script, version 3.3.4
 @REM
 @REM Required ENV vars:
 @REM JAVA_HOME - location of a JDK home dir
@@ -119,7 +119,7 @@ SET MAVEN_JAVA_EXE="%JAVA_HOME%\bin\java.exe"
 set WRAPPER_JAR="%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.jar"
 set WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain
 
-set WRAPPER_URL="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
+set WRAPPER_URL="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar"
 
 FOR /F "usebackq tokens=1,2 delims==" %%A IN ("%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.properties") DO (
     IF "%%A"=="wrapperUrl" SET WRAPPER_URL=%%B
@@ -133,7 +133,7 @@ if exist %WRAPPER_JAR% (
     )
 ) else (
     if not "%MVNW_REPOURL%" == "" (
-        SET WRAPPER_URL="%MVNW_REPOURL%/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
+        SET WRAPPER_URL="%MVNW_REPOURL%/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar"
     )
     if "%MVNW_VERBOSE%" == "true" (
         echo Couldn't find %WRAPPER_JAR%, downloading it ...
diff --git a/pom.xml b/pom.xml
index 28585229..62458dcb 100755
--- a/pom.xml
+++ b/pom.xml
@@ -50,45 +50,45 @@
 
     <!-- override to set exclusions per-project -->
     <errorprone.args />
-    <errorprone.version>2.38.0</errorprone.version>
+    <errorprone.version>2.48.0</errorprone.version>
 
     <!-- NOTE: Do not update to 3.x as that has floor Java 8 -->
     <zipkin2.version>2.27.1</zipkin2.version>
 
     <!-- Do not set this value in bom/pom.xml to avoid cyclic pinning -->
-    <brave.version>6.1.0</brave.version>
+    <brave.version>6.3.0</brave.version>
 
-    <log4j.version>2.24.3</log4j.version>
+    <log4j.version>2.25.3</log4j.version>
     <okhttp4.version>4.12.0</okhttp4.version>
 
-    <junit-jupiter.version>5.12.2</junit-jupiter.version>
-    <mockito.version>5.18.0</mockito.version>
-    <assertj.version>3.27.3</assertj.version>
+    <junit-jupiter.version>5.14.3</junit-jupiter.version>
+    <mockito.version>5.23.0</mockito.version>
+    <assertj.version>3.27.7</assertj.version>
     <awaitility.version>4.3.0</awaitility.version>
-    <testcontainers.version>1.21.1</testcontainers.version>
+    <testcontainers.version>2.0.4</testcontainers.version>
 
     <license.skip>${skipTests}</license.skip>
 
     <go-offline-maven-plugin.version>1.2.8</go-offline-maven-plugin.version>
     <!-- TODO: cleanup any redundant ignores now also in the 4.0 release (once final) -->
     <license-maven-plugin.version>5.0.0</license-maven-plugin.version>
-    <maven-assembly-plugin.version>3.7.1</maven-assembly-plugin.version>
+    <maven-assembly-plugin.version>3.8.0</maven-assembly-plugin.version>
     <!-- NOTE: Do not update to 6.x as 5.x is the last version to support Java 11 -->
     <maven-bundle-plugin.version>5.1.9</maven-bundle-plugin.version>
-    <maven-compiler-plugin.version>3.14.0</maven-compiler-plugin.version>
+    <maven-compiler-plugin.version>3.15.0</maven-compiler-plugin.version>
     <!-- Use same version as https://github.com/openzipkin/docker-java -->
-    <maven-dependency-plugin.version>3.8.1</maven-dependency-plugin.version>
+    <maven-dependency-plugin.version>3.10.0</maven-dependency-plugin.version>
     <maven-deploy-plugin.version>3.1.4</maven-deploy-plugin.version>
-    <maven-enforcer-plugin.version>3.5.0</maven-enforcer-plugin.version>
+    <maven-enforcer-plugin.version>3.6.2</maven-enforcer-plugin.version>
     <!-- Use same version as https://github.com/openzipkin/docker-java -->
     <maven-help-plugin.version>3.5.1</maven-help-plugin.version>
     <maven-install-plugin.version>3.1.4</maven-install-plugin.version>
-    <maven-invoker-plugin.version>3.9.0</maven-invoker-plugin.version>
-    <maven-javadoc-plugin.version>3.11.2</maven-javadoc-plugin.version>
-    <maven-jar-plugin.version>3.4.2</maven-jar-plugin.version>
-    <maven-release-plugin.version>3.1.1</maven-release-plugin.version>
-    <maven-source-plugin.version>3.3.1</maven-source-plugin.version>
-    <maven-surefire-plugin.version>3.5.3</maven-surefire-plugin.version>
+    <maven-invoker-plugin.version>3.9.1</maven-invoker-plugin.version>
+    <maven-javadoc-plugin.version>3.12.0</maven-javadoc-plugin.version>
+    <maven-jar-plugin.version>3.5.0</maven-jar-plugin.version>
+    <maven-release-plugin.version>3.3.1</maven-release-plugin.version>
+    <maven-source-plugin.version>3.4.0</maven-source-plugin.version>
+    <maven-surefire-plugin.version>3.5.5</maven-surefire-plugin.version>
     <central-publishing-maven-plugin.version>0.10.0</central-publishing-maven-plugin.version>
   </properties>
 
@@ -412,7 +412,7 @@
                 <requireJavaVersion>
                   <!-- Change this to control LTS JDK versions allowed to build
                        the project. Keep in sync with .github/workflows -->
-                  <version>[11,12),[17,18),[21,22)</version>
+                  <version>[11,12),[25,26)</version>
                 </requireJavaVersion>
               </rules>
             </configuration>
@@ -426,8 +426,6 @@
         <version>${license-maven-plugin.version}</version>
         <configuration>
           <skip>${license.skip}</skip>
-          <!-- session.executionRootDirectory resolves properly even with nested modules -->
-          <header>${main.basedir}/src/etc/header.txt</header>
           <mapping>
             <!-- Don't use javadoc style as this makes code formatters break it by adding tags! -->
             <java>SLASHSTAR_STYLE</java>
@@ -445,25 +443,31 @@
             <maven_opts>SCRIPT_STYLE</maven_opts>
             <maven_release>SCRIPT_STYLE</maven_release>
           </mapping>
-          <excludes>
-            <exclude>**/log4j2.properties</exclude>
-            <exclude>.editorconfig</exclude>
-            <exclude>.gitattributes</exclude>
-            <exclude>.gitignore</exclude>
-            <exclude>.mailmap</exclude>
-            <exclude>.mvn/**</exclude>
-            <exclude>mvnw*</exclude>
-            <exclude>etc/header.txt</exclude>
-            <exclude>**/.idea/**</exclude>
-            <exclude>**/.editorconfig</exclude>
-            <exclude>LICENSE</exclude>
-            <exclude>NOTICE</exclude>
-            <exclude>**/*.md</exclude>
-            <exclude>**/*.bnd</exclude>
-            <exclude>src/test/resources/**</exclude>
-            <exclude>.github/**</exclude>
-            <exclude>build-bin/*</exclude>
-          </excludes>
+          <licenseSets>
+            <licenseSet>
+              <!-- session.executionRootDirectory resolves properly even with nested modules -->
+              <header>${main.basedir}/src/etc/header.txt</header>
+              <excludes>
+                <exclude>**/log4j2.properties</exclude>
+                <exclude>.editorconfig</exclude>
+                <exclude>.gitattributes</exclude>
+                <exclude>.gitignore</exclude>
+                <exclude>.mailmap</exclude>
+                <exclude>.mvn/**</exclude>
+                <exclude>mvnw*</exclude>
+                <exclude>etc/header.txt</exclude>
+                <exclude>**/.idea/**</exclude>
+                <exclude>**/.editorconfig</exclude>
+                <exclude>LICENSE</exclude>
+                <exclude>NOTICE</exclude>
+                <exclude>**/*.md</exclude>
+                <exclude>**/*.bnd</exclude>
+                <exclude>src/test/resources/**</exclude>
+                <exclude>.github/**</exclude>
+                <exclude>build-bin/*</exclude>
+              </excludes>
+            </licenseSet>
+          </licenseSets>
           <strictCheck>true</strictCheck>
         </configuration>
         <dependencies>
@@ -513,10 +517,10 @@
     </profile>
 
     <profile>
-      <id>error-prone-17+</id>
+      <id>error-prone-21+</id>
       <activation>
-        <!-- Only LTS versions that work with errorprone -->
-        <jdk>[17,18),[21,22)</jdk>
+        <!-- errorprone 2.48+ requires JDK 21+ (Java 21 bytecode) -->
+        <jdk>[21,)</jdk>
       </activation>
       <build>
         <plugins>
@@ -537,11 +541,12 @@
                   <goal>compile</goal>
                 </goals>
                 <configuration>
-                  <forceJavacCompilerUse>true</forceJavacCompilerUse>
+                  <forceLegacyJavacApi>true</forceLegacyJavacApi>
                   <compilerArgs>
                     <arg>-XDcompilePolicy=simple</arg>
                     <arg>--should-stop=ifError=FLOW</arg>
                     <arg>-Xplugin:ErrorProne ${errorprone.args}</arg>
+                    <arg>-XDaddTypeAnnotationsToSymbol=true</arg>
                     <!-- below needed per https://errorprone.info/docs/installation -->
                     <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED</arg>
                     <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED</arg>
@@ -585,7 +590,7 @@
 
           <plugin>
             <artifactId>maven-gpg-plugin</artifactId>
-            <version>3.1.0</version>
+            <version>3.2.8</version>
             <executions>
               <execution>
                 <id>sign-artifacts</id>
diff --git a/pulsar-client/pom.xml b/pulsar-client/pom.xml
index eff0c8f0..2e674c91 100644
--- a/pulsar-client/pom.xml
+++ b/pulsar-client/pom.xml
@@ -22,7 +22,8 @@
     <module.name>zipkin2.reporter.pulsar</module.name>
 
     <main.basedir>${project.basedir}/..</main.basedir>
-    <pulsar-client.version>4.0.5</pulsar-client.version>
+    <!-- 4.1+ is Java 17 bytecode, can't use until we floor JDK 17 -->
+    <pulsar-client.version>4.0.9</pulsar-client.version>
   </properties>
 
   <dependencies>
@@ -46,7 +47,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
diff --git a/pulsar-client/src/test/java/zipkin2/reporter/pulsar/PulsarContainer.java b/pulsar-client/src/test/java/zipkin2/reporter/pulsar/PulsarContainer.java
index bb8f986e..093434d4 100644
--- a/pulsar-client/src/test/java/zipkin2/reporter/pulsar/PulsarContainer.java
+++ b/pulsar-client/src/test/java/zipkin2/reporter/pulsar/PulsarContainer.java
@@ -20,7 +20,7 @@ final class PulsarContainer extends GenericContainer<PulsarContainer> {
   static final int BROKER_HTTP_PORT = 8080;
 
   PulsarContainer() {
-    super(parse("ghcr.io/openzipkin/zipkin-pulsar:3.4.3"));
+    super(parse("ghcr.io/openzipkin/zipkin-pulsar:3.6.0"));
     withExposedPorts(BROKER_PORT, BROKER_HTTP_PORT);
     String cmd = "/pulsar/bin/apply-config-from-env.py /pulsar/conf/standalone.conf " +
         "&& bin/pulsar standalone " +