diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 5c50e4b..a965570 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -15,7 +15,7 @@ jobs:
   suite:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Unit suite
         run: docker build --target test .
       - name: Live iya-sts
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d020733..3035f48 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -57,7 +57,7 @@ jobs:
           fi
 
       # Every tag: the last release's tag is what the decision compares with.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         if: steps.gate.outputs.publish == 'true'
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 3525a9c..98a7dc0 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -15,5 +15,5 @@ jobs:
     name: Library tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - run: docker build --target test .
diff --git a/CLAUDE.md b/CLAUDE.md
index 6d64c1f..ca2cb6b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -20,7 +20,7 @@ Request bindings are `redirect` and `post`. Response bindings are `post`, `redir
 docker build --target test .
 ```
 
-The `test` stage runs `mvn -B test` in `maven:3.9.6-eclipse-temurin-17`, with `python3` and `openssl` installed for `TrustChainTest` (the install script's code and `scripts/trust_chain.py` write the four-certificate chain to `idpCa`'s path; the library trusts the provider and a reissued leaf through that file, and refuses a forged leaf followed by the real CA certificates and the right chain under the wrong host name). GitHub Actions uses that command. Do not run Maven on the host. The demo stage packages with `-DskipTests` in its own Maven image. Signatures and decryption are real (JDK ciphers, Apache Santuario exclusive canonicalization). Nimbus JOSE verifies Shared Signals JWS only. The stub identity provider is in `src/test/java/com/iyasec/saml/StubIdp.java`. The stub tests do not start iya-sts. Java 17.
+The `test` stage runs `mvn -B test` in `maven:3.9-eclipse-temurin-26`, with `python3` and `openssl` installed for `TrustChainTest` (the install script's code and `scripts/trust_chain.py` write the four-certificate chain to `idpCa`'s path; the library trusts the provider and a reissued leaf through that file, and refuses a forged leaf followed by the real CA certificates and the right chain under the wrong host name). GitHub Actions uses that command. Do not run Maven on the host. The demo stage packages with `-DskipTests` in its own Maven image. Signatures and decryption are real (JDK ciphers, Apache Santuario exclusive canonicalization). Nimbus JOSE verifies Shared Signals JWS only. The stub identity provider is in `src/test/java/com/iyasec/saml/StubIdp.java`. The stub tests do not start iya-sts. Java 25.
 
 `python3 scripts/live_iya_sts.py` signs the demo in to iya-sts and checks credential-change and session-revoked on `GET /live-status`. It builds the demo the way a user does: in a scratch copy of the checkout, the install script first (writing the key pair, the metadata and the `idpCa` chain; its Java CLI runs in the demo image), then the image build, then the run with only `sp.key`, `sp.crt` and `idp-metadata.xml` mounted. No CA mount, no `idpCa` rewrite; it checks the image holds the chain and no key. Secrets go to docker as `-e NAME`; no log line carries a sign-in URL. The nightly workflow runs the unit suite and that script once every 24 hours. Neither binds port 3000, 8081 or 18481-18495; the defaults are 18555 and 18655. Push CI stays the unit suite.
 
diff --git a/Dockerfile b/Dockerfile
index 4032b63..8afc890 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,7 +4,7 @@
 
 # `docker build --target test` runs the suite in this image.
 # The demo image below does not run it.
-FROM maven:3.9.6-eclipse-temurin-17 AS test
+FROM maven:3.9-eclipse-temurin-26 AS test
 # TrustChainTest runs the install script's trust-chain code: python3, and the
 # openssl CLI it reads certificate names with.
 RUN apt-get update && apt-get install -y --no-install-recommends python3 openssl && rm -rf /var/lib/apt/lists/*
@@ -19,7 +19,7 @@ COPY scripts scripts
 COPY demo/saml.json demo/saml.json
 RUN mvn -B test
 
-FROM maven:3.9.6-eclipse-temurin-17 AS build
+FROM maven:3.9-eclipse-temurin-26 AS build
 WORKDIR /src
 COPY pom.xml .
 COPY library library
@@ -27,7 +27,7 @@ COPY demo/pom.xml demo/pom.xml
 COPY demo/src demo/src
 # The demo module copies its runtime dependencies, the library among them, to demo/target/dependency.
 RUN mvn -B -DskipTests package
-FROM eclipse-temurin:17-jre
+FROM eclipse-temurin:25-jre
 WORKDIR /app
 # The demo's jar under the name the image has always run, and beside it every
 # runtime dependency, the library jar among them (com.iyasec.saml.Cli is there).
diff --git a/demo/pom.xml b/demo/pom.xml
index 6ed0308..c82a20e 100644
--- a/demo/pom.xml
+++ b/demo/pom.xml
@@ -19,7 +19,7 @@
     <dependency>
       <groupId>org.junit.jupiter</groupId>
       <artifactId>junit-jupiter</artifactId>
-      <version>5.10.2</version>
+      <version>6.1.3</version>
       <scope>test</scope>
     </dependency>
   </dependencies>
@@ -27,14 +27,14 @@
     <plugins>
       <plugin>
         <artifactId>maven-compiler-plugin</artifactId>
-        <version>3.11.0</version>
+        <version>3.16.0</version>
         <configuration>
           <release>17</release>
         </configuration>
       </plugin>
       <plugin>
         <artifactId>maven-surefire-plugin</artifactId>
-        <version>3.2.5</version>
+        <version>3.6.1</version>
         <configuration>
           <!-- TrustChainTest runs scripts/ and reads demo/saml.json from the repository root. -->
           <workingDirectory>${project.basedir}/..</workingDirectory>
@@ -45,7 +45,7 @@
              compiled into the test classpaths only, never into a published jar. -->
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>build-helper-maven-plugin</artifactId>
-        <version>3.6.0</version>
+        <version>3.6.2</version>
         <executions>
           <execution>
             <id>test-fixtures</id>
@@ -60,14 +60,14 @@
       <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>exec-maven-plugin</artifactId>
-        <version>3.1.0</version>
+        <version>3.6.4</version>
         <configuration>
           <mainClass>com.iyasec.saml.demo.Demo</mainClass>
         </configuration>
       </plugin>
       <plugin>
         <artifactId>maven-dependency-plugin</artifactId>
-        <version>3.6.1</version>
+        <version>3.11.0</version>
         <executions>
           <execution>
             <id>copy-dependencies</id>
diff --git a/library/pom.xml b/library/pom.xml
index d8142f3..a07b614 100644
--- a/library/pom.xml
+++ b/library/pom.xml
@@ -38,17 +38,17 @@
     <dependency>
       <groupId>org.apache.santuario</groupId>
       <artifactId>xmlsec</artifactId>
-      <version>2.3.4</version>
+      <version>4.0.4</version>
     </dependency>
     <dependency>
       <groupId>com.nimbusds</groupId>
       <artifactId>nimbus-jose-jwt</artifactId>
-      <version>10.0.2</version>
+      <version>10.10</version>
     </dependency>
     <dependency>
       <groupId>org.junit.jupiter</groupId>
       <artifactId>junit-jupiter</artifactId>
-      <version>5.10.2</version>
+      <version>6.1.3</version>
       <scope>test</scope>
     </dependency>
   </dependencies>
@@ -56,21 +56,21 @@
     <plugins>
       <plugin>
         <artifactId>maven-compiler-plugin</artifactId>
-        <version>3.11.0</version>
+        <version>3.16.0</version>
         <configuration>
           <release>17</release>
         </configuration>
       </plugin>
       <plugin>
         <artifactId>maven-surefire-plugin</artifactId>
-        <version>3.2.5</version>
+        <version>3.6.1</version>
       </plugin>
       <plugin>
         <!-- StubIdp: a test fixture this module's tests and the demo's share. It is
              compiled into the test classpaths only, never into a published jar. -->
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>build-helper-maven-plugin</artifactId>
-        <version>3.6.0</version>
+        <version>3.6.2</version>
         <executions>
           <execution>
             <id>test-fixtures</id>
@@ -99,7 +99,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-source-plugin</artifactId>
-            <version>3.3.1</version>
+            <version>3.4.0</version>
             <executions>
               <execution>
                 <id>attach-sources</id>
@@ -110,7 +110,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-javadoc-plugin</artifactId>
-            <version>3.11.2</version>
+            <version>3.12.0</version>
             <configuration>
               <!-- Missing comments are not errors; malformed ones still are. -->
               <doclint>all,-missing</doclint>
@@ -125,7 +125,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-gpg-plugin</artifactId>
-            <version>3.2.7</version>
+            <version>3.2.8</version>
             <configuration>
               <signer>bc</signer>
             </configuration>