diff --git a/contrib/trino-connector/pom.xml b/contrib/trino-connector/pom.xml
index 3215d5b905a3e8..2c27d0ef458a3a 100644
--- a/contrib/trino-connector/pom.xml
+++ b/contrib/trino-connector/pom.xml
@@ -291,7 +291,7 @@
         <dependency>
             <groupId>org.assertj</groupId>
             <artifactId>assertj-core</artifactId>
-            <version>3.18.1</version>
+            <version>3.27.7</version>
             <scope>test</scope>
         </dependency>
 
diff --git a/fe/fe-core/pom.xml b/fe/fe-core/pom.xml
index 315d67c77690e8..7bd748b0dae261 100644
--- a/fe/fe-core/pom.xml
+++ b/fe/fe-core/pom.xml
@@ -288,7 +288,7 @@ under the License.
         <dependency>
             <groupId>org.assertj</groupId>
             <artifactId>assertj-core</artifactId>
-            <version>3.24.2</version>
+            <version>3.27.7</version>
             <scope>test</scope>
         </dependency>
 
diff --git a/fe/pom.xml b/fe/pom.xml
index 3b8ee185b38e75..346daa7bdb6f31 100644
--- a/fe/pom.xml
+++ b/fe/pom.xml
@@ -48,11 +48,11 @@ under the License.
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <junit.version>5.8.2</junit.version>
         <jprotobuf-starrocks.version>1.0.0</jprotobuf-starrocks.version>
-        <log4j.version>2.19.0</log4j.version>
+        <log4j.version>2.25.3</log4j.version>
         <jackson.version>2.15.2</jackson.version>
         <spark.version>3.5.5</spark.version>
         <tomcat.version>8.5.70</tomcat.version>
-        <parquet.version>1.16.0</parquet.version>
+        <parquet.version>1.17.0</parquet.version>
         <hadoop.version>3.4.3</hadoop.version>
         <gcs.connector.version>3.0.13</gcs.connector.version>
         <antlr.version>4.9.3</antlr.version>
@@ -65,16 +65,16 @@ under the License.
         <odps.version>0.48.7-public</odps.version>
         <kudu.version>1.17.1</kudu.version>
         <hikaricp.version>3.4.5</hikaricp.version>
-        <kafka-clients.version>3.9.1</kafka-clients.version>
+        <kafka-clients.version>4.2.0</kafka-clients.version>
         <arrow.version>18.0.0</arrow.version>
-        <grpc.version>1.63.0</grpc.version>
+        <grpc.version>1.75.0</grpc.version>
         <io.netty.version>4.1.128.Final</io.netty.version>
         <puppycrawl.version>10.21.1</puppycrawl.version>
         <aws-v2-sdk.version>2.42.1</aws-v2-sdk.version>
         <avro.version>1.12.0</avro.version>
         <dnsjava.version>3.6.3</dnsjava.version>
-        <nimbusds.version>9.37.2</nimbusds.version>
-        <protobuf-java.version>3.25.5</protobuf-java.version>
+        <nimbusds.version>9.37.4</nimbusds.version>
+        <protobuf-java.version>4.34.0</protobuf-java.version>
         <paimon.version>1.3.1</paimon.version>
         <delta-kernel.version>4.0.0rc1</delta-kernel.version>
         <iceberg.version>1.10.0</iceberg.version>
@@ -260,7 +260,7 @@ under the License.
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-lang3</artifactId>
-                <version>3.9</version>
+                <version>3.18.0</version>
             </dependency>
 
             <!-- https://mvnrepository.com/artifact/org.apache.commons/commons-pool2 -->
@@ -300,7 +300,7 @@ under the License.
             <dependency>
                 <groupId>org.apache.httpcomponents.client5</groupId>
                 <artifactId>httpclient5</artifactId>
-                <version>5.4.3</version>
+                <version>5.6</version>
             </dependency>
 
             <!-- https://mvnrepository.com/artifact/commons-validator/commons-validator -->
@@ -455,7 +455,7 @@ under the License.
             <dependency>
                 <groupId>commons-io</groupId>
                 <artifactId>commons-io</artifactId>
-                <version>2.16.1</version>
+                <version>2.21.0</version>
             </dependency>
 
             <!-- https://mvnrepository.com/artifact/com.baidu/jprotobuf-rpc-core -->
diff --git a/format-sdk/pom.xml b/format-sdk/pom.xml
index 8a13bb19d8070c..49fe3511a77ff2 100644
--- a/format-sdk/pom.xml
+++ b/format-sdk/pom.xml
@@ -22,7 +22,7 @@
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
-            <version>3.9</version>
+            <version>3.18.0</version>
         </dependency>
         <dependency>
             <groupId>org.apache.commons</groupId>
@@ -72,14 +72,14 @@
         <dependency>
             <groupId>com.google.protobuf</groupId>
             <artifactId>protobuf-java</artifactId>
-            <version>3.25.5</version>
+            <version>4.34.0</version>
             <scope>compile</scope>
         </dependency>
 
         <dependency>
             <groupId>com.mysql</groupId>
             <artifactId>mysql-connector-j</artifactId>
-            <version>8.0.33</version>
+            <version>8.2.0</version>
             <scope>test</scope>
         </dependency>
 
@@ -98,7 +98,7 @@
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
-            <version>2.24.1</version>
+            <version>2.25.3</version>
             <scope>test</scope>
         </dependency>
 
diff --git a/fs_brokers/apache_hdfs_broker/src/pom.xml b/fs_brokers/apache_hdfs_broker/src/pom.xml
index 933260bb55ef96..e0f4add5f1255e 100644
--- a/fs_brokers/apache_hdfs_broker/src/pom.xml
+++ b/fs_brokers/apache_hdfs_broker/src/pom.xml
@@ -42,11 +42,11 @@ under the License.
         <maven.compiler.target>1.8</maven.compiler.target>
         <hadoop.version>3.4.3</hadoop.version>
         <guava.version>32.0.1-jre</guava.version>
-        <zookeeper.version>3.9.3</zookeeper.version>
-        <protobuf.version>3.25.5</protobuf.version>
+        <zookeeper.version>3.9.4</zookeeper.version>
+        <protobuf.version>4.34.0</protobuf.version>
         <thrift.version>0.14.1</thrift.version>
-        <tomcat.version>9.0.106</tomcat.version>
-        <log4j.version>2.17.1</log4j.version>
+        <tomcat.version>9.0.112</tomcat.version>
+        <log4j.version>2.25.3</log4j.version>
         <jackson.version>2.18.3</jackson.version>
         <avro.version>1.11.4</avro.version>
         <jetty.version>9.4.57.v20241219</jetty.version>
@@ -166,7 +166,7 @@ under the License.
             <dependency>
                 <groupId>commons-io</groupId>
                 <artifactId>commons-io</artifactId>
-                <version>2.14.0</version>
+                <version>2.21.0</version>
             </dependency>
 
             <!-- https://mvnrepository.com/artifact/commons-lang/commons-lang -->
@@ -180,7 +180,7 @@ under the License.
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-lang3</artifactId>
-                <version>3.3.2</version>
+                <version>3.18.0</version>
             </dependency>
 
             <!-- https://mvnrepository.com/artifact/commons-logging/commons-logging -->
diff --git a/java-extensions/pom.xml b/java-extensions/pom.xml
index 6335804e7d6fcd..7b19cc15cf11b6 100644
--- a/java-extensions/pom.xml
+++ b/java-extensions/pom.xml
@@ -35,16 +35,16 @@
         <aws-v2-sdk.version>2.42.1</aws-v2-sdk.version>
         <hadoop.version>3.4.3</hadoop.version>
         <iceberg.version>1.10.0</iceberg.version>
-        <log4j2.version>2.23.1</log4j2.version>
+        <log4j2.version>2.25.3</log4j2.version>
         <junit.version>5.10.3</junit.version>
         <hive-apache.version>3.1.2-22</hive-apache.version>
         <jni-connector.version>1.0.0</jni-connector.version>
         <hadoop-ext.version>1.0.0</hadoop-ext.version>
         <java-utils.version>1.0.0</java-utils.version>
         <io.netty.version>4.1.128.Final</io.netty.version>
-        <protobuf-java.version>3.25.5</protobuf-java.version>
-        <nimbusds.version>9.37.2</nimbusds.version>
-        <commons-io.version>2.14.0</commons-io.version>
+        <protobuf-java.version>4.34.0</protobuf-java.version>
+        <nimbusds.version>9.37.4</nimbusds.version>
+        <commons-io.version>2.21.0</commons-io.version>
         <gcs.connector.version>3.0.13</gcs.connector.version>
         <slf4j.version>1.7.36</slf4j.version>
         <arrow.version>17.0.0</arrow.version>
@@ -53,14 +53,14 @@
         <!-- hadoop-azure requires no more than jetty10+ -->
         <!-- https://stackoverflow.com/questions/66713254/spark-wasb-and-jetty-11 -->
         <jetty.version>9.4.57.v20241219</jetty.version>
-        <parquet.version>1.15.2</parquet.version>
+        <parquet.version>1.17.0</parquet.version>
         <airlift.version>2.0.3</airlift.version>
         <avro.version>1.12.0</avro.version>
         <luben.zstd.jni.version>1.5.4-2</luben.zstd.jni.version>
         <kryo.version>4.0.2</kryo.version>
         <commons-beanutils.version>1.11.0</commons-beanutils.version>
         <lz4-java.version>1.10.1</lz4-java.version>
-        <httpclient5.version>5.4.3</httpclient5.version>
+        <httpclient5.version>5.6</httpclient5.version>
     </properties>
 
     <dependencyManagement>
diff --git a/java-extensions/udf-extensions/pom.xml b/java-extensions/udf-extensions/pom.xml
index eb7519dde01193..d429e373487441 100644
--- a/java-extensions/udf-extensions/pom.xml
+++ b/java-extensions/udf-extensions/pom.xml
@@ -43,7 +43,7 @@
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
-            <version>3.9</version>
+            <version>3.18.0</version>
         </dependency>
     </dependencies>