diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 22675e3a69..cebd5dd5bb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -301,7 +301,7 @@ jobs:
       - name: Decompress
         run: find . -type f -name '*.tar.gz' -exec sh -c 'tar -zxf {} --one-top-level' \;
       - name: Publish Test Results
-        uses: EnricoMi/publish-unit-test-result-action@567cc7f8dcea3eba5da355f6ebc95663310d8a07 # v2.17.0
+        uses: EnricoMi/publish-unit-test-result-action@82082dac68ad6a19d980f8ce817e108b9f496c2a # v2.17.1
         continue-on-error: true
         id: test-results
         with:
diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml
index 7124035ea1..5f89cc112c 100644
--- a/.github/workflows/spelling.yml
+++ b/.github/workflows/spelling.yml
@@ -34,4 +34,4 @@ jobs:
             objects.githubusercontent.com:443
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Typos
-        uses: crate-ci/typos@9ad6f5c0549e0eb32bd70e26d5083421d639f278 # v1.24.3
+        uses: crate-ci/typos@945d407a5fc9097f020969446a16f581612ab4df # v1.24.5
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index d38f5a4203..c74537b1a0 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -7,7 +7,7 @@ bnd = "7.0.0"
 bouncycastle-jdk18on = "1.78.1"
 cache2k = "2.6.1.Final"
 caffeine = "3.1.8"
-checker-framework = "3.46.0"
+checker-framework = "3.47.0"
 checkstyle = "10.18.1"
 coherence = "22.06.2"
 commons-collections4 = "4.4"
@@ -86,7 +86,7 @@ snakeyaml = "2.3"
 sonarqube = "5.1.0.4882"
 spotbugs = "4.8.6"
 spotbugs-contrib = "7.6.4"
-spotbugs-plugin = "6.0.21"
+spotbugs-plugin = "6.0.22"
 stream = "2.9.8"
 tcache = "2.0.1"
 testng = "7.10.2"
diff --git a/gradle/plugins/build.gradle.kts b/gradle/plugins/build.gradle.kts
index 8a39a8399a..dca051339f 100644
--- a/gradle/plugins/build.gradle.kts
+++ b/gradle/plugins/build.gradle.kts
@@ -54,7 +54,7 @@ dependencies {
   }
 }
 
-tasks.withType<DependencyUpdatesTask> {
+tasks.named<DependencyUpdatesTask>("dependencyUpdates").configure {
   checkBuildEnvironmentConstraints = true
   checkConstraints = true
   resolutionStrategy {
diff --git a/gradle/plugins/src/main/kotlin/quality/forbidden-apis.caffeine.gradle.kts b/gradle/plugins/src/main/kotlin/quality/forbidden-apis.caffeine.gradle.kts
index 46ec6064e1..8091ec2823 100644
--- a/gradle/plugins/src/main/kotlin/quality/forbidden-apis.caffeine.gradle.kts
+++ b/gradle/plugins/src/main/kotlin/quality/forbidden-apis.caffeine.gradle.kts
@@ -10,5 +10,7 @@ forbiddenApis {
 
 tasks.withType<CheckForbiddenApis>().configureEach {
   enabled = System.getProperties().containsKey("forbiddenApis")
-  incompatibleWithConfigurationCache()
+  if (enabled) {
+    incompatibleWithConfigurationCache()
+  }
 }