diff --git a/Directory.Packages.props b/Directory.Packages.props
index c333e5d..20c5a98 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -1,25 +1,25 @@
 <Project>
   <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
     <!-- Pinned to 2.x: the ASP.NET Core 10 OpenAPI source generator is incompatible with
          Microsoft.OpenApi 3.x (IOpenApiMediaType.Example became read-only). 3.x lands with
          ASP.NET Core 11. Also carries the GHSA-v5pm-xwqc-g5wc patch. -->
-    <PackageVersion Include="Microsoft.OpenApi" Version="2.10.0" />
-    <PackageVersion Include="Microsoft.Extensions.ApiDescription.Server" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.NetAnalyzers" Version="10.0.301" />
+    <PackageVersion Include="Microsoft.OpenApi" Version="3.9.0" />
+    <PackageVersion Include="Microsoft.Extensions.ApiDescription.Server" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.NetAnalyzers" Version="10.0.302" />
     <PackageVersion Include="StyleCop.Analyzers" Version="1.1.118" />
-    <PackageVersion Include="System.Text.Json" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
+    <PackageVersion Include="System.Text.Json" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <!-- Test-only: hosts the /v1 API in memory so the endpoints are exercised over real HTTP
          (routing, status codes, content types, model binding) without binding a port. Version
          tracks the ASP.NET Core 10 packages above. Never referenced by a shipped artifact. -->
     <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.9" />
-    <PackageVersion Include="MSTest.TestAdapter" Version="4.2.3" />
-    <PackageVersion Include="MSTest.TestFramework" Version="4.2.3" />
+    <PackageVersion Include="MSTest.TestAdapter" Version="4.3.2" />
+    <PackageVersion Include="MSTest.TestFramework" Version="4.3.2" />
     <PackageVersion Include="coverlet.collector" Version="10.0.1" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
-    <PackageVersion Include="Sarif.Sdk" Version="5.4.3" />
+    <PackageVersion Include="Sarif.Sdk" Version="5.5.0" />
     <PackageVersion Include="ModelContextProtocol" Version="1.4.1" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
   </ItemGroup>
 </Project>
diff --git a/test/ThreatModelForge.Api.Tests/ThreatModelForge.Api.Tests.csproj b/test/ThreatModelForge.Api.Tests/ThreatModelForge.Api.Tests.csproj
index 5a46c3d..25a3cc2 100644
--- a/test/ThreatModelForge.Api.Tests/ThreatModelForge.Api.Tests.csproj
+++ b/test/ThreatModelForge.Api.Tests/ThreatModelForge.Api.Tests.csproj
@@ -9,6 +9,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="Microsoft.Extensions.Hosting" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" />
     <PackageReference Include="MSTest.TestAdapter" />