diff --git a/.github/workflows/maven-publish.yml b/.github/workflows/maven-publish.yml
index d7e837cf7..3e33c0e7b 100644
--- a/.github/workflows/maven-publish.yml
+++ b/.github/workflows/maven-publish.yml
@@ -28,7 +28,7 @@ jobs:
           distribution: temurin # Temurin is a distribution of adoptium
           java-version: 21
       - uses: actions/checkout@v4
-      - uses: aws-actions/configure-aws-credentials@v4.0.1
+      - uses: aws-actions/configure-aws-credentials@v4.0.2
         with:
           role-to-assume: ${{ secrets.PUBLISH_SNAPSHOTS_ROLE }}
           aws-region: us-east-1
diff --git a/.github/workflows/test_build_multi_platform.yml b/.github/workflows/test_build_multi_platform.yml
index 2e1ca9de4..a344c9ffd 100644
--- a/.github/workflows/test_build_multi_platform.yml
+++ b/.github/workflows/test_build_multi_platform.yml
@@ -69,20 +69,22 @@ jobs:
       # this image tag is subject to change as more dependencies and updates will arrive over time
       image: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-version-linux }}
       # need to switch to root so that github actions can install runner binary on container without permission issues.
-      options: --user root
+      options: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-options }}
 
     env:
       JENKINS_URL: build.ci.opensearch.org
 
     steps:
+      - name: Run start commands
+        run: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-command }}
       - name: Setup Java ${{ matrix.java }}
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: ${{ matrix.java }}
 
       - name: Checkout AD
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Assemble / build / mavenlocal / integTest
         run: |
@@ -106,7 +108,7 @@ jobs:
 
     steps:
       - name: Setup Java ${{ matrix.java }}
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: ${{ matrix.java }}
@@ -122,7 +124,7 @@ jobs:
           ./gradlew build -x spotlessJava
       # coverage.gradle is only applied in single local node test
       - name: Upload Coverage Report
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
diff --git a/.github/workflows/test_bwc.yml b/.github/workflows/test_bwc.yml
index e3c08d794..03ebeb359 100644
--- a/.github/workflows/test_bwc.yml
+++ b/.github/workflows/test_bwc.yml
@@ -30,18 +30,20 @@ jobs:
       # this image tag is subject to change as more dependencies and updates will arrive over time
       image: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-version-linux }}
       # need to switch to root so that github actions can install runner binary on container without permission issues.
-      options: --user root
+      options: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-options }}
 
     steps:
+      - name: Run start commands
+        run: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-command }}
       - name: Setup Java ${{ matrix.java }}
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: ${{ matrix.java }}
 
       # anomaly-detection
       - name: Checkout AD
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Assemble anomaly-detection
         run: |
diff --git a/build.gradle b/build.gradle
index 219db1556..6e67c5792 100644
--- a/build.gradle
+++ b/build.gradle
@@ -142,20 +142,20 @@ dependencies {
 
 
     implementation "org.jacoco:org.jacoco.agent:0.8.12"
-    implementation ("org.jacoco:org.jacoco.ant:0.8.11") {
+    implementation ("org.jacoco:org.jacoco.ant:0.8.12") {
         exclude group: 'org.ow2.asm', module: 'asm-commons'
         exclude group: 'org.ow2.asm', module: 'asm'
         exclude group: 'org.ow2.asm', module: 'asm-tree'
     }
 
     // used for output encoding of config descriptions
-    implementation group: 'org.owasp.encoder' , name: 'encoder', version: '1.2.3'
+    implementation group: 'org.owasp.encoder' , name: 'encoder', version: '1.3.1'
 
     testImplementation group: 'pl.pragmatists', name: 'JUnitParams', version: '1.1.1'
-    testImplementation group: 'org.mockito', name: 'mockito-core', version: '5.14.1'
+    testImplementation group: 'org.mockito', name: 'mockito-core', version: '5.14.2'
     testImplementation group: 'org.objenesis', name: 'objenesis', version: '3.3'
-    testImplementation group: 'net.bytebuddy', name: 'byte-buddy', version: '1.14.9'
-    testImplementation group: 'net.bytebuddy', name: 'byte-buddy-agent', version: '1.14.9'
+    testImplementation group: 'net.bytebuddy', name: 'byte-buddy', version: '1.15.10'
+    testImplementation group: 'net.bytebuddy', name: 'byte-buddy-agent', version: '1.15.10'
     testCompileOnly 'org.apiguardian:apiguardian-api:1.1.2'
     // jupiter is required to run unit tests not inherited from OpenSearchTestCase (e.g., PreviousValueImputerTests)
     testImplementation 'org.junit.jupiter:junit-jupiter-api:5.11.2'
@@ -186,7 +186,7 @@ allprojects {
     version = "${opensearch_build}"
 
     plugins.withId('jacoco') {
-        jacoco.toolVersion = '0.8.11'
+        jacoco.toolVersion = '0.8.12'
     }
 }
 
@@ -218,10 +218,10 @@ configurations.all {
         force "org.apache.httpcomponents.client5:httpclient5:${versions.httpclient5}"
         force "commons-codec:commons-codec:${versions.commonscodec}"
 
-        force "org.mockito:mockito-core:5.14.1"
+        force "org.mockito:mockito-core:5.14.2"
         force "org.objenesis:objenesis:3.3"
-        force "net.bytebuddy:byte-buddy:1.14.9"
-        force "net.bytebuddy:byte-buddy-agent:1.14.9"
+        force "net.bytebuddy:byte-buddy:1.15.10"
+        force "net.bytebuddy:byte-buddy-agent:1.15.10"
         force "com.google.code.gson:gson:2.8.9"
         force "junit:junit:4.13.2"