diff --git a/hello-world-pypi-package/requirements.txt b/hello-world-pypi-package/requirements.txt
index d865baa..2566788 100644
--- a/hello-world-pypi-package/requirements.txt
+++ b/hello-world-pypi-package/requirements.txt
@@ -3,8 +3,8 @@ build==1.3.0
 certifi==2025.8.3
 cffi==2.0.0
 charset-normalizer==3.4.3
-cryptography==45.0.7
-docutils==0.22
+cryptography==46.0.1
+docutils==0.22.2
 id==1.5.0
 idna==3.10
 importlib_metadata==8.7.0
diff --git a/provision/provision-nexus.sh b/provision/provision-nexus.sh
index 810cf40..b1791a1 100644
--- a/provision/provision-nexus.sh
+++ b/provision/provision-nexus.sh
@@ -541,8 +541,8 @@ EOF
 #    as such, we cannot use our docker-group registry, instead we must use the docker-proxy
 #    registry, enable the Docker Bearer Token Realm and allow anonymous access to it.
 #    see https://github.com/moby/moby/issues/30880
-# NB this will make https://nexus.example.com:5002/v2/library/debian/manifests/buster-slim proxy
-#    to https://registry-1.docker.io/v2/library/debian/manifests/buster-slim
+# NB this will make https://nexus.example.com:5002/v2/library/debian/manifests/trixie-slim proxy
+#    to https://registry-1.docker.io/v2/library/debian/manifests/trixie-slim
 #       https://registry-1.docker.io/v2/library/golang/tags/list
 http \
     --check-status \
diff --git a/provision/use-docker-repository.sh b/provision/use-docker-repository.sh
index a8b78ad..14dd294 100644
--- a/provision/use-docker-repository.sh
+++ b/provision/use-docker-repository.sh
@@ -68,14 +68,14 @@ module example.com/go-hello
 go $go_version
 EOF
 cat >Dockerfile <<EOF
-FROM golang:$go_version-bookworm AS builder
+FROM golang:$go_version-trixie AS builder
 WORKDIR /app
 COPY go.* main.go ./
 RUN CGO_ENABLED=0 go build -ldflags="-s"
 
-# NB we use the buster-slim (instead of scratch) image so we
+# NB we use the trixie-slim (instead of scratch) image so we
 #    can enter the container to execute bash etc.
-FROM debian:bookworm-slim
+FROM debian:trixie-slim
 COPY --from=builder /app/go-hello .
 WORKDIR /
 EXPOSE 8000
diff --git a/provision/use-maven-repository-from-gradle.sh b/provision/use-maven-repository-from-gradle.sh
index eb7b9e3..8e806b1 100644
--- a/provision/use-maven-repository-from-gradle.sh
+++ b/provision/use-maven-repository-from-gradle.sh
@@ -13,7 +13,7 @@ cd tmp/use-maven-repository-from-gradle
 # download and install gradle.
 # see https://gradle.org/releases/
 # renovate: datasource=github-releases depName=gradle/gradle
-gradle_version='9.0.0'
+gradle_version='9.1.0'
 if [ ! -f /opt/gradle/gradle-$gradle_version/bin/gradle ]; then
     apt-get install -y unzip
     wget -qO/tmp/gradle-$gradle_version-bin.zip https://services.gradle.org/distributions/gradle-$gradle_version-bin.zip
@@ -36,8 +36,8 @@ cat >settings.gradle <<'EOF'
 rootProject.name = 'gradle-greeter'
 EOF
 cat >build.gradle <<'EOF'
-// see https://docs.gradle.org/9.0.0/userguide/java_library_plugin.html
-// see https://docs.gradle.org/9.0.0/userguide/maven_plugin.html
+// see https://docs.gradle.org/9.1.0/userguide/java_library_plugin.html
+// see https://docs.gradle.org/9.1.0/userguide/maven_plugin.html
 
 plugins {
     id 'java-library'
@@ -106,8 +106,8 @@ EOF
 # renovate: datasource=maven depName=com.gradleup.shadow:shadow-gradle-plugin
 com_gradleup_shadow_version='9.1.0'
 cat >build.gradle <<EOF
-// see https://docs.gradle.org/9.0.0/userguide/java_plugin.html
-// see https://docs.gradle.org/9.0.0/userguide/application_plugin.html
+// see https://docs.gradle.org/9.1.0/userguide/java_plugin.html
+// see https://docs.gradle.org/9.1.0/userguide/application_plugin.html
 // see https://gradleup.com/shadow/
 // see https://github.com/GradleUp/shadow
 
diff --git a/renovate.sh b/renovate.sh
index 88a653a..6ecf0dd 100755
--- a/renovate.sh
+++ b/renovate.sh
@@ -13,12 +13,12 @@ gitea_container_name="$(basename "$(dirname "$(realpath "${BASH_SOURCE[0]}")")")
 
 # see https://hub.docker.com/r/gitea/gitea/tags
 # renovate: datasource=docker depName=gitea/gitea
-gitea_version='1.24.5'
+gitea_version='1.24.6'
 
 # see https://hub.docker.com/r/renovate/renovate/tags
 # see https://github.com/renovatebot/renovate/releases
 # renovate: datasource=docker depName=renovate/renovate
-renovate_version='41.98.2'
+renovate_version='41.124.0'
 
 # clean.
 echo 'Deleting existing Gitea...'
@@ -30,7 +30,7 @@ install -d tmp
 # start gitea in background.
 # see https://docs.gitea.io/en-us/config-cheat-sheet/
 # see https://github.com/go-gitea/gitea/releases
-# see https://github.com/go-gitea/gitea/blob/v1.24.5/docker/root/etc/s6/gitea/setup
+# see https://github.com/go-gitea/gitea/blob/v1.24.6/docker/root/etc/s6/gitea/setup
 echo 'Starting Gitea...'
 docker run \
     --detach \