diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1bf6c0b2f..4883b203e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,8 +9,19 @@ updates:
       # Un major por paquete rompe los 5 workspaces (ver PRs #720 y #721, cerrados).
       - dependency-name: "@nestjs/*"
         update-types: ["version-update:semver-major"]
+      # nestjs-pino 5.x exige Node >= 22.12 y el repo corre en Node 20 por diseño
+      # (engines raíz `>=20 <21`, imágenes node:20-alpine). Es una migración de
+      # runtime, no un bump (ver PR #727, cerrado).
+      - dependency-name: "nestjs-pino"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: monthly
+    groups:
+      # init, autobuild, analyze y upload-sarif tienen que moverse JUNTOS: analyze
+      # rechaza la configuración escrita por un init de otra versión (ver PRs #731
+      # y #733, cerrados). Dependabot los trata como dependencias distintas.
+      codeql-action:
+        patterns: ["github/codeql-action*"]
diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index 4cc7f23db..8025f6151 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -927,7 +927,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build ${{ matrix.service }} (push only from main/tags)
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ${{ matrix.context }}
           file: ${{ matrix.dockerfile }}
diff --git a/.github/workflows/docker-images.yml b/.github/workflows/docker-images.yml
index 55c1c5936..d5011e7ce 100644
--- a/.github/workflows/docker-images.yml
+++ b/.github/workflows/docker-images.yml
@@ -52,7 +52,7 @@ jobs:
 
       - name: Compute tags
         id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ghcr.io/${{ github.repository_owner }}/${{ matrix.name }}
           # `type=ref,event=tag` publishes the git tag VERBATIM — `v1.1.0`, with
@@ -74,7 +74,7 @@ jobs:
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           # Build context is the repository root for all services (the Dockerfiles
           # COPY repo-relative paths; agent-runtime builds the workspace packages).
diff --git a/.github/workflows/openssf-scorecard.yml b/.github/workflows/openssf-scorecard.yml
index bed418ef2..c337ad5bc 100644
--- a/.github/workflows/openssf-scorecard.yml
+++ b/.github/workflows/openssf-scorecard.yml
@@ -112,7 +112,7 @@ jobs:
           retention-days: 90
 
       - name: Upload results to code scanning
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: scorecard-results.sarif
 
diff --git a/.github/workflows/published-canary.yml b/.github/workflows/published-canary.yml
index d86e6021c..2ed84f3c0 100644
--- a/.github/workflows/published-canary.yml
+++ b/.github/workflows/published-canary.yml
@@ -67,7 +67,7 @@ jobs:
       # duplicated, so a week of red is one thread and not seven.
       - name: Open or update the canary issue
         if: failure() && github.event_name == 'schedule'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
@@ -106,7 +106,7 @@ jobs:
       # healthy again the thread says so and closes itself.
       - name: Close the canary issue when the registry is healthy again
         if: success() && github.event_name == 'schedule'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const existing = await github.rest.issues.listForRepo({
diff --git a/.github/workflows/sdk-cli-ci.yml b/.github/workflows/sdk-cli-ci.yml
index 387e69e10..ea7dad28a 100644
--- a/.github/workflows/sdk-cli-ci.yml
+++ b/.github/workflows/sdk-cli-ci.yml
@@ -421,16 +421,16 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           languages: javascript-typescript
           queries: security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           category: "/language:javascript-typescript"
 
@@ -457,7 +457,7 @@ jobs:
           severity: 'CRITICAL,HIGH'
 
       - name: Upload Trivy SARIF Report
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'
diff --git a/package-lock.json b/package-lock.json
index 23fbe7f32..99432b840 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13747,22 +13747,6 @@
         "node": ">= 0.8"
       }
     },
-    "node_modules/passport-custom": {
-      "version": "1.1.1",
-      "license": "MIT",
-      "dependencies": {
-        "passport-strategy": "1.x.x"
-      },
-      "engines": {
-        "node": ">= 0.10.0"
-      }
-    },
-    "node_modules/passport-strategy": {
-      "version": "1.0.0",
-      "engines": {
-        "node": ">= 0.4.0"
-      }
-    },
     "node_modules/path-exists": {
       "version": "4.0.0",
       "dev": true,
@@ -16293,7 +16277,6 @@
         "helmet": "8.2.0",
         "keyv": "5.6.0",
         "nestjs-pino": "4.6.1",
-        "passport-custom": "1.1.1",
         "pino": "10.3.1",
         "pino-http": "11.0.0",
         "prom-client": "15.1.3",
@@ -16514,7 +16497,7 @@
       "license": "MIT",
       "dependencies": {
         "@beyondnet/evolith-core-domain": "^1.3.0",
-        "yaml": "2.9.0"
+        "yaml": "2.9.1"
       },
       "devDependencies": {
         "@types/jest": "30.0.0",
@@ -16543,9 +16526,9 @@
       }
     },
     "src/packages/agent-runtime/node_modules/yaml": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
-      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
+      "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==",
       "license": "ISC",
       "bin": {
         "yaml": "bin.mjs"
@@ -16604,7 +16587,7 @@
         "ajv": "8.20.0",
         "ajv-formats": "3.0.1",
         "typescript": "6.0.3",
-        "yaml": "2.9.0",
+        "yaml": "2.9.1",
         "zod": "4.4.3"
       },
       "devDependencies": {
@@ -16815,9 +16798,9 @@
       }
     },
     "src/packages/core-domain/node_modules/yaml": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
-      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
+      "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==",
       "license": "ISC",
       "bin": {
         "yaml": "bin.mjs"
@@ -16850,7 +16833,7 @@
         "ajv": "8.20.0",
         "ajv-formats": "3.0.1",
         "fs-extra": "10.1.0",
-        "yaml": "2.9.0"
+        "yaml": "2.9.1"
       },
       "devDependencies": {
         "@types/fs-extra": "11.0.4",
@@ -16872,9 +16855,9 @@
       }
     },
     "src/packages/infra-providers/node_modules/yaml": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
-      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
+      "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==",
       "license": "ISC",
       "bin": {
         "yaml": "bin.mjs"
@@ -16917,7 +16900,7 @@
         "prom-client": "15.1.3",
         "reflect-metadata": "0.2.2",
         "rxjs": "7.8.2",
-        "yaml": "2.9.0"
+        "yaml": "2.9.1"
       },
       "bin": {
         "evolith-mcp": "dist/main.js"
@@ -17251,9 +17234,9 @@
       }
     },
     "src/packages/mcp-server/node_modules/yaml": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
-      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
+      "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==",
       "license": "ISC",
       "bin": {
         "yaml": "bin.mjs"
@@ -17328,7 +17311,7 @@
         "@beyondnet/evolith-core-domain": "1.3.2",
         "@beyondnet/evolith-infra-providers": "1.2.1",
         "@beyondnet/evolith-sdk": "2.0.0",
-        "@clack/prompts": "^1.8.1",
+        "@clack/prompts": "1.8.1",
         "@hono/node-server": "1.19.15",
         "@modelcontextprotocol/sdk": "1.29.0",
         "@nestjs/common": "11.2.1",
@@ -17348,7 +17331,7 @@
         "inherits": "2.0.4",
         "nest-commander": "3.20.1",
         "path-to-regexp": "8.4.2",
-        "yaml": "2.9.0"
+        "yaml": "2.9.1"
       },
       "bin": {
         "evolith": "dist/main.js",
@@ -17779,9 +17762,9 @@
       }
     },
     "src/sdk/cli/node_modules/yaml": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
-      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
+      "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==",
       "license": "ISC",
       "bin": {
         "yaml": "bin.mjs"
diff --git a/src/apps/core-api/package.json b/src/apps/core-api/package.json
index cceaab328..d73ba2974 100644
--- a/src/apps/core-api/package.json
+++ b/src/apps/core-api/package.json
@@ -42,7 +42,6 @@
     "helmet": "8.2.0",
     "keyv": "5.6.0",
     "nestjs-pino": "4.6.1",
-    "passport-custom": "1.1.1",
     "pino": "10.3.1",
     "pino-http": "11.0.0",
     "prom-client": "15.1.3",
diff --git a/src/packages/agent-runtime/package.json b/src/packages/agent-runtime/package.json
index c5409b13a..1032db678 100644
--- a/src/packages/agent-runtime/package.json
+++ b/src/packages/agent-runtime/package.json
@@ -44,7 +44,7 @@
   },
   "dependencies": {
     "@beyondnet/evolith-core-domain": "^1.3.0",
-    "yaml": "2.9.0"
+    "yaml": "2.9.1"
   },
   "devDependencies": {
     "@types/jest": "30.0.0",
diff --git a/src/packages/core-domain/package.json b/src/packages/core-domain/package.json
index b59e607e0..7e92579d4 100644
--- a/src/packages/core-domain/package.json
+++ b/src/packages/core-domain/package.json
@@ -106,7 +106,7 @@
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
     "typescript": "6.0.3",
-    "yaml": "2.9.0",
+    "yaml": "2.9.1",
     "zod": "4.4.3"
   },
   "peerDependencies": {
diff --git a/src/packages/infra-providers/package.json b/src/packages/infra-providers/package.json
index 6aba6d97a..f4ce59493 100644
--- a/src/packages/infra-providers/package.json
+++ b/src/packages/infra-providers/package.json
@@ -33,7 +33,7 @@
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
     "fs-extra": "10.1.0",
-    "yaml": "2.9.0"
+    "yaml": "2.9.1"
   },
   "devDependencies": {
     "@types/fs-extra": "11.0.4",
diff --git a/src/packages/mcp-server/package.json b/src/packages/mcp-server/package.json
index 3a504987a..30cc27444 100644
--- a/src/packages/mcp-server/package.json
+++ b/src/packages/mcp-server/package.json
@@ -68,7 +68,7 @@
     "prom-client": "15.1.3",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2",
-    "yaml": "2.9.0"
+    "yaml": "2.9.1"
   },
   "devDependencies": {
     "@nestjs/cli": "11.0.24",
diff --git a/src/sdk/cli/package.json b/src/sdk/cli/package.json
index b56cb491b..ba9265a19 100644
--- a/src/sdk/cli/package.json
+++ b/src/sdk/cli/package.json
@@ -94,7 +94,7 @@
     "inherits": "2.0.4",
     "nest-commander": "3.20.1",
     "path-to-regexp": "8.4.2",
-    "yaml": "2.9.0"
+    "yaml": "2.9.1"
   },
   "devDependencies": {
     "@nestjs/testing": "11.1.28",