diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index da27af8b..cb77d3a2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,13 +40,13 @@ jobs:
           java-distribution: temurin
           maven-version: 3.9.9
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
+        uses: github/codeql-action/init@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12
         with:
           languages: ${{ matrix.language }}
       - name: Perform minimal build
         if: matrix.language == 'java'
         run: mvn -T1C clean package -DskipTests -Dverification.skip
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
+        uses: github/codeql-action/analyze@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
index 29a8e913..839fc984 100644
--- a/.github/workflows/deploy-website.yml
+++ b/.github/workflows/deploy-website.yml
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
-      - uses: ruby/setup-ruby@32110d4e311bd8996b2a82bf2a43b714ccc91777 # v1.221.0
+      - uses: ruby/setup-ruby@1a615958ad9d422dd932dc1d5823942ee002799f # v1.227.0
         with:
           working-directory: ./website
           bundler-cache: true
diff --git a/.github/workflows/openssf-scorecard.yml b/.github/workflows/openssf-scorecard.yml
index 33bcb630..355bb6b7 100644
--- a/.github/workflows/openssf-scorecard.yml
+++ b/.github/workflows/openssf-scorecard.yml
@@ -48,6 +48,6 @@ jobs:
           results_format: sarif
           publish_results: ${{ github.ref == 'refs/heads/master' }}
       - name: Update GitHub's code scanning dashboard
-        uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
+        uses: github/codeql-action/upload-sarif@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12
         with:
           sarif_file: results.sarif
diff --git a/documentation-support/pom.xml b/documentation-support/pom.xml
index 7ca2ca3f..4c29bb57 100644
--- a/documentation-support/pom.xml
+++ b/documentation-support/pom.xml
@@ -5,7 +5,7 @@
     <parent>
         <groupId>tech.picnic.error-prone-support</groupId>
         <artifactId>error-prone-support</artifactId>
-        <version>0.20.1-SNAPSHOT</version>
+        <version>0.21.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>documentation-support</artifactId>
diff --git a/error-prone-contrib/pom.xml b/error-prone-contrib/pom.xml
index 18105e43..0927880f 100644
--- a/error-prone-contrib/pom.xml
+++ b/error-prone-contrib/pom.xml
@@ -5,7 +5,7 @@
     <parent>
         <groupId>tech.picnic.error-prone-support</groupId>
         <artifactId>error-prone-support</artifactId>
-        <version>0.20.1-SNAPSHOT</version>
+        <version>0.21.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>error-prone-contrib</artifactId>
diff --git a/error-prone-experimental/pom.xml b/error-prone-experimental/pom.xml
index 95f1845b..947d319c 100644
--- a/error-prone-experimental/pom.xml
+++ b/error-prone-experimental/pom.xml
@@ -5,7 +5,7 @@
     <parent>
         <groupId>tech.picnic.error-prone-support</groupId>
         <artifactId>error-prone-support</artifactId>
-        <version>0.20.1-SNAPSHOT</version>
+        <version>0.21.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>error-prone-experimental</artifactId>
diff --git a/error-prone-guidelines/pom.xml b/error-prone-guidelines/pom.xml
index 21fe7486..bf14d998 100644
--- a/error-prone-guidelines/pom.xml
+++ b/error-prone-guidelines/pom.xml
@@ -5,7 +5,7 @@
     <parent>
         <groupId>tech.picnic.error-prone-support</groupId>
         <artifactId>error-prone-support</artifactId>
-        <version>0.20.1-SNAPSHOT</version>
+        <version>0.21.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>error-prone-guidelines</artifactId>
diff --git a/error-prone-utils/pom.xml b/error-prone-utils/pom.xml
index e84bb808..926a567a 100644
--- a/error-prone-utils/pom.xml
+++ b/error-prone-utils/pom.xml
@@ -5,7 +5,7 @@
     <parent>
         <groupId>tech.picnic.error-prone-support</groupId>
         <artifactId>error-prone-support</artifactId>
-        <version>0.20.1-SNAPSHOT</version>
+        <version>0.21.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>error-prone-utils</artifactId>
diff --git a/pom.xml b/pom.xml
index 86e558da..7c7a2b57 100644
--- a/pom.xml
+++ b/pom.xml
@@ -4,7 +4,7 @@
 
     <groupId>tech.picnic.error-prone-support</groupId>
     <artifactId>error-prone-support</artifactId>
-    <version>0.20.1-SNAPSHOT</version>
+    <version>0.21.1-SNAPSHOT</version>
     <packaging>pom</packaging>
 
     <name>Picnic :: Error Prone Support</name>
@@ -146,7 +146,7 @@
         <error-prone.self-check-args />
         <!-- The build timestamp is derived from the most recent commit
         timestamp in support of reproducible builds. -->
-        <project.build.outputTimestamp>2025-02-02T12:19:40Z</project.build.outputTimestamp>
+        <project.build.outputTimestamp>2025-03-24T10:41:07Z</project.build.outputTimestamp>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <!-- Glob pattern identifying Refaster rule definition files. These
         Java classes don't contain "regular" code, and thus require special
@@ -217,9 +217,9 @@
         functionality, and designing it such that JMH classes would not need to
         be annotated `@Open`. -->
         <version.nopen>1.0.1</version.nopen>
-        <version.nullaway>0.12.4</version.nullaway>
-        <version.pitest-git>2.1.0</version.pitest-git>
-        <version.rewrite-templating>1.24.1</version.rewrite-templating>
+        <version.nullaway>0.12.5</version.nullaway>
+        <version.pitest-git>2.2.0</version.pitest-git>
+        <version.rewrite-templating>1.24.2</version.rewrite-templating>
         <version.surefire>3.2.3</version.surefire>
     </properties>
 
@@ -431,7 +431,7 @@
             <dependency>
                 <groupId>net.bytebuddy</groupId>
                 <artifactId>byte-buddy</artifactId>
-                <version>1.17.2</version>
+                <version>1.17.4</version>
             </dependency>
             <!-- Specified so that Renovate will file Maven upgrade PRs, which
             subsequently will cause `maven-enforcer-plugin` to require that
@@ -494,8 +494,10 @@
             </dependency>
             <dependency>
                 <groupId>org.mongodb</groupId>
-                <artifactId>mongodb-driver-core</artifactId>
-                <version>5.3.1</version>
+                <artifactId>mongodb-driver-bom</artifactId>
+                <version>5.4.0</version>
+                <type>pom</type>
+                <scope>import</scope>
             </dependency>
             <dependency>
                 <groupId>org.openjdk.jmh</groupId>
@@ -536,7 +538,7 @@
             <dependency>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-test</artifactId>
-                <version>3.4.3</version>
+                <version>3.4.4</version>
             </dependency>
             <dependency>
                 <groupId>org.springframework.security</groupId>
@@ -945,7 +947,7 @@
                         <dependency>
                             <groupId>com.puppycrawl.tools</groupId>
                             <artifactId>checkstyle</artifactId>
-                            <version>10.21.4</version>
+                            <version>10.22.0</version>
                         </dependency>
                         <dependency>
                             <groupId>io.spring.nohttp</groupId>
@@ -1329,7 +1331,7 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>3.5.2</version>
+                    <version>3.5.3</version>
                     <configuration>
                         <includes>
                             <include>**/*Test.java</include>
@@ -1586,7 +1588,7 @@
                         <dependency>
                             <groupId>com.arcmutate</groupId>
                             <artifactId>base</artifactId>
-                            <version>1.3.2</version>
+                            <version>1.4.0</version>
                         </dependency>
                         <dependency>
                             <groupId>com.arcmutate</groupId>
@@ -1616,7 +1618,7 @@
                 <plugin>
                     <groupId>org.sonarsource.scanner.maven</groupId>
                     <artifactId>sonar-maven-plugin</artifactId>
-                    <version>5.0.0.4389</version>
+                    <version>5.1.0.4751</version>
                 </plugin>
             </plugins>
         </pluginManagement>
diff --git a/refaster-compiler/pom.xml b/refaster-compiler/pom.xml
index b70132bf..dbafa401 100644
--- a/refaster-compiler/pom.xml
+++ b/refaster-compiler/pom.xml
@@ -5,7 +5,7 @@
     <parent>
         <groupId>tech.picnic.error-prone-support</groupId>
         <artifactId>error-prone-support</artifactId>
-        <version>0.20.1-SNAPSHOT</version>
+        <version>0.21.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>refaster-compiler</artifactId>
diff --git a/refaster-runner/pom.xml b/refaster-runner/pom.xml
index 1b1099c6..b060665b 100644
--- a/refaster-runner/pom.xml
+++ b/refaster-runner/pom.xml
@@ -5,7 +5,7 @@
     <parent>
         <groupId>tech.picnic.error-prone-support</groupId>
         <artifactId>error-prone-support</artifactId>
-        <version>0.20.1-SNAPSHOT</version>
+        <version>0.21.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>refaster-runner</artifactId>
diff --git a/refaster-support/pom.xml b/refaster-support/pom.xml
index ed7c17ba..9b100284 100644
--- a/refaster-support/pom.xml
+++ b/refaster-support/pom.xml
@@ -5,7 +5,7 @@
     <parent>
         <groupId>tech.picnic.error-prone-support</groupId>
         <artifactId>error-prone-support</artifactId>
-        <version>0.20.1-SNAPSHOT</version>
+        <version>0.21.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>refaster-support</artifactId>
diff --git a/refaster-test-support/pom.xml b/refaster-test-support/pom.xml
index d9f1e61b..9ef89c9a 100644
--- a/refaster-test-support/pom.xml
+++ b/refaster-test-support/pom.xml
@@ -5,7 +5,7 @@
     <parent>
         <groupId>tech.picnic.error-prone-support</groupId>
         <artifactId>error-prone-support</artifactId>
-        <version>0.20.1-SNAPSHOT</version>
+        <version>0.21.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>refaster-test-support</artifactId>
diff --git a/website/_data/compatibility.yml b/website/_data/compatibility.yml
index c1b9b33d..a0293cc6 100644
--- a/website/_data/compatibility.yml
+++ b/website/_data/compatibility.yml
@@ -1,6 +1,9 @@
 # An overview of Error Prone Support releases, along with compatible Error
 # Prone releases. This data was generated by `generate-version-compatibility-overview.sh`.
 releases:
+  - version: 0.21.0
+    compatible:
+      - "2.37.0"
   - version: 0.20.0
     compatible:
       - "2.36.0"