diff --git a/package-lock.json b/package-lock.json
index 8349b55bd..7c2f3c545 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8248,12 +8248,12 @@
       }
     },
     "node_modules/express-rate-limit": {
-      "version": "8.4.1",
-      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.4.1.tgz",
-      "integrity": "sha512-NGVYwQSAyEQgzxX1iCM978PP9AdO/hW93gMcF6ZwQCm+rFvLsBH6w4xcXWTcliS8La5EPRN3p9wzItqBwJrfNw==",
+      "version": "8.5.1",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.5.1.tgz",
+      "integrity": "sha512-5O6KYmyJEpuPJV5hNTXKbAHWRqrzyu+OI3vUnSd2kXFubIVpG7ezpgxQy76Zo5GQZtrQBg86hF+CM/NX+cioiQ==",
       "license": "MIT",
       "dependencies": {
-        "ip-address": "10.1.0"
+        "ip-address": "^10.2.0"
       },
       "engines": {
         "node": ">= 16"
@@ -9916,9 +9916,9 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
-      "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
+      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -15218,9 +15218,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.8",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.8.tgz",
-      "integrity": "sha512-SYkBtK99u0yXa+IWL0JRzzcl7RxNpvX/U08Z+8DKnysfno7M+uExnTZH8K+VGgShf2qFPKtbNr9QBl8n7WBP6Q==",
+      "version": "7.5.14",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.14.tgz",
+      "integrity": "sha512-/7sHKgQO3JLP9ESlwTYUUftHUadOURUqq23xs1vjcnp8Vss6k0wCfzulyEtk5g91pjvnuriimGlyG7k6msrzRw==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "@isaacs/fs-minipass": "^4.0.0",
@@ -17284,7 +17284,7 @@
         "express": "^5.1.0",
         "fs-extra": "^11.3.0",
         "strip-json-comments": "^3.1.1",
-        "tar": "^7.5.8",
+        "tar": "^7.5.14",
         "uuid": "^13.0.0",
         "winston": "^3.17.0"
       },
@@ -17371,7 +17371,7 @@
         "string-width": "^8.1.0",
         "strip-ansi": "^7.1.0",
         "strip-json-comments": "^3.1.1",
-        "tar": "^7.5.8",
+        "tar": "^7.5.14",
         "tinygradient": "^1.1.5",
         "undici": "^7.10.0",
         "ws": "^8.16.0",
diff --git a/packages/a2a-server/package.json b/packages/a2a-server/package.json
index b70ea8986..25f8db4fe 100644
--- a/packages/a2a-server/package.json
+++ b/packages/a2a-server/package.json
@@ -31,7 +31,7 @@
     "express": "^5.1.0",
     "fs-extra": "^11.3.0",
     "strip-json-comments": "^3.1.1",
-    "tar": "^7.5.8",
+    "tar": "^7.5.14",
     "uuid": "^13.0.0",
     "winston": "^3.17.0"
   },
diff --git a/packages/cli/package.json b/packages/cli/package.json
index cc561eeb8..4ce3243d8 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -63,7 +63,7 @@
     "string-width": "^8.1.0",
     "strip-ansi": "^7.1.0",
     "strip-json-comments": "^3.1.1",
-    "tar": "^7.5.8",
+    "tar": "^7.5.14",
     "tinygradient": "^1.1.5",
     "undici": "^7.10.0",
     "ws": "^8.16.0",