diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 61fc12c7..06cd4227 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,11 +1,10 @@
-# CI workflow for the main line (JDK 17)
+# CI workflow for the main line (JDK 21)
 #
 # Triggers:
 #   - push / pull_request on the main branch
 #   - manual workflow_dispatch
 #
-# Runs `mvn -B clean verify` which includes the JaCoCo coverage gate
-# (90% line coverage, haltOnFailure=false) configured in the POM.
+# Runs the pinned Maven Wrapper and enforces the JaCoCo coverage gates configured in the POM.
 name: CI
 
 on:
@@ -20,29 +19,29 @@ permissions:
 
 jobs:
   build:
-    name: JDK 17 Build & Verify
+    name: JDK 21 Build & Verify
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - name: Checkout source
         uses: actions/checkout@v7
 
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@v5
         with:
           distribution: temurin
-          java-version: '17'
+          java-version: '21'
           cache: maven
 
       - name: Build and verify with JaCoCo coverage gate
-        run: mvn -B --no-transfer-progress clean verify
+        run: ./mvnw -B --no-transfer-progress clean verify
 
       - name: Upload JaCoCo coverage report
         if: always()
         uses: actions/upload-artifact@v7
         with:
           name: jacoco-coverage
-          path: target/site/jacoco
+          path: '**/target/site/jacoco/**'
           retention-days: 14
 
       - name: Upload surefire reports
@@ -50,5 +49,5 @@ jobs:
         uses: actions/upload-artifact@v7
         with:
           name: surefire-reports
-          path: target/surefire-reports
+          path: '**/target/surefire-reports/**'
           retention-days: 14
diff --git a/pom.xml b/pom.xml
index 5df47e48..b2ea8af9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -48,7 +48,7 @@
         <revision>3.0.x.20261031-SNAPSHOT</revision>
         <java.version>21</java.version>
         <maven.compiler.release>${java.version}</maven.compiler.release>
-        <maven.version>4.0.0-rc-5</maven.version>
+        <maven.version>4.0.0-rc-6</maven.version>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
         <!-- ═══ 第二段: docx4j 全家桶版本 ═══ -->
@@ -72,7 +72,7 @@
 
         <!-- ═══ 第四段: 模板引擎版本 ═══ -->
         <beetl.version>3.21.2.RELEASE</beetl.version>
-        <freemarker.version>2.3.34</freemarker.version>
+        <freemarker.version>2.3.35</freemarker.version>
         <httl.version>1.0.12</httl.version>
         <jetbrick.version>2.1.10</jetbrick.version>
         <rythm.version>1.4.2</rythm.version>
@@ -90,10 +90,10 @@
         <!-- Markdown 解析（MD→HTML 渲染，Java 8 兼容） -->
         <flexmark.version>0.64.8</flexmark.version>
         <jackson-bom.version>3.2.1</jackson-bom.version>
-        <jsoup.version>1.23.1</jsoup.version>
+        <jsoup.version>1.23.2</jsoup.version>
         <!-- fastjson：v1 兼容构建（内核 fastjson2），锁定 rythm-engine 传递依赖 -->
         <fastjson.version>2.0.57</fastjson.version>
-        <ognl.version>3.4.2</ognl.version>
+        <ognl.version>3.4.13</ognl.version>
         <tomcat-jasper.version>10.1.54</tomcat-jasper.version>
 
         <!-- ═══ 第六段: 测试框架版本 ═══ -->