diff --git a/Directory.Packages.props b/Directory.Packages.props
index 5fa1f64..4d26d91 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -31,6 +31,14 @@
     <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="$(DotNetVersion)" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.6.0" />
     <PackageVersion Include="Microsoft.OData.Core" Version="$(ODataVersion)" />
+    <!--
+      Microsoft.AspNetCore.OpenApi/NSwag.AspNetCore/Swashbuckle.AspNetCore all float a transitive
+      dependency on Microsoft.OpenApi 2.0.0, which has a known high-severity vulnerability (NU1903,
+      GHSA-v5pm-xwqc-g5wc - a crafted OpenAPI document with a circular schema reference can crash the
+      process). Pin explicitly to the patched 2.x release; CentralPackageTransitivePinningEnabled above
+      forces this version across all transitive references.
+    -->
+    <PackageVersion Include="Microsoft.OpenApi" Version="2.7.5" />
     <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.300" />
     <PackageVersion Include="Microsoft.Spatial" Version="8.4.3" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
diff --git a/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Client/TodoApp.BlazorWasm.Client.csproj b/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Client/TodoApp.BlazorWasm.Client.csproj
index 2dae8a3..b500632 100644
--- a/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Client/TodoApp.BlazorWasm.Client.csproj
+++ b/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Client/TodoApp.BlazorWasm.Client.csproj
@@ -7,10 +7,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.0.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="10.0.3" />
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="10.0.3" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.Extensions.Http" Version="10.0.3" />
+    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.1.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="10.0.9" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="10.0.9" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.Extensions.Http" Version="10.0.9" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Server/TodoApp.BlazorWasm.Server.csproj b/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Server/TodoApp.BlazorWasm.Server.csproj
index a6be799..9b70cc7 100644
--- a/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Server/TodoApp.BlazorWasm.Server.csproj
+++ b/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Server/TodoApp.BlazorWasm.Server.csproj
@@ -11,7 +11,7 @@
     <PackageReference Include="CommunityToolkit.Datasync.Server.EntityFrameworkCore" Version="10.1.0" />
     <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.9" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.9" />
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="10.0.3" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="10.0.9" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/samples/todoapp-mvc/TodoApp.Service/TodoApp.Service.csproj b/samples/todoapp-mvc/TodoApp.Service/TodoApp.Service.csproj
index 7a88cde..bbc928a 100644
--- a/samples/todoapp-mvc/TodoApp.Service/TodoApp.Service.csproj
+++ b/samples/todoapp-mvc/TodoApp.Service/TodoApp.Service.csproj
@@ -9,7 +9,7 @@
   <ItemGroup>
     <PackageReference Include="CommunityToolkit.Datasync.Server" Version="10.1.0" />
     <PackageReference Include="CommunityToolkit.Datasync.Server.EntityFrameworkCore" Version="10.1.0" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.9" />
     <PackageReference Include="Microsoft.Web.LibraryManager.Build" Version="3.0.71" />
   </ItemGroup>
 
diff --git a/samples/todoapp-tutorial/ClientApp/ClientApp.csproj b/samples/todoapp-tutorial/ClientApp/ClientApp.csproj
index e0e368d..c3c6132 100644
--- a/samples/todoapp-tutorial/ClientApp/ClientApp.csproj
+++ b/samples/todoapp-tutorial/ClientApp/ClientApp.csproj
@@ -9,7 +9,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.0.0" />
+    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.1.0" />
     <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.0" />
   </ItemGroup>
 
diff --git a/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia/TodoApp.Avalonia.csproj b/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia/TodoApp.Avalonia.csproj
index 6cc92ee..e2c0899 100644
--- a/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia/TodoApp.Avalonia.csproj
+++ b/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia/TodoApp.Avalonia.csproj
@@ -16,8 +16,8 @@
         <PackageReference Include="Avalonia.Fonts.Inter" Version="11.3.0" />
         <!--Condition below is needed to remove Avalonia.Diagnostics package from build output in Release configuration.-->
         <PackageReference Condition="'$(Configuration)' == 'Debug'" Include="Avalonia.Diagnostics" Version="11.3.0" />
-        <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.0.0" />
+        <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.1.0" />
         <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.0" />
-        <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.3" />
+        <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.9" />
     </ItemGroup>
 </Project>
diff --git a/samples/todoapp/TodoApp.MAUI/TodoApp.MAUI.csproj b/samples/todoapp/TodoApp.MAUI/TodoApp.MAUI.csproj
index 7c68ea6..424870a 100644
--- a/samples/todoapp/TodoApp.MAUI/TodoApp.MAUI.csproj
+++ b/samples/todoapp/TodoApp.MAUI/TodoApp.MAUI.csproj
@@ -50,10 +50,10 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.0.0" />
+    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.1.0" />
     <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.0" />
     <PackageReference Include="Microsoft.Maui.Controls" Version="10.0.40" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Debug" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Debug" Version="10.0.9" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/samples/todoapp/TodoApp.Uno/Directory.Packages.props b/samples/todoapp/TodoApp.Uno/Directory.Packages.props
index 6d4cbfc..73f9c81 100644
--- a/samples/todoapp/TodoApp.Uno/Directory.Packages.props
+++ b/samples/todoapp/TodoApp.Uno/Directory.Packages.props
@@ -10,11 +10,11 @@
   <ItemGroup>
     <PackageVersion Include="CommunityToolkit.WinUI.Behaviors" Version="8.2.250402" />
     <PackageVersion Include="CommunityToolkit.WinUI.Converters" Version="8.2.250402" />
-    <PackageVersion Include="CommunityToolkit.Datasync.Client" Version="10.0.0" />
+    <PackageVersion Include="CommunityToolkit.Datasync.Client" Version="10.1.0" />
     <PackageVersion Include="Refit" Version="8.0.0" />
-    <PackageVersion Include="System.Formats.Asn1" Version="10.0.3" />
-    <PackageVersion Include="System.IO.Packaging" Version="10.0.3" />
+    <PackageVersion Include="System.Formats.Asn1" Version="10.0.9" />
+    <PackageVersion Include="System.IO.Packaging" Version="10.0.9" />
     <PackageVersion Include="System.Private.Uri" Version="4.3.2" />
-    <PackageVersion Include="System.Text.Json" Version="10.0.3" />
+    <PackageVersion Include="System.Text.Json" Version="10.0.9" />
   </ItemGroup>
 </Project>
diff --git a/samples/todoapp/TodoApp.WPF/TodoApp.WPF.csproj b/samples/todoapp/TodoApp.WPF/TodoApp.WPF.csproj
index c6faa09..1dcc877 100644
--- a/samples/todoapp/TodoApp.WPF/TodoApp.WPF.csproj
+++ b/samples/todoapp/TodoApp.WPF/TodoApp.WPF.csproj
@@ -10,6 +10,6 @@
 
   <ItemGroup>
     <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.0" />
-    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.0.0" />
+    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.1.0" />
   </ItemGroup>
 </Project>
diff --git a/samples/todoapp/TodoApp.WinUI3/TodoApp.WinUI3.csproj b/samples/todoapp/TodoApp.WinUI3/TodoApp.WinUI3.csproj
index 68ae39f..c4863a8 100644
--- a/samples/todoapp/TodoApp.WinUI3/TodoApp.WinUI3.csproj
+++ b/samples/todoapp/TodoApp.WinUI3/TodoApp.WinUI3.csproj
@@ -29,11 +29,11 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.0.0" />
+    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.1.0" />
     <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.0" />
     <PackageReference Include="CommunityToolkit.WinUI.Behaviors" Version="8.2.250402" />
     <PackageReference Include="CommunityToolkit.WinUI.Converters" Version="8.2.250402" />
-    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="10.0.9" />
     <PackageReference Include="Microsoft.WindowsAppSDK" Version="1.7.250401001" />
     <PackageReference Include="Microsoft.Windows.SDK.BuildTools" Version="10.0.26100.3916" />
     <Manifest Include="$(ApplicationManifest)" />