diff --git a/workspaces/arborist/package.json b/workspaces/arborist/package.json
index 4b11b3dfffd2c..04c0310fd6b52 100644
--- a/workspaces/arborist/package.json
+++ b/workspaces/arborist/package.json
@@ -6,13 +6,13 @@
     "@isaacs/string-locale-compare": "^1.1.0",
     "@npmcli/installed-package-contents": "^1.0.7",
     "@npmcli/map-workspaces": "^2.0.3",
-    "@npmcli/metavuln-calculator": "^4.0.0",
+    "@npmcli/metavuln-calculator": "^7.0.0",
     "@npmcli/move-file": "^2.0.0",
     "@npmcli/name-from-folder": "^1.0.1",
     "@npmcli/node-gyp": "^2.0.0",
     "@npmcli/package-json": "^2.0.0",
     "@npmcli/query": "^2.0.0",
-    "@npmcli/run-script": "^4.1.3",
+    "@npmcli/run-script": "^7.0.2",
     "bin-links": "^3.0.3",
     "cacache": "^16.1.3",
     "common-ancestor-path": "^1.0.1",
@@ -23,9 +23,9 @@
     "npm-install-checks": "^5.0.0",
     "npm-package-arg": "^9.0.0",
     "npm-pick-manifest": "^7.0.2",
-    "npm-registry-fetch": "^13.0.0",
+    "npm-registry-fetch": "^15.0.0",
     "npmlog": "^6.0.2",
-    "pacote": "^14.0.0",
+    "pacote": "^17.0.4",
     "parse-conflict-json": "^2.0.1",
     "proc-log": "^2.0.0",
     "promise-all-reject-late": "^1.0.0",