@@ -17,22 +17,22 @@ module(
 )
 
 bazel_dep(name = "bazel_skylib", version = "1.9.2")
-bazel_dep(name = "rules_jvm_external", version = "7.1")
-bazel_dep(name = "protobuf", version = "35.1", repo_name = "com_google_protobuf")  # see https://github.com/bazelbuild/rules_android/issues/373
-bazel_dep(name = "googleapis", version = "0.0.0-20260728-b8486a2f", repo_name = "com_google_googleapis")
-bazel_dep(name = "rules_pkg", version = "1.2.0")
+bazel_dep(name = "rules_jvm_external", version = "7.2")
+bazel_dep(name = "protobuf", version = "36.2", repo_name = "com_google_protobuf")
+bazel_dep(name = "googleapis", version = "0.0.0-20261020-14a161a9", repo_name = "com_google_googleapis")
+bazel_dep(name = "rules_pkg", version = "1.3.0")
 bazel_dep(name = "rules_license", version = "1.0.0")
 bazel_dep(name = "rules_proto", version = "7.1.0")
-bazel_dep(name = "rules_java", version = "9.7.0")
+bazel_dep(name = "rules_java", version = "9.9.0")
 bazel_dep(name = "rules_android", version = "0.7.3")
 bazel_dep(name = "rules_shell", version = "0.8.0")
 bazel_dep(name = "googleapis-java", version = "1.1.5")
 bazel_dep(name = "cel-spec", version = "0.25.3", repo_name = "cel_spec")
-bazel_dep(name = "rules_go", version = "0.62.0")
+bazel_dep(name = "rules_go", version = "0.65.0")
 
 # Required by cel-spec to satisfy gazelle transitive dependency
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
-go_sdk.download(version = "1.26.5")
+go_sdk.download(version = "1.27.3")
 
 switched_rules = use_extension("@com_google_googleapis//:extensions.bzl", "switched_rules")
 switched_rules.use_languages(java = True)
@@ -42,15 +42,15 @@ maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
 
 AUTO_VALUE_VERSION = "1.11.1"
 
-GUAVA_VERSION = "33.6.0"
+GUAVA_VERSION = "33.7.2"
 
-JLINE_VERSION = "3.30.16"
+JLINE_VERSION = "3.30.17"
 
 TRUTH_VERSION = "1.4.5"
 
-PROTOBUF_JAVA_VERSION = "4.35.1"
+PROTOBUF_JAVA_VERSION = "4.36.2"
 
-CEL_VERSION = "0.14.0"
+CEL_VERSION = "0.15.0"
 
 # Compile only artifacts
 [
@@ -62,7 +62,7 @@ CEL_VERSION = "0.14.0"
     )
     for group, artifact, version in [coord.split(":") for coord in [
         "com.google.code.findbugs:annotations:3.0.1",
-        "com.google.errorprone:error_prone_annotations:2.50.0",
+        "com.google.errorprone:error_prone_annotations:2.51.0",
     ]]
 ]
 
@@ -76,8 +76,8 @@ CEL_VERSION = "0.14.0"
     )
     for group, artifact, version in [coord.split(":") for coord in [
         "org.mockito:mockito-core:4.11.0",
-        "io.github.classgraph:classgraph:4.8.186",
-        "com.google.testparameterinjector:test-parameter-injector:1.22",
+        "io.github.classgraph:classgraph:4.8.199",
+        "com.google.testparameterinjector:test-parameter-injector:1.25",
         "com.google.guava:guava-testlib:" + GUAVA_VERSION + "-jre",
         "com.google.truth.extensions:truth-java8-extension:" + TRUTH_VERSION,
         "com.google.truth.extensions:truth-proto-extension:" + TRUTH_VERSION,
@@ -98,12 +98,12 @@ maven.install(
         "com.google.re2j:re2j:1.8",
         "info.picocli:picocli:4.7.7",
         "org.antlr:antlr4-runtime:4.13.2",
-        "org.freemarker:freemarker:2.3.34",
+        "org.freemarker:freemarker:2.3.35",
         "org.jline:jline-reader:" + JLINE_VERSION,
         "org.jline:jline-terminal:" + JLINE_VERSION,
-        "org.jspecify:jspecify:1.0.0",
-        "org.threeten:threeten-extra:1.10.0",
-        "org.yaml:snakeyaml:2.6",
+        "org.jspecify:jspecify:1.0.1",
+        "org.threeten:threeten-extra:1.11.0",
+        "org.yaml:snakeyaml:2.7",
         "tools.aqua:z3-turnkey:4.14.1",
     ],
     known_contributing_modules = ["protobuf"],
 
@@ -55,14 +55,14 @@ CEL-Java is available in Maven Central Repository. [Download the JARs here][8] o
 <dependency>
   <groupId>dev.cel</groupId>
   <artifactId>cel</artifactId>
-  <version>0.14.0</version>
+  <version>0.15.0</version>
 </dependency>
 ```
 
 **Gradle**
 
 ```gradle
-implementation 'dev.cel:cel:0.14.0'
+implementation 'dev.cel:cel:0.15.0'
 ```
 
 Then run this example:
 
@@ -12,4 +12,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 """Maven artifact version for CEL."""
-CEL_VERSION = "0.14.0"
+CEL_VERSION = "0.15.0"
@@ -29,15 +29,15 @@
 ALL_TARGETS=("//publish:cel_common.publish" "//publish:cel.publish" "//publish:cel_compiler.publish" "//publish:cel_runtime.publish" "//publish:cel_v1alpha1.publish" "//publish:cel_protobuf.publish" "//publish:cel_runtime_android.publish" "//publish:cel_verifier.publish" "//publish:cel_verifier_cli.publish")
 JDK8_FLAGS="--java_language_version=8 --java_runtime_version=8"
 
-function publish_maven_remote() {
+function publish_maven_snapshot() {
   maven_repo_url=$1
   # Credentials should be read from maven config (settings.xml) once it
   # is supported by bazelbuild:
   # https://github.com/bazelbuild/rules_jvm_external/issues/679
   read -p "maven_user: " maven_user
   read -s -p "maven_password: " maven_password
+  echo ""
 
-  # Upload artifacts to staging repository
   for PUBLISH_TARGET in "${ALL_TARGETS[@]}"
   do
        bazel run --stamp \
@@ -46,37 +46,52 @@ function publish_maven_remote() {
          --define "maven_user=$maven_user" \
          --define "maven_password=$maven_password" \
          $PUBLISH_TARGET \
-         $JDK8_FLAGS
+         $JDK8_FLAGS || exit 1
   done
+}
 
-  # Begin creating a staging deployment in central maven
-  auth_token=$(printf "%s:%s" "$maven_user" "$maven_password" | base64)
-  repository_key=$(curl -s -X GET \
-    -H "Authorization:Bearer $auth_token" \
-    "https://ossrh-staging-api.central.sonatype.com/manual/search/repositories?ip=any&profile_id=dev.cel" | \
-    jq -r '.repositories[] | select(.state=="open") | .key' | head -n 1)
+function publish_maven_release() {
+  read -p "maven_user: " maven_user
+  read -s -p "maven_password: " maven_password
   echo ""
-  if [[ -n "$repository_key" ]]; then
-    echo "Open repository key:"
-    echo "$repository_key"
-
-    echo "Creating deployment..."
-    post_response=$(curl -s -w "\n%{http_code}" -X POST \
-      -H "Authorization: Bearer $auth_token" \
-      "https://ossrh-staging-api.central.sonatype.com/manual/upload/repository/$repository_key")
-
-    http_code=$(tail -n1 <<< "$post_response")
-    response_body=$(sed '$ d' <<< "$post_response")
-
-    echo "----------------------------------------"
-    echo "Deployment API Response (HTTP Status: $http_code):"
-    echo "$response_body"
-    echo "----------------------------------------"
-    echo ""
-    echo "Proceed to https://central.sonatype.com/publishing/deployments to finalize publishing."
-  else
-    echo "No open repository was found. Likely an indication that artifacts were not uploaded."
-  fi
+
+  staging_dir=$(mktemp -d)
+  trap 'rm -rf "$staging_dir"' EXIT
+
+  # Stage and GPG-sign artifacts locally into a single directory tree
+  for PUBLISH_TARGET in "${ALL_TARGETS[@]}"
+  do
+       bazel run --stamp \
+         --define "maven_repo=file://$staging_dir" \
+         --define gpg_sign=true \
+         $PUBLISH_TARGET \
+         $JDK8_FLAGS || exit 1
+  done
+
+  # Central Portal bundle validation rejects maven-metadata.xml files
+  find "$staging_dir" -name "maven-metadata.xml*" -delete
+
+  bundle_zip="$staging_dir/central-bundle.zip"
+  (cd "$staging_dir" && zip -qr "$bundle_zip" dev)
+
+  # Upload the atomic bundle to Maven Central Portal
+  auth_token=$(printf "%s:%s" "$maven_user" "$maven_password" | base64 | tr -d '\n')
+  echo ""
+  echo "Uploading deployment bundle to Maven Central Portal..."
+  post_response=$(curl -s -w "\n%{http_code}" -X POST \
+    -H "Authorization: Bearer $auth_token" \
+    -F "bundle=@$bundle_zip" \
+    "https://central.sonatype.com/api/v1/publisher/upload?publishingType=USER_MANAGED&name=dev.cel-$version")
+
+  http_code=$(tail -n1 <<< "$post_response")
+  response_body=$(sed '$ d' <<< "$post_response")
+
+  echo "----------------------------------------"
+  echo "Deployment API Response (HTTP Status: $http_code):"
+  echo "$response_body"
+  echo "----------------------------------------"
+  echo ""
+  echo "Proceed to https://central.sonatype.com/publishing/deployments to finalize publishing."
 }
 
 version=$(<cel_version.bzl)
@@ -89,7 +104,7 @@ if [ "$flag" == "--snapshot" ] || [ "$flag" == "-s" ]; then
     exit 1;
   fi
   echo "Publishing a SNAPSHOT version: $version to remote Maven repository"
-  publish_maven_remote "https://central.sonatype.com/repository/maven-snapshots/"
+  publish_maven_snapshot "https://central.sonatype.com/repository/maven-snapshots/"
 elif [ "$flag" == "--release" ] || [ "$flag" == "-r" ]; then
   if [[ $version == *"-SNAPSHOT"* ]]; then
    echo "Unable to publish. Please remove -SNAPSHOT suffix from CEL Version"
@@ -100,7 +115,7 @@ elif [ "$flag" == "--release" ] || [ "$flag" == "-r" ]; then
      read -p "Proceed (Y/N)? " yn
      case $yn in
          [Yy]* )
-           publish_maven_remote "https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2/"
+           publish_maven_release
            break;;
          [Nn]* ) exit;;
          * ) echo "Please answer yes or no.";;
 
@@ -14,25 +14,25 @@ directly from Maven Central and invoke it with `java -jar`:
 <!-- disableFinding(LINE_OVER_80) -->
 ```bash
 # Download the latest CLI JAR (Note: this is an uber-JAR)
-curl -LO https://repo1.maven.org/maven2/dev/cel/verifier-cli/0.14.0/verifier-cli-0.14.0.jar
+curl -LO https://repo1.maven.org/maven2/dev/cel/verifier-cli/0.15.0/verifier-cli-0.15.0.jar
 
 # Launch interactive REPL shell
-java -jar verifier-cli-0.14.0.jar repl
+java -jar verifier-cli-0.15.0.jar repl
 
 # Run a one-shot verification command
-java -jar verifier-cli-0.14.0.jar check-sat \
+java -jar verifier-cli-0.15.0.jar check-sat \
   --expr "role == 'editor' && port > 1024" \
   --var "role:string" \
   --var "port:int"
 
 # Run with JSON output format for CI/CD integrations
-java -jar verifier-cli-0.14.0.jar check-sat \
+java -jar verifier-cli-0.15.0.jar check-sat \
   --expr "role == 'editor'" \
   --var "role:string" \
   --output_format=json
 
 # Display help and available commands
-java -jar verifier-cli-0.14.0.jar --help
+java -jar verifier-cli-0.15.0.jar --help
 ```
 
 ### Running via Bazel