diff --git a/docs/dependency-overrides.md b/docs/dependency-overrides.md
new file mode 100644
index 0000000..0e48c45
--- /dev/null
+++ b/docs/dependency-overrides.md
@@ -0,0 +1,16 @@
+# Dependency override rationale
+
+The overrides in `package.json` are intentionally narrow and should be revisited when the upstream packages move their dependency ranges.
+
+## Security fixes
+
+- `axios` is pinned to `1.18.1` to incorporate the security update from the open Dependabot update, Ref: #228. It is consumed transitively by the OpenTelemetry Jaeger remote sampler.
+- `@opentelemetry/propagator-jaeger` is pinned to `2.10.0` because the current OpenTelemetry SDK pins `2.8.0`, which is affected by `GHSA-45rx-2jwx-cxfr`. Version `2.10.0` aligns with the existing `@opentelemetry/core` override.
+- `brace-expansion` is overridden only below `glob@10.5.0` and its `minimatch` dependency at `2.1.4`. This fixes the vulnerable 2.x subtree while preserving the separate `5.0.9` subtree required by ESLint's `minimatch` 10 dependency.
+
+## Deferred major updates
+
+- TypeScript remains on the TypeScript 6 line. The current `typescript-eslint` packages require a TypeScript version below `6.1.0`, and TypeScript 7 does not provide the JavaScript compiler API they need. Ref: #214.
+- `js-yaml` remains pinned to `4.3.1`. Current GraphQL Mesh utilities use v4 APIs removed in js-yaml 5, including `DEFAULT_SCHEMA.extend` and `Type`. Ref: #190.
+
+Do not use `npm audit fix --force` for these dependencies. Its proposed gateway downgrade would be a breaking runtime change. Re-evaluate the deferred updates when the upstream consumers publish compatible releases.
diff --git a/package-lock.json b/package-lock.json
index 6ec1467..f1987b1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6682,12 +6682,12 @@
       }
     },
     "node_modules/@opentelemetry/propagator-jaeger": {
-      "version": "2.8.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/propagator-jaeger/-/propagator-jaeger-2.8.0.tgz",
-      "integrity": "sha512-Xnz9zZvvQzUw+9DrOn0MomR7BxFCkA2pcfXBQuHC28ndJpSbjLs7knzYb05kw5SyCjSsEWombkZMgGcJSk8JVg==",
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/propagator-jaeger/-/propagator-jaeger-2.10.0.tgz",
+      "integrity": "sha512-yw/IX8DL470dSMZJoE82ScfYGp7JWZ/G8kFJo35ZILUVTB2jFPTOaioN+8s09pH0RHsWNhweVZb+ZnjJJpCChg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.8.0"
+        "@opentelemetry/core": "2.10.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -10171,16 +10171,42 @@
       "license": "MIT"
     },
     "node_modules/axios": {
-      "version": "1.16.0",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.16.0.tgz",
-      "integrity": "sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==",
+      "version": "1.18.1",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.1.tgz",
+      "integrity": "sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==",
       "license": "MIT",
       "dependencies": {
         "follow-redirects": "^1.16.0",
         "form-data": "^4.0.5",
+        "https-proxy-agent": "^5.0.1",
         "proxy-from-env": "^2.1.0"
       }
     },
+    "node_modules/axios/node_modules/agent-base": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
+    "node_modules/axios/node_modules/https-proxy-agent": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "6",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/backo2": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/backo2/-/backo2-1.0.2.tgz",
@@ -11515,9 +11541,9 @@
       "license": "MIT"
     },
     "node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz",
-      "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
diff --git a/package.json b/package.json
index d784c4d..2127337 100644
--- a/package.json
+++ b/package.json
@@ -39,10 +39,17 @@
     "typescript": "^6.0.0"
   },
   "overrides": {
+    "axios": "1.18.1",
     "@grpc/grpc-js": "1.14.4",
     "@opentelemetry/core": "2.10.0",
+    "@opentelemetry/propagator-jaeger": "2.10.0",
     "fast-uri": "4.1.2",
     "form-data": "4.0.6",
+    "glob@10.5.0": {
+      "minimatch": {
+        "brace-expansion": "2.1.4"
+      }
+    },
     "js-yaml": "4.3.1",
     "protobufjs": "8.7.1",
     "uuid": "14.0.1"