diff --git a/Gemfile.lock b/Gemfile.lock
index 70dd69388a..9b178e9a58 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -164,7 +164,7 @@ GEM
       activerecord (>= 3.0)
     acts_as_tree (2.9.1)
       activerecord (>= 3.0.0)
-    addressable (2.8.8)
+    addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     afm (0.2.2)
     after_commit_queue (1.1.0)
@@ -273,8 +273,9 @@ GEM
       bigdecimal
       rexml
     crass (1.0.6)
-    css_parser (1.21.1)
+    css_parser (3.0.0)
       addressable
+      ssrf_filter (~> 1.5)
     cssbundling-rails (1.4.3)
       railties (>= 6.0.0)
     csv (3.3.5)
@@ -588,7 +589,7 @@ GEM
       racc
     pastel (0.8.0)
       tty-color (~> 0.5)
-    pdf-core (0.9.0)
+    pdf-core (0.10.0)
     pdf-inspector (1.3.0)
       pdf-reader (>= 1.0, < 3.0.a)
     pdf-reader (2.11.0)
@@ -605,13 +606,15 @@ GEM
       json (~> 2.7, >= 2.7.1)
     pp (0.6.2)
       prettyprint
-    prawn (2.4.0)
-      pdf-core (~> 0.9.0)
-      ttfunk (~> 1.7)
-    prawn-svg (0.32.0)
-      css_parser (~> 1.6)
+    prawn (2.5.0)
+      matrix (~> 0.4)
+      pdf-core (~> 0.10.0)
+      ttfunk (~> 1.8)
+    prawn-svg (0.40.3)
+      css_parser (>= 1.17.1, < 4)
+      matrix (~> 0.4.2)
       prawn (>= 0.11.1, < 3)
-      rexml (~> 3.2)
+      rexml (>= 3.4.2, < 4)
     prettyprint (0.2.0)
     prism (1.4.0)
     prometheus-client-mmap (1.3.0)
@@ -640,7 +643,7 @@ GEM
     psych (5.2.6)
       date
       stringio
-    public_suffix (7.0.2)
+    public_suffix (7.0.5)
     raabro (1.4.0)
     racc (1.8.1)
     rack (2.2.23)
@@ -902,6 +905,7 @@ GEM
       actionpack (>= 6.1)
       activesupport (>= 6.1)
       sprockets (>= 3.0.0)
+    ssrf_filter (1.5.0)
     state_machines (0.5.0)
     state_machines-activemodel (0.8.0)
       activemodel (>= 5.1)
@@ -940,7 +944,8 @@ GEM
     timeout (0.6.0)
     tomlrb (2.0.3)
     tsort (0.2.0)
-    ttfunk (1.7.0)
+    ttfunk (1.8.0)
+      bigdecimal (~> 3.1)
     tty-color (0.6.0)
     tty-cursor (0.7.1)
     tty-markdown (0.7.2)
diff --git a/app/lib/pdf/report.rb b/app/lib/pdf/report.rb
index 750e7b5d54..2706576281 100644
--- a/app/lib/pdf/report.rb
+++ b/app/lib/pdf/report.rb
@@ -180,6 +180,8 @@ def traffic_graph
 
     def traffic_graph_style(svg)
       xml = Nokogiri::XML(svg)
+      # cleaning up `a` elements can be removed with prawn-svg 0.40.4+
+      xml.css('a').each { |a| a.replace(a.children) }
       style = xml.at_css("style")
       css = CssParser::Parser.new
       css.load_string!(style.text.gsub(/ff0000/i, "9273ED"))
diff --git a/doc/dependency_decisions.yml b/doc/dependency_decisions.yml
index f246ab975e..1be964a166 100644
--- a/doc/dependency_decisions.yml
+++ b/doc/dependency_decisions.yml
@@ -250,3 +250,9 @@
     :why: Approved by OSI and Fedora
     :versions: []
     :when: 2026-04-29 07:57:00.547859043 Z
+- - :permit
+  - GPL-2.0-only
+  - :who: Aleksandar Kostadinov
+    :why: this is the preferred SPDX name of the already approved but deprecated GPL-2 and GPL-2.0 identifiers
+    :versions: []
+    :when: 2026-07-24 18:16:05.649037719 Z