diff --git a/.github/workflows/checks.apicheck.yml b/.github/workflows/checks.apicheck.yml
new file mode 100644
index 000000000..3b54b3959
--- /dev/null
+++ b/.github/workflows/checks.apicheck.yml
@@ -0,0 +1,76 @@
+name: "API Check"
+
+"on":
+  workflow_dispatch: {}
+  workflow_call:
+    inputs:
+      ignore_failures:
+        description: "Ignore failures"
+        required: false
+        type: boolean
+        default: false
+
+    secrets:
+      GRADLE_CONFIGURATION_KEY:
+        description: "Gradle cache key"
+        required: false
+      BUILDLESS_APIKEY:
+        description: "Buildless key"
+        required: false
+
+permissions:
+  contents: "read"
+
+jobs:
+  api-check:
+    name: "API Check"
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - name: "Setup: Harden Runner"
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+      - name: "Setup: Checkout"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: "Setup: Cache Restore (Build)"
+        id: cache-restore-build
+        uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+        with:
+          key: pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+          restore-keys: |
+            pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+            pkl-v1-build-
+            pkl-v1-
+            pkl-
+          path: |
+            .gradle/
+            build/
+            .codebase/
+            .kotlin/
+            ./*/build/bin
+            ./*/build/classes
+            ./*/build/kotlin
+            ./*/build/klib
+            ./*/build/generated
+            ./*/build/generated-sources
+      - name: "Setup: Java 21"
+        uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
+        with:
+          distribution: 'adopt'
+          java-version: '21'
+      - name: "Analysis: API Check"
+        uses: gradle/actions/setup-gradle@417ae3ccd767c252f5661f1ace9f835f9654f2b5 # v3.1.0
+        continue-on-error: ${{ inputs.ignore_failures }}
+        env:
+          CI: true
+        with:
+          cache-read-only: true
+          cache-encryption-key: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
+          arguments: |
+            apiCheck
+            -x test
+            -PenableAnalysis=true
diff --git a/.github/workflows/checks.codeql.yml b/.github/workflows/checks.codeql.yml
new file mode 100644
index 000000000..2c979838f
--- /dev/null
+++ b/.github/workflows/checks.codeql.yml
@@ -0,0 +1,95 @@
+name: "CodeQL"
+
+"on":
+  workflow_dispatch: {}
+  workflow_call:
+    inputs: {}
+    secrets:
+      GRADLE_CONFIGURATION_KEY:
+        description: "Gradle cache key"
+        required: false
+      BUILDLESS_APIKEY:
+        description: "Buildless key"
+        required: false
+
+  schedule:
+    - cron: "0 0-23/2 * * *"
+
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["java-kotlin"]
+    steps:
+      - name: "Setup: Harden Runner"
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+      - name: "Setup: Checkout"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
+      - name: "Setup: Cache Restore (Build)"
+        id: cache-restore-build
+        uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+        with:
+          key: pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+          restore-keys: |
+            pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+            pkl-v1-build-
+            pkl-v1-
+            pkl-
+          path: |
+            .gradle/
+            build/
+            .codebase/
+            .kotlin/
+            ./*/build/bin
+            ./*/build/classes
+            ./*/build/kotlin
+            ./*/build/klib
+            ./*/build/generated
+            ./*/build/generated-sources
+      - name: "Setup: Java 21"
+        uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
+        with:
+          distribution: 'adopt'
+          java-version: '21'
+      - name: "Setup: Initialize CodeQL"
+        uses: github/codeql-action/init@379614612a29c9e28f31f39a59013eb8012a51f0 # v3.24.3
+        with:
+          config-file: ./.github/codeql/codeql-config.yml
+          languages: ${{ matrix.language }}
+      - name: "Analysis: Build"
+        uses: gradle/actions/setup-gradle@417ae3ccd767c252f5661f1ace9f835f9654f2b5 # v3.1.0
+        continue-on-error: true
+        env:
+          CI: true
+          BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
+        with:
+          cache-read-only: true
+          cache-encryption-key: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
+          arguments: |
+            compileKotlin
+            compileJava
+            assemble
+            -x test
+            -x check
+      - name: "Analysis: CodeQL"
+        uses: github/codeql-action/analyze@379614612a29c9e28f31f39a59013eb8012a51f0 # v3.24.3
+        continue-on-error: true
diff --git a/.github/workflows/checks.dependency-review.yml b/.github/workflows/checks.dependency-review.yml
new file mode 100644
index 000000000..7abd41119
--- /dev/null
+++ b/.github/workflows/checks.dependency-review.yml
@@ -0,0 +1,33 @@
+name: "Dependencies"
+
+"on":
+  workflow_dispatch: {}
+  workflow_call: {}
+
+permissions:
+  contents: read
+
+jobs:
+  dep-review:
+    name: "Dependency Review"
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Setup: Harden Runner"
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+      - name: "Setup: Checkout"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: "Check: Dependency Review"
+        uses: actions/dependency-review-action@80f10bf419f34980065523f5efca7ebed17576aa # v4.1.0
+        continue-on-error: true
+        if: github.event_name == 'pull_request'
+        with:
+          config-file: "./.github/dependency-review-config.yml"
+          license-check: true
+          vulnerability-check: true
+          fail-on-severity: "low"
+          base-ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref || 'main' }}
diff --git a/.github/workflows/checks.detekt.yml b/.github/workflows/checks.detekt.yml
new file mode 100644
index 000000000..3e6b6b6cf
--- /dev/null
+++ b/.github/workflows/checks.detekt.yml
@@ -0,0 +1,73 @@
+name: "Detekt"
+
+"on":
+  workflow_dispatch: {}
+  workflow_call:
+    inputs: {}
+    secrets:
+      GRADLE_CONFIGURATION_KEY:
+        description: "Gradle cache key"
+        required: false
+      BUILDLESS_APIKEY:
+        description: "Buildless key"
+        required: false
+
+permissions:
+  contents: "read"
+
+jobs:
+  sonar:
+    name: "Detekt"
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - name: "Setup: Harden Runner"
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+      - name: "Setup: Checkout"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: "Setup: Cache Restore (Build)"
+        id: cache-restore-build
+        uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+        with:
+          key: pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+          restore-keys: |
+            pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+            pkl-v1-build-
+            pkl-v1-
+            pkl-
+          path: |
+            .gradle/
+            build/
+            .codebase/
+            .kotlin/
+            ./*/build/bin
+            ./*/build/classes
+            ./*/build/kotlin
+            ./*/build/klib
+            ./*/build/generated
+            ./*/build/generated-sources
+      - name: "Setup: Java 21"
+        uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
+        with:
+          distribution: 'adopt'
+          java-version: '21'
+      - name: "Setup: Git History"
+        run: git fetch --unshallow || exit 0
+      - name: "Analysis: Detekt"
+        uses: gradle/actions/setup-gradle@417ae3ccd767c252f5661f1ace9f835f9654f2b5 # v3.1.0
+        continue-on-error: true
+        env:
+          CI: true
+        with:
+          cache-read-only: true
+          cache-encryption-key: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
+          arguments: detekt detektMergeSarif detektMergeXml -PenableAnalysis=true -PsarifReporting=true
+      - name: "Report: SARIF Upload"
+        uses: github/codeql-action/upload-sarif@379614612a29c9e28f31f39a59013eb8012a51f0 # v3.24.3
+        with:
+          sarif_file: build/reports/detekt/detekt.sarif
diff --git a/.github/workflows/checks.formatting.yml b/.github/workflows/checks.formatting.yml
new file mode 100644
index 000000000..e109285b3
--- /dev/null
+++ b/.github/workflows/checks.formatting.yml
@@ -0,0 +1,84 @@
+name: "Formatting"
+
+"on":
+  workflow_dispatch:
+    inputs:
+      ## Input: Ignore Failures
+      ignore_failures:
+        description: "Ignore failures"
+        required: false
+        type: boolean
+        default: false
+
+  workflow_call:
+    inputs:
+      ignore_failures:
+        description: "Ignore failures"
+        required: false
+        type: boolean
+        default: false
+
+    secrets:
+      GRADLE_CONFIGURATION_KEY:
+        description: "Gradle cache key"
+        required: false
+      BUILDLESS_APIKEY:
+        description: "Buildless key"
+        required: false
+
+permissions:
+  contents: "read"
+
+jobs:
+  fmt-check:
+    name: "Formatting"
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - name: "Setup: Harden Runner"
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+      - name: "Setup: Checkout"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: "Setup: Cache Restore (Build)"
+        id: cache-restore-build
+        uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+        with:
+          key: pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+          restore-keys: |
+            pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+            pkl-v1-build-
+            pkl-v1-
+            pkl-
+          path: |
+            .gradle/
+            build/
+            .codebase/
+            .kotlin/
+            ./*/build/bin
+            ./*/build/classes
+            ./*/build/kotlin
+            ./*/build/klib
+            ./*/build/generated
+            ./*/build/generated-sources
+      - name: "Setup: Java 21"
+        uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
+        with:
+          distribution: 'adopt'
+          java-version: '21'
+      - name: "Analysis: Formatting (Spotless)"
+        uses: gradle/actions/setup-gradle@417ae3ccd767c252f5661f1ace9f835f9654f2b5 # v3.1.0
+        continue-on-error: ${{ inputs.ignore_failures }}
+        env:
+          CI: true
+        with:
+          cache-read-only: true
+          cache-encryption-key: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
+          arguments: |
+            spotlessCheck
+            -PenableAnalysis=true
+            -x spotlessKotlinGradleCheck
diff --git a/.github/workflows/checks.gradle-wrapper.yml b/.github/workflows/checks.gradle-wrapper.yml
new file mode 100644
index 000000000..33e9ded32
--- /dev/null
+++ b/.github/workflows/checks.gradle-wrapper.yml
@@ -0,0 +1,25 @@
+name: "Gradle Wrapper"
+
+"on":
+  workflow_dispatch: {}
+  workflow_call: {}
+
+permissions:
+  contents: read
+
+jobs:
+  validation:
+    name: "Gradle Wrapper"
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Setup: Harden Runner"
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+      - name: "Setup: Checkout"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: "Check: Gradle Wrapper"
+        uses: gradle/wrapper-validation-action@699bb18358f12c5b78b37bb0111d3a0e2276e0e2 # v2.1.1
diff --git a/.github/workflows/checks.scorecards.yml b/.github/workflows/checks.scorecards.yml
new file mode 100644
index 000000000..8be190998
--- /dev/null
+++ b/.github/workflows/checks.scorecards.yml
@@ -0,0 +1,62 @@
+name: "Scorecard"
+
+"on":
+  branch_protection_rule: {}
+  workflow_dispatch: {}
+  workflow_call: {}
+
+# Declare default permissions as read-only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      contents: read
+      actions: read
+    steps:
+      - name: "Setup: Harden Runner"
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+      - name: "Setup: Checkout"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
+      - name: "Analysis: Scorecard"
+        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecards on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Artifact: Scorecard Analysis"
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Artifact: Scorecard SARIF"
+        uses: github/codeql-action/upload-sarif@379614612a29c9e28f31f39a59013eb8012a51f0 # v3.24.3
+        with:
+          sarif_file: results.sarif
diff --git a/.github/workflows/job.build.yml b/.github/workflows/job.build.yml
new file mode 100644
index 000000000..55d22f331
--- /dev/null
+++ b/.github/workflows/job.build.yml
@@ -0,0 +1,98 @@
+name: "Build"
+
+"on":
+  workflow_dispatch: {}
+  workflow_call:
+    inputs: {}
+    secrets:
+      GRADLE_CONFIGURATION_KEY:
+        description: "Gradle cache key"
+        required: false
+      BUILDLESS_APIKEY:
+        description: "Buildless key"
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  ##
+  ## Job: Build
+  ##
+  gradle:
+    name: "Build (Ubuntu)"
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        shell: bash
+
+    outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
+
+    steps:
+      - name: "Setup: Harden Runner"
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+      - name: "Setup: Checkout"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          submodules: true
+          persist-credentials: false
+      - name: "Setup: Cache Restore (Build)"
+        id: cache-restore-build
+        uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+        with:
+          key: pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+          restore-keys: |
+            pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+            pkl-v1-build-
+            pkl-v1-
+            pkl-
+          path: |
+            .gradle/
+            build/
+            .codebase/
+            .kotlin/
+            ./*/build/bin
+            ./*/build/classes
+            ./*/build/kotlin
+            ./*/build/klib
+            ./*/build/generated
+            ./*/build/generated-sources
+      - name: "Setup: GraalVM (Java 21)"
+        uses: graalvm/setup-graalvm@4a200f28cd70d1940b5e33bd00830b7dc71a7e2b # v1.2.6
+        with:
+          distribution: "graalvm"
+          java-version: '21'
+          check-for-updates: false
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: "🛠️ Build"
+        uses: gradle/actions/setup-gradle@417ae3ccd767c252f5661f1ace9f835f9654f2b5 # v3.1.0
+        id: gradlebuild
+        env:
+          CI: true
+        with:
+          cache-read-only: true
+          cache-encryption-key: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
+          gradle-home-cache-cleanup: true
+          arguments: build -x test -x check --scan
+          build-scan-publish: true
+          build-scan-terms-of-service-url: "https://gradle.com/terms-of-service"
+          build-scan-terms-of-service-agree: "yes"
+      - name: "Artifact: Caches"
+        uses: actions/cache/save@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+        with:
+          key: ${{ steps.cache-restore.outputs.cache-primary-key }}
+          path: |
+            .gradle/
+            build/
+            .codebase/
+            .kotlin/
+            ./*/build/bin
+            ./*/build/classes
+            ./*/build/kotlin
+            ./*/build/klib
+            ./*/build/generated
+            ./*/build/generated-sources
diff --git a/.github/workflows/job.dependency-graph.yml b/.github/workflows/job.dependency-graph.yml
new file mode 100644
index 000000000..4e3206f07
--- /dev/null
+++ b/.github/workflows/job.dependency-graph.yml
@@ -0,0 +1,75 @@
+name: "Dependency Graph"
+
+"on":
+  workflow_dispatch: {}
+  workflow_call:
+    inputs: {}
+    secrets:
+      GRADLE_CONFIGURATION_KEY:
+        description: "Gradle cache key"
+        required: false
+      BUILDLESS_APIKEY:
+        description: "Buildless key"
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  ##
+  ## Job: Build+Submit Dependency Graph
+  ##
+  gradle:
+    name: "Dependency Graph"
+    runs-on: "ubuntu-latest"
+
+    permissions:
+      ## Needed for submission of dependency graphs
+      contents: "write"
+
+    defaults:
+      run:
+        shell: bash
+
+    outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
+
+    steps:
+      - name: "Setup: Harden Runner"
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+      - name: "Setup: Checkout"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          submodules: true
+          persist-credentials: false
+      - name: "Setup: Cache Restore (Build)"
+        id: cache-restore-build
+        uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+        with:
+          key: pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+          restore-keys: |
+            pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+            pkl-v1-build-
+            pkl-v1-
+            pkl-
+          path: |
+            .gradle/
+            build/
+            .codebase/
+            .kotlin/
+            ./*/build/bin
+            ./*/build/classes
+            ./*/build/kotlin
+            ./*/build/klib
+            ./*/build/generated
+            ./*/build/generated-sources
+      - name: "Setup: Java 21"
+        uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
+        with:
+          distribution: 'adopt'
+          java-version: '21'
+      - name: "🛠️ Dependency Graph"
+        uses: gradle/actions/dependency-submission@417ae3ccd767c252f5661f1ace9f835f9654f2b5 # v3.1.0
+        continue-on-error: true
diff --git a/.github/workflows/job.native-build.yml b/.github/workflows/job.native-build.yml
new file mode 100644
index 000000000..2da457bf1
--- /dev/null
+++ b/.github/workflows/job.native-build.yml
@@ -0,0 +1,193 @@
+name: "Native Build"
+
+"on":
+  workflow_dispatch:
+    inputs:
+      release:
+        type: boolean
+        default: false
+        description: "Release build"
+      macos:
+        type: boolean
+        default: true
+        description: "macOS"
+      linux:
+        type: boolean
+        default: true
+        description: "Linux"
+      windows:
+        type: boolean
+        default: false
+        description: "Windows"
+      artifact:
+        type: string
+        default: ""
+        description: "Artifact prefix"
+
+  workflow_call:
+    inputs:
+      release:
+        type: boolean
+        default: false
+        description: "Release build"
+      macos:
+        type: boolean
+        default: true
+        description: "macOS"
+      linux:
+        type: boolean
+        default: true
+        description: "Linux"
+      windows:
+        type: boolean
+        default: false
+        description: "Windows"
+      artifact:
+        type: string
+        default: ""
+        description: "Artifact prefix"
+
+    secrets:
+      GRADLE_CONFIGURATION_KEY:
+        description: "Gradle cache key"
+        required: false
+      BUILDLESS_APIKEY:
+        description: "Buildless key"
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  ##
+  ## Job: Build+Submit Dependency Graph
+  ##
+  gradle:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [Ubuntu]
+        mode: ["Strict"]
+        tag: ["linux-amd64-${{ fromJson(inputs.release) && 'opt' || 'dev' }}"]
+        machine: ["ubuntu-latest"]
+        target: [":pkl-cli:linuxExecutableAmd64"]
+        enabled:
+          - ${{ fromJson(inputs.linux) }}
+        include:
+          - os: macOS x64
+            tag: macos-x64-${{ fromJson(inputs.release) && 'opt' || 'dev' }}
+            machine: macos-13
+            target: :pkl-cli:macExecutableAmd64
+            enabled: ${{ fromJson(inputs.macos) }}
+          - os: macOS aarch64
+            tag: macos-aarch64-${{ fromJson(inputs.release) && 'opt' || 'dev' }}
+            machine: macos-13-xlarge
+            target: :pkl-cli:macExecutableAarch64
+            enabled: ${{ fromJson(inputs.macos) }}
+
+          # Windows build is currently broken.
+          #
+          # - os: Windows
+          #   machine: windows-latest
+          #   target: :pkl-cli:windowsAmd64
+          #   tag: windows-x64
+
+    name: "Native CLI (${{ matrix.os }})"
+    runs-on: ${{ matrix.machine }}
+
+    defaults:
+      run:
+        shell: bash
+
+    outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
+
+    steps:
+      - name: "Setup: Harden Runner"
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+      - name: "Setup: Checkout"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        if: ${{ matrix.enabled }}
+        with:
+          submodules: true
+          persist-credentials: false
+      - name: "Setup: Cache Restore (Build)"
+        id: cache-restore-build
+        uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+        if: ${{ matrix.enabled }}
+        with:
+          key: pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+          restore-keys: |
+            pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+            pkl-v1-build-
+            pkl-v1-
+            pkl-
+          path: |
+            .gradle/
+            build/
+            .codebase/
+            .kotlin/
+            ./*/build/bin
+            ./*/build/classes
+            ./*/build/kotlin
+            ./*/build/klib
+            ./*/build/generated
+            ./*/build/generated-sources
+      - name: "Setup: GraalVM (Java 21)"
+        uses: graalvm/setup-graalvm@4a200f28cd70d1940b5e33bd00830b7dc71a7e2b # v1.2.6
+        if: ${{ matrix.enabled }}
+        with:
+          distribution: "graalvm"
+          java-version: '21'
+          check-for-updates: false
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          native-image-job-reports: 'true'
+      - name: "🛠️ Build"
+        uses: gradle/actions/setup-gradle@417ae3ccd767c252f5661f1ace9f835f9654f2b5 # v3.1.0
+        id: gradlebuild
+        if: ${{ matrix.enabled }}
+        env:
+          CI: true
+        with:
+          build-scan-publish: true
+          build-scan-terms-of-service-url: "https://gradle.com/terms-of-service"
+          build-scan-terms-of-service-agree: "yes"
+          cache-read-only: true
+          cache-encryption-key: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
+          gradle-home-cache-cleanup: true
+          arguments: |
+            assemble
+            build
+            ${{ matrix.target || ':pkl-cli:assembleNative' }}
+            -PnativeRelease=${{ inputs.release }}
+            --scan
+            -x test
+            -x check
+      - name: "Artifact: Native CLI"
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        if: ${{ matrix.enabled }}
+        with:
+          name: "${{ inputs.artifact || 'pkl-cli-latest' }}-${{ matrix.tag }}"
+          path: ./pkl-cli/build/distributions/pkl*.*
+          if-no-files-found: warn
+          retention-days: 14
+          compression-level: 1
+          overwrite: true
+      - name: "Artifact: Caches"
+        uses: actions/cache/save@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+        if: ${{ matrix.enabled }}
+        with:
+          key: ${{ steps.cache-restore.outputs.cache-primary-key }}
+          path: |
+            .gradle/
+            build/
+            .codebase/
+            .kotlin/
+            ./*/build/bin
+            ./*/build/classes
+            ./*/build/kotlin
+            ./*/build/klib
+            ./*/build/generated
+            ./*/build/generated-sources
diff --git a/.github/workflows/job.tests.yml b/.github/workflows/job.tests.yml
new file mode 100644
index 000000000..1f44f2ba9
--- /dev/null
+++ b/.github/workflows/job.tests.yml
@@ -0,0 +1,135 @@
+name: "Tests"
+
+"on":
+  workflow_dispatch: {}
+  workflow_call:
+    inputs:
+      native:
+        description: "Native Tests"
+        default: false
+        type: boolean
+      runner:
+        description: "Runner"
+        default: "ubuntu-latest"
+        type: string
+
+    secrets:
+      GRADLE_CONFIGURATION_KEY:
+        description: "Gradle cache key"
+        required: false
+      CODECOV_TOKEN:
+        description: "Codecov token"
+        required: false
+      BUILDLESS_APIKEY:
+        description: "Buildless key"
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  ##
+  ## Job: Testsuite
+  ##
+  gradle:
+    name: "Testsuite"
+    runs-on: ${{ inputs.runner || 'ubuntu-latest' }}
+
+    defaults:
+      run:
+        shell: bash
+
+    outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
+
+    steps:
+      - name: "Setup: Harden Runner"
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+      - name: "Setup: Checkout"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          submodules: true
+          persist-credentials: false
+      - name: "Setup: Cache Restore (Build)"
+        id: cache-restore-build
+        uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+        with:
+          key: pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+          restore-keys: |
+            pkl-v1-build-${{ hashFiles('gradle/libs.versions.toml') }}
+            pkl-v1-build-
+            pkl-v1-
+            pkl-
+          path: |
+            .gradle/
+            build/
+            .codebase/
+            .kotlin/
+            ./*/build/bin
+            ./*/build/classes
+            ./*/build/kotlin
+            ./*/build/klib
+            ./*/build/generated
+            ./*/build/generated-sources
+      - name: "Setup: GraalVM (Java 21)"
+        uses: graalvm/setup-graalvm@4a200f28cd70d1940b5e33bd00830b7dc71a7e2b # v1.2.6
+        with:
+          distribution: "graalvm"
+          java-version: '21'
+          check-for-updates: false
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: "🛠️ JVM Testsuite"
+        uses: gradle/actions/setup-gradle@417ae3ccd767c252f5661f1ace9f835f9654f2b5 # v3.1.0
+        id: gradlebuild
+        env:
+          CI: true
+        with:
+          cache-read-only: true
+          cache-encryption-key: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
+          gradle-home-cache-cleanup: true
+          build-scan-publish: true
+          build-scan-terms-of-service-url: "https://gradle.com/terms-of-service"
+          build-scan-terms-of-service-agree: "yes"
+          arguments: |
+            test
+            -x check
+            --continue
+            --scan
+      - name: "Artifact: Test Reports"
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        if: success() || failure()
+        with:
+          name: "pkl-test-reports-${{ github.sha }}"
+          if-no-files-found: warn
+          retention-days: 7
+          compression-level: 4
+          overwrite: true
+          path: |
+            ./build/reports
+            ./pkl-*/build/reports
+            ./build/reports/*
+            ./pkl-*/build/reports/*
+      - name: "Reporting: Coverage"
+        uses: codecov/codecov-action@e0b68c6749509c5f83f984dd99a76a1c1a231044 # v4.0.1
+        continue-on-error: true
+        if: success()
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          slug: elide-dev/pkl
+      - name: "Artifact: Caches"
+        uses: actions/cache/save@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+        with:
+          key: ${{ steps.cache-restore.outputs.cache-primary-key }}
+          path: |
+            .gradle/
+            build/
+            .codebase/
+            .kotlin/
+            ./*/build/bin
+            ./*/build/classes
+            ./*/build/kotlin
+            ./*/build/klib
+            ./*/build/generated
+            ./*/build/generated-sources
diff --git a/.github/workflows/on.pr.yml b/.github/workflows/on.pr.yml
new file mode 100644
index 000000000..4a6cc697b
--- /dev/null
+++ b/.github/workflows/on.pr.yml
@@ -0,0 +1,152 @@
+name: "PR"
+
+# Labels to control this PR flow:
+#
+# - ci:api-check-bypass - Bypass API check failures.
+# - ci:fmt-ignore - Ignore formatting failures.
+
+"on":
+  pull_request:
+    types: [opened, reopened, synchronize]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: "pr-${{ github.event.pull_request.number }}"
+  cancel-in-progress: true
+
+jobs:
+  ##
+  ## Job: Pre-flight Checks
+  ##
+  preflight-checks:
+    name: "Pre-flight Checks"
+    runs-on: ${{ vars.RUNNER_DEFAULT || 'ubuntu-latest' }}
+    permissions:
+      contents: "read"
+      checks: "read"
+      packages: "read"
+    steps:
+      - name: "Setup: Harden Runner"
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+      - name: "Setup: Checkout"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          submodules: true
+          persist-credentials: false
+      - name: "Setup: Java 21"
+        uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
+        with:
+          distribution: 'adopt'
+          java-version: '21'
+      - name: "Setup: GraalVM (Java 21)"
+        uses: graalvm/setup-graalvm@4a200f28cd70d1940b5e33bd00830b7dc71a7e2b # v1.2.6
+        with:
+          distribution: "graalvm"
+          java-version: "23"
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: "Check: Build Compile"
+        uses: gradle/actions/setup-gradle@417ae3ccd767c252f5661f1ace9f835f9654f2b5 # v3.1.0
+        continue-on-error: ${{ contains(github.event.pull_request.labels.*.name, 'ci:api-check-bypass') }}
+        env:
+          CI: true
+          GITHUB_ACTOR: ${{ env.GITHUB_ACTOR }}
+          BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
+        with:
+          cache-read-only: false
+          build-scan-publish: true
+          build-scan-terms-of-service-url: "https://gradle.com/terms-of-service"
+          build-scan-terms-of-service-agree: "yes"
+          cache-encryption-key: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
+          arguments: |
+            projects
+            tasks
+            --scan
+
+  ##
+  ## Job: Build
+  ##
+  build:
+    name: "Build"
+    uses: ./.github/workflows/job.build.yml
+    needs: [preflight-checks]
+    secrets:
+      GRADLE_CONFIGURATION_KEY: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
+      BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
+
+  ##
+  ## Job: Native Build
+  ##
+  native-build:
+    name: "Build"
+    uses: ./.github/workflows/job.native-build.yml
+    needs: [preflight-checks, build]
+    secrets:
+      GRADLE_CONFIGURATION_KEY: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
+      BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
+    permissions:
+      contents: "read"
+
+  ##
+  ## Job: Tests
+  ##
+  pr-tests:
+    name: "Tests"
+    uses: ./.github/workflows/job.tests.yml
+    needs: [preflight-checks, build]
+    secrets:
+      GRADLE_CONFIGURATION_KEY: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
+      BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+  ##
+  ## Job: Submit Dependency Graph
+  ##
+  dependency-graph:
+    name: "Checks"
+    uses: ./.github/workflows/job.dependency-graph.yml
+    needs: [preflight-checks]
+    secrets:
+      GRADLE_CONFIGURATION_KEY: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
+      BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
+    permissions:
+      ## Needed for build graph publishing
+      contents: "write"
+
+  ##
+  ## Job: Checks for Formatting/Style
+  ##
+  check-format:
+    name: "Checks"
+    uses: ./.github/workflows/checks.formatting.yml
+    needs: [preflight-checks]
+    permissions:
+      contents: "read"
+    secrets:
+      GRADLE_CONFIGURATION_KEY: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
+      BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
+    with:
+      ignore_failures: ${{ contains(github.event.pull_request.labels.*.name, 'ci:fmt-ignore') }}
+
+  ##
+  ## Job: Check for Wrapper
+  ##
+  check-wrapper:
+    name: "Checks"
+    uses: ./.github/workflows/checks.gradle-wrapper.yml
+    needs: [preflight-checks]
+    permissions:
+      contents: "read"
+
+  ##
+  ## Job: Checks for Vulnerabilities/Licensing
+  ##
+  check-dependencies:
+    name: "Checks"
+    uses: ./.github/workflows/checks.dependency-review.yml
+    needs: [preflight-checks, dependency-graph]
+    permissions:
+      contents: "read"
diff --git a/.github/workflows/on.push.yml b/.github/workflows/on.push.yml
new file mode 100644
index 000000000..06d77f061
--- /dev/null
+++ b/.github/workflows/on.push.yml
@@ -0,0 +1,69 @@
+name: "CI"
+
+"on":
+  merge_group: {}
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: "push-${{ github.sha }}"
+
+jobs:
+  ##
+  ## Job: Build Dependency Graph
+  ##
+  build-graph:
+    name: "Checks"
+    uses: ./.github/workflows/job.dependency-graph.yml
+    permissions:
+      ## Needed for submission of dependency graphs
+      contents: "write"
+
+  ##
+  ## Job: Build
+  ##
+  build:
+    name: "Build"
+    uses: ./.github/workflows/job.build.yml
+    needs: [preflight-checks]
+    secrets:
+      GRADLE_CONFIGURATION_KEY: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
+      BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
+
+  ##
+  ## Job: Tests
+  ##
+  tests:
+    name: "Tests"
+    uses: ./.github/workflows/job.tests.yml
+    needs: [build]
+    secrets:
+      GRADLE_CONFIGURATION_KEY: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
+      BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+  ##
+  ## Job: Checks with Scorecard
+  ##
+  check-scorecard:
+    name: "Checks"
+    uses: ./.github/workflows/checks.scorecards.yml
+    needs: [build-graph]
+    permissions:
+      actions: "read"
+      contents: "read"
+      checks: "read"
+      deployments: "read"
+      discussions: "read"
+      id-token: "write"
+      issues: "read"
+      packages: "read"
+      pages: "read"
+      pull-requests: "read"
+      repository-projects: "read"
+      security-events: "write"
+      statuses: "read"
diff --git a/bench/gradle.lockfile b/bench/gradle.lockfile
index b41a8e1cf..269a12b4b 100644
--- a/bench/gradle.lockfile
+++ b/bench/gradle.lockfile
@@ -2,15 +2,20 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.tunnelvisionlabs:antlr4-runtime:4.9.0=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-net.bytebuddy:byte-buddy:1.14.18=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 net.sf.jopt-simple:jopt-simple:5.0.4=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
 org.apache.commons:commons-math3:3.6.1=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.26.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.compiler:compiler:23.0.6=graal
-org.graalvm.sdk:graal-sdk:23.0.6=graal,jmh,jmhRuntimeClasspath,truffle
-org.graalvm.truffle:truffle-api:23.0.6=graal,jmh,jmhRuntimeClasspath,truffle
+org.assertj:assertj-core:3.27.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.compiler:compiler:24.1.1=graal
+org.graalvm.polyglot:polyglot:24.1.1=jmh,jmhRuntimeClasspath,truffle
+org.graalvm.sdk:collections:24.1.1=graal,jmh,jmhRuntimeClasspath,truffle
+org.graalvm.sdk:graal-sdk:24.1.1=jmh,jmhRuntimeClasspath
+org.graalvm.sdk:nativeimage:24.1.1=jmh,jmhRuntimeClasspath,truffle
+org.graalvm.sdk:word:24.1.1=graal,jmh,jmhRuntimeClasspath,truffle
+org.graalvm.truffle:truffle-api:24.1.1=jmh,jmhRuntimeClasspath,truffle
+org.graalvm.truffle:truffle-compiler:24.1.1=graal
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-daemon-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
@@ -26,12 +31,12 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.10=testCompileClasspath,testImplemen
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.10=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib:1.7.10=kotlinCompilerClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains:annotations:13.0=kotlinCompilerClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.11.3=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.11.3=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-params:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.platform:junit-platform-engine:1.11.4=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit:junit-bom:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.msgpack:msgpack-core:0.9.8=jmh,jmhRuntimeClasspath
 org.openjdk.jmh:jmh-core:1.37=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
 org.openjdk.jmh:jmh-generator-asm:1.37=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
diff --git a/buildSrc/src/main/kotlin/BuildInfo.kt b/buildSrc/src/main/kotlin/BuildInfo.kt
index df44e3902..da37b39f9 100644
--- a/buildSrc/src/main/kotlin/BuildInfo.kt
+++ b/buildSrc/src/main/kotlin/BuildInfo.kt
@@ -80,6 +80,10 @@ open class BuildInfo(project: Project) {
 
   val isReleaseBuild: Boolean by lazy { java.lang.Boolean.getBoolean("releaseBuild") }
 
+  val isNativeArch: Boolean by lazy { java.lang.Boolean.getBoolean("nativeArch") }
+
+  val isEnableOracleGraalvm: Boolean by lazy { java.lang.Boolean.getBoolean("oracleGraalvm") }
+
   val hasMuslToolchain: Boolean by lazy {
     // see "install musl" in .circleci/jobs/BuildNativeJob.pkl
     File(System.getProperty("user.home"), "staticdeps/bin/x86_64-linux-musl-gcc").exists()
diff --git a/buildSrc/src/main/kotlin/InstallGraalVm.kt b/buildSrc/src/main/kotlin/InstallGraalVm.kt
index 79acad0b1..57e7267a3 100644
--- a/buildSrc/src/main/kotlin/InstallGraalVm.kt
+++ b/buildSrc/src/main/kotlin/InstallGraalVm.kt
@@ -58,10 +58,16 @@ constructor(
         if (os.isMacOsX) distroDir.resolve("Contents/Home/bin") else distroDir.resolve("bin")
 
       println("Installing native-image into $distroDir")
-      execOperations.exec {
-        val executableName = if (os.isWindows) "gu.cmd" else "gu"
-        executable = distroBinDir.resolve(executableName).toString()
-        args("install", "--no-progress", "native-image")
+      val gvmVersionMajor =
+        requireNotNull(graalVm.get().version.split(".").first().toIntOrNull()) {
+          "Invalid GraalVM JDK version: ${graalVm.get().graalVmJdkVersion}"
+        }
+      if (gvmVersionMajor < 24) {
+        execOperations.exec {
+          val executableName = if (os.isWindows) "gu.cmd" else "gu"
+          executable = distroBinDir.resolve(executableName).toString()
+          args("install", "--no-progress", "native-image")
+        }
       }
 
       println("Creating symlink ${graalVm.get().installDir} for $distroDir")
diff --git a/buildSrc/src/main/kotlin/org/gradle/kotlin/dsl/ToolchainExtensions.kt b/buildSrc/src/main/kotlin/org/gradle/kotlin/dsl/ToolchainExtensions.kt
new file mode 100644
index 000000000..6db9fcf91
--- /dev/null
+++ b/buildSrc/src/main/kotlin/org/gradle/kotlin/dsl/ToolchainExtensions.kt
@@ -0,0 +1,82 @@
+/*
+ * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.gradle.kotlin.dsl
+
+import org.gradle.accessors.dm.LibrariesForLibs
+import org.gradle.api.Project
+import org.gradle.api.plugins.JavaPluginExtension
+import org.gradle.api.provider.Provider
+import org.gradle.api.tasks.JavaExec
+import org.gradle.api.tasks.compile.JavaCompile
+import org.gradle.jvm.toolchain.*
+import org.gradle.kotlin.dsl.support.serviceOf
+
+private val oracleGraalvm = java.lang.Boolean.getBoolean("oracleGraalvm")
+private val graalvmVendor = if (oracleGraalvm) JvmVendorSpec.ORACLE else JvmVendorSpec.GRAAL_VM
+
+/**
+ * Configure a Java toolchain to use a specific version of GraalVM.
+ *
+ * @param javaVersion The version of GraalVM to use.
+ */
+fun JavaToolchainSpec.graalvmAt(javaVersion: JavaLanguageVersion) {
+  languageVersion = javaVersion
+  vendor = graalvmVendor
+}
+
+/**
+ * Resolve a Java compiler and launcher for the pinned version of GraalVM.
+ *
+ * @param javaVersion The version of GraalVM to use.
+ * @return A pair of Java compiler and launcher.
+ */
+fun Project.graalvmToolchain(
+  javaVersion: JavaLanguageVersion
+): Provider<Pair<JavaCompiler, JavaLauncher>> {
+  val javaToolchains = serviceOf<JavaToolchainService>()
+  val compiler = javaToolchains.compilerFor { graalvmAt(javaVersion) }
+  val launcher = javaToolchains.launcherFor { graalvmAt(javaVersion) }
+  return provider { compiler.get() to launcher.get() }
+}
+
+/**
+ * Configure a project to use the pinned version of GraalVM; this will apply the Java compiler and
+ * launcher resolved by [graalvmToolchain] to all Java compile and exec tasks.
+ */
+fun Project.useGraalvmToolchainForAllTasks(javaVersion: JavaLanguageVersion) {
+  graalvmToolchain(javaVersion).get().let { (compiler, launcher) ->
+    tasks.withType<JavaCompile> { javaCompiler = compiler }
+    tasks.withType<JavaExec> { javaLauncher = launcher }
+  }
+}
+
+/**
+ * Configure a project and Java toolchain to use the pinned version of GraalVM specified within the
+ * `libs.versions.toml` file.
+ */
+fun Project.useGraalVm(javaVersion: JavaLanguageVersion? = null) {
+  val libs = the<LibrariesForLibs>()
+  val gvmVersion =
+    javaVersion
+      ?: requireNotNull(libs.versions.graalVmJdkVersion.get().substringBefore('.').toUIntOrNull()) {
+          "GraalVM JDK version is not valid or not supported on this platform"
+        }
+        .let { JavaLanguageVersion.of(it.toInt()) }
+
+  configure<JavaPluginExtension> {
+    toolchain { graalvmAt(gvmVersion) }.also { useGraalvmToolchainForAllTasks(gvmVersion) }
+  }
+}
diff --git a/buildSrc/src/main/kotlin/pklFatJar.gradle.kts b/buildSrc/src/main/kotlin/pklFatJar.gradle.kts
index fd70e02d9..421845c0f 100644
--- a/buildSrc/src/main/kotlin/pklFatJar.gradle.kts
+++ b/buildSrc/src/main/kotlin/pklFatJar.gradle.kts
@@ -24,7 +24,7 @@ import org.gradle.kotlin.dsl.*
 plugins {
   `java-library`
   `maven-publish`
-  id("com.github.johnrengelman.shadow")
+  id("com.gradleup.shadow")
 }
 
 // make fat Jar available to other subprojects
@@ -40,8 +40,6 @@ val relocations =
   mapOf(
     // pkl-core dependencies
     "org.antlr.v4." to "org.pkl.thirdparty.antlr.v4.",
-    "com.oracle.truffle" to "org.pkl.thirdparty.truffle",
-    "org.graalvm." to "org.pkl.thirdparty.graalvm.",
     "org.organicdesign.fp." to "org.pkl.thirdparty.paguro.",
     "org.snakeyaml.engine." to "org.pkl.thirdparty.snakeyaml.engine.",
     "org.msgpack." to "org.pkl.thirdparty.msgpack.",
@@ -71,7 +69,11 @@ val relocations =
     "com.squareup.kotlinpoet." to "org.pkl.thirdparty.kotlinpoet.",
   )
 
-val nonRelocations = listOf("com/oracle/truffle/")
+val nonRelocations =
+  listOf(
+    "com/oracle/truffle/",
+    "org/graalvm/",
+  )
 
 tasks.shadowJar {
   inputs.property("relocations", relocations)
diff --git a/buildSrc/src/main/kotlin/pklJavaLibrary.gradle.kts b/buildSrc/src/main/kotlin/pklJavaLibrary.gradle.kts
index 7579a8521..1fc46d7dd 100644
--- a/buildSrc/src/main/kotlin/pklJavaLibrary.gradle.kts
+++ b/buildSrc/src/main/kotlin/pklJavaLibrary.gradle.kts
@@ -20,6 +20,7 @@ import org.gradle.accessors.dm.LibrariesForLibs
 plugins {
   `java-library`
   id("pklKotlinTest")
+  id("pklJvmToolchain")
   id("com.diffplug.spotless")
 }
 
@@ -86,3 +87,27 @@ tasks.compileJava {
   // (see https://graalvm.slack.com/archives/CNQSB2DHD/p1712380902746829)
   options.compilerArgs.add("-Atruffle.dsl.SuppressWarnings=truffle-limit")
 }
+
+//
+// JPMS Support
+//
+
+fun Project.ifJpms(block: Project.() -> Unit) {
+  // if current java is over 17...
+  if (JavaVersion.current().majorVersion.toInt() >= 17) {
+    block()
+  }
+}
+
+val jpmsJavacArgs =
+  listOf(
+    "--add-modules=jdk.unsupported",
+  )
+
+val jpmsJvmArgs = jpmsJavacArgs.plus(listOf())
+
+tasks.withType<JavaCompile>().configureEach {
+  ifJpms { options.compilerArgumentProviders.add(CommandLineArgumentProvider { jpmsJavacArgs }) }
+}
+
+tasks.withType<JavaExec>().configureEach { ifJpms { jvmArgs(jpmsJvmArgs) } }
diff --git a/buildSrc/src/main/kotlin/pklJvmToolchain.gradle.kts b/buildSrc/src/main/kotlin/pklJvmToolchain.gradle.kts
new file mode 100644
index 000000000..53bbb1b1b
--- /dev/null
+++ b/buildSrc/src/main/kotlin/pklJvmToolchain.gradle.kts
@@ -0,0 +1,16 @@
+/*
+ * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+plugins { `jvm-toolchains` }
diff --git a/docs/gradle.lockfile b/docs/gradle.lockfile
index 75a512653..185feccbd 100644
--- a/docs/gradle.lockfile
+++ b/docs/gradle.lockfile
@@ -3,12 +3,16 @@
 # This file is expected to be part of source control.
 com.tunnelvisionlabs:antlr4-runtime:4.9.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 io.leangen.geantyref:geantyref:1.3.16=testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.14.18=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.26.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.sdk:graal-sdk:23.0.6=testRuntimeClasspath
-org.graalvm.truffle:truffle-api:23.0.6=testRuntimeClasspath
+org.assertj:assertj-core:3.27.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.polyglot:polyglot:24.1.1=testRuntimeClasspath
+org.graalvm.sdk:collections:24.1.1=testRuntimeClasspath
+org.graalvm.sdk:graal-sdk:24.1.1=testRuntimeClasspath
+org.graalvm.sdk:nativeimage:24.1.1=testRuntimeClasspath
+org.graalvm.sdk:word:24.1.1=testRuntimeClasspath
+org.graalvm.truffle:truffle-api:24.1.1=testRuntimeClasspath
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-daemon-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
@@ -24,12 +28,12 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.10=testCompileClasspath,testImplemen
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.10=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib:1.7.10=kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains:annotations:13.0=kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-params:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.platform:junit-platform-engine:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit:junit-bom:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.msgpack:msgpack-core:0.9.8=testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.organicdesign:Paguro:3.10.3=testRuntimeClasspath
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 3d37edec0..c55b197bd 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -9,14 +9,14 @@ geantyref = "1.+"
 googleJavaFormat = "1.21.0"
 # must not use `+` because used in download URL
 # 23.1.x requires JDK 20+
-graalVm = "23.0.6"
-graalVmJdkVersion = "17.0.12"
+graalVm = "24.1.1"
+graalVmJdkVersion = "21.0.5"
 # slightly hacky but convenient place so we remember to update the checksum
-graalVmSha256-macos-x64 = "3ecac1471f3fa95a56c5b75c65db9e60ac4551f56eda09eb9da95e6049ea77d7"
-graalVmSha256-macos-aarch64 = "4cdfdc6c9395f6773efcd191b6605f1b7c8e1b78ab900ab5cff34720a3feffc5"
-graalVmSha256-linux-x64 = "b6f3dace24cf1960ec790216f4c86f00d4f43df64e4e8b548f6382f04894713f"
-graalVmSha256-linux-aarch64 = "bd991d486b92deb74337b881e0f13a764c9c1e90fc358819080f7321fa5175e8"
-graalVmSha256-windows-x64 = "8b978e56dddc0edc60db99794b56975740d9c52293b31549cfc3f7516fc18b43"
+graalVmSha256-macos-x64 = "2d9b09e28bc1bb6ff219bf62eacc4626c7740b4f1829ede9ea4450f33e9c0826"
+graalVmSha256-macos-aarch64 = "cb68cb2c796f42f37a56fcd1385d8b86cca12e0b46c5618a5ed3ec7dd2260f6f"
+graalVmSha256-linux-x64 = "c1960d4f9d278458bde1cd15115ac2f0b3240cb427d51cfeceb79dab91a7f5c9"
+graalVmSha256-linux-aarch64 = "3ad68fbb2d13da528dfa0aea9e9345383245ec9c31094dce3905cefba9aac01e"
+graalVmSha256-windows-x64 = "d5784cbdc87f84b5cbd6c9d09c6f1d4611954f139fcfc795005c58dffd7f6b41"
 ideaExtPlugin = "1.1.9"
 javaPoet = "0.+"
 javaxInject = "1"
@@ -44,7 +44,7 @@ msgpack = "0.9.8"
 nexusPublishPlugin = "2.0.0"
 nuValidator = "20.+"
 paguro = "3.+"
-shadowPlugin = "8.1.1"
+shadowPlugin = "8.3.1"
 slf4j = "1.+"
 snakeYaml = "2.+"
 spotlessPlugin = "6.25.0"
@@ -88,7 +88,7 @@ nuValidator = { group = "nu.validator", name = "validator", version.ref = "nuVal
 # to be replaced with https://github.com/usethesource/capsule or https://github.com/lacuna/bifurcan
 paguro = { group = "org.organicdesign", name = "Paguro", version.ref = "paguro" }
 pklConfigJavaAll025 = { group = "org.pkl-lang", name = "pkl-config-java-all", version = "0.25.0" }
-shadowPlugin = { group = "com.github.johnrengelman", name = "shadow", version.ref = "shadowPlugin" }
+shadowPlugin = { group = "com.gradleup.shadow", name = "shadow-gradle-plugin", version.ref = "shadowPlugin" }
 slf4jApi = { group = "org.slf4j", name = "slf4j-api", version.ref = "slf4j" }
 slf4jSimple = { group = "org.slf4j", name = "slf4j-simple", version.ref = "slf4j" }
 snakeYaml = { group = "org.snakeyaml", name = "snakeyaml-engine", version.ref = "snakeYaml" }
@@ -96,6 +96,8 @@ spotlessPlugin = { group = "com.diffplug.spotless", name = "spotless-plugin-grad
 svm = { group = "org.graalvm.nativeimage", name = "svm", version.ref = "graalVm" }
 truffleApi = { group = "org.graalvm.truffle", name = "truffle-api", version.ref = "graalVm" }
 truffleDslProcessor = { group = "org.graalvm.truffle", name = "truffle-dsl-processor", version.ref = "graalVm" }
+truffleSvm = { group = "org.graalvm.nativeimage", name = "truffle-runtime-svm", version.ref = "graalVm" }
+truffleRuntime = { group = "org.graalvm.truffle", name = "truffle-runtime", version.ref = "graalVm" }
 wiremock = { group = "org.wiremock", name = "wiremock", version.ref = "wiremock" }
 
 [plugins] # ordered alphabetically
@@ -104,4 +106,4 @@ ideaExt = { id = "org.jetbrains.gradle.plugin.idea-ext", version.ref = "ideaExtP
 jmh = { id = "me.champeau.jmh", version.ref = "jmhPlugin" }
 kotlinxSerialization = { id = "org.jetbrains.kotlin.plugin.serialization", version.ref = "kotlin" }
 nexusPublish = { id = "io.github.gradle-nexus.publish-plugin", version.ref = "nexusPublishPlugin" }
-shadow = { id = "com.github.johnrengelman.shadow", version.ref = "shadowPlugin" }
+shadow = { id = "com.gradleup.shadow", version.ref = "shadowPlugin" }
diff --git a/gradlew b/gradlew
index f5feea6d6..f3b75f3b0 100755
--- a/gradlew
+++ b/gradlew
@@ -86,8 +86,7 @@ done
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
 # Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
-APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s
-' "$PWD" ) || exit
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
diff --git a/pkl-cli/gradle.lockfile b/pkl-cli/gradle.lockfile
index 60311c5ab..b0c3bfdab 100644
--- a/pkl-cli/gradle.lockfile
+++ b/pkl-cli/gradle.lockfile
@@ -2,12 +2,12 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.ethlo.time:itu:1.10.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.17.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.17.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.17.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.17.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.17.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.17.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.18.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.18.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.18.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.18.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 com.github.ajalt.clikt:clikt-jvm:3.5.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.ajalt.clikt:clikt:3.5.4=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 com.github.jknack:handlebars-helpers:4.3.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
@@ -18,21 +18,21 @@ com.google.guava:guava:33.3.1-jre=testCompileClasspath,testImplementationDepende
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:3.0.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 com.jayway.jsonpath:json-path:2.9.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-com.networknt:json-schema-validator:1.5.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+com.networknt:json-schema-validator:1.5.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 com.tunnelvisionlabs:antlr4-runtime:4.9.0=runtimeClasspath,testRuntimeClasspath
 commons-fileupload:commons-fileupload:1.5=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 commons-io:commons-io:2.11.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.14.18=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 net.javacrumbs.json-unit:json-unit-core:2.40.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.minidev:accessors-smart:2.5.1=testRuntimeClasspath
 net.minidev:json-smart:2.5.1=testRuntimeClasspath
 net.sf.jopt-simple:jopt-simple:5.0.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.apache.httpcomponents.client5:httpclient5:5.3.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.apache.httpcomponents.core5:httpcore5-h2:5.2.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.apache.httpcomponents.core5:httpcore5:5.2.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.apache.httpcomponents.client5:httpclient5:5.4.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.apache.httpcomponents.core5:httpcore5-h2:5.3.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.apache.httpcomponents.core5:httpcore5:5.3.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.26.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.assertj:assertj-core:3.27.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.checkerframework:checker-qual:3.43.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.eclipse.jetty.http2:http2-common:11.0.24=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.eclipse.jetty.http2:http2-hpack:11.0.24=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
@@ -55,13 +55,21 @@ org.eclipse.jetty:jetty-util:11.0.24=testCompileClasspath,testImplementationDepe
 org.eclipse.jetty:jetty-webapp:11.0.24=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.eclipse.jetty:jetty-xml:11.0.24=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.fusesource.jansi:jansi:2.4.1=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.compiler:compiler:23.0.6=compileClasspath,compileOnlyDependenciesMetadata
-org.graalvm.nativeimage:native-image-base:23.0.6=compileClasspath,compileOnlyDependenciesMetadata
-org.graalvm.nativeimage:objectfile:23.0.6=compileClasspath,compileOnlyDependenciesMetadata
-org.graalvm.nativeimage:pointsto:23.0.6=compileClasspath,compileOnlyDependenciesMetadata
-org.graalvm.nativeimage:svm:23.0.6=compileClasspath,compileOnlyDependenciesMetadata
-org.graalvm.sdk:graal-sdk:23.0.6=compileClasspath,compileOnlyDependenciesMetadata,runtimeClasspath,testRuntimeClasspath
-org.graalvm.truffle:truffle-api:23.0.6=compileClasspath,compileOnlyDependenciesMetadata,runtimeClasspath,testRuntimeClasspath
+org.graalvm.compiler:compiler:24.1.1=compileClasspath,compileOnlyDependenciesMetadata
+org.graalvm.nativeimage:native-image-base:24.1.1=compileClasspath,compileOnlyDependenciesMetadata
+org.graalvm.nativeimage:objectfile:24.1.1=compileClasspath,compileOnlyDependenciesMetadata
+org.graalvm.nativeimage:pointsto:24.1.1=compileClasspath,compileOnlyDependenciesMetadata
+org.graalvm.nativeimage:svm:24.1.1=compileClasspath,compileOnlyDependenciesMetadata
+org.graalvm.nativeimage:truffle-runtime-svm:24.1.1=compileClasspath,compileOnlyDependenciesMetadata
+org.graalvm.polyglot:polyglot:24.1.1=compileClasspath,compileOnlyDependenciesMetadata,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.graalvm.sdk:collections:24.1.1=compileClasspath,compileOnlyDependenciesMetadata,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.graalvm.sdk:graal-sdk:24.1.1=compileClasspath,compileOnlyDependenciesMetadata,runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:jniutils:24.1.1=compileClasspath,compileOnlyDependenciesMetadata,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.graalvm.sdk:nativeimage:24.1.1=compileClasspath,compileOnlyDependenciesMetadata,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.graalvm.sdk:word:24.1.1=compileClasspath,compileOnlyDependenciesMetadata,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.graalvm.truffle:truffle-api:24.1.1=compileClasspath,compileOnlyDependenciesMetadata,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.graalvm.truffle:truffle-compiler:24.1.1=compileClasspath,compileOnlyDependenciesMetadata,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.graalvm.truffle:truffle-runtime:24.1.1=compileClasspath,compileOnlyDependenciesMetadata,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.hamcrest:hamcrest-core:2.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.hamcrest:hamcrest:2.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
@@ -83,20 +91,20 @@ org.jline:jline-native:3.23.0=compileClasspath,implementationDependenciesMetadat
 org.jline:jline-reader:3.23.0=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jline:jline-terminal-jansi:3.23.0=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jline:jline-terminal:3.23.0=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-params:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.platform:junit-platform-engine:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit:junit-bom:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.msgpack:msgpack-core:0.9.8=runtimeClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.organicdesign:Paguro:3.10.3=runtimeClasspath,testRuntimeClasspath
-org.slf4j:slf4j-api:2.0.13=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.slf4j:slf4j-api:2.0.16=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.snakeyaml:snakeyaml-engine:2.8=runtimeClasspath,testRuntimeClasspath
-org.wiremock:wiremock:3.9.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.wiremock:wiremock:3.10.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.xmlunit:xmlunit-core:2.10.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.xmlunit:xmlunit-legacy:2.10.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.xmlunit:xmlunit-placeholders:2.10.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.yaml:snakeyaml:2.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.yaml:snakeyaml:2.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 empty=annotationProcessor,archives,compile,intransitiveDependenciesMetadata,javaExecutable,kotlinCompilerPluginClasspath,kotlinNativeCompilerPluginClasspath,kotlinScriptDef,kotlinScriptDefExtensions,runtime,runtimeOnlyDependenciesMetadata,shadow,signatures,sourcesJar,stagedAlpineLinuxAmd64Executable,stagedLinuxAarch64Executable,stagedLinuxAmd64Executable,stagedMacAarch64Executable,stagedMacAmd64Executable,stagedWindowsAmd64Executable,testAnnotationProcessor,testApiDependenciesMetadata,testCompile,testCompileOnly,testCompileOnlyDependenciesMetadata,testIntransitiveDependenciesMetadata,testKotlinScriptDef,testKotlinScriptDefExtensions,testRuntime
diff --git a/pkl-cli/pkl-cli.gradle.kts b/pkl-cli/pkl-cli.gradle.kts
index d82e9d332..80ac78080 100644
--- a/pkl-cli/pkl-cli.gradle.kts
+++ b/pkl-cli/pkl-cli.gradle.kts
@@ -50,12 +50,16 @@ val stagedWindowsAmd64Executable: Configuration by configurations.creating
 
 dependencies {
   compileOnly(libs.svm)
+  compileOnly(libs.truffleSvm)
+  implementation(libs.truffleRuntime)
 
   // CliEvaluator exposes PClass
   api(projects.pklCore)
   // CliEvaluatorOptions exposes CliBaseOptions
   api(projects.pklCommonsCli)
 
+  compileOnly(libs.graalSdk)
+
   implementation(projects.pklCommons)
   implementation(libs.jansi)
   implementation(libs.jlineReader)
@@ -107,6 +111,8 @@ val javaExecutable by
     inJar.set(tasks.shadowJar.flatMap { it.archiveFile })
     outJar.set(layout.buildDirectory.file("executable/jpkl"))
 
+    jvmArgs.addAll("--add-modules=jdk.unsupported")
+
     // uncomment for debugging
     // jvmArgs.addAll("-ea", "-agentlib:jdwp=transport=dt_socket,server=y,suspend=y,address=5005")
   }
@@ -179,7 +185,7 @@ fun Exec.configureExecutable(
   executable = "${graalVm.baseDir}/bin/$nativeImageCommandName"
 
   // JARs to exclude from the class path for the native-image build.
-  val exclusions = listOf(libs.truffleApi, libs.graalSdk).map { it.get().module.name }
+  val exclusions = listOf(libs.graalSdk).map { it.get().module.name }
   // https://www.graalvm.org/22.0/reference-manual/native-image/Options/
   argumentProviders.add(
     CommandLineArgumentProvider {
@@ -190,13 +196,15 @@ fun Exec.configureExecutable(
         // needed for messagepack-java (see https://github.com/msgpack/msgpack-java/issues/600)
         add("--initialize-at-run-time=org.msgpack.core.buffer.DirectBufferAccess")
         add("--no-fallback")
+        // must be emitted before any experimental options are used
+        add("-H:+UnlockExperimentalVMOptions")
         add("-H:IncludeResources=org/pkl/core/stdlib/.*\\.pkl")
         add("-H:IncludeResources=org/jline/utils/.*")
         add("-H:IncludeResourceBundles=org.pkl.core.errorMessages")
         add("-H:IncludeResources=org/pkl/commons/cli/PklCARoots.pem")
-        add("--macro:truffle")
         add("-H:Class=org.pkl.cli.Main")
-        add("-H:Name=${outputFile.get().asFile.name}")
+        add("-o")
+        add(outputFile.get().asFile.name)
         // the actual limit (currently) used by native-image is this number + 1400 (idea is to
         // compensate for Truffle's own nodes)
         add("-H:MaxRuntimeCompileMethods=1800")
@@ -208,10 +216,24 @@ fun Exec.configureExecutable(
         add("-H:-ParseRuntimeOptions")
         // quick build mode: 40% faster compilation, 20% smaller (but presumably also slower)
         // executable
-        if (!buildInfo.isReleaseBuild) {
-          add("-Ob")
+        when {
+          // non-releases should optimize for build time
+          !buildInfo.isReleaseBuild -> add("-Ob")
+
+          // size optimization is only supported at GraalVM JDK 23+
+          libs.versions.graalVmJdkVersion.get().split(".").first().toInt() >= 23 -> add("-Os")
+        }
+        if (buildInfo.isNativeArch) {
+          add("-march=native")
+        } else {
+          add("-march=compatibility")
+        }
+        if (buildInfo.isEnableOracleGraalvm) {
+          add("--gc=G1")
+          add("--enable-sbom=cyclonedx")
+        } else {
+          add("--gc=serial")
         }
-        add("-march=compatibility")
         // native-image rejects non-existing class path entries -> filter
         add("--class-path")
         val pathInput =
diff --git a/pkl-codegen-java/gradle.lockfile b/pkl-codegen-java/gradle.lockfile
index 67f5b3c8b..f204b8108 100644
--- a/pkl-codegen-java/gradle.lockfile
+++ b/pkl-codegen-java/gradle.lockfile
@@ -3,15 +3,19 @@
 # This file is expected to be part of source control.
 com.github.ajalt.clikt:clikt-jvm:3.5.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.ajalt.clikt:clikt:3.5.4=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-com.palantir.javapoet:javapoet:0.5.0=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+com.palantir.javapoet:javapoet:0.6.0=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 com.tunnelvisionlabs:antlr4-runtime:4.9.0=runtimeClasspath,testRuntimeClasspath
 io.leangen.geantyref:geantyref:1.3.16=testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.14.18=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.26.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.sdk:graal-sdk:23.0.6=runtimeClasspath,testRuntimeClasspath
-org.graalvm.truffle:truffle-api:23.0.6=runtimeClasspath,testRuntimeClasspath
+org.assertj:assertj-core:3.27.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.polyglot:polyglot:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:collections:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:graal-sdk:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:nativeimage:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:word:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.truffle:truffle-api:24.1.1=runtimeClasspath,testRuntimeClasspath
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-daemon-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
@@ -27,12 +31,12 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.10=apiDependenciesMetadata,compileCl
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.10=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib:1.7.10=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains:annotations:13.0=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-params:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.platform:junit-platform-engine:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit:junit-bom:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.msgpack:msgpack-core:0.9.8=runtimeClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.organicdesign:Paguro:3.10.3=runtimeClasspath,testRuntimeClasspath
diff --git a/pkl-codegen-kotlin/gradle.lockfile b/pkl-codegen-kotlin/gradle.lockfile
index 63b28c160..c118c12d1 100644
--- a/pkl-codegen-kotlin/gradle.lockfile
+++ b/pkl-codegen-kotlin/gradle.lockfile
@@ -6,12 +6,16 @@ com.github.ajalt.clikt:clikt:3.5.4=apiDependenciesMetadata,compileClasspath,impl
 com.squareup:kotlinpoet:1.6.0=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 com.tunnelvisionlabs:antlr4-runtime:4.9.0=runtimeClasspath,testRuntimeClasspath
 io.leangen.geantyref:geantyref:1.3.16=testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.14.18=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.26.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.sdk:graal-sdk:23.0.6=runtimeClasspath,testRuntimeClasspath
-org.graalvm.truffle:truffle-api:23.0.6=runtimeClasspath,testRuntimeClasspath
+org.assertj:assertj-core:3.27.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.polyglot:polyglot:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:collections:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:graal-sdk:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:nativeimage:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:word:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.truffle:truffle-api:24.1.1=runtimeClasspath,testRuntimeClasspath
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-daemon-client:1.7.10=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
@@ -30,12 +34,12 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.10=apiDependenciesMetadata,compileCl
 org.jetbrains.kotlin:kotlin-stdlib:1.7.10=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.5.0=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.jetbrains:annotations:13.0=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-api:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-params:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.platform:junit-platform-engine:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit:junit-bom:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.msgpack:msgpack-core:0.9.8=runtimeClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.organicdesign:Paguro:3.10.3=runtimeClasspath,testRuntimeClasspath
diff --git a/pkl-commons-cli/gradle.lockfile b/pkl-commons-cli/gradle.lockfile
index 9ab8705c5..6c74b1201 100644
--- a/pkl-commons-cli/gradle.lockfile
+++ b/pkl-commons-cli/gradle.lockfile
@@ -4,12 +4,16 @@
 com.github.ajalt.clikt:clikt-jvm:3.5.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.ajalt.clikt:clikt:3.5.4=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 com.tunnelvisionlabs:antlr4-runtime:4.9.0=runtimeClasspath,testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.14.18=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.26.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.sdk:graal-sdk:23.0.6=runtimeClasspath,testRuntimeClasspath
-org.graalvm.truffle:truffle-api:23.0.6=runtimeClasspath,testRuntimeClasspath
+org.assertj:assertj-core:3.27.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.polyglot:polyglot:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:collections:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:graal-sdk:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:nativeimage:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:word:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.truffle:truffle-api:24.1.1=runtimeClasspath,testRuntimeClasspath
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-daemon-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
@@ -25,12 +29,12 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.10=apiDependenciesMetadata,compileCl
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.10=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib:1.7.10=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains:annotations:13.0=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-params:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.platform:junit-platform-engine:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit:junit-bom:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.msgpack:msgpack-core:0.9.8=runtimeClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.organicdesign:Paguro:3.10.3=runtimeClasspath,testRuntimeClasspath
diff --git a/pkl-commons-test/gradle.lockfile b/pkl-commons-test/gradle.lockfile
index 651fd3e3c..d78ea2141 100644
--- a/pkl-commons-test/gradle.lockfile
+++ b/pkl-commons-test/gradle.lockfile
@@ -1,10 +1,10 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-net.bytebuddy:byte-buddy:1.14.18=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.apiguardian:apiguardian-api:1.1.2=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.26.3=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.assertj:assertj-core:3.27.2=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-daemon-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
@@ -20,11 +20,11 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.10=apiDependenciesMetadata,compileCl
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.10=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib:1.7.10=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains:annotations:13.0=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.3=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.11.3=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.11.3=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.3=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.11.3=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.11.3=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-api:5.11.4=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-engine:5.11.4=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-params:5.11.4=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.platform:junit-platform-engine:1.11.4=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit:junit-bom:5.11.4=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.opentest4j:opentest4j:1.3.0=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 empty=annotationProcessor,compileOnlyDependenciesMetadata,intransitiveDependenciesMetadata,kotlinCompilerPluginClasspath,kotlinNativeCompilerPluginClasspath,kotlinScriptDef,kotlinScriptDefExtensions,runtimeOnlyDependenciesMetadata,sourcesJar,testAnnotationProcessor,testApiDependenciesMetadata,testCompileOnlyDependenciesMetadata,testIntransitiveDependenciesMetadata,testKotlinScriptDef,testKotlinScriptDefExtensions
diff --git a/pkl-commons/gradle.lockfile b/pkl-commons/gradle.lockfile
index 05aa5ee7d..b79814bd7 100644
--- a/pkl-commons/gradle.lockfile
+++ b/pkl-commons/gradle.lockfile
@@ -1,10 +1,10 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-net.bytebuddy:byte-buddy:1.14.18=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.26.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.assertj:assertj-core:3.27.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-daemon-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
@@ -20,11 +20,11 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.10=apiDependenciesMetadata,compileCl
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.10=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib:1.7.10=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains:annotations:13.0=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.11.3=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.11.3=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-params:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.platform:junit-platform-engine:1.11.4=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit:junit-bom:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 empty=annotationProcessor,compileOnlyDependenciesMetadata,intransitiveDependenciesMetadata,kotlinCompilerPluginClasspath,kotlinNativeCompilerPluginClasspath,kotlinScriptDef,kotlinScriptDefExtensions,runtimeOnlyDependenciesMetadata,signatures,sourcesJar,testAnnotationProcessor,testApiDependenciesMetadata,testCompileOnlyDependenciesMetadata,testIntransitiveDependenciesMetadata,testKotlinScriptDef,testKotlinScriptDefExtensions
diff --git a/pkl-config-java/gradle.lockfile b/pkl-config-java/gradle.lockfile
index de3f3af88..2857844f5 100644
--- a/pkl-config-java/gradle.lockfile
+++ b/pkl-config-java/gradle.lockfile
@@ -3,16 +3,20 @@
 # This file is expected to be part of source control.
 com.github.ajalt.clikt:clikt-jvm:3.5.4=pklCodegenJava
 com.github.ajalt.clikt:clikt:3.5.4=pklCodegenJava
-com.palantir.javapoet:javapoet:0.5.0=pklCodegenJava
+com.palantir.javapoet:javapoet:0.6.0=pklCodegenJava
 com.tunnelvisionlabs:antlr4-runtime:4.9.0=pklCodegenJava,runtimeClasspath,testRuntimeClasspath
 io.leangen.geantyref:geantyref:1.3.16=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 javax.inject:javax.inject:1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.14.18=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.26.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.sdk:graal-sdk:23.0.6=pklCodegenJava,runtimeClasspath,testRuntimeClasspath
-org.graalvm.truffle:truffle-api:23.0.6=pklCodegenJava,runtimeClasspath,testRuntimeClasspath
+org.assertj:assertj-core:3.27.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.polyglot:polyglot:24.1.1=pklCodegenJava,runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:collections:24.1.1=pklCodegenJava,runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:graal-sdk:24.1.1=pklCodegenJava,runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:nativeimage:24.1.1=pklCodegenJava,runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:word:24.1.1=pklCodegenJava,runtimeClasspath,testRuntimeClasspath
+org.graalvm.truffle:truffle-api:24.1.1=pklCodegenJava,runtimeClasspath,testRuntimeClasspath
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-daemon-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
@@ -28,12 +32,12 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.10=pklCodegenJava,testCompileClasspa
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.10=pklCodegenJava,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib:1.7.10=kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,pklCodegenJava,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains:annotations:13.0=kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,pklCodegenJava,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.11.3=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.11.3=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-params:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.platform:junit-platform-engine:1.11.4=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit:junit-bom:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.msgpack:msgpack-core:0.9.8=pklCodegenJava,runtimeClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.organicdesign:Paguro:3.10.3=pklCodegenJava,runtimeClasspath,testRuntimeClasspath
diff --git a/pkl-config-kotlin/gradle.lockfile b/pkl-config-kotlin/gradle.lockfile
index 7b18450ac..86ab32337 100644
--- a/pkl-config-kotlin/gradle.lockfile
+++ b/pkl-config-kotlin/gradle.lockfile
@@ -6,12 +6,16 @@ com.github.ajalt.clikt:clikt:3.5.4=pklCodegenKotlin
 com.squareup:kotlinpoet:1.6.0=pklCodegenKotlin
 com.tunnelvisionlabs:antlr4-runtime:4.9.0=pklCodegenKotlin,pklConfigJava,runtimeClasspath,testRuntimeClasspath
 io.leangen.geantyref:geantyref:1.3.16=pklConfigJava,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.14.18=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.26.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.sdk:graal-sdk:23.0.6=pklCodegenKotlin,pklConfigJava,runtimeClasspath,testRuntimeClasspath
-org.graalvm.truffle:truffle-api:23.0.6=pklCodegenKotlin,pklConfigJava,runtimeClasspath,testRuntimeClasspath
+org.assertj:assertj-core:3.27.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.polyglot:polyglot:24.1.1=pklCodegenKotlin,pklConfigJava,runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:collections:24.1.1=pklCodegenKotlin,pklConfigJava,runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:graal-sdk:24.1.1=pklCodegenKotlin,pklConfigJava,runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:nativeimage:24.1.1=pklCodegenKotlin,pklConfigJava,runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:word:24.1.1=pklCodegenKotlin,pklConfigJava,runtimeClasspath,testRuntimeClasspath
+org.graalvm.truffle:truffle-api:24.1.1=pklCodegenKotlin,pklConfigJava,runtimeClasspath,testRuntimeClasspath
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-daemon-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
@@ -27,12 +31,12 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.10=apiDependenciesMetadata,compileCl
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.10=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,pklCodegenKotlin,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib:1.7.10=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,pklCodegenKotlin,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains:annotations:13.0=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,pklCodegenKotlin,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.11.3=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.11.3=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-params:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.platform:junit-platform-engine:1.11.4=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit:junit-bom:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.msgpack:msgpack-core:0.9.8=pklCodegenKotlin,pklConfigJava,runtimeClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.organicdesign:Paguro:3.10.3=pklCodegenKotlin,pklConfigJava,runtimeClasspath,testRuntimeClasspath
diff --git a/pkl-core/gradle.lockfile b/pkl-core/gradle.lockfile
index d8fb8a0e1..95b6b4a78 100644
--- a/pkl-core/gradle.lockfile
+++ b/pkl-core/gradle.lockfile
@@ -2,20 +2,24 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.google.code.findbugs:jsr305:3.0.2=compileClasspath,compileOnlyDependenciesMetadata
-com.palantir.javapoet:javapoet:0.5.0=generatorCompileClasspath,generatorImplementationDependenciesMetadata,generatorRuntimeClasspath
+com.palantir.javapoet:javapoet:0.6.0=generatorCompileClasspath,generatorImplementationDependenciesMetadata,generatorRuntimeClasspath
 com.tunnelvisionlabs:antlr4-annotations:4.9.0=antlr
 com.tunnelvisionlabs:antlr4-runtime:4.9.0=antlr,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 com.tunnelvisionlabs:antlr4:4.9.0=antlr
-net.bytebuddy:byte-buddy:1.14.18=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.abego.treelayout:org.abego.treelayout.core:1.0.1=antlr
 org.antlr:ST4:4.3=antlr
 org.antlr:antlr-runtime:3.5.2=antlr
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.26.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.sdk:graal-sdk:23.0.6=compileClasspath,generatorCompileClasspath,generatorImplementationDependenciesMetadata,generatorRuntimeClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.truffle:truffle-api:23.0.6=compileClasspath,generatorCompileClasspath,generatorImplementationDependenciesMetadata,generatorRuntimeClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.truffle:truffle-dsl-processor:23.0.6=annotationProcessor
+org.assertj:assertj-core:3.27.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.polyglot:polyglot:24.1.1=compileClasspath,generatorCompileClasspath,generatorImplementationDependenciesMetadata,generatorRuntimeClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.sdk:collections:24.1.1=compileClasspath,generatorCompileClasspath,generatorImplementationDependenciesMetadata,generatorRuntimeClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.sdk:graal-sdk:24.1.1=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.sdk:nativeimage:24.1.1=compileClasspath,generatorCompileClasspath,generatorImplementationDependenciesMetadata,generatorRuntimeClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.sdk:word:24.1.1=compileClasspath,generatorCompileClasspath,generatorImplementationDependenciesMetadata,generatorRuntimeClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.truffle:truffle-api:24.1.1=compileClasspath,generatorCompileClasspath,generatorImplementationDependenciesMetadata,generatorRuntimeClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.truffle:truffle-dsl-processor:24.1.1=annotationProcessor
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-daemon-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
@@ -31,12 +35,12 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.10=generatorCompileClasspath,generat
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.10=generatorCompileClasspath,generatorImplementationDependenciesMetadata,generatorRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib:1.7.10=generatorCompileClasspath,generatorImplementationDependenciesMetadata,generatorRuntimeClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathGenerator,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains:annotations:13.0=generatorCompileClasspath,generatorImplementationDependenciesMetadata,generatorRuntimeClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathGenerator,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-params:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.platform:junit-platform-engine:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit:junit-bom:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.msgpack:msgpack-core:0.9.8=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.organicdesign:Paguro:3.10.3=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
diff --git a/pkl-core/pkl-core.gradle.kts b/pkl-core/pkl-core.gradle.kts
index 869690209..fd7a4e0bc 100644
--- a/pkl-core/pkl-core.gradle.kts
+++ b/pkl-core/pkl-core.gradle.kts
@@ -29,6 +29,8 @@ val generatorSourceSet = sourceSets.register("generator")
 
 sourceSets { main { java { srcDir(file("generated/antlr")) } } }
 
+java { useGraalVm() }
+
 idea {
   module {
     // mark src/main/antlr as source dir
diff --git a/pkl-core/src/main/resources/META-INF/native-image/org.pkl-lang/native-image.properties b/pkl-core/src/main/resources/META-INF/native-image/org.pkl-lang/native-image.properties
new file mode 100644
index 000000000..3693f9b41
--- /dev/null
+++ b/pkl-core/src/main/resources/META-INF/native-image/org.pkl-lang/native-image.properties
@@ -0,0 +1,2 @@
+
+Args = --initialize-at-build-time=org.pkl.core
diff --git a/pkl-core/src/test/files/LanguageSnippetTests/input/errors/analyzeInvalidHttpModule.pkl b/pkl-core/src/test/files/LanguageSnippetTests/input/errors/analyzeInvalidHttpModule.inert
similarity index 100%
rename from pkl-core/src/test/files/LanguageSnippetTests/input/errors/analyzeInvalidHttpModule.pkl
rename to pkl-core/src/test/files/LanguageSnippetTests/input/errors/analyzeInvalidHttpModule.inert
diff --git a/pkl-core/src/test/files/LanguageSnippetTests/output/errors/analyzeInvalidHttpModule.err b/pkl-core/src/test/files/LanguageSnippetTests/output/errors/analyzeInvalidHttpModule.err
deleted file mode 100644
index 45d1460c8..000000000
--- a/pkl-core/src/test/files/LanguageSnippetTests/output/errors/analyzeInvalidHttpModule.err
+++ /dev/null
@@ -1,10 +0,0 @@
-–– Pkl Error ––
-HTTP/1.1 header parser received no bytes
-
-x | result = analyze.importGraph(Set("http://localhost:0/foo.pkl"))
-             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-at analyzeInvalidHttpModule#result (file:///$snippetsDir/input/errors/analyzeInvalidHttpModule.pkl)
-
-xxx | text = renderer.renderDocument(value)
-             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-at pkl.base#Module.output.text (pkl:base)
diff --git a/pkl-doc/gradle.lockfile b/pkl-doc/gradle.lockfile
index 7260308c7..795111fb5 100644
--- a/pkl-doc/gradle.lockfile
+++ b/pkl-doc/gradle.lockfile
@@ -11,14 +11,13 @@ com.google.guava:guava:32.1.1-jre=testCompileClasspath,testImplementationDepende
 com.google.j2objc:j2objc-annotations:2.8=testCompileClasspath,testImplementationDependenciesMetadata
 com.google.jimfs:jimfs:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 com.ibm.icu:icu4j:58.2=validator
-com.ibm.icu:icu4j:72.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 com.shapesecurity:salvation:2.7.2=validator
 com.tunnelvisionlabs:antlr4-runtime:4.9.0=runtimeClasspath,testRuntimeClasspath
 commons-codec:commons-codec:1.10=validator
 commons-io:commons-io:2.4=validator
 commons-logging:commons-logging:1.2=validator
 isorelax:isorelax:20030108=validator
-net.bytebuddy:byte-buddy:1.14.18=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 net.sf.saxon:Saxon-HE:9.6.0-4=validator
 nu.validator:cssvalidator:1.0.8=validator
@@ -32,16 +31,28 @@ org.apache.httpcomponents:httpcore:4.4=validator
 org.apache.logging.log4j:log4j-1.2-api:2.17.1=validator
 org.apache.logging.log4j:log4j-api:2.17.1=validator
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.26.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.assertj:assertj-core:3.27.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.checkerframework:checker-qual:3.33.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.commonmark:commonmark-ext-gfm-tables:0.24.0=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.commonmark:commonmark:0.24.0=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.eclipse.jetty:jetty-util-ajax:9.4.18.v20190429=validator
 org.eclipse.jetty:jetty-util:9.4.18.v20190429=validator
-org.graalvm.js:js:23.0.6=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.regex:regex:23.0.6=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.sdk:graal-sdk:23.0.6=runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.truffle:truffle-api:23.0.6=runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.js:js-community:24.1.1=testRuntimeClasspath
+org.graalvm.js:js-language:24.1.1=testRuntimeClasspath
+org.graalvm.js:js:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.polyglot:polyglot:24.1.1=runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.regex:regex:24.1.1=testRuntimeClasspath
+org.graalvm.sdk:collections:24.1.1=runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.sdk:graal-sdk:24.1.1=runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.sdk:jniutils:24.1.1=testRuntimeClasspath
+org.graalvm.sdk:nativebridge:24.1.1=testRuntimeClasspath
+org.graalvm.sdk:nativeimage:24.1.1=runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.sdk:word:24.1.1=runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.shadowed:icu4j:24.1.1=testRuntimeClasspath
+org.graalvm.truffle:truffle-api:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.truffle:truffle-compiler:24.1.1=testRuntimeClasspath
+org.graalvm.truffle:truffle-enterprise:24.1.1=testRuntimeClasspath
+org.graalvm.truffle:truffle-runtime:24.1.1=testRuntimeClasspath
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-daemon-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
@@ -69,12 +80,12 @@ org.jetbrains.kotlinx:kotlinx-serialization-core:1.5.1=compileClasspath,implemen
 org.jetbrains.kotlinx:kotlinx-serialization-json-jvm:1.5.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-serialization-json:1.5.1=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains:annotations:13.0=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-params:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.platform:junit-platform-engine:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit:junit-bom:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.msgpack:msgpack-core:0.9.8=runtimeClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.organicdesign:Paguro:3.10.3=runtimeClasspath,testRuntimeClasspath
diff --git a/pkl-executor/gradle.lockfile b/pkl-executor/gradle.lockfile
index 0067d9cea..303f2e565 100644
--- a/pkl-executor/gradle.lockfile
+++ b/pkl-executor/gradle.lockfile
@@ -2,12 +2,25 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.tunnelvisionlabs:antlr4-runtime:4.9.0=testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.14.18=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.26.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.sdk:graal-sdk:23.0.6=testRuntimeClasspath
-org.graalvm.truffle:truffle-api:23.0.6=testRuntimeClasspath
+org.assertj:assertj-core:3.27.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.compiler:compiler:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.nativeimage:native-image-base:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.nativeimage:objectfile:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.nativeimage:pointsto:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.nativeimage:svm:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.nativeimage:truffle-runtime-svm:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.polyglot:polyglot:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.sdk:collections:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.sdk:graal-sdk:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.sdk:jniutils:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.sdk:nativeimage:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.sdk:word:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.truffle:truffle-api:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.truffle:truffle-compiler:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.truffle:truffle-runtime:24.1.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-daemon-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
@@ -23,12 +36,12 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.10=testCompileClasspath,testImplemen
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.10=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib:1.7.10=kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains:annotations:13.0=kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-params:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.platform:junit-platform-engine:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit:junit-bom:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.msgpack:msgpack-core:0.9.8=testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.organicdesign:Paguro:3.10.3=testRuntimeClasspath
diff --git a/pkl-executor/pkl-executor.gradle.kts b/pkl-executor/pkl-executor.gradle.kts
index 05583f195..9ed9536a5 100644
--- a/pkl-executor/pkl-executor.gradle.kts
+++ b/pkl-executor/pkl-executor.gradle.kts
@@ -21,11 +21,14 @@ plugins {
   pklJavaLibrary
   pklPublishLibrary
   pklKotlinTest
+  `jvm-toolchains`
 }
 
 val pklDistributionCurrent: Configuration by configurations.creating
 val pklHistoricalDistributions: Configuration by configurations.creating
 
+java { useGraalVm() }
+
 // Because pkl-executor doesn't depend on other Pkl modules
 // (nor has overlapping dependencies that could cause a version conflict),
 // clients are free to use different versions of pkl-executor and (say) pkl-config-java-all.
@@ -38,6 +41,10 @@ dependencies {
 
   testImplementation(projects.pklCommonsTest)
   testImplementation(projects.pklCore)
+  testImplementation(libs.truffleApi)
+  testImplementation(libs.graalSdk)
+  testImplementation(libs.svm)
+  testImplementation(libs.truffleSvm)
   testImplementation(libs.slf4jSimple)
 }
 
@@ -98,4 +105,8 @@ val prepareHistoricalDistributions by
 val prepareTest by
   tasks.registering { dependsOn(pklDistributionCurrent, prepareHistoricalDistributions) }
 
-tasks.test { dependsOn(prepareTest) }
+tasks.test {
+  dependsOn(prepareTest)
+  useJUnitPlatform()
+  jvmArgumentProviders.add(CommandLineArgumentProvider { listOf("--add-modules=jdk.unsupported") })
+}
diff --git a/pkl-gradle/gradle.lockfile b/pkl-gradle/gradle.lockfile
index 562043c49..fc32578f6 100644
--- a/pkl-gradle/gradle.lockfile
+++ b/pkl-gradle/gradle.lockfile
@@ -3,10 +3,10 @@
 # This file is expected to be part of source control.
 com.github.ajalt.clikt:clikt-jvm:3.5.4=compileClasspath
 com.github.ajalt.clikt:clikt:3.5.4=compileClasspath,compileOnlyDependenciesMetadata
-net.bytebuddy:byte-buddy:1.14.18=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.26.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.assertj:assertj-core:3.27.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-daemon-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
@@ -22,11 +22,11 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.10=compileClasspath,compileOnlyDepen
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.10=compileClasspath,compileOnlyDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib:1.7.10=compileClasspath,compileOnlyDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains:annotations:13.0=compileClasspath,compileOnlyDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-params:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.platform:junit-platform-engine:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit:junit-bom:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 empty=annotationProcessor,apiDependenciesMetadata,implementationDependenciesMetadata,intransitiveDependenciesMetadata,kotlinCompilerPluginClasspath,kotlinNativeCompilerPluginClasspath,kotlinScriptDef,kotlinScriptDefExtensions,runtimeClasspath,runtimeOnlyDependenciesMetadata,signatures,sourcesJar,testAnnotationProcessor,testApiDependenciesMetadata,testCompileOnlyDependenciesMetadata,testIntransitiveDependenciesMetadata,testKotlinScriptDef,testKotlinScriptDefExtensions
diff --git a/pkl-server/gradle.lockfile b/pkl-server/gradle.lockfile
index 5ec0acf36..df1a61809 100644
--- a/pkl-server/gradle.lockfile
+++ b/pkl-server/gradle.lockfile
@@ -2,12 +2,16 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.tunnelvisionlabs:antlr4-runtime:4.9.0=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.14.18=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.26.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.sdk:graal-sdk:23.0.6=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.truffle:truffle-api:23.0.6=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.assertj:assertj-core:3.27.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.polyglot:polyglot:24.1.1=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.sdk:collections:24.1.1=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.sdk:graal-sdk:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:nativeimage:24.1.1=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.sdk:word:24.1.1=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.graalvm.truffle:truffle-api:24.1.1=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-daemon-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
@@ -23,12 +27,12 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.10=apiDependenciesMetadata,compileCl
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.10=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib:1.7.10=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.jetbrains:annotations:13.0=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.11.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.jupiter:junit-jupiter-params:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit.platform:junit-platform-engine:1.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.junit:junit-bom:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.msgpack:msgpack-core:0.9.8=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
 org.organicdesign:Paguro:3.10.3=runtimeClasspath,testRuntimeClasspath
diff --git a/pkl-tools/gradle.lockfile b/pkl-tools/gradle.lockfile
index 215fdbb66..f4129437b 100644
--- a/pkl-tools/gradle.lockfile
+++ b/pkl-tools/gradle.lockfile
@@ -3,15 +3,22 @@
 # This file is expected to be part of source control.
 com.github.ajalt.clikt:clikt-jvm:3.5.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.ajalt.clikt:clikt:3.5.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.palantir.javapoet:javapoet:0.5.0=runtimeClasspath,testRuntimeClasspath
+com.palantir.javapoet:javapoet:0.6.0=runtimeClasspath,testRuntimeClasspath
 com.squareup:kotlinpoet:1.6.0=runtimeClasspath,testRuntimeClasspath
 com.tunnelvisionlabs:antlr4-runtime:4.9.0=runtimeClasspath,testRuntimeClasspath
 io.leangen.geantyref:geantyref:1.3.16=runtimeClasspath,testRuntimeClasspath
 org.commonmark:commonmark-ext-gfm-tables:0.24.0=runtimeClasspath,testRuntimeClasspath
 org.commonmark:commonmark:0.24.0=runtimeClasspath,testRuntimeClasspath
 org.fusesource.jansi:jansi:2.4.1=runtimeClasspath,testRuntimeClasspath
-org.graalvm.sdk:graal-sdk:23.0.6=runtimeClasspath,testRuntimeClasspath
-org.graalvm.truffle:truffle-api:23.0.6=runtimeClasspath,testRuntimeClasspath
+org.graalvm.polyglot:polyglot:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:collections:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:graal-sdk:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:jniutils:24.1.1=runtimeClasspath
+org.graalvm.sdk:nativeimage:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.sdk:word:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.truffle:truffle-api:24.1.1=runtimeClasspath,testRuntimeClasspath
+org.graalvm.truffle:truffle-compiler:24.1.1=runtimeClasspath
+org.graalvm.truffle:truffle-runtime:24.1.1=runtimeClasspath
 org.jetbrains.kotlin:kotlin-reflect:1.7.10=runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib-common:1.7.10=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.10=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
diff --git a/settings.gradle.kts b/settings.gradle.kts
index 5f97fee35..f764cc18f 100644
--- a/settings.gradle.kts
+++ b/settings.gradle.kts
@@ -56,6 +56,8 @@ pluginManagement {
   }
 }
 
+plugins { id("org.gradle.toolchains.foojay-resolver-convention") version ("0.8.0") }
+
 @Suppress("UnstableApiUsage") dependencyResolutionManagement { repositories { mavenCentral() } }
 
 val javaVersion = JavaVersion.current()