diff --git a/build.gradle b/build.gradle
index 1a8c7e82..5f150c2f 100644
--- a/build.gradle
+++ b/build.gradle
@@ -70,11 +70,11 @@ dependencies {
   // In the past we tested against nightly closure releases at  'com.google.javascript:closure-compiler:1.0-SNAPSHOT',
   // but sonatype started 404-ing CircleCI. Now, we test against the latest released Closure version on Circle, and
   // internally test against Closure head.
-  compile 'com.google.javascript:closure-compiler:v20190929'
+  compile 'com.google.javascript:closure-compiler:v20191027'
 
   compile 'com.google.code.gson:gson:2.7'
   compile 'com.google.code.findbugs:jsr305:3.0.1'
-  compile 'com.google.guava:guava:28.0-jre'
+  compile 'com.google.guava:guava:28.1-jre'
   compile 'org.apache.commons:commons-text:1.4'
 
   // ErrorProne itself, plus its javac integration.
diff --git a/package.json b/package.json
index 35da9daf..5ca0d0c9 100644
--- a/package.json
+++ b/package.json
@@ -5,7 +5,7 @@
   "homepage": "https://github.com/angular/clutz",
   "description": "Clutz is not on npm, and technically not a node package. \n This is needed only for testing Clutz's output against the TypeScript compiler, and to install some development dependencies from npm.",
   "devDependencies": {
-    "clang-format": "^1.2.3",
+    "clang-format": "^1.3.0",
     "typescript": "^3.3.1"
   }
 }