diff --git a/Cargo.lock b/Cargo.lock
index bdbc832e..2fb10539 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -291,9 +291,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"
 dependencies = [
  "serde",
 ]
@@ -351,9 +351,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.51"
+version = "4.5.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c26d721170e0295f191a69bd9a1f93efcdb0aff38684b61ab5750468972e5f5"
+checksum = "c9e340e012a1bf4935f5282ed1436d1489548e8f72308207ea5df0e23d2d03f8"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -361,9 +361,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.51"
+version = "4.5.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75835f0c7bf681bfd05abe44e965760fea999a5286c6eb2d59883634fd02011a"
+checksum = "d76b5d13eaa18c901fd2f7fca939fefe3a0727a953561fefdf3b2922b8569d00"
 dependencies = [
  "anstream",
  "anstyle",
@@ -438,9 +438,9 @@ dependencies = [
 
 [[package]]
 name = "console"
-version = "0.16.1"
+version = "0.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b430743a6eb14e9764d4260d4c0d8123087d504eeb9c48f2b2a5e810dd369df4"
+checksum = "03e45a4a8926227e4197636ba97a9fc9b00477e9f4bd711395687c5f0734bec4"
 dependencies = [
  "encode_unicode",
  "libc",
@@ -863,6 +863,12 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
@@ -1078,7 +1084,7 @@ checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
  "allocator-api2",
  "equivalent",
- "foldhash",
+ "foldhash 0.1.5",
 ]
 
 [[package]]
@@ -1086,6 +1092,9 @@ name = "hashbrown"
 version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5419bdc4f6a9207fbeba6d11b604d481addf78ecd10c11ad51e76c2f6482748d"
+dependencies = [
+ "foldhash 0.2.0",
+]
 
 [[package]]
 name = "hashlink"
@@ -1566,9 +1575,9 @@ checksum = "2c4a545a15244c7d945065b5d392b2d2d7f21526fba56ce51467b06ed445e8f7"
 
 [[package]]
 name = "libc"
-version = "0.2.177"
+version = "0.2.178"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
+checksum = "37c93d8daa9d8a012fd8ab92f088405fb202ea0b6ab73ee2482ae66af4f42091"
 
 [[package]]
 name = "liblzma"
@@ -1663,9 +1672,9 @@ checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
 
 [[package]]
 name = "lzma-rust2"
-version = "0.13.0"
+version = "0.15.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c60a23ffb90d527e23192f1246b14746e2f7f071cb84476dd879071696c18a4a"
+checksum = "48172246aa7c3ea28e423295dd1ca2589a24617cc4e588bb8cfe177cb2c54d95"
 dependencies = [
  "crc",
  "sha2",
@@ -1860,13 +1869,13 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.37.3"
+version = "0.38.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
+checksum = "b8b28f24bd43920cd8e0bc4f9c6553e8b93221c512cb9a1014987fc89d36f830"
 dependencies = [
  "crc32fast",
  "flate2",
- "hashbrown 0.15.5",
+ "hashbrown 0.16.0",
  "indexmap",
  "memchr",
  "ruzstd",
@@ -2260,9 +2269,9 @@ checksum = "caf4aa5b0f434c91fe5c7f1ecb6a5ece2130b02ad2a590589dda5146df959001"
 
 [[package]]
 name = "reqwest"
-version = "0.12.24"
+version = "0.12.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d0946410b9f7b082a427e4ef5c8ff541a88b357bc6c637c40db3a68ac70a36f"
+checksum = "3b4c14b2d9afca6a60277086b0cc6a6ae0b568f6f7916c943a8cdc79f8be240f"
 dependencies = [
  "base64",
  "bytes",
@@ -2583,9 +2592,9 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e24345aa0fe688594e73770a5f6d1b216508b4f93484c0026d521acd30134392"
+checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
 dependencies = [
  "serde_core",
 ]
@@ -3602,9 +3611,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.9.8"
+version = "0.9.10+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0dc8b1fb61449e27716ec0e1bdf0f6b8f3e8f6b05391e8497b8b6d7804ea6d8"
+checksum = "0825052159284a1a8b4d6c0c86cbc801f2da5afd2b225fa548c72f2e74002f48"
 dependencies = [
  "indexmap",
  "serde_core",
@@ -3617,27 +3626,27 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "0.7.3"
+version = "0.7.5+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2cdb639ebbc97961c51720f858597f7f24c4fc295327923af55b74c3c724533"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
 dependencies = [
  "serde_core",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.0.4"
+version = "1.0.6+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0cbe268d35bdb4bb5a56a2de88d0ad0eb70af5384a99d648cd4b3d04039800e"
+checksum = "a3198b4b0a8e11f09dd03e133c0280504d0801269e9afa46362ffde1cbeebf44"
 dependencies = [
  "winnow",
 ]
 
 [[package]]
 name = "toml_writer"
-version = "1.0.4"
+version = "1.0.6+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df8b2b54733674ad286d16267dcfc7a71ed5c776e4ac7aa3c3e2561f7c637bf2"
+checksum = "ab16f14aed21ee8bfd8ec22513f7287cd4a91aa92e44edfe2c17ddd004e92607"
 
 [[package]]
 name = "tower"
@@ -3656,9 +3665,9 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.6"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
 dependencies = [
  "bitflags",
  "bytes",
@@ -3686,9 +3695,9 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
 [[package]]
 name = "tracing"
-version = "0.1.41"
+version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
  "log",
  "pin-project-lite",
@@ -3698,9 +3707,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.30"
+version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3709,9 +3718,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-core"
-version = "0.1.34"
+version = "0.1.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
  "once_cell",
  "valuable",
@@ -3740,9 +3749,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.20"
+version = "0.3.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2054a14f5307d601f88daf0553e1cbf472acc4f2c51afab632431cdcd72124d5"
+checksum = "2f30143827ddab0d256fd843b7a66d164e9f271cfa0dde49142c5ca0ca291f1e"
 dependencies = [
  "matchers",
  "nu-ansi-term",
@@ -3854,13 +3863,13 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.18.1"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f87b8aa10b915a06587d0dec516c282ff295b475d94abf425d62b57710070a2"
+checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a"
 dependencies = [
  "getrandom 0.3.3",
  "js-sys",
- "serde",
+ "serde_core",
  "wasm-bindgen",
 ]
 
@@ -4648,9 +4657,9 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "6.0.0"
+version = "7.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb2a05c7c36fde6c09b08576c9f7fb4cda705990f73b58fe011abf7dfb24168b"
+checksum = "bdd8a47718a4ee5fe78e07667cd36f3de80e7c2bfe727c7074245ffc7303c037"
 dependencies = [
  "aes",
  "arbitrary",
@@ -4659,6 +4668,7 @@ dependencies = [
  "crc32fast",
  "deflate64",
  "flate2",
+ "generic-array",
  "getrandom 0.3.3",
  "hmac",
  "indexmap",
diff --git a/Cargo.toml b/Cargo.toml
index 56359182..5bf8cb62 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -44,22 +44,22 @@ sqlx = { version = "0.8.6", features = [
 ] }
 
 # HTTP0.12.20
-reqwest = { version = "0.12.24", features = ["json", "stream"] }
+reqwest = { version = "0.12.26", features = ["json", "stream"] }
 
 # Serialization
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.145"
-toml = "0.9.8"
+toml = "0.9.10"
 
 # Error handl2.0.12
 thiserror = "2.0.17"
 
 # Utilities
-uuid = { version = "1.18.1", features = ["v4", "serde"] }
+uuid = { version = "1.19.0", features = ["v4", "serde"] }
 semver = { version = "1.0.27", features = ["serde"] }
 blake3 = "1.8.2"
 xxhash-rust = { version = "0.8.15", features = ["xxh3"] }
-tracing = "0.1.41"
+tracing = "0.1.44"
 chrono = { version = "0.4.42", features = ["serde"] }
 minisign-verify = "0.2.4"
 
@@ -67,7 +67,7 @@ minisign-verify = "0.2.4"
 dashmap = "6.1.0"
 crossbeam = "0.8.4"
 
-clap = { version = "4.5.51", features = ["derive", "env"] }
+clap = { version = "4.5.53", features = ["derive", "env"] }
 
 tar = "0.4.44"
 
diff --git a/apps/sbs/Cargo.toml b/apps/sbs/Cargo.toml
index 146e9067..5fc1b026 100644
--- a/apps/sbs/Cargo.toml
+++ b/apps/sbs/Cargo.toml
@@ -17,8 +17,8 @@ sps2-errors = { path = "../../crates/errors" }
 sps2-repository = { path = "../../crates/repository" }
 sps2-net = { path = "../../crates/net" }
 tokio = { workspace = true, features = ["fs", "rt-multi-thread", "macros"] }
-tracing = "0.1.41"
-tracing-subscriber = { version = "0.3.20", features = ["env-filter"] }
+tracing = "0.1.44"
+tracing-subscriber = { version = "0.3.22", features = ["env-filter"] }
 minisign = "0.8.0"
 base64 = "0.22.1"
 rpassword = "7.4.0"
diff --git a/apps/sls/Cargo.toml b/apps/sls/Cargo.toml
index 60bf2237..880edc26 100644
--- a/apps/sls/Cargo.toml
+++ b/apps/sls/Cargo.toml
@@ -12,8 +12,8 @@ sps2-hash = { path = "../../crates/hash" }
 sps2-state = { path = "../../crates/state" }
 sps2-config = { path = "../../crates/config" }
 
-clap = { version = "4.5.51", features = ["derive"] }
+clap = { version = "4.5.53", features = ["derive"] }
 tokio = { version = "1.48.0", features = ["full"] }
 chrono = "0.4.42"
 sqlx = { version = "0.8.6", features = ["runtime-tokio", "sqlite"] }
-libc = { version = "0.2.177", optional = false }
+libc = { version = "0.2.178", optional = false }
diff --git a/apps/sps2/Cargo.toml b/apps/sps2/Cargo.toml
index c12bff2e..31bf77c8 100644
--- a/apps/sps2/Cargo.toml
+++ b/apps/sps2/Cargo.toml
@@ -26,13 +26,13 @@ sps2-index = { path = "../../crates/index" }
 sps2-builder = { path = "../../crates/builder" }
 sps2-platform = { path = "../../crates/platform" }
 
-clap = { version = "4.5.51", features = ["derive", "color"] }
+clap = { version = "4.5.53", features = ["derive", "color"] }
 tokio = { workspace = true, features = ["full"] }
-tracing = "0.1.41"
-tracing-subscriber = { version = "0.3.20", features = ["env-filter", "json"] }
+tracing = "0.1.44"
+tracing-subscriber = { version = "0.3.22", features = ["env-filter", "json"] }
 serde_json = { workspace = true }
 comfy-table = "7.2.1"
-console = "0.16.1"
+console = "0.16.2"
 chrono = { workspace = true }
 uuid = { workspace = true }
 
diff --git a/crates/builder/Cargo.toml b/crates/builder/Cargo.toml
index fbb778bc..ac9a9f85 100644
--- a/crates/builder/Cargo.toml
+++ b/crates/builder/Cargo.toml
@@ -44,16 +44,16 @@ crossbeam = { workspace = true }
 chrono = { workspace = true }
 which = "8.0.0"
 sysinfo = "0.37.2"
-uuid = { version = "1.18.1", features = ["v4"] }
+uuid = { version = "1.19.0", features = ["v4"] }
 bitflags = "2.10.0"
-zip = "6.0.0"
+zip = "7.0.0"
 rayon = "1.11.0"
 ignore = { version = "0.4.25", features = [
     "simd-accel",
 ] } # ripgrep's fast walker
 globset = "0.4.16"
 bstr = "1.12.1" # binary‑safe search helpers
-object = { version = "0.37.3", features = ["read_core", "write_core", "macho"] }
+object = { version = "0.38.0", features = ["read_core", "write_core", "macho"] }
 regex = "1.12.2"
 thiserror = "2.0.17"
 md-5 = "0.10.6"
diff --git a/crates/install/Cargo.toml b/crates/install/Cargo.toml
index ac74a6f7..d6f33150 100644
--- a/crates/install/Cargo.toml
+++ b/crates/install/Cargo.toml
@@ -27,7 +27,7 @@ dashmap = { workspace = true }
 crossbeam = { workspace = true }
 chrono = { workspace = true }
 tempfile = { workspace = true }
-libc = "0.2.177"
+libc = "0.2.178"
 toml = { workspace = true }
 async-compression = { version = "0.4.33", features = ["tokio", "zstd"] }
 tar = { workspace = true }
diff --git a/crates/net/Cargo.toml b/crates/net/Cargo.toml
index e9cbe014..92bc5943 100644
--- a/crates/net/Cargo.toml
+++ b/crates/net/Cargo.toml
@@ -17,7 +17,7 @@ blake3 = { workspace = true }
 tokio = { workspace = true, features = ["fs"] }
 reqwest = { workspace = true }
 futures = "0.3.31"
-bytes = "1.10.1"
+bytes = "1.11.0"
 url = "2.5.7"
 rand = "0.9.2"
 serde = { workspace = true }
diff --git a/crates/ops/Cargo.toml b/crates/ops/Cargo.toml
index f1d5304d..7d1a4b30 100644
--- a/crates/ops/Cargo.toml
+++ b/crates/ops/Cargo.toml
@@ -30,7 +30,7 @@ tempfile = { workspace = true }
 minisign-verify = "0.2.4"
 hex = "0.4.3"
 walkdir = "2.5.0"
-toml = "0.9.8"
+toml = "0.9.10"
 base64 = "0.22.1"
 dialoguer = "0.12.0"
 
diff --git a/crates/platform/Cargo.toml b/crates/platform/Cargo.toml
index 7fc0ac41..5f85d675 100644
--- a/crates/platform/Cargo.toml
+++ b/crates/platform/Cargo.toml
@@ -16,7 +16,7 @@ tokio = { workspace = true }
 serde = { workspace = true }
 thiserror = { workspace = true }
 futures = { workspace = true }
-libc = "0.2.177"
+libc = "0.2.178"
 serde_json = { workspace = true }
 dirs = "6.0.0"
 chrono = { workspace = true }
diff --git a/crates/resolver/Cargo.toml b/crates/resolver/Cargo.toml
index 2d232045..a39581a7 100644
--- a/crates/resolver/Cargo.toml
+++ b/crates/resolver/Cargo.toml
@@ -19,7 +19,7 @@ semver = { workspace = true }
 tokio = { workspace = true }
 dashmap = { workspace = true }
 crossbeam = { workspace = true }
-uuid = { version = "1.18.1", features = ["v4"] }
+uuid = { version = "1.19.0", features = ["v4"] }
 scopeguard = "1.2.0"
 
 [dev-dependencies]
diff --git a/crates/store/Cargo.toml b/crates/store/Cargo.toml
index 16b14063..58627d39 100644
--- a/crates/store/Cargo.toml
+++ b/crates/store/Cargo.toml
@@ -19,7 +19,7 @@ tar = "0.4.44"
 async-compression = { version = "0.4.33", features = ["tokio", "zstd"] }
 tokio-util = { version = "0.7.17", features = ["compat", "io", "io-util"] }
 tempfile = { workspace = true }
-uuid = { version = "1.18.1", features = ["v4"] }
+uuid = { version = "1.19.0", features = ["v4"] }
 serde = { workspace = true }
 serde_json = { workspace = true }