diff --git a/json/internal/utf8x/_asm/go.mod b/json/internal/utf8x/_asm/go.mod
index 3c12793..1b78da8 100644
--- a/json/internal/utf8x/_asm/go.mod
+++ b/json/internal/utf8x/_asm/go.mod
@@ -5,7 +5,7 @@ go 1.26.0
 require github.com/mmcloughlin/avo v0.6.1-0.20260701065415-16419356370f
 
 require (
-	golang.org/x/mod v0.40.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/mod v0.41.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/tools v0.49.0 // indirect
 )
diff --git a/json/internal/utf8x/_asm/go.sum b/json/internal/utf8x/_asm/go.sum
index 6d506d0..50ee934 100644
--- a/json/internal/utf8x/_asm/go.sum
+++ b/json/internal/utf8x/_asm/go.sum
@@ -2,9 +2,9 @@ github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/mmcloughlin/avo v0.6.1-0.20260701065415-16419356370f h1:eLpJhGSyRTsY+l0MFH5zGdcm15rwu7Cm48S257NMHRQ=
 github.com/mmcloughlin/avo v0.6.1-0.20260701065415-16419356370f/go.mod h1:+Pk+j3KceMwAIGb32HZSCvkMCzJvxy6xCRk+urz7iPw=
-golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
-golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
 golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
diff --git a/json/lexers/default-lexer/internal/strscan/_asm/go.mod b/json/lexers/default-lexer/internal/strscan/_asm/go.mod
index 66a8b12..3050aba 100644
--- a/json/lexers/default-lexer/internal/strscan/_asm/go.mod
+++ b/json/lexers/default-lexer/internal/strscan/_asm/go.mod
@@ -5,7 +5,7 @@ go 1.26.0
 require github.com/mmcloughlin/avo v0.6.1-0.20260701065415-16419356370f
 
 require (
-	golang.org/x/mod v0.40.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/mod v0.41.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/tools v0.49.0 // indirect
 )
diff --git a/json/lexers/default-lexer/internal/strscan/_asm/go.sum b/json/lexers/default-lexer/internal/strscan/_asm/go.sum
index 6d506d0..50ee934 100644
--- a/json/lexers/default-lexer/internal/strscan/_asm/go.sum
+++ b/json/lexers/default-lexer/internal/strscan/_asm/go.sum
@@ -2,9 +2,9 @@ github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/mmcloughlin/avo v0.6.1-0.20260701065415-16419356370f h1:eLpJhGSyRTsY+l0MFH5zGdcm15rwu7Cm48S257NMHRQ=
 github.com/mmcloughlin/avo v0.6.1-0.20260701065415-16419356370f/go.mod h1:+Pk+j3KceMwAIGb32HZSCvkMCzJvxy6xCRk+urz7iPw=
-golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
-golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
 golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=