diff --git a/Cargo.lock b/Cargo.lock
index d6af648b..e8e06ee7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -399,9 +399,9 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cc"
-version = "1.5.1"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f360145194ee8e21db5ee7f3fcd4fe52210864c75c985dae33218202c8bbe040"
+checksum = "f74872d07caf508b30a21f6836e7d7016a2eaf7d9ff4f48deaa58cd8a0407630"
 dependencies = [
  "find-msvc-tools",
  "shlex 2.0.1",
@@ -1295,12 +1295,13 @@ checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
 [[package]]
 name = "flate2"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
 dependencies = [
  "crc32fast",
- "miniz_oxide",
+ "miniz_oxide 0.9.1",
+ "zlib-rs",
 ]
 
 [[package]]
@@ -1846,9 +1847,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.11.1"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
+checksum = "2c3e324da4c95177d6291d4c8730197c0d1822f8a9766814a4a44fa5ab797c9c"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -2569,9 +2570,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "libc"
-version = "0.2.189"
+version = "0.2.190"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
 
 [[package]]
 name = "libloading"
@@ -2860,6 +2861,16 @@ dependencies = [
  "simd-adler32",
 ]
 
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
 [[package]]
 name = "mio"
 version = "1.2.0"
@@ -3834,7 +3845,7 @@ dependencies = [
  "crc32fast",
  "fdeflate",
  "flate2",
- "miniz_oxide",
+ "miniz_oxide 0.8.9",
 ]
 
 [[package]]
@@ -5545,9 +5556,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.53.1"
+version = "1.53.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044"
 dependencies = [
  "bytes",
  "libc",
@@ -6091,9 +6102,9 @@ dependencies = [
 
 [[package]]
 name = "want"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+checksum = "ec4cdd0dd910afe868b7ef477227d8d538b46b3075031afee8a9f2acb0a2ed0b"
 dependencies = [
  "try-lock",
 ]
@@ -7297,6 +7308,12 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "zlib-rs"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"
+
 [[package]]
 name = "zmij"
 version = "1.0.21"
diff --git a/Cargo.toml b/Cargo.toml
index 8b3d87a4..8fba08ac 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -19,7 +19,7 @@ forge = { path = "forge" }
 flux = { path = "flux", default-features = false }
 log = "=0.4.34"
 rquickjs = { version = "=0.14.0", features = ["bindgen", "rust-alloc", "futures", "macro", "loader"] }
-tokio = { version = "=1.53.1", features = ["rt", "rt-multi-thread", "time", "sync", "net"] }
+tokio = { version = "=1.53.2", features = ["rt", "rt-multi-thread", "time", "sync", "net"] }
 
 # livekit-wakeword 0.1.3 + a session optimization-level fix (without it the
 # ort-tract backend runs unoptimized graphs, ~9x slower than real time).
diff --git a/alloy/Cargo.toml b/alloy/Cargo.toml
index e9997044..43f6a00f 100644
--- a/alloy/Cargo.toml
+++ b/alloy/Cargo.toml
@@ -29,7 +29,7 @@ ndk-sys = "=0.6.0"
 # threads run at display priority so background processes stop preempting
 # frames mid-flight.
 [target.'cfg(unix)'.dependencies]
-libc = "=0.2.189"
+libc = "=0.2.190"
 
 # impellers ships pre-generated bindings sized for 64-bit hosts; on 32-bit
 # armv7 the pointer-sized struct fields don't line up, so re-run bindgen
@@ -129,4 +129,4 @@ libloading = "=0.8.9"
 [build-dependencies]
 # Compiles the vendored msdfgen core and the C shim over it (build.rs), the
 # glyph engine's distance-field generator; forge's pin.
-cc = "=1.5.1"
+cc = "=1.6.0"
diff --git a/flux/Cargo.toml b/flux/Cargo.toml
index d730f650..90ab85fd 100644
--- a/flux/Cargo.toml
+++ b/flux/Cargo.toml
@@ -64,4 +64,4 @@ tokio = { workspace = true, features = ["sync", "time", "fs", "io-util", "macros
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["full"] }
-libc = "=0.2.189"
+libc = "=0.2.190"
diff --git a/forge/Cargo.toml b/forge/Cargo.toml
index 1d8d1a6e..2ba35a4d 100644
--- a/forge/Cargo.toml
+++ b/forge/Cargo.toml
@@ -38,7 +38,7 @@ wasm-native = ["dep:wasmtime"]
 log = { workspace = true }
 tokio = { workspace = true, features = ["sync", "time", "fs", "io-util", "macros", "rt", "net", "signal", "process"] }
 reqwest = { version = "=0.12.28", default-features = false, features = ["rustls-tls", "stream"] }
-hyper = { version = "=1.11.1", features = ["server", "http1"] }
+hyper = { version = "=1.12.0", features = ["server", "http1"] }
 hyper-util = { version = "=0.1.21", features = ["tokio"] }
 http-body-util = "=0.1.5"
 # The digest core behind crypto.subtle.digest.
@@ -46,7 +46,7 @@ sha2 = "=0.11.0"
 # forge::compression (CompressionStream / DecompressionStream): deflate, the
 # zlib format and the gzip framing's CRC-32, on the pure-Rust backend. Already
 # in the tree (image -> png depends on it).
-flate2 = "=1.1.9"
+flate2 = "=1.1.10"
 bytes = "=1.12.1"
 futures-core = "=0.3.34"
 # Jitter for the fetch 429 backoff. Already in the tree (tokio and others
@@ -139,12 +139,12 @@ rustix = { version = "=1.1.5", features = ["termios", "process", "time"] }
 # glibc's allocator settings (forge::process::return_large_allocations).
 # Already in the tree (alloy, flux).
 [target.'cfg(all(target_os = "linux", target_env = "gnu"))'.dependencies]
-libc = "=0.2.189"
+libc = "=0.2.190"
 
 [build-dependencies]
 # Locates the target C compiler (respecting cargo-ndk's CC_<target>) so the
 # Android build can link clang_rt.builtins; see build.rs.
-cc = "=1.5.1"
+cc = "=1.6.0"
 # Drives the vendored libopus's CMake project (build.rs); already in the tree
 # (sdl3-sys builds SDL with it).
 cmake = "=0.1.58"