diff --git a/Cargo.lock b/Cargo.lock
index 954d474e..61cd2592 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -333,9 +333,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.13.0"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 dependencies = [
  "serde_core",
 ]
@@ -480,9 +480,9 @@ checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
 
 [[package]]
 name = "cfg_aliases"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
@@ -583,18 +583,18 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.1"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+checksum = "dd059f9da4f5c36b3787f65d38ccaab1cc315f07b01f89abc8359ee6a8205011"
 dependencies = [
  "clap_builder",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.6.0"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
 dependencies = [
  "anstyle",
  "clap_lex",
@@ -2275,7 +2275,7 @@ version = "0.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "153be1941a183ec9ccd095ddbe17a8b8d435ef6c76e9e02451b933c3999af2c8"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "inotify-sys",
  "libc",
 ]
@@ -2473,7 +2473,7 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "07293a4e297ac234359b510362495713f75ea345d5307140414f20c69ffeb087"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "libc",
 ]
 
@@ -2695,7 +2695,7 @@ checksum = "e09a917eb1f7643d9d9a06b2f131e2ceb39df6910a7b830dac18bfd6db37a1f5"
 dependencies = [
  "as_variant",
  "async-trait",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "decancer",
  "eyeball",
  "eyeball-im",
@@ -2987,7 +2987,7 @@ version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cfg-if",
  "cfg_aliases 0.1.1",
  "libc",
@@ -2999,9 +2999,9 @@ version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cfg-if",
- "cfg_aliases 0.2.1",
+ "cfg_aliases 0.2.2",
  "libc",
 ]
 
@@ -3011,7 +3011,7 @@ version = "8.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4d3d07927151ff8575b7087f245456e549fea62edf0ec4e565a5ee50c8402bc3"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "fsevent-sys",
  "inotify",
  "kqueue",
@@ -3029,7 +3029,7 @@ version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42b8cfee0e339a0337359f3c88165702ac6e600dc01c0cc9579a92d62b08477a"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -3483,7 +3483,7 @@ version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "memchr",
  "pulldown-cmark-escape",
  "unicase",
@@ -3502,7 +3502,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
 dependencies = [
  "bytes",
- "cfg_aliases 0.2.1",
+ "cfg_aliases 0.2.2",
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
@@ -3544,7 +3544,7 @@ version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
 dependencies = [
- "cfg_aliases 0.2.1",
+ "cfg_aliases 0.2.2",
  "libc",
  "once_cell",
  "socket2",
@@ -3717,7 +3717,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -3742,9 +3742,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a0e75113e14dc5acb068cd0786884f214f1312650a3d36d269f5c4f3cdee8a2"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -3754,9 +3754,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.15"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f388202e4b80542a0921078cc23b6333bcf1409c1e3f86404cae4766a6131db"
+checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -4014,7 +4014,7 @@ version = "0.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "165ca6e57b20e1351573e3729b958bc62f0e48025386970b6e4d29e7a7e71f3f"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "fallible-iterator",
  "fallible-streaming-iterator",
  "hashlink 0.10.0",
@@ -4043,7 +4043,7 @@ version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -4203,7 +4203,7 @@ version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "core-foundation 0.10.1",
  "core-foundation-sys",
  "libc",
@@ -4658,7 +4658,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "90b8020fe17c5f2c245bfa2505d7ef59c5604839527c740266ad2214acebea27"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "byteorder",
  "bytes",
  "crc",
@@ -4686,7 +4686,7 @@ checksum = "87a2bdd6e83f6b3ea525ca9fee568030508b58355a43d0b2c1674d5f79dcd65e"
 dependencies = [
  "atoi",
  "base64",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "byteorder",
  "crc",
  "dotenvy",
@@ -4855,7 +4855,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "core-foundation 0.9.4",
  "system-configuration-sys",
 ]
@@ -5008,9 +5008,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.52.3"
+version = "1.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+checksum = "317fafbbe3f02fc663dad00ea6186197de963cd4190e86a26d8d0fae095539af"
 dependencies = [
  "bytes",
  "libc",
@@ -5171,7 +5171,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
  "async-compression",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "bytes",
  "futures-core",
  "futures-util",
@@ -5410,9 +5410,9 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "uuid"
-version = "1.23.5"
+version = "1.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea5fab0d6c3c01ae70085a09cb03d4c7a1d6314e2b3e075392783396d724ca0a"
+checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
diff --git a/Cargo.toml b/Cargo.toml
index 1f860ad7..0d75b2c2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -9,41 +9,40 @@ members = [
 resolver = "3"
 
 [workspace.dependencies]
-async-stream = "0.3"
+async-stream = "0.3.6"
 async-trait = "0.1.89"
-bytes = "1"
-chrono = { version = "0.4.44", features = ["serde"] }
-chrono-tz = "0.10"
+bytes = "1.12.1"
+chrono = { version = "0.4.45", features = ["serde"] }
+chrono-tz = "0.10.4"
 eventsource-stream = "0.2.3"
-futures = "0.3"
+futures = "0.3.32"
 homedir = "0.3.6"
-ignore = "0.4.25"
-mime_guess = "2"
+ignore = "0.4.29"
+mime_guess = "2.0.5"
 notify = "8.2.0"
-poem = { version = "3", features = ["websocket", "test"] }
+poem = { version = "3.1.12", features = ["websocket", "test"] }
 portable-pty = "0.9.0"
-reqwest = { version = "0.13.3", features = ["json", "stream"] }
-rust-embed = "8"
-ed25519-dalek = { version = "3", default-features = false, features = ["rand_core"] }
+reqwest = { version = "0.13.4", features = ["json", "stream"] }
+rust-embed = "8.12.0"
+ed25519-dalek = { version = "3.0.0", default-features = false, features = ["rand_core"] }
 indexmap = { version = "2.14.0", features = ["serde"] }
-rand = "0.10"
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
-serde_urlencoded = "0.7"
-sha1 = "0.11"
+rand = "0.10.2"
+serde = { version = "1.0.228", features = ["derive"] }
+serde_json = "1.0.150"
+serde_urlencoded = "0.7.1"
+sha1 = "0.11.0"
 sha2 = "0.11.0"
-hmac = "0.13"
-subtle = "2"
-base64 = "0.22"
-serde_yaml = "0.9"
-strip-ansi-escapes = "0.2"
-tempfile = "3"
-tokio = { version = "1", features = ["rt-multi-thread", "macros", "sync"] }
-toml = "1.1.2"
-uuid = { version = "1.23.1", features = ["v4", "serde"] }
+hmac = "0.13.0"
+subtle = "2.6.1"
+base64 = "0.22.1"
+strip-ansi-escapes = "0.2.1"
+tempfile = "3.27.0"
+tokio = { version = "1.52.4", features = ["rt-multi-thread", "macros", "sync"] }
+toml = "1.1.3"
+uuid = { version = "1.24.0", features = ["v4", "serde"] }
 tokio-tungstenite = { version = "0.30.0", features = ["connect", "rustls-tls-native-roots"] }
 walkdir = "2.5.0"
-filetime = "0.2"
+filetime = "0.2.29"
 # 0.18 is current as of this pin (verified via `cargo search matrix-sdk`).
 # matrix-sdk-sqlite 0.18 pulls in rusqlite 0.37, which requires libsqlite3-sys
 # ==0.35.x — see the pin rationale in server/Cargo.toml. Bumping matrix-sdk
@@ -52,14 +51,14 @@ matrix-sdk = { version = "0.18", default-features = false, features = [
     "sqlite",
     "e2e-encryption",
 ] }
-pulldown-cmark = { version = "0.13.3", default-features = false, features = [
+pulldown-cmark = { version = "0.13.4", default-features = false, features = [
     "html",
 ] }
-regex = "1"
-libc = "0.2"
-nutype = { version = "0.7", features = ["serde"] }
+regex = "1.13.1"
+libc = "0.2.186"
+nutype = { version = "0.7.0", features = ["serde"] }
 garde = { version = "0.23", features = ["derive"] }
-ammonia = "4.1"
+ammonia = "4.1.3"
 sqlx = { version = "0.9.0", default-features = false, features = [
     "runtime-tokio",
     "sqlite",
diff --git a/crates/bft-json-crdt/Cargo.toml b/crates/bft-json-crdt/Cargo.toml
index c74aa39d..f6da075d 100644
--- a/crates/bft-json-crdt/Cargo.toml
+++ b/crates/bft-json-crdt/Cargo.toml
@@ -21,18 +21,18 @@ bft = []
 
 [dependencies]
 bft-crdt-derive = { path = "bft-crdt-derive" }
-colored = "3"
+colored = "3.1.1"
 ed25519-dalek = { workspace = true }
 indexmap = { workspace = true, features = ["serde"] }
 rand = { workspace = true }
-random_color = "1"
+random_color = "1.1.0"
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true, features = ["preserve_order"] }
-serde_with = "3"
+serde_with = "3.21.0"
 sha2 = { workspace = true }
 
 [dev-dependencies]
-criterion = { version = "0.8", features = ["html_reports"] }
+criterion = { version = "0.8.2", features = ["html_reports"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true, features = ["preserve_order"] }
 
diff --git a/crates/bft-json-crdt/bft-crdt-derive/Cargo.toml b/crates/bft-json-crdt/bft-crdt-derive/Cargo.toml
index 742645a5..00d5b531 100644
--- a/crates/bft-json-crdt/bft-crdt-derive/Cargo.toml
+++ b/crates/bft-json-crdt/bft-crdt-derive/Cargo.toml
@@ -8,8 +8,8 @@ publish = false
 proc-macro = true
 
 [dependencies]
-indexmap = { version = "2.2.6", features = ["serde"] }
-proc-macro2 = "1.0.47"
-proc-macro-crate = "3"
-quote = "1.0.21"
-syn = { version = "2", features = ["full"] }
+indexmap = { version = "2.14.0", features = ["serde"] }
+proc-macro2 = "1.0.106"
+proc-macro-crate = "3.5.0"
+quote = "1.0.46"
+syn = { version = "2.0.119", features = ["full"] }
diff --git a/server/Cargo.toml b/server/Cargo.toml
index 1a7ce420..bc150ca3 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -64,5 +64,5 @@ check-cfg = ["cfg(feature, values(\"logging-base\"))"]
 
 [dev-dependencies]
 tempfile = { workspace = true }
-mockito = "1"
+mockito = "1.7.2"
 filetime = { workspace = true }