diff --git a/Cargo.lock b/Cargo.lock
index 009dba24..d4493323 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -153,9 +153,6 @@ name = "arbitrary"
 version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
-dependencies = [
- "derive_arbitrary",
-]
 
 [[package]]
 name = "arg_enum_proc_macro"
@@ -338,9 +335,9 @@ dependencies = [
 
 [[package]]
 name = "atoi_simd"
-version = "0.16.1"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2a49e05797ca52e312a0c658938b7d00693ef037799ef7187678f212d7684cf"
+checksum = "8ad17c7c205c2c28b527b9845eeb91cf1b4d008b438f98ce0e628227a822758e"
 dependencies = [
  "debug_unsafe",
 ]
@@ -1394,9 +1391,9 @@ dependencies = [
 
 [[package]]
 name = "calamine"
-version = "0.32.0"
+version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41bdeb83af82cd9cb686a19ed7efc2f50a21c262610f51ce945a8528860725ce"
+checksum = "8822fe6253ca47aa5ad9a3be09f6fe7cd20c6a74e41b0aa42e8f4e3d523508df"
 dependencies = [
  "atoi_simd",
  "byteorder",
@@ -1404,7 +1401,7 @@ dependencies = [
  "encoding_rs",
  "fast-float2",
  "log",
- "quick-xml 0.38.4",
+ "quick-xml 0.39.4",
  "serde",
  "zip",
 ]
@@ -1418,7 +1415,7 @@ dependencies = [
  "find-msvc-tools",
  "jobserver",
  "libc",
- "shlex",
+ "shlex 1.3.0",
 ]
 
 [[package]]
@@ -2015,7 +2012,7 @@ dependencies = [
  "nonempty",
  "rand 0.9.4",
  "regex",
- "shlex",
+ "shlex 1.3.0",
  "ssh2",
  "tempfile",
  "tes",
@@ -2025,7 +2022,7 @@ dependencies = [
  "tokio-util",
  "tracing",
  "url",
- "whoami",
+ "whoami 1.6.1",
 ]
 
 [[package]]
@@ -2231,7 +2228,7 @@ dependencies = [
  "miette",
  "regex",
  "serde",
- "serde-saphyr 0.0.27",
+ "serde-saphyr",
  "serde_json",
  "sha1 0.11.0",
  "thiserror 2.0.18",
@@ -2265,7 +2262,7 @@ dependencies = [
  "rdf",
  "semver 1.0.28",
  "serde",
- "serde-saphyr 0.0.27",
+ "serde-saphyr",
  "serde_json",
  "sha1 0.11.0",
  "sysinfo",
@@ -2309,7 +2306,7 @@ checksum = "a4caa74c460004ab32fe624b55191764a469fa12dbdaa0d2b6827d1dd2933d97"
 dependencies = [
  "cwl_salad_derive",
  "serde",
- "serde-saphyr 0.0.27",
+ "serde-saphyr",
  "serde_json",
 ]
 
@@ -2474,17 +2471,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "derive_arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "derive_more"
 version = "0.99.20"
@@ -4277,16 +4263,6 @@ dependencies = [
  "system-deps",
 ]
 
-[[package]]
-name = "granit-parser"
-version = "0.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7e736dfe3881c53a7dce0685eb18202d0d9fe6911782f9870946eb9ee89d778"
-dependencies = [
- "arraydeque",
- "smallvec",
-]
-
 [[package]]
 name = "granit-parser"
 version = "0.0.3"
@@ -4660,7 +4636,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_regex",
- "similar",
+ "similar 2.7.0",
  "stringmetrics",
  "tabwriter",
  "thiserror 2.0.18",
@@ -5791,7 +5767,7 @@ dependencies = [
  "regex",
  "serde_json",
  "serde_urlencoded",
- "similar",
+ "similar 2.7.0",
  "tokio",
 ]
 
@@ -6160,6 +6136,15 @@ dependencies = [
  "objc2-foundation",
 ]
 
+[[package]]
+name = "objc2-system-configuration"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7216bd11cbda54ccabcab84d523dc93b858ec75ecfb3a7d89513fa22464da396"
+dependencies = [
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "objc2-ui-kit"
 version = "0.3.2"
@@ -7088,22 +7073,13 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "quick-xml"
-version = "0.38.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b66c2058c55a409d601666cffe35f04333cf1013010882cec174a7467cd4e21c"
-dependencies = [
- "encoding_rs",
- "memchr",
-]
-
 [[package]]
 name = "quick-xml"
 version = "0.39.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cdcc8dd4e2f670d309a5f0e83fe36dfdc05af317008fea29144da1a2ac858e5e"
 dependencies = [
+ "encoding_rs",
  "memchr",
 ]
 
@@ -7418,7 +7394,7 @@ dependencies = [
  "serde_yaml",
  "tempfile",
  "tokio",
- "toml_edit 0.23.10+spec-1.0.0",
+ "toml_edit 0.25.12+spec-1.1.0",
  "util",
  "uuid",
 ]
@@ -7550,7 +7526,7 @@ dependencies = [
  "serde_yaml",
  "tempfile",
  "tokio",
- "toml 0.9.12+spec-1.1.0",
+ "toml 1.1.2+spec-1.1.0",
  "util",
  "uuid",
 ]
@@ -7955,11 +7931,11 @@ dependencies = [
  "repository",
  "reqwest 0.13.4",
  "s4n_core",
- "serde-saphyr 0.0.26",
+ "serde-saphyr",
  "serde_json",
  "serial_test",
- "shlex",
- "similar",
+ "shlex 2.0.1",
+ "similar 3.1.1",
  "syntect",
  "tempfile",
  "test_utils",
@@ -7981,18 +7957,18 @@ dependencies = [
  "rstest",
  "semver 1.0.28",
  "serde",
- "serde-saphyr 0.0.26",
+ "serde-saphyr",
  "serde_json",
  "serial_test",
- "shlex",
+ "shlex 2.0.1",
  "slugify",
  "smart-default",
  "tempfile",
  "test_utils",
  "tokio",
  "tokio-util",
- "toml 0.9.12+spec-1.1.0",
- "toml_edit 0.23.10+spec-1.0.0",
+ "toml 1.1.2+spec-1.1.0",
+ "toml_edit 0.25.12+spec-1.1.0",
  "util",
 ]
 
@@ -8075,11 +8051,11 @@ dependencies = [
  "serde_json",
  "serde_yaml",
  "serial_test",
- "shlex",
+ "shlex 2.0.1",
  "tempfile",
  "tokio",
  "tokio-util",
- "toml 0.9.12+spec-1.1.0",
+ "toml 1.1.2+spec-1.1.0",
 ]
 
 [[package]]
@@ -8222,25 +8198,6 @@ dependencies = [
  "serde_derive",
 ]
 
-[[package]]
-name = "serde-saphyr"
-version = "0.0.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcc7fe48e34d02a97bc8e6253b8b91e5a47fe2c47eaacb5149cefbb69922eaf0"
-dependencies = [
- "ahash",
- "annotate-snippets",
- "base64",
- "encoding_rs_io",
- "getrandom 0.3.4",
- "granit-parser 0.0.2",
- "nohash-hasher",
- "num-traits",
- "serde",
- "smallvec",
- "zmij",
-]
-
 [[package]]
 name = "serde-saphyr"
 version = "0.0.27"
@@ -8252,7 +8209,7 @@ dependencies = [
  "base64",
  "encoding_rs_io",
  "getrandom 0.3.4",
- "granit-parser 0.0.3",
+ "granit-parser",
  "miette",
  "nohash-hasher",
  "num-traits",
@@ -8532,6 +8489,12 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
 [[package]]
 name = "signal-hook"
 version = "0.3.18"
@@ -8599,6 +8562,15 @@ version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbbb5d9659141646ae647b42fe094daf6c6192d1620870b449d9557f748b2daa"
 
+[[package]]
+name = "similar"
+version = "3.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6505efef05804732ed8a3f2d4f279429eb485bd69d5b0cc6b19cc02005cda16"
+dependencies = [
+ "bstr",
+]
+
 [[package]]
 name = "siphasher"
 version = "0.3.11"
@@ -9142,7 +9114,7 @@ dependencies = [
  "git2 0.21.0",
  "serde_json",
  "tempfile",
- "whoami",
+ "whoami 2.1.2",
 ]
 
 [[package]]
@@ -9403,31 +9375,18 @@ dependencies = [
  "toml_edit 0.20.2",
 ]
 
-[[package]]
-name = "toml"
-version = "0.9.12+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
-dependencies = [
- "indexmap 2.14.0",
- "serde_core",
- "serde_spanned 1.1.1",
- "toml_datetime 0.7.5+spec-1.1.0",
- "toml_parser",
- "toml_writer",
- "winnow 0.7.15",
-]
-
 [[package]]
 name = "toml"
 version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "81f3d15e84cbcd896376e6730314d59fb5a87f31e4b038454184435cd57defee"
 dependencies = [
+ "indexmap 2.14.0",
  "serde_core",
  "serde_spanned 1.1.1",
  "toml_datetime 1.1.1+spec-1.1.0",
  "toml_parser",
+ "toml_writer",
  "winnow 1.0.3",
 ]
 
@@ -9440,15 +9399,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "toml_datetime"
-version = "0.7.5+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
-dependencies = [
- "serde_core",
-]
-
 [[package]]
 name = "toml_datetime"
 version = "1.1.1+spec-1.1.0"
@@ -9482,21 +9432,6 @@ dependencies = [
  "winnow 0.5.40",
 ]
 
-[[package]]
-name = "toml_edit"
-version = "0.23.10+spec-1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84c8b9f757e028cee9fa244aea147aab2a9ec09d5325a9b01e0a49730c2b5269"
-dependencies = [
- "indexmap 2.14.0",
- "serde_core",
- "serde_spanned 1.1.1",
- "toml_datetime 0.7.5+spec-1.1.0",
- "toml_parser",
- "toml_writer",
- "winnow 0.7.15",
-]
-
 [[package]]
 name = "toml_edit"
 version = "0.25.12+spec-1.1.0"
@@ -9504,8 +9439,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2153edc6955a6c354fad8f5efd38b6a8769bdccf9fe50f8e1329f81b0baa5d7"
 dependencies = [
  "indexmap 2.14.0",
+ "serde_core",
+ "serde_spanned 1.1.1",
  "toml_datetime 1.1.1+spec-1.1.0",
  "toml_parser",
+ "toml_writer",
  "winnow 1.0.3",
 ]
 
@@ -9690,6 +9628,12 @@ dependencies = [
  "utf-8",
 ]
 
+[[package]]
+name = "typed-path"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+
 [[package]]
 name = "typenum"
 version = "1.20.0"
@@ -9978,6 +9922,15 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
+[[package]]
+name = "wasi"
+version = "0.14.7+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "883478de20367e224c0090af9cf5f9fa85bed63a95c1abf3afc5c083ebc06e8c"
+dependencies = [
+ "wasip2",
+]
+
 [[package]]
 name = "wasip2"
 version = "1.0.3+wasi-0.2.9"
@@ -10002,6 +9955,15 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
 
+[[package]]
+name = "wasite"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66fe902b4a6b8028a753d5424909b764ccf79b7a209eac9bf97e59cda9f71a42"
+dependencies = [
+ "wasi 0.14.7+wasi-0.2.4",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.122"
@@ -10320,7 +10282,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
 dependencies = [
  "libredox",
- "wasite",
+ "wasite 0.1.0",
+ "web-sys",
+]
+
+[[package]]
+name = "whoami"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "998767ef88740d1f5b0682a9c53c24431453923962269c2db68ee43788c5a40d"
+dependencies = [
+ "libc",
+ "libredox",
+ "objc2-system-configuration",
+ "wasite 1.0.2",
  "web-sys",
 ]
 
@@ -11233,15 +11208,15 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "4.6.1"
+version = "7.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caa8cd6af31c3b31c6631b8f483848b91589021b28fffe50adada48d4f4d2ed1"
+checksum = "c42e33efc22a0650c311c2ef19115ce232583abbe80850bc8b66509ebef02de0"
 dependencies = [
- "arbitrary",
  "crc32fast",
  "flate2",
  "indexmap 2.14.0",
  "memchr",
+ "typed-path",
  "zopfli",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index c047c2cc..26bf32b2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -41,9 +41,9 @@ log = "0.4.29"
 pathdiff = "0.2.3"
 serde = { version = "1.0.219", features = ["derive"] }
 serde_json = "1.0.149"
-serde-saphyr = "0.0.26"
+serde-saphyr = "0.0.27"
 serde_yaml = "0.9.34-deprecated"
-shlex = "1.3.0"
+shlex = "2.0.1"
 rand = "0.10.1"
 reqwest = { version = "0.13.3", features = [
     "json",
@@ -51,8 +51,8 @@ reqwest = { version = "0.13.3", features = [
     "cookies",
     "http2",
 ], default-features = false }
-toml = "0.9.8"
-toml_edit = { version = "0.23.9", features = ["serde"] }
+toml = "1.1.2"
+toml_edit = { version = "0.25.12", features = ["serde"] }
 tempfile = "3.26.0"
 tokio = { version = "1.51.1", features = ["macros", "rt"] }
 tokio-util = "0.7.18"
diff --git a/packages/cli/Cargo.toml b/packages/cli/Cargo.toml
index 0d0f7e41..8b7a46e9 100644
--- a/packages/cli/Cargo.toml
+++ b/packages/cli/Cargo.toml
@@ -41,7 +41,7 @@ syntect = { version = "5.2.0", default-features = false, features = [
     "default-themes",
     "default-syntaxes",
 ] }
-similar = "2.7.0"
+similar = "3.1.1"
 
 [dev-dependencies]
 shlex = { workspace = true }
diff --git a/packages/core/Cargo.toml b/packages/core/Cargo.toml
index 8b578dac..43e3cf57 100644
--- a/packages/core/Cargo.toml
+++ b/packages/core/Cargo.toml
@@ -22,14 +22,14 @@ toml.workspace = true
 toml_edit.workspace = true
 
 semver = { version = "1.0.26", features = ["serde"] }
-shlex = "1.3.0"
+shlex = "2.0.1"
 slugify = "0.1.0"
 smart-default = "0.7.1"
 tokio.workspace = true
 tokio-util.workspace = true
 
 [dev-dependencies]
-calamine = "0.32.0"
+calamine = "0.35.0"
 
 test_utils = { workspace = true }
 rstest = { workspace = true }
diff --git a/packages/test_utils/Cargo.toml b/packages/test_utils/Cargo.toml
index 8a2b28ee..698b7174 100644
--- a/packages/test_utils/Cargo.toml
+++ b/packages/test_utils/Cargo.toml
@@ -15,4 +15,4 @@ git2 = { workspace = true }
 serde_json = { workspace = true }
 tempfile = { workspace = true }
 copy_dir = "0.1.3"
-whoami = "1.6.1"
+whoami = "2.1.2"