diff --git a/eoc/eoc-rs/Cargo.lock b/eoc/eoc-rs/Cargo.lock
index 123156ba3..2d9ee802b 100644
--- a/eoc/eoc-rs/Cargo.lock
+++ b/eoc/eoc-rs/Cargo.lock
@@ -339,9 +339,9 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures",
diff --git a/joule-code/joule-code-rs/Cargo.lock b/joule-code/joule-code-rs/Cargo.lock
index 0d9139c18..9f3a11d43 100644
--- a/joule-code/joule-code-rs/Cargo.lock
+++ b/joule-code/joule-code-rs/Cargo.lock
@@ -73,7 +73,7 @@ dependencies = [
  "nom 7.1.3",
  "num-traits",
  "rusticata-macros",
- "thiserror 2.0.20",
+ "thiserror",
  "time",
 ]
 
@@ -325,9 +325,9 @@ dependencies = [
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
@@ -431,7 +431,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
 dependencies = [
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -621,9 +621,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
+checksum = "12218662ccac37d9714f2191252553d67585b97df8c839cbe49e0bde278dc865"
 dependencies = [
  "cmov",
 ]
@@ -926,7 +926,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1013,7 +1013,7 @@ dependencies = [
  "rand_core 0.6.4",
  "serde",
  "serdect",
- "thiserror 2.0.20",
+ "thiserror",
  "visibility",
  "zeroize",
 ]
@@ -1335,45 +1335,23 @@ dependencies = [
  "digest 0.11.3",
 ]
 
-[[package]]
-name = "hpke-rs"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e11bd4ee27b79fa1820e72ef8489cc729c87299ec3f7f52b8fc8dcb87cb2d485"
-dependencies = [
- "hpke-rs-crypto 0.2.0",
- "log",
- "serde",
- "tls_codec 0.4.2",
- "zeroize",
-]
-
 [[package]]
 name = "hpke-rs"
 version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "812de62ab573b876c6c40d7553bae9402ae3bad95b64af06f964388eecb9b7b1"
 dependencies = [
- "hpke-rs-crypto 0.7.0",
+ "hpke-rs-crypto",
  "hpke-rs-libcrux",
- "hpke-rs-rust-crypto 0.7.0",
+ "hpke-rs-rust-crypto",
  "libcrux-sha3",
  "log",
  "serde",
  "subtle",
- "tls_codec 0.5.0",
+ "tls_codec",
  "zeroize",
 ]
 
-[[package]]
-name = "hpke-rs-crypto"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c3f1ae0a26c18d6469a70db1217136056261c4a244b09a755bc60bd4e055b67"
-dependencies = [
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "hpke-rs-crypto"
 version = "0.7.0"
@@ -1390,7 +1368,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c1ace95ef11fbbd84527eada5fc1304f66720fc4c008db30d888d62d3c52613"
 dependencies = [
- "hpke-rs-crypto 0.7.0",
+ "hpke-rs-crypto",
  "libcrux-aead",
  "libcrux-ecdh",
  "libcrux-hkdf",
@@ -1402,24 +1380,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "hpke-rs-rust-crypto"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a08d4500baf0aced746723d3515d08212bdb9d941df6d1aca3d46d1619b2a1cf"
-dependencies = [
- "aes-gcm",
- "chacha20poly1305",
- "hkdf 0.12.4",
- "hpke-rs-crypto 0.2.0",
- "p256",
- "p384",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
- "sha2 0.10.9",
- "x25519-dalek 2.0.1",
-]
-
 [[package]]
 name = "hpke-rs-rust-crypto"
 version = "0.7.0"
@@ -1429,7 +1389,7 @@ dependencies = [
  "aes-gcm",
  "chacha20poly1305",
  "hkdf 0.13.0",
- "hpke-rs-crypto 0.7.0",
+ "hpke-rs-crypto",
  "k256",
  "ml-kem",
  "p256",
@@ -1731,7 +1691,7 @@ dependencies = [
  "ed25519-dalek",
  "jcp-schema",
  "serde",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -1744,7 +1704,7 @@ dependencies = [
  "jcp-schema",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -1766,7 +1726,7 @@ dependencies = [
  "hex",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -1781,7 +1741,7 @@ dependencies = [
  "jni-sys",
  "log",
  "simd_cesu8",
- "thiserror 2.0.20",
+ "thiserror",
  "walkdir",
  "windows-link",
 ]
@@ -1835,7 +1795,7 @@ dependencies = [
  "ed25519-dalek",
  "joule-code-schema",
  "serde",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -1855,11 +1815,11 @@ dependencies = [
  "frost-ed25519",
  "joule-code-cargo",
  "joule-code-schema",
- "openmls 0.6.0",
+ "openmls",
  "openmls_basic_credential",
- "openmls_rust_crypto 0.3.0",
+ "openmls_rust_crypto",
  "rand 0.8.8",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -1916,7 +1876,7 @@ dependencies = [
  "joule-code-schema",
  "joulecontract-receipt",
  "joulecontract-schema",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -1928,7 +1888,7 @@ dependencies = [
  "joule-code-schema",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -1947,7 +1907,7 @@ dependencies = [
  "proof-schema",
  "proof-solvers",
  "serde",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -1970,7 +1930,7 @@ dependencies = [
  "sandbox-schema",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -1981,7 +1941,7 @@ dependencies = [
  "joule-code-cargo",
  "joule-code-schema",
  "serde",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -1996,7 +1956,7 @@ dependencies = [
  "joule-code-spec",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -2007,7 +1967,7 @@ dependencies = [
  "blake3",
  "ciborium",
  "serde",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -2018,7 +1978,7 @@ dependencies = [
  "joule-code-cargo",
  "joule-code-schema",
  "serde",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -2044,7 +2004,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2 0.10.9",
- "thiserror 2.0.20",
+ "thiserror",
  "tokio",
  "tracing",
  "uuid",
@@ -2072,7 +2032,7 @@ dependencies = [
  "serde_json",
  "sha2 0.10.9",
  "str0m",
- "thiserror 2.0.20",
+ "thiserror",
  "tokio",
  "toml",
  "tracing",
@@ -2109,13 +2069,13 @@ dependencies = [
  "getrandom 0.2.17",
  "hex",
  "joule-moq",
- "openmls 0.9.1",
- "openmls_rust_crypto 0.6.0",
- "openmls_traits 0.6.0",
+ "openmls",
+ "openmls_rust_crypto",
+ "openmls_traits",
  "serde",
  "serde_json",
  "sha2 0.10.9",
- "tls_codec 0.5.0",
+ "tls_codec",
 ]
 
 [[package]]
@@ -2136,7 +2096,7 @@ dependencies = [
  "rustls",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror",
  "tokio",
  "tokio-tungstenite",
  "toml",
@@ -2163,7 +2123,7 @@ version = "0.6.0"
 dependencies = [
  "joulecontract-schema",
  "serde",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -2174,7 +2134,7 @@ dependencies = [
  "proof-cascade",
  "proof-schema",
  "serde",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -2186,7 +2146,7 @@ dependencies = [
  "joulecontract-seal",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -2197,7 +2157,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2 0.10.9",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -2209,7 +2169,7 @@ dependencies = [
  "rand 0.8.8",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -2223,7 +2183,7 @@ dependencies = [
  "joulecontract-schema",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -2249,7 +2209,7 @@ dependencies = [
  "quinn",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror",
  "tokio",
  "tokio-util",
  "tracing",
@@ -2356,7 +2316,7 @@ dependencies = [
  "libcrux-curve25519",
  "libcrux-p256",
  "rand 0.10.2",
- "tls_codec 0.5.0",
+ "tls_codec",
 ]
 
 [[package]]
@@ -2439,7 +2399,7 @@ dependencies = [
  "libcrux-sha3",
  "libcrux-traits",
  "rand 0.10.2",
- "tls_codec 0.5.0",
+ "tls_codec",
 ]
 
 [[package]]
@@ -2743,20 +2703,6 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
-[[package]]
-name = "openmls"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f1295188c6665fb9e96466180ac0a919ef52b5861cf7e86523823661348a597"
-dependencies = [
- "log",
- "openmls_traits 0.3.0",
- "rayon",
- "serde",
- "thiserror 1.0.69",
- "tls_codec 0.4.2",
-]
-
 [[package]]
 name = "openmls"
 version = "0.9.1"
@@ -2766,41 +2712,31 @@ dependencies = [
  "getrandom 0.4.3",
  "log",
  "openmls_serialization_helpers",
- "openmls_traits 0.6.0",
+ "openmls_traits",
  "rayon",
  "serde",
  "serde_bytes",
- "thiserror 2.0.20",
- "tls_codec 0.5.0",
+ "thiserror",
+ "tls_codec",
  "web-time",
  "zeroize",
 ]
 
 [[package]]
 name = "openmls_basic_credential"
-version = "0.3.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "465874276a4e2a3e391b25a464059a224c70c5c77ca1e3f595032bb310ab8984"
+checksum = "dbd3f0c3422e7c7a8496f042b547b0c28d0793f8ba97feb401966e58196a1e40"
 dependencies = [
  "ed25519-dalek",
- "openmls_traits 0.3.0",
+ "ml-dsa",
+ "openmls_traits",
  "p256",
- "rand 0.8.8",
+ "p384",
+ "rand_core 0.6.4",
  "serde",
- "tls_codec 0.4.2",
-]
-
-[[package]]
-name = "openmls_memory_storage"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea9cc9eb04ed97262fa96382d7dbf0adfebd5ecde7dbafc7070f9231dd9cf08b"
-dependencies = [
- "log",
- "openmls_traits 0.3.0",
- "serde",
- "serde_json",
- "thiserror 1.0.69",
+ "tls_codec",
+ "zeroize",
 ]
 
 [[package]]
@@ -2810,35 +2746,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce927945a16eaa19302ed5ccef052f01ba68f2ba7ae67e4ac4ff2fc661445364"
 dependencies = [
  "log",
- "openmls_traits 0.6.0",
+ "openmls_traits",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
-]
-
-[[package]]
-name = "openmls_rust_crypto"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1038331eabb5e63f276c9f866c081167c3ec1448ece0bf2bd535d1ecb5083d39"
-dependencies = [
- "aes-gcm",
- "chacha20poly1305",
- "ed25519-dalek",
- "hkdf 0.12.4",
- "hmac 0.12.1",
- "hpke-rs 0.2.0",
- "hpke-rs-crypto 0.2.0",
- "hpke-rs-rust-crypto 0.2.0",
- "openmls_memory_storage 0.3.0",
- "openmls_traits 0.3.0",
- "p256",
- "rand 0.8.8",
- "rand_chacha 0.3.1",
- "serde",
- "sha2 0.10.9",
- "thiserror 1.0.69",
- "tls_codec 0.4.2",
+ "thiserror",
 ]
 
 [[package]]
@@ -2852,20 +2763,20 @@ dependencies = [
  "ed25519-dalek",
  "hkdf 0.13.0",
  "hmac 0.13.0",
- "hpke-rs 0.7.0",
- "hpke-rs-crypto 0.7.0",
- "hpke-rs-rust-crypto 0.7.0",
+ "hpke-rs",
+ "hpke-rs-crypto",
+ "hpke-rs-rust-crypto",
  "ml-dsa",
- "openmls_memory_storage 0.6.0",
- "openmls_traits 0.6.0",
+ "openmls_memory_storage",
+ "openmls_traits",
  "p256",
  "p384",
  "rand_chacha 0.3.1",
  "rand_core 0.10.1",
  "rand_core 0.6.4",
  "sha2 0.11.1",
- "thiserror 2.0.20",
- "tls_codec 0.5.0",
+ "thiserror",
+ "tls_codec",
 ]
 
 [[package]]
@@ -2877,17 +2788,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.119",
- "thiserror 2.0.20",
-]
-
-[[package]]
-name = "openmls_traits"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "443afa05406adc75fbfa0c3e04db93c5647b763861a474ae1aa8a99c362b80f8"
-dependencies = [
- "serde",
- "tls_codec 0.4.2",
+ "thiserror",
 ]
 
 [[package]]
@@ -2897,7 +2798,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac13edad8698eb1917cbc1dab99591fa1594d84320904fe3fc5121854f95831c"
 dependencies = [
  "serde",
- "tls_codec 0.5.0",
+ "tls_codec",
 ]
 
 [[package]]
@@ -3126,7 +3027,7 @@ dependencies = [
  "hex",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -3151,7 +3052,7 @@ dependencies = [
  "rustc-hash",
  "rustls",
  "socket2",
- "thiserror 2.0.20",
+ "thiserror",
  "tokio",
  "tracing",
  "web-time",
@@ -3175,7 +3076,7 @@ dependencies = [
  "rustls-pki-types",
  "rustls-platform-verifier",
  "slab",
- "thiserror 2.0.20",
+ "thiserror",
  "tinyvec",
  "tracing",
  "web-time",
@@ -3192,7 +3093,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3243,7 +3144,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "chacha20 0.10.1",
+ "chacha20 0.10.2",
  "getrandom 0.4.3",
  "rand_core 0.10.1",
 ]
@@ -3479,7 +3380,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3524,7 +3425,7 @@ dependencies = [
  "libloading",
  "sandbox-schema",
  "serde",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -3535,7 +3436,7 @@ dependencies = [
  "blake3",
  "ciborium",
  "serde",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -3565,7 +3466,7 @@ dependencies = [
  "rand 0.9.5",
  "rustc-hash",
  "slab",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -3983,33 +3884,13 @@ dependencies = [
  "syn 3.0.4",
 ]
 
-[[package]]
-name = "thiserror"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
-dependencies = [
- "thiserror-impl 1.0.69",
-]
-
 [[package]]
 name = "thiserror"
 version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
 dependencies = [
- "thiserror-impl 2.0.20",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
+ "thiserror-impl",
 ]
 
 [[package]]
@@ -4087,17 +3968,6 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
-[[package]]
-name = "tls_codec"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0de2e01245e2bb89d6f05801c564fa27624dbd7b1846859876c7dad82e90bf6b"
-dependencies = [
- "serde",
- "tls_codec_derive 0.4.2",
- "zeroize",
-]
-
 [[package]]
 name = "tls_codec"
 version = "0.5.0"
@@ -4106,21 +3976,10 @@ checksum = "18cc98286004cea38f717e2b03d990fc774fbfd38a82720de40e5c94365067c8"
 dependencies = [
  "serde",
  "serde_bytes",
- "tls_codec_derive 0.5.0",
+ "tls_codec_derive",
  "zeroize",
 ]
 
-[[package]]
-name = "tls_codec_derive"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d2e76690929402faae40aebdda620a2c0e25dd6d3b9afe48867dfd95991f4bd"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "tls_codec_derive"
 version = "0.5.0"
@@ -4301,7 +4160,7 @@ dependencies = [
  "log",
  "rand 0.9.5",
  "sha1",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
@@ -4503,7 +4362,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4684,7 +4543,7 @@ dependencies = [
  "rustls-pki-types",
  "sha2 0.11.1",
  "socket2",
- "thiserror 2.0.20",
+ "thiserror",
  "time",
  "tokio",
  "tracing",
@@ -4701,7 +4560,7 @@ checksum = "aad9059572c7dbd6901ccef37f3b7321678cd708dcf58a64b1921dbeab7bfede"
 dependencies = [
  "httlib-huffman",
  "octets",
- "thiserror 2.0.20",
+ "thiserror",
  "url",
 ]
 
@@ -4766,7 +4625,7 @@ dependencies = [
  "oid-registry",
  "ring",
  "rusticata-macros",
- "thiserror 2.0.20",
+ "thiserror",
  "time",
 ]
 
diff --git a/joule-code/joule-code-rs/crates/joule-code-collab/Cargo.toml b/joule-code/joule-code-rs/crates/joule-code-collab/Cargo.toml
index 4bb8f5cd4..410e4608b 100644
--- a/joule-code/joule-code-rs/crates/joule-code-collab/Cargo.toml
+++ b/joule-code/joule-code-rs/crates/joule-code-collab/Cargo.toml
@@ -18,6 +18,11 @@ ed25519-dalek.workspace = true
 rand = "0.8"
 # MLS group keying (RFC 9420) for the collaborating set — demonstrated in
 # tests/mls_keying.rs. Dev-dep so the library's runtime deps stay light.
-openmls = "0.6"
-openmls_rust_crypto = "0.3"
-openmls_basic_credential = "0.3"
+# Pinned to the same generation joule-moq-mls runs in production. They were
+# two generations apart, which put a second, older MLS stack in the test graph
+# and with it hpke-rs 0.2.0 — RUSTSEC-2026-0071 (nonce reuse in an HPKE
+# context) and -0069/-0070/-0072. Nothing shipped it, but there is no reason to
+# test RFC 9420 against an implementation production does not use.
+openmls = "=0.9.1"
+openmls_rust_crypto = "=0.6.0"
+openmls_basic_credential = "=0.6.0"
diff --git a/joule-code/joule-code-rs/crates/joule-code-collab/tests/mls_keying.rs b/joule-code/joule-code-rs/crates/joule-code-collab/tests/mls_keying.rs
index 50a9e0be5..079af8689 100644
--- a/joule-code/joule-code-rs/crates/joule-code-collab/tests/mls_keying.rs
+++ b/joule-code/joule-code-rs/crates/joule-code-collab/tests/mls_keying.rs
@@ -45,7 +45,9 @@ fn key_package(
 
 fn export(group: &MlsGroup, provider: &OpenMlsRustCrypto) -> Vec<u8> {
     group
-        .export_secret(provider, EXPORT_LABEL, &[], 32)
+        // openmls 0.9 takes the crypto backend here, not the whole provider —
+        // the same call joule-moq-mls makes in production.
+        .export_secret(provider.crypto(), EXPORT_LABEL, &[], 32)
         .expect("export secret")
 }
 
diff --git a/joule-code/joule-code-rs/crates/joule-moq-room/Cargo.lock b/joule-code/joule-code-rs/crates/joule-moq-room/Cargo.lock
index deb76194e..2cf03d627 100644
--- a/joule-code/joule-code-rs/crates/joule-moq-room/Cargo.lock
+++ b/joule-code/joule-code-rs/crates/joule-moq-room/Cargo.lock
@@ -283,9 +283,9 @@ dependencies = [
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
@@ -534,9 +534,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
+checksum = "12218662ccac37d9714f2191252553d67585b97df8c839cbe49e0bde278dc865"
 dependencies = [
  "cmov",
 ]
@@ -2407,7 +2407,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "chacha20 0.10.1",
+ "chacha20 0.10.2",
  "getrandom 0.4.3",
  "rand_core 0.10.1",
 ]
diff --git a/jouleclaw/jouleclaw-rs/Cargo.lock b/jouleclaw/jouleclaw-rs/Cargo.lock
index 61fcc3f78..ab72caa20 100644
--- a/jouleclaw/jouleclaw-rs/Cargo.lock
+++ b/jouleclaw/jouleclaw-rs/Cargo.lock
@@ -626,9 +626,9 @@ dependencies = [
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
@@ -6392,7 +6392,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "chacha20 0.10.1",
+ "chacha20 0.10.2",
  "getrandom 0.4.3",
  "rand_core 0.10.1",
 ]
diff --git a/jouleclaw/jouleclaw-rs/crates/jouleclaw-loader-gguf/src/openvino.rs b/jouleclaw/jouleclaw-rs/crates/jouleclaw-loader-gguf/src/openvino.rs
index 84e6f7b45..c2ee2bfad 100644
--- a/jouleclaw/jouleclaw-rs/crates/jouleclaw-loader-gguf/src/openvino.rs
+++ b/jouleclaw/jouleclaw-rs/crates/jouleclaw-loader-gguf/src/openvino.rs
@@ -43,6 +43,7 @@ use std::sync::Arc;
 
 use quick_xml::events::Event;
 use quick_xml::reader::Reader;
+use quick_xml::XmlVersion;
 
 // ─────────────────────────────────────────────────────────────────────
 // OpenVINO IR dtype enum
@@ -286,7 +287,7 @@ pub fn parse_openvino_xml(
                     b"net" => {
                         for attr in e.attributes().flatten() {
                             let key = attr.key.as_ref();
-                            let val = attr.unescape_value().unwrap_or_default().to_string();
+                            let val = attr.normalized_value(XmlVersion::Implicit1_0).unwrap_or_default().to_string();
                             match key {
                                 b"name" => net_name = val,
                                 b"version" => {
@@ -301,7 +302,7 @@ pub fn parse_openvino_xml(
                         let mut name = String::new();
                         let mut ty = String::new();
                         for attr in e.attributes().flatten() {
-                            let val = attr.unescape_value().unwrap_or_default().to_string();
+                            let val = attr.normalized_value(XmlVersion::Implicit1_0).unwrap_or_default().to_string();
                             match attr.key.as_ref() {
                                 b"id" => { id = val.parse().unwrap_or(0); }
                                 b"name" => { name = val; }
@@ -321,7 +322,7 @@ pub fn parse_openvino_xml(
                     }
                     b"data" if in_layer_const => {
                         for attr in e.attributes().flatten() {
-                            let val = attr.unescape_value().unwrap_or_default().to_string();
+                            let val = attr.normalized_value(XmlVersion::Implicit1_0).unwrap_or_default().to_string();
                             match attr.key.as_ref() {
                                 b"element_type" => {
                                     cur_dtype = OvDtype::parse(&val);
diff --git a/jouleclaw/jouleclaw-rs/crates/jouleclaw-transform-trx/src/lib.rs b/jouleclaw/jouleclaw-rs/crates/jouleclaw-transform-trx/src/lib.rs
index d25c776d3..cd636c8b2 100644
--- a/jouleclaw/jouleclaw-rs/crates/jouleclaw-transform-trx/src/lib.rs
+++ b/jouleclaw/jouleclaw-rs/crates/jouleclaw-transform-trx/src/lib.rs
@@ -174,6 +174,7 @@ fn xml_escape(s: &str) -> String {
 pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
     use quick_xml::events::Event;
     use quick_xml::Reader;
+    use quick_xml::XmlVersion;
 
     let mut reader = Reader::from_str(xml);
     // Deliberately no `trim_text(true)`: quick-xml reports an entity reference as
@@ -193,7 +194,6 @@ pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
     let mut cur_entity_properties: BTreeMap<String, serde_json::Value> = BTreeMap::new();
     // Per-field scratch.
     let mut cur_field_name: Option<String> = None;
-    let mut cur_field_value: Option<String> = None;
     // Per-UIMessage scratch.
     let mut cur_uimsg_kind: Option<UiMessageKind> = None;
 
@@ -204,11 +204,6 @@ pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
     // keeps `a &amp; b` from arriving as just `b`.
     let mut chars = String::new();
 
-    let mut in_value = false;
-    let mut in_weight = false;
-    let mut in_field = false;
-    let mut in_uimsg = false;
-
     let mut entity_counter: usize = 0;
 
     loop {
@@ -222,40 +217,36 @@ pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
                         for attr in e.attributes().with_checks(false).flatten() {
                             if attr.key.as_ref() == b"Type" {
                                 let v = attr
-                                    .unescape_value()
+                                    .normalized_value(XmlVersion::Implicit1_0)
                                     .map_err(|err| TrxError::Decode(format!("entity attr: {err}")))?;
                                 cur_entity_type = Some(v.into_owned());
                             }
                         }
                     }
                     "Value" => {
-                        in_value = true;
                         chars.clear();
                     }
                     "Weight" => {
-                        in_weight = true;
                         chars.clear();
                     }
                     "Field" => {
-                        in_field = true;
                         chars.clear();
                         for attr in e.attributes().with_checks(false).flatten() {
                             if attr.key.as_ref() == b"Name" {
                                 let v = attr
-                                    .unescape_value()
+                                    .normalized_value(XmlVersion::Implicit1_0)
                                     .map_err(|err| TrxError::Decode(format!("field attr: {err}")))?;
                                 cur_field_name = Some(v.into_owned());
                             }
                         }
                     }
                     "UIMessage" => {
-                        in_uimsg = true;
                         chars.clear();
                         let mut kind = UiMessageKind::Inform;
                         for attr in e.attributes().with_checks(false).flatten() {
                             if attr.key.as_ref() == b"Type" {
                                 let v = attr
-                                    .unescape_value()
+                                    .normalized_value(XmlVersion::Implicit1_0)
                                     .map_err(|err| TrxError::Decode(format!("uimsg attr: {err}")))?;
                                 kind = match v.as_ref() {
                                     "Inform" => UiMessageKind::Inform,
@@ -312,29 +303,23 @@ pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
                     .to_string();
                 match name.as_str() {
                     "Value" => {
-                        in_value = false;
                         cur_entity_value = Some(chars.trim().to_string());
                         chars.clear();
                     }
                     "Weight" => {
-                        in_weight = false;
                         cur_entity_weight = chars.trim().parse::<f64>().ok();
                         chars.clear();
                     }
                     "Field" => {
-                        cur_field_value = Some(chars.trim().to_string());
+                        let v = chars.trim().to_string();
                         chars.clear();
-                        if let (Some(n), Some(v)) =
-                            (cur_field_name.take(), cur_field_value.take())
-                        {
+                        if let Some(n) = cur_field_name.take() {
                             let val = serde_json::from_str::<serde_json::Value>(&v)
                                 .unwrap_or(serde_json::Value::String(v));
                             cur_entity_properties.insert(n, val);
                         }
-                        in_field = false;
                     }
                     "UIMessage" => {
-                        in_uimsg = false;
                         if let Some(kind) = cur_uimsg_kind.take() {
                             messages.push(UiMessage {
                                 kind,
diff --git a/jouledesk/jouledesk-rs/Cargo.lock b/jouledesk/jouledesk-rs/Cargo.lock
index b2dfee651..429122526 100644
--- a/jouledesk/jouledesk-rs/Cargo.lock
+++ b/jouledesk/jouledesk-rs/Cargo.lock
@@ -198,9 +198,9 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
diff --git a/openpay/Cargo.lock b/openpay/Cargo.lock
index 51742c5dc..ee4fd66cb 100644
--- a/openpay/Cargo.lock
+++ b/openpay/Cargo.lock
@@ -1395,9 +1395,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
+checksum = "12218662ccac37d9714f2191252553d67585b97df8c839cbe49e0bde278dc865"
 dependencies = [
  "cmov",
 ]
diff --git a/scripts/check-advisories-selftest.sh b/scripts/check-advisories-selftest.sh
index c6f0faeb9..04e048a29 100755
--- a/scripts/check-advisories-selftest.sh
+++ b/scripts/check-advisories-selftest.sh
@@ -4,17 +4,21 @@
 #
 # A check that cannot fail is decoration. This feeds the check pre-captured
 # `cargo audit --json` documents through `--from-json` and asserts that it
-#   1. passes when every advisory found is allowed and every allowed advisory
-#      is found;
+#   1. passes when every advisory found is allowed and every allowance is used;
 #   2. fails when an advisory is reported that the allow list does not name
 #      (the case this check exists for);
 #   3. fails when an allow-list entry matches nothing, so an excuse cannot
 #      outlive the exposure it was written for;
-#   4. fails, and says it could not audit, when the document does not parse:
+#   4. fails when a version-pinned allowance is offered a version it does not
+#      name — the whole point of pinning it;
+#   5. fails when a version-pinned allowance names a pair that is gone, so the
+#      pin cannot keep describing a tree that moved;
+#   6. fails, and says it could not audit, when the document does not parse:
 #      an error is never read as "clean".
 #
-# Nothing here runs cargo or reads the advisory database, so it needs no
-# network and no lockfile.
+# The documents are generated from the check's own ALLOW table, imported rather
+# than scraped, so the two cannot drift apart. Nothing here runs cargo or reads
+# the advisory database, so it needs no network and no lockfile.
 set -uo pipefail
 
 here=$(cd "$(dirname "$0")" && pwd)
@@ -22,37 +26,53 @@ check="$here/check-advisories.py"
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' EXIT
 
-# Every advisory the check allows, read from the check itself so the two cannot
-# drift apart.
-# (a read loop, not `mapfile`: macOS ships bash 3.2, where mapfile does not exist)
-allowed=()
-while IFS= read -r id; do allowed+=("$id"); done < <(
-  grep -oE '^    "RUSTSEC-[0-9]{4}-[0-9]{4}"' "$check" | tr -d ' "'
-)
-if [ ${#allowed[@]} -eq 0 ]; then
-  echo "selftest: could not read the allow list out of $check" >&2
-  exit 2
-fi
+# gen <out> [mutation]  — a cargo-audit document built from the real ALLOW.
+#   (none)      every allowance, each at a version it covers
+#   extra       plus an advisory nobody allows
+#   drop-one    one allowance missing, so it matches nothing
+#   wrong-ver   a version-pinned allowance at a version it does not name
+#   drop-pinned a version-pinned allowance's named pair removed
+gen() {
+  python3 -I - "$check" "$1" "${2:-none}" <<'PY'
+import importlib.util, json, sys
+path, out, mode = sys.argv[1], sys.argv[2], sys.argv[3]
+spec = importlib.util.spec_from_file_location("chk", path)
+m = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(m)           # __name__ != "__main__", so main() stays put
 
-# write_json <file> <id>...  — a cargo-audit document reporting exactly these.
-write_json() {
-  local out=$1; shift
-  { printf '{"vulnerabilities":{"found":true,"count":%d,"list":[' "$#"
-    local first=1 id
-    for id in "$@"; do
-      [ $first -eq 1 ] || printf ','
-      first=0
-      printf '{"advisory":{"id":"%s","title":"t"},"package":{"name":"c","version":"1.0.0"}}' "$id"
-    done
-    printf ']},"warnings":{}}'
-  } > "$out"
+rows = []
+for adv, entry in m.ALLOW.items():
+    if isinstance(entry, str):
+        rows.append((adv, "c", "1.0.0"))
+    else:
+        for pair in entry["only"]:
+            crate, ver = pair.rsplit(" ", 1)
+            rows.append((adv, crate, ver))
+
+pinned = [a for a, e in m.ALLOW.items() if not isinstance(e, str)]
+if mode == "extra":
+    rows.append(("RUSTSEC-2099-0001", "c", "1.0.0"))
+elif mode == "drop-one":
+    rows.pop(0)
+elif mode == "wrong-ver":
+    assert pinned, "no version-pinned allowance to test"
+    rows = [(a, c, ("9.9.9" if a == pinned[0] else v)) for a, c, v in rows]
+elif mode == "drop-pinned":
+    assert pinned, "no version-pinned allowance to test"
+    rows = [(a, c, v) for a, c, v in rows if a != pinned[0]]
+    rows.append((pinned[0], "c", "1.0.0"))   # present, but not at a named pair
+
+doc = {"vulnerabilities": {"found": bool(rows), "count": len(rows), "list": [
+    {"advisory": {"id": a, "title": "t"}, "package": {"name": c, "version": v}}
+    for a, c, v in rows]}, "warnings": {}}
+open(out, "w").write(json.dumps(doc))
+PY
 }
 
 fails=0
-expect() { # expect <pass|fail> <what> [text the output must hold] -- <args...>
-  local want=$1 what=$2 needle=$3; shift 3; [ "${1:-}" = -- ] && shift
-  local out rc
-  out=$(python3 -I "$check" --from-json "$@" 2>&1); rc=$?
+expect() { # expect <pass|fail> <what> <needle> <file>
+  local want=$1 what=$2 needle=$3 file=$4 out rc
+  out=$(python3 -I "$check" --from-json "$file" 2>&1); rc=$?
   if [ "$want" = pass ] && [ $rc -ne 0 ]; then
     echo "FAIL  $what: the check failed"; printf '%s\n' "$out" | sed 's/^/      /'; fails=$((fails+1)); return
   fi
@@ -65,17 +85,19 @@ expect() { # expect <pass|fail> <what> [text the output must hold] -- <args...>
   echo "ok    $what"
 }
 
-write_json "$tmp/all.json" "${allowed[@]}"
-expect pass "every advisory allowed and every allowance used passes" "" -- "$tmp/all.json"
-
-write_json "$tmp/extra.json" "${allowed[@]}" "RUSTSEC-2099-0001"
-expect fail "an advisory the allow list does not name fails" "not in the allow list" -- "$tmp/extra.json"
-
-write_json "$tmp/short.json" "${allowed[@]:1}"
-expect fail "an allowance that matches nothing fails" "no longer match anything" -- "$tmp/short.json"
-
+gen "$tmp/all.json"                  || exit 2
+gen "$tmp/extra.json"    extra       || exit 2
+gen "$tmp/short.json"    drop-one    || exit 2
+gen "$tmp/wrongver.json" wrong-ver   || exit 2
+gen "$tmp/dropped.json"  drop-pinned || exit 2
 printf 'this is not json\n' > "$tmp/broken.json"
-expect fail "a document that does not parse fails as unaudited, not as clean" "Could not be audited" -- "$tmp/broken.json"
+
+expect pass "every advisory allowed and every allowance used passes"            ""                          "$tmp/all.json"
+expect fail "an advisory the allow list does not name fails"                    "not in the allow list"     "$tmp/extra.json"
+expect fail "an allowance that matches nothing fails"                           "no longer match anything"  "$tmp/short.json"
+expect fail "a version-pinned allowance at an unnamed version fails"            "not in the allow list"     "$tmp/wrongver.json"
+expect fail "a version-pinned allowance whose named pair is gone fails"         "no longer"                 "$tmp/dropped.json"
+expect fail "a document that does not parse fails as unaudited, not as clean"   "Could not be audited"      "$tmp/broken.json"
 
 if [ $fails -ne 0 ]; then echo "check-advisories-selftest: $fails failure(s)"; exit 1; fi
 echo "check-advisories-selftest: the check passes a reviewed tree and fails each way it should."
diff --git a/scripts/check-advisories.py b/scripts/check-advisories.py
index d113cb19d..0800e2e47 100755
--- a/scripts/check-advisories.py
+++ b/scripts/check-advisories.py
@@ -45,6 +45,21 @@ import sys
 
 # Advisories left in place on purpose. Each needs the reason, and each must
 # still be reported by at least one lockfile or this check fails.
+#
+# An entry is either
+#
+#     "RUSTSEC-...": "why it can be left"
+#
+# which excuses the advisory at ANY version — correct when the reason does not
+# depend on the version, such as a call we never make — or
+#
+#     "RUSTSEC-...": {"why": "...", "only": ("crate 1.2.3", ...)}
+#
+# which excuses it ONLY at those exact crate/version pairs. Use the second form
+# whenever the reason is "this particular line cannot move yet", because the
+# first form is version-blind: it would go on excusing the advisory if a
+# patched line later regressed to an unpatched release. Every pair named in
+# `only` must also still appear, or the entry is stale and the run fails.
 ALLOW = {
     # ── Unreachable here ────────────────────────────────────────────────────
     # All three are faults in `extract()`: SUID/SGID bits preserved from the
@@ -61,30 +76,36 @@ ALLOW = {
     # sandbox-rs and wai-rs transitively and neither holds an RSA private key
     # nor decrypts: openpay's unused direct dependency was removed outright.
     "RUSTSEC-2023-0071": "rsa: no fixed release; no private-key decryption here",
-    # ── Not in a shipped artifact ──────────────────────────────────────────
-    # The production MLS path (joule-moq-mls) resolves the patched hpke-rs
-    # 0.7.0. These four are the old 0.2.0, reached only through a
-    # [dev-dependencies] edge of joule-code-collab, which still pins the
-    # openmls 0.6/0.3 stack. Test graph only; aligning it to the 0.9.1/0.6.0
-    # stack already used in-repo would remove them.
-    "RUSTSEC-2026-0069": "hpke-rs 0.2.0: dev-dependency only; production uses 0.7.0",
-    "RUSTSEC-2026-0070": "hpke-rs 0.2.0: dev-dependency only; production uses 0.7.0",
-    "RUSTSEC-2026-0071": "hpke-rs 0.2.0: dev-dependency only; production uses 0.7.0",
-    "RUSTSEC-2026-0072": "hpke-rs-rust-crypto 0.2.0: dev-dependency only",
     # ── Pinned by a dependency; needs an upstream release ──────────────────
+    # Secret-dependent branches in operations meant to be constant-time
+    # (subtraction, zero counting, division, Montgomery multiplication), so
+    # timing can leak intermediate arithmetic on secret integers. Fixed in
+    # >=0.7.6, and smart-byte's 0.7.x copy is patched. The 0.5.5 line is pinned
+    # by elliptic-curve 0.13, so reaching it means moving the whole
+    # p256/elliptic-curve stack — a real upgrade, not a bump, and this entry is
+    # that debt, recorded on paths that sign and derive keys. Version-pinned on
+    # purpose: a 0.7.x copy must never be excused by it.
+    "RUSTSEC-2026-0387": {
+        "why": "crypto-bigint 0.5.5 is pinned by elliptic-curve 0.13; 0.7.x is patched",
+        "only": ("crypto-bigint 0.5.5",),
+    },
     # hpke-rs-libcrux pins `=0.7.0`, which pins libcrux-kem 0.0.9. Both are
     # panics on short or malformed hybrid keys — denial of service, not memory
     # corruption. Fixed by an openmls/hpke-rs release, not from here.
     "RUSTSEC-2026-0330": "libcrux-kem: pinned by hpke-rs-libcrux =0.7.0; upstream",
     "RUSTSEC-2026-0331": "libcrux-kem: pinned by hpke-rs-libcrux =0.7.0; upstream",
-    # quick-xml is 0.41 everywhere the version is ours to choose. openpay also
-    # resolves 0.37.5 through open-payments-iso20022 1.0.10 (no later release
-    # exists), and smart-byte resolves 0.39.4 through plist -> netdev ->
-    # netwatch -> iroh. NOTE: the openpay path is the same ISO 20022 surface we
-    # harden directly, so this entry is a known remaining exposure on a payment
-    # ingestion path, not a dismissal. Drop it the moment upstream ships.
-    "RUSTSEC-2026-0194": "quick-xml 0.37.5/0.39.4: pinned by open-payments-iso20022 and iroh",
-    "RUSTSEC-2026-0195": "quick-xml 0.37.5/0.39.4: NsReader unused here; dependents pin the version",
+    # quick-xml is 0.41 everywhere the version is ours to choose, which includes
+    # every call that actually parses: op-iso20022's codec binds the workspace
+    # 0.41. Two older copies remain in the graph, neither on a parse path.
+    #   openpay resolves 0.37.5 through open-payments-iso20022 1.0.10, which
+    #   declares quick-xml but never calls it — the crate ships serde-annotated
+    #   ISO 20022 types (3 files, ~2.2k lines, no `quick_xml` reference), and
+    #   the parsing is ours. Compiled, never executed.
+    #   smart-byte resolves 0.39.4 through plist -> netdev -> netwatch -> iroh,
+    #   which parses macOS plists, not counterparty XML.
+    # -0195 additionally needs `NsReader`, which appears nowhere in this tree.
+    "RUSTSEC-2026-0194": "quick-xml 0.37.5/0.39.4: not on a parse path; our parsing is on 0.41",
+    "RUSTSEC-2026-0195": "quick-xml 0.37.5/0.39.4: NsReader unused, and neither copy parses",
     # h2 0.3.27 under jouleclaw and 0.4.14 under smart-byte, both transitive;
     # the fix is a major move for the dependent.
     "RUSTSEC-2026-0258": "h2: transitive; fixed version is a major move for the dependent",
@@ -189,8 +210,29 @@ def main():
         for kind, items in (data.get("warnings") or {}).items():
             warn_count += len(items or [])
 
-    unexpected = {k: v for k, v in found.items() if k not in ALLOW}
+    def covered(adv, crate, ver):
+        entry = ALLOW.get(adv)
+        if entry is None:
+            return False
+        if isinstance(entry, str):
+            return True
+        return f"{crate} {ver}" in entry["only"]
+
+    unexpected = {}
+    for adv, occurrences in found.items():
+        loose = [o for o in occurrences if not covered(adv, o[0], o[1])]
+        if loose:
+            unexpected[adv] = loose
+
     stale = [k for k in ALLOW if k not in found]
+    # A version-pinned entry is also stale when a pair it names is gone: the
+    # pin stops describing the tree the moment that line moves.
+    for adv, entry in ALLOW.items():
+        if adv in found and isinstance(entry, dict):
+            seen = {f"{c} {v}" for c, v, _ in found[adv]}
+            for pair in entry["only"]:
+                if pair not in seen:
+                    stale.append(f"{adv} (no longer at {pair})")
 
     if unexpected:
         print("Advisories that are not in the allow list:\n")
@@ -205,7 +247,9 @@ def main():
     if stale:
         print("\nAllow-list entries that no longer match anything:\n")
         for adv in sorted(stale):
-            print(f"  {adv}  — {ALLOW[adv]}")
+            entry = ALLOW.get(adv.split(" (")[0])
+            why = entry if isinstance(entry, str) else (entry or {}).get("why", "")
+            print(f"  {adv}  — {why}")
         print(
             "\nThe exposure is gone. Remove the entry, so the list keeps describing\n"
             "the tree instead of hiding it."
diff --git a/smart-byte/smart-byte-rs/Cargo.lock b/smart-byte/smart-byte-rs/Cargo.lock
index f97dc2ef5..f85aa68cb 100644
--- a/smart-byte/smart-byte-rs/Cargo.lock
+++ b/smart-byte/smart-byte-rs/Cargo.lock
@@ -150,9 +150,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "arc-swap"
@@ -711,9 +711,9 @@ dependencies = [
 
 [[package]]
 name = "chacha20"
-version = "0.10.0"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cipher 0.5.2",
@@ -1045,9 +1045,9 @@ checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
 [[package]]
 name = "crypto-bigint"
-version = "0.7.3"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42a0d26b245348befa0c121944541476763dcc46ede886c88f9d12e1697d27c3"
+checksum = "6bb08299a6046833a879ace115697f12fd2bd6c8d3e93c909ffc9e0738e7cae0"
 dependencies = [
  "cpubits",
  "ctutils",
@@ -1090,9 +1090,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.2"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0"
 dependencies = [
  "cmov",
  "subtle",
@@ -1218,7 +1218,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090"
 dependencies = [
  "data-encoding",
- "syn 1.0.109",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -1251,9 +1251,9 @@ dependencies = [
 
 [[package]]
 name = "der"
-version = "0.8.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71fd89660b2dc699704064e59e9dba0147b903e85319429e131620d022be411b"
+checksum = "a878c850e9e421b20262e9b41f9c860e4785fa07541c266b62ff9d1ef998a80a"
 dependencies = [
  "const-oid 0.10.2",
  "pem-rfc7468",
@@ -1427,7 +1427,7 @@ version = "0.17.0-rc.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "54fb064faabbee66e1fc8e5c5a9458d4269dc2d8b638fe86a425adb2510d1a96"
 dependencies = [
- "der 0.8.0",
+ "der 0.8.2",
  "digest 0.11.3",
  "elliptic-curve",
  "rfc6979",
@@ -1564,16 +1564,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "event-listener"
-version = "5.4.1"
+version = "5.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
 dependencies = [
- "concurrent-queue",
  "parking",
  "pin-project-lite",
 ]
@@ -1715,7 +1714,7 @@ dependencies = [
  "diatomic-waker",
  "futures-core",
  "pin-project-lite",
- "spin 0.10.0",
+ "spin 0.10.1",
 ]
 
 [[package]]
@@ -2070,7 +2069,7 @@ dependencies = [
  "hash32",
  "rustc_version",
  "serde",
- "spin 0.9.8",
+ "spin 0.9.9",
  "stable_deref_trait",
 ]
 
@@ -2377,7 +2376,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "tokio",
  "tower-service",
  "tracing",
@@ -2786,9 +2785,9 @@ dependencies = [
 
 [[package]]
 name = "iroh-blobs"
-version = "0.101.0"
+version = "0.101.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6e351f5c1db08dcfb456e6299bda0881e1ba95a360f0913a5e57344c1538fb2"
+checksum = "7b9674590d5b678af0989a7ed77d24b57f88bad45e4729c08f66c7177b1c0b6e"
 dependencies = [
  "arrayvec",
  "bao-tree",
@@ -3665,9 +3664,9 @@ dependencies = [
 
 [[package]]
 name = "lru"
-version = "0.18.0"
+version = "0.18.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a860605968fce16869fd239cf4237a82f3ac470723415db603b0e8b6c8d4fb9"
+checksum = "5d2f2f9b4ba7e6b24d95e7e899329d35be83bcded72c8540cdd5368932d1d90a"
 dependencies = [
  "hashbrown 0.17.1",
 ]
@@ -4065,7 +4064,7 @@ dependencies = [
  "pin-project-lite",
  "rustc-hash",
  "rustls",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "thiserror 2.0.18",
  "tokio",
  "tokio-stream",
@@ -4110,7 +4109,7 @@ checksum = "78633d1fe1bde91d12bcabb230ac9edb890857414c6d44f3212e0d309525b5ff"
 dependencies = [
  "cfg_aliases",
  "libc",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "tracing",
  "windows-sys 0.61.2",
 ]
@@ -4480,7 +4479,7 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
 dependencies = [
- "der 0.8.0",
+ "der 0.8.2",
  "spki 0.8.0",
 ]
 
@@ -4906,7 +4905,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash",
  "rustls",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -4945,7 +4944,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "tracing",
  "windows-sys 0.52.0",
 ]
@@ -4998,7 +4997,7 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
- "chacha20 0.10.0",
+ "chacha20 0.10.2",
  "getrandom 0.4.2",
  "rand_core 0.10.1",
 ]
@@ -5343,7 +5342,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5402,7 +5401,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5502,7 +5501,7 @@ checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
 dependencies = [
  "base16ct",
  "ctutils",
- "der 0.8.0",
+ "der 0.8.2",
  "hybrid-array",
  "subtle",
  "zeroize",
@@ -5558,7 +5557,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5b55fb86dfd3a2f5f76ea78310a88f96c4ea21a3031f8d212443d56123fd0521"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6164,7 +6163,7 @@ dependencies = [
  "aes",
  "async-trait",
  "cbc",
- "chacha20 0.10.0",
+ "chacha20 0.10.2",
  "chrono",
  "data-encoding",
  "hex",
@@ -6350,18 +6349,18 @@ dependencies = [
 
 [[package]]
 name = "spin"
-version = "0.9.8"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
 dependencies = [
  "lock_api",
 ]
 
 [[package]]
 name = "spin"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
 
 [[package]]
 name = "spki"
@@ -6380,7 +6379,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d9efca8738c78ee9484207732f728b1ef517bbb1833d6fc0879ca898a522f6f"
 dependencies = [
  "base64ct",
- "der 0.8.0",
+ "der 0.8.2",
 ]
 
 [[package]]
@@ -6538,7 +6537,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -7260,7 +7259,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]