diff --git a/Cargo.lock b/Cargo.lock
index 860d80160c..6b2bc7d988 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -142,24 +142,24 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "arc-swap"
-version = "1.9.1"
+version = "1.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a3a1fd6f75306b68087b831f025c712524bcb19aad54e557b1129cfa0a2b207"
+checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b"
 dependencies = [
  "rustversion",
 ]
 
 [[package]]
 name = "arrayvec"
-version = "0.7.6"
+version = "0.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
+checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
 dependencies = [
  "serde",
 ]
@@ -201,7 +201,7 @@ checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -212,7 +212,7 @@ checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -229,15 +229,15 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "autocfg"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.16.3"
+version = "1.17.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec6fb3fe69024a75fa7e1bfb48aa6cf59706a101658ea01bfd33b2b248a038f"
+checksum = "00bdb5da18dac48ca2cc7cd4a98e533e8635a58e2361d13a1a4ee3888e0d72f1"
 dependencies = [
  "aws-lc-sys",
  "zeroize",
@@ -245,14 +245,15 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.40.0"
+version = "0.43.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f50037ee5e1e41e7b8f9d161680a725bd1626cb6f8c7e901f91f942850852fe7"
+checksum = "43103168cc76fe62678a375e722fc9cb3a0146159ac5828bc4f0dfd755c2224c"
 dependencies = [
  "cc",
  "cmake",
  "dunce",
  "fs_extra",
+ "pkg-config",
 ]
 
 [[package]]
@@ -264,7 +265,7 @@ dependencies = [
  "axum-core",
  "bytes",
  "futures-util",
- "http 1.4.0",
+ "http",
  "http-body",
  "http-body-util",
  "hyper",
@@ -291,7 +292,7 @@ checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.4.0",
+ "http",
  "http-body",
  "http-body-util",
  "mime",
@@ -310,7 +311,7 @@ dependencies = [
  "bytes",
  "either",
  "fs-err",
- "http 1.4.0",
+ "http",
  "http-body",
  "hyper",
  "hyper-util",
@@ -353,16 +354,6 @@ dependencies = [
  "backtrace",
 ]
 
-[[package]]
-name = "base64"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5032d51da2741729bfdaeb2664d9b8c6d9fd1e2b90715c660b6def36628499c2"
-dependencies = [
- "byteorder",
- "safemem",
-]
-
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -376,7 +367,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
 dependencies = [
  "annotate-snippets",
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "cexpr",
  "clang-sys",
  "itertools 0.13.0",
@@ -384,8 +375,8 @@ dependencies = [
  "quote",
  "regex",
  "rustc-hash",
- "shlex",
- "syn 2.0.117",
+ "shlex 1.3.0",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -396,18 +387,18 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.11.1"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 dependencies = [
  "serde_core",
 ]
 
 [[package]]
 name = "bitvec"
-version = "1.0.1"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bc2832c24239b0141d5674bb9174f9d68a8b5b3f2753311927c172ca46f7e9c"
+checksum = "ddcec3d12c579d40898fe0a9a358a803c23e9c52ca3c425707f81c9436211837"
 dependencies = [
  "funty",
  "radium",
@@ -417,18 +408,9 @@ dependencies = [
 
 [[package]]
 name = "block-buffer"
-version = "0.10.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "block-buffer"
-version = "0.12.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
 dependencies = [
  "hybrid-array",
 ]
@@ -461,7 +443,7 @@ dependencies = [
  "bolero-kani",
  "bolero-libfuzzer",
  "cfg-if",
- "rand 0.9.4",
+ "rand 0.9.5",
 ]
 
 [[package]]
@@ -484,7 +466,7 @@ dependencies = [
  "bolero-generator",
  "lazy_static",
  "pretty-hex",
- "rand 0.9.4",
+ "rand 0.9.5",
  "rand_xoshiro",
 ]
 
@@ -510,7 +492,7 @@ dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -543,18 +525,18 @@ dependencies = [
 
 [[package]]
 name = "bollard"
-version = "0.19.4"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87a52479c9237eb04047ddb94788c41ca0d26eaff8b697ecfbb4c32f7fdc3b1b"
+checksum = "c9d0a013e3d3ee4edd61e779adf117944c08902d375f18630a0c5b8f95659734"
 dependencies = [
- "base64 0.22.1",
+ "base64",
  "bollard-stubs",
  "bytes",
  "futures-core",
  "futures-util",
  "hex",
  "home",
- "http 1.4.0",
+ "http",
  "http-body-util",
  "hyper",
  "hyper-named-pipe",
@@ -565,12 +547,10 @@ dependencies = [
  "pin-project-lite",
  "rustls",
  "rustls-native-certs",
- "rustls-pemfile",
  "rustls-pki-types",
  "serde",
  "serde_derive",
  "serde_json",
- "serde_repr",
  "serde_urlencoded",
  "thiserror",
  "tokio",
@@ -582,21 +562,20 @@ dependencies = [
 
 [[package]]
 name = "bollard-stubs"
-version = "1.49.1-rc.28.4.0"
+version = "1.53.1-rc.29.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5731fe885755e92beff1950774068e0cae67ea6ec7587381536fca84f1779623"
+checksum = "ce412eb6f7096743011dc3cb5c674caeb24ced61d8c498fe07cf7998a4fea889"
 dependencies = [
  "serde",
  "serde_json",
  "serde_repr",
- "serde_with",
 ]
 
 [[package]]
 name = "bumpalo"
-version = "3.20.2"
+version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
 name = "bytecheck"
@@ -619,7 +598,7 @@ checksum = "89385e82b5d1821d2219e0b095efa2cc1f246cbf99080f3be46a1a85c0d392d9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -630,9 +609,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.11.1"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 dependencies = [
  "serde",
 ]
@@ -665,27 +644,27 @@ checksum = "3fce8dd7fcfcbf3a0a87d8f515194b49d6135acab73e18bd380d1d93bb1a15eb"
 dependencies = [
  "clap",
  "heck 0.4.1",
- "indexmap 2.14.0",
+ "indexmap",
  "log",
  "proc-macro2",
  "quote",
  "serde",
  "serde_json",
- "syn 2.0.117",
+ "syn 2.0.119",
  "tempfile",
  "toml",
 ]
 
 [[package]]
 name = "cc"
-version = "1.2.61"
+version = "1.2.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
+checksum = "e17dd265a7d0f31ef544e1b20e03add05d3b45b491b633b10d67145d2acc1a38"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
  "libc 0.2.186",
- "shlex",
+ "shlex 2.0.1",
 ]
 
 [[package]]
@@ -705,26 +684,26 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "cfg_aliases"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.0",
+ "cpufeatures",
  "rand_core 0.10.1",
 ]
 
 [[package]]
 name = "chrono"
-version = "0.4.44"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
 dependencies = [
  "iana-time-zone",
  "num-traits",
@@ -745,9 +724,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.1"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+checksum = "dd059f9da4f5c36b3787f65d38ccaab1cc315f07b01f89abc8359ee6a8205011"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -755,9 +734,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.0"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
 dependencies = [
  "anstream",
  "anstyle",
@@ -774,7 +753,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -785,13 +764,12 @@ checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 
 [[package]]
 name = "cloud-hypervisor-client"
-version = "0.3.3"
+version = "0.6.0+api-spec-0.3.0-2026-05-19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a135a9339a5ad2775b8843dfad19cd5057e9d8092a3c09b523c5030fcc1348ee"
+checksum = "a4bed6a95ff723212851f4f331887d6de58cc8f9ecf887accffea5d1575d9c1f"
 dependencies = [
- "base64 0.7.0",
  "futures",
- "http 0.2.12",
+ "http",
  "http-body-util",
  "hyper",
  "hyper-util",
@@ -852,7 +830,7 @@ version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -861,7 +839,7 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b60b5124979fccd9addd89d8b97a1d6eebb4950694520c75ddd722535ea443f"
 dependencies = [
- "nix 0.31.2",
+ "nix 0.31.3",
  "thiserror",
  "tokio",
 ]
@@ -917,9 +895,9 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "corosensei"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c54787b605c7df106ceccf798df23da4f2e09918defad66705d1cedf3bb914f"
+checksum = "6886a0c0f263965933c438626e7179139a62b978a33aa18281cbf0cd5a975f34"
 dependencies = [
  "autocfg",
  "cfg-if",
@@ -928,24 +906,6 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
-[[package]]
-name = "cpp_demangle"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2bb79cb74d735044c972aae58ed0aaa9a837e85b01106a54c39e42e97f62253"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "cpufeatures"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
-dependencies = [
- "libc 0.2.186",
-]
-
 [[package]]
 name = "cpufeatures"
 version = "0.3.0"
@@ -966,18 +926,18 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.21"
+version = "0.8.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
 
 [[package]]
 name = "crossterm"
@@ -985,7 +945,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8b9f2e4c67f833b660cdb0a3523065869fb35570177239812ed4c905aeff87b"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "crossterm_winapi",
  "derive_more",
  "document-features",
@@ -1009,19 +969,9 @@ dependencies = [
 
 [[package]]
 name = "crypto-common"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77727bb15fa921304124b128af125e7e3b968275d1b108b379190264f4423710"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
  "hybrid-array",
 ]
@@ -1033,7 +983,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e0b1fab2ae45819af2d0731d60f2afe17227ebb1a1538a236da84c93e9a60162"
 dependencies = [
  "dispatch2",
- "nix 0.31.2",
+ "nix 0.31.3",
  "windows-sys 0.61.2",
 ]
 
@@ -1068,7 +1018,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1081,7 +1031,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1092,7 +1042,7 @@ checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
  "darling_core 0.20.11",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1103,7 +1053,7 @@ checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
 dependencies = [
  "darling_core 0.23.0",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1114,9 +1064,9 @@ checksum = "8b1e3a325bc115f096c8b77bbf027a7c2592230e70be2d985be950d3d5e60ebe"
 
 [[package]]
 name = "dashmap"
-version = "6.1.0"
+version = "6.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5041cc499144891f3790297212f32a74fb938e5136a14943f338ef9e0ae276cf"
+checksum = "e6361d5c062261c78a176addb82d4c821ae42bed6089de0e12603cd25de2059c"
 dependencies = [
  "cfg-if",
  "crossbeam-utils",
@@ -1161,7 +1111,7 @@ dependencies = [
  "mio",
  "n-vm",
  "netdev",
- "nix 0.31.2",
+ "nix 0.31.3",
  "once_cell",
  "ordermap",
  "parking_lot",
@@ -1183,13 +1133,13 @@ dependencies = [
  "dataplane-hardware",
  "dataplane-id",
  "dataplane-net",
- "memmap2 0.9.10",
+ "memmap2",
  "miette",
- "nix 0.31.2",
+ "nix 0.31.3",
  "rkyv",
  "serde",
  "serde_yaml_ng",
- "sha2 0.11.0",
+ "sha2",
  "thiserror",
  "tokio",
  "tracing",
@@ -1204,8 +1154,8 @@ version = "0.20.2"
 dependencies = [
  "clap",
  "colored",
- "nix 0.31.2",
- "rand 0.10.1",
+ "nix 0.31.3",
+ "rand 0.10.2",
  "reedline",
  "rkyv",
  "strum 0.28.0",
@@ -1235,7 +1185,7 @@ version = "0.20.2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1378,7 +1328,7 @@ dependencies = [
  "dataplane-hardware",
  "dataplane-id",
  "dataplane-sysfs",
- "nix 0.31.2",
+ "nix 0.31.3",
  "procfs",
  "strum 0.28.0",
  "strum_macros 0.28.0",
@@ -1398,7 +1348,7 @@ dependencies = [
  "futures",
  "libc 1.0.0-alpha.3",
  "multi_index_map",
- "nix 0.31.2",
+ "nix 0.31.3",
  "rtnetlink",
  "serde",
  "static_assertions",
@@ -1423,7 +1373,7 @@ dependencies = [
  "kube-core",
  "linkme",
  "rustls",
- "schemars 1.2.1",
+ "schemars",
  "serde",
  "serde_json",
  "serde_yaml_ng",
@@ -1537,7 +1487,7 @@ dependencies = [
  "indenter",
  "left-right 0.11.7 (git+https://github.com/githedgehog/left-right.git?branch=fredi%2Ffix-writehandle-drop)",
  "linkme",
- "rand 0.10.1",
+ "rand 0.10.2",
  "roaring",
  "shuttle",
  "strum 0.28.0",
@@ -1554,7 +1504,7 @@ dependencies = [
  "ahash",
  "arrayvec",
  "atomic-instant-full",
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "bolero",
  "bytecheck",
  "dataplane-common",
@@ -1602,7 +1552,7 @@ dependencies = [
  "ahash",
  "anyhow",
  "async-trait",
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "bolero",
  "bytes",
  "chrono",
@@ -1625,9 +1575,9 @@ dependencies = [
  "netdev",
  "netgauze-bgp-pkt",
  "netgauze-bmp-pkt",
- "nix 0.31.2",
+ "nix 0.31.3",
  "procfs",
- "rand 0.10.1",
+ "rand 0.10.2",
  "serde",
  "strum 0.28.0",
  "thiserror",
@@ -1649,12 +1599,12 @@ dependencies = [
  "dataplane-tracectl",
  "dataplane-vpcmap",
  "derive_builder",
- "hashbrown 0.17.0",
+ "hashbrown 0.17.1",
  "kanal",
  "linkme",
  "metrics",
  "multi_index_map",
- "rand 0.10.1",
+ "rand 0.10.2",
  "serde",
  "small-map",
  "thiserror",
@@ -1667,7 +1617,7 @@ name = "dataplane-sysfs"
 version = "0.20.2"
 dependencies = [
  "n-vm",
- "nix 0.31.2",
+ "nix 0.31.3",
  "procfs",
  "thiserror",
  "tracing",
@@ -1678,7 +1628,7 @@ name = "dataplane-test-utils"
 version = "0.20.2"
 dependencies = [
  "caps",
- "nix 0.31.2",
+ "nix 0.31.3",
  "rtnetlink",
  "tokio",
  "tracing",
@@ -1730,15 +1680,42 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "defmt"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
+dependencies = [
+ "bitflags 1.3.2",
+ "defmt-macros",
+]
+
+[[package]]
+name = "defmt-macros"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
+dependencies = [
+ "defmt-parser",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "defmt-parser"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
+dependencies = [
+ "thiserror",
+]
+
 [[package]]
 name = "deranged"
 version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
-dependencies = [
- "powerfmt",
- "serde_core",
-]
 
 [[package]]
 name = "derive_builder"
@@ -1758,7 +1735,7 @@ dependencies = [
  "darling 0.20.11",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1768,7 +1745,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
 dependencies = [
  "derive_builder_core",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1790,7 +1767,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 2.0.117",
+ "syn 2.0.119",
  "unicode-xid",
 ]
 
@@ -1800,24 +1777,14 @@ version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8"
 
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer 0.10.4",
- "crypto-common 0.1.7",
-]
-
 [[package]]
 name = "digest"
 version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
- "block-buffer 0.12.0",
- "crypto-common 0.2.1",
+ "block-buffer",
+ "crypto-common",
 ]
 
 [[package]]
@@ -1826,7 +1793,7 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "block2",
  "libc 0.2.186",
  "objc2",
@@ -1834,13 +1801,13 @@ dependencies = [
 
 [[package]]
 name = "displaydoc"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1922,7 +1889,7 @@ dependencies = [
  "enum-ordinalize",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1934,33 +1901,33 @@ dependencies = [
  "enum-ordinalize",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "either"
-version = "1.15.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
 
 [[package]]
 name = "enum-ordinalize"
-version = "4.3.2"
+version = "4.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a1091a7bb1f8f2c4b28f1fe2cef4980ca2d410a3d727d67ecc3178c9b0800f0"
+checksum = "07f808d588c10e464ea6f7d3eaed500049eff30aaac103460f61828c2d65b3eb"
 dependencies = [
  "enum-ordinalize-derive",
 ]
 
 [[package]]
 name = "enum-ordinalize-derive"
-version = "4.3.2"
+version = "4.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ca9601fb2d62598ee17836250842873a413586e5d7ed88b356e38ddbb0ec631"
+checksum = "42e528e2d34ba8a67a1a650b86beae8ef69fc5fdb638016f386b973226590432"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1980,7 +1947,7 @@ checksum = "44f23cf4b44bfce11a86ace86f8a73ffdec849c9fd00a386a53d278bd9e81fb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1996,14 +1963,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc 0.2.186",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "etherparse"
-version = "0.20.1"
+version = "0.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ac016aaf11dfe643edcd088a166234bfcb72e7f06691abfcf21e9af524037f4"
+checksum = "aeebdb565da33451794551a771bd0b4e6f416d3182adc3ed2837f614d6168f9a"
 dependencies = [
  "arrayvec",
 ]
@@ -2107,7 +2074,7 @@ source = "git+https://github.com/githedgehog/fixin?branch=main#5e0de31606466b173
 dependencies = [
  "proc-macro-error2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2126,12 +2093,6 @@ version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
-[[package]]
-name = "foldhash"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
-
 [[package]]
 name = "foldhash"
 version = "0.2.0"
@@ -2149,23 +2110,23 @@ dependencies = [
 
 [[package]]
 name = "framehop"
-version = "0.13.3"
+version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09a5a3f0acb82df800ca3aa50c0d60d286c5d13d4cfc3114b3a9663f13b032fe"
+checksum = "6f54fe4785e899d4d6f43793b151c63c5647240fc630b005509d2614a939f693"
 dependencies = [
  "arrayvec",
  "cfg-if",
  "fallible-iterator",
- "gimli 0.31.1",
+ "gimli 0.33.0",
  "macho-unwind-info",
  "pe-unwind-info",
 ]
 
 [[package]]
 name = "fs-err"
-version = "3.3.0"
+version = "3.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73fde052dbfc920003cfd2c8e2c6e6d4cc7c1091538c3a24226cec0665ab08c0"
+checksum = "b91aa448ca50d7e79433bdf3ee8d99215430d2ec02ade5aefab2a073a1822e8a"
 dependencies = [
  "autocfg",
  "tokio",
@@ -2254,7 +2215,7 @@ checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2288,9 +2249,9 @@ dependencies = [
 
 [[package]]
 name = "generator"
-version = "0.8.8"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52f04ae4152da20c76fe800fa48659201d5cf627c5149ca0b707b69d7eef6cf9"
+checksum = "b3b854b0e584ead1a33f18b2fcad7cf7be18b3875c78816b753639aa501513ae"
 dependencies = [
  "cc",
  "cfg-if",
@@ -2301,16 +2262,6 @@ dependencies = [
  "windows-result",
 ]
 
-[[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -2336,33 +2287,30 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.4.2"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
  "libc 0.2.186",
  "r-efi 6.0.0",
  "rand_core 0.10.1",
- "wasip2",
- "wasip3",
 ]
 
 [[package]]
 name = "gimli"
-version = "0.31.1"
+version = "0.32.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
-dependencies = [
- "fallible-iterator",
- "stable_deref_trait",
-]
+checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
 
 [[package]]
 name = "gimli"
-version = "0.32.3"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
+checksum = "0bf7f043f89559805f8c7cacc432749b2fa0d0a0a9ee46ce47164ed5ba7f126c"
+dependencies = [
+ "stable_deref_trait",
+]
 
 [[package]]
 name = "glob"
@@ -2384,17 +2332,17 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.13"
+version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
 dependencies = [
  "atomic-waker",
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.4.0",
- "indexmap 2.14.0",
+ "http",
+ "indexmap",
  "slab",
  "tokio",
  "tokio-util",
@@ -2407,27 +2355,12 @@ version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7040a10f52cba493ddb09926e15d10a9d8a28043708a405931fe4c6f19fac064"
 
-[[package]]
-name = "hashbrown"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-
 [[package]]
 name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 
-[[package]]
-name = "hashbrown"
-version = "0.15.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
-dependencies = [
- "foldhash 0.1.5",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
@@ -2436,16 +2369,16 @@ checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 dependencies = [
  "allocator-api2",
  "equivalent",
- "foldhash 0.2.0",
+ "foldhash",
 ]
 
 [[package]]
 name = "hashbrown"
-version = "0.17.0"
+version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 dependencies = [
- "foldhash 0.2.0",
+ "foldhash",
 ]
 
 [[package]]
@@ -2488,20 +2421,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "0.2.12"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
-dependencies = [
- "bytes",
- "fnv",
- "itoa",
-]
-
-[[package]]
-name = "http"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
 dependencies = [
  "bytes",
  "itoa",
@@ -2509,23 +2431,23 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "1.0.1"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http",
 ]
 
 [[package]]
 name = "http-body-util"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.4.0",
+ "http",
  "http-body",
  "pin-project-lite",
 ]
@@ -2549,7 +2471,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c2e65a48d3b300843ac84a2fe8e166bb5a5b00f30054593bcee8157e4b465fd"
 dependencies = [
  "arrayvec",
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "derive_more",
  "errno",
  "hwlocality-sys",
@@ -2561,9 +2483,9 @@ dependencies = [
 
 [[package]]
 name = "hwlocality-sys"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10a83c43a772c1f774b806deb44891c2a9578eb33cec48aad513482e0da3d4d4"
+checksum = "507b4c70a812b6ed5907db7d59726118f4e17708fbc09e32a872ac8e3b5bafaf"
 dependencies = [
  "libc 0.2.186",
  "pkg-config",
@@ -2572,25 +2494,25 @@ dependencies = [
 
 [[package]]
 name = "hybrid-array"
-version = "0.4.11"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d46837a0ed51fe95bd3b05de33cd64a1ee88fc797477ca48446872504507c5"
+checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
 dependencies = [
  "typenum",
 ]
 
 [[package]]
 name = "hyper"
-version = "1.9.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
 dependencies = [
  "atomic-waker",
  "bytes",
  "futures-channel",
  "futures-core",
  "h2",
- "http 1.4.0",
+ "http",
  "http-body",
  "httparse",
  "httpdate",
@@ -2622,7 +2544,7 @@ version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
- "http 1.4.0",
+ "http",
  "hyper",
  "hyper-util",
  "log",
@@ -2652,11 +2574,11 @@ version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
- "base64 0.22.1",
+ "base64",
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.4.0",
+ "http",
  "http-body",
  "hyper",
  "ipnet",
@@ -2790,12 +2712,6 @@ dependencies = [
  "zerovec",
 ]
 
-[[package]]
-name = "id-arena"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
-
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -2829,17 +2745,6 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "964de6e86d545b246d84badc0fef527924ace5134f30641c203ef52ba83f58d5"
 
-[[package]]
-name = "indexmap"
-version = "1.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
-dependencies = [
- "autocfg",
- "hashbrown 0.12.3",
- "serde",
-]
-
 [[package]]
 name = "indexmap"
 version = "2.14.0"
@@ -2847,19 +2752,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.17.0",
- "serde",
- "serde_core",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
 name = "inotify"
-version = "0.11.1"
+version = "0.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd5b3eaf1a28b758ac0faa5a4254e8ab2705605496f1b1f3fbbc3988ad73d199"
+checksum = "153be1941a183ec9ccd095ddbe17a8b8d435ef6c76e9e02451b933c3999af2c8"
 dependencies = [
- "bitflags 2.11.1",
- "futures-core",
+ "bitflags 2.13.1",
+ "futures-util",
  "inotify-sys",
  "libc 0.2.186",
  "tokio",
@@ -2867,9 +2770,9 @@ dependencies = [
 
 [[package]]
 name = "inotify-sys"
-version = "0.1.5"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e05c02b5e89bff3b946cedeca278abc628fe811e604f027c45a8aa3cf793d0eb"
+checksum = "c033f80b2c113cdf91ab7a33faa9cbc014726dcad99880c8609af2a370edf37d"
 dependencies = [
  "libc 0.2.186",
 ]
@@ -2892,16 +2795,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "iri-string"
-version = "0.7.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25e659a4bb38e810ebc252e53b5814ff908a8c58c2a9ce2fae1bbec24cbf4e20"
-dependencies = [
- "memchr",
- "serde",
-]
-
 [[package]]
 name = "is_ci"
 version = "1.2.0"
@@ -2940,10 +2833,11 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "jiff"
-version = "0.2.24"
+version = "0.2.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f00b5dbd620d61dfdcb6007c9c1f6054ebd75319f163d886a9055cec1155073d"
+checksum = "961d16382652bfdd8c6f68b223b26a8c93e0d475c672f414411db31c6c5c900e"
 dependencies = [
+ "defmt",
  "jiff-static",
  "log",
  "portable-atomic",
@@ -2953,34 +2847,33 @@ dependencies = [
 
 [[package]]
 name = "jiff-static"
-version = "0.2.24"
+version = "0.2.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e000de030ff8022ea1da3f466fbb0f3a809f5e51ed31f6dd931c35181ad8e6d7"
+checksum = "d0879bd39df99c4c5e2c6615ccc026391a423dde10532c573e6086eb94a802cc"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "jobserver"
-version = "0.1.34"
+version = "0.1.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
 dependencies = [
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "libc 0.2.186",
 ]
 
 [[package]]
 name = "js-sys"
-version = "0.3.97"
+version = "0.3.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1840c94c045fbcf8ba2812c95db44499f7c64910a912551aaaa541decebcacf"
+checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
 dependencies = [
  "cfg-if",
  "futures-util",
- "once_cell",
  "wasm-bindgen",
 ]
 
@@ -2998,9 +2891,9 @@ dependencies = [
 
 [[package]]
 name = "jsonpath-rust"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "633a7320c4bb672863a3782e89b9094ad70285e097ff6832cddd0ec615beadfa"
+checksum = "4222e00941bfe18bf81b79fa23ad933e233bfa18f3ee27254c5dd9b1543b5d5f"
 dependencies = [
  "pest",
  "pest_derive",
@@ -3025,9 +2918,9 @@ version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51b326f5219dd55872a72c1b6ddd1b830b8334996c667449c29391d657d78d5e"
 dependencies = [
- "base64 0.22.1",
+ "base64",
  "jiff",
- "schemars 1.2.1",
+ "schemars",
  "serde",
  "serde_json",
 ]
@@ -3061,11 +2954,11 @@ version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fcaf2d1f1a91e1805d4cd82e8333c022767ae8ffd65909bbef6802733a7dd40"
 dependencies = [
- "base64 0.22.1",
+ "base64",
  "bytes",
  "either",
  "futures",
- "http 1.4.0",
+ "http",
  "http-body",
  "http-body-util",
  "hyper",
@@ -3098,11 +2991,11 @@ checksum = "f126d2db7a8b532ec1d839ece2a71e2485dc3bbca6cc3c3f929becaa810e719e"
 dependencies = [
  "derive_more",
  "form_urlencoded",
- "http 1.4.0",
+ "http",
  "jiff",
  "json-patch",
  "k8s-openapi",
- "schemars 1.2.1",
+ "schemars",
  "serde",
  "serde-value",
  "serde_json",
@@ -3120,7 +3013,7 @@ dependencies = [
  "quote",
  "serde",
  "serde_json",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3156,12 +3049,6 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
-[[package]]
-name = "leb128fmt"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
-
 [[package]]
 name = "left-right"
 version = "0.11.7"
@@ -3246,7 +3133,7 @@ checksum = "32d59e20403c7d08fe62b4376edfe5c7fb2ef1e6b1465379686d0f21c8df444b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3278,9 +3165,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.29"
+version = "0.4.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "loom"
@@ -3339,24 +3226,15 @@ checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
 [[package]]
 name = "memchr"
-version = "2.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
-
-[[package]]
-name = "memmap2"
-version = "0.5.10"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83faa42c0a078c393f6b29d5db232d8be22776a891f8f56e5284faee4a20b327"
-dependencies = [
- "libc 0.2.186",
-]
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "memmap2"
-version = "0.9.10"
+version = "0.9.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714098028fe011992e1c3962653c96b2d578c4b4bce9036e15ff220319b1e0e3"
+checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
 dependencies = [
  "libc 0.2.186",
 ]
@@ -3372,9 +3250,9 @@ dependencies = [
 
 [[package]]
 name = "metrics"
-version = "0.24.5"
+version = "0.24.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff56c2e7dce6bd462e3b8919986a617027481b1dcc703175b58cf9dd98a2f071"
+checksum = "89550ee9f79e88fef3119de263694973a8adb26c21d75322164fb8c493039fe2"
 dependencies = [
  "portable-atomic",
  "rapidhash",
@@ -3386,9 +3264,9 @@ version = "0.18.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1db0d8f1fc9e62caebd0319e11eaec5822b0186c171568f0480b46a0137f9108"
 dependencies = [
- "base64 0.22.1",
+ "base64",
  "evmap",
- "indexmap 2.14.0",
+ "indexmap",
  "metrics",
  "metrics-util",
  "quanta",
@@ -3397,16 +3275,16 @@ dependencies = [
 
 [[package]]
 name = "metrics-util"
-version = "0.20.3"
+version = "0.20.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e56997f084e57b045edf17c3ed8ba7f9f779c670df8206dfd1c736f4c02dc4a"
+checksum = "96f8722f8562635f92f8ed992f26df0532266eb03d5202607c20c0d7e9745e13"
 dependencies = [
  "crossbeam-epoch",
  "crossbeam-utils",
  "hashbrown 0.16.1",
  "metrics",
  "quanta",
- "rand 0.9.4",
+ "rand 0.9.5",
  "rand_xoshiro",
  "rapidhash",
  "sketches-ddsketch",
@@ -3439,7 +3317,7 @@ checksum = "db5b29714e950dbb20d5e6f74f9dcec4edbcc1067bb7f8ed198c097b8c1a818b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3466,9 +3344,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.2.0"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
 dependencies = [
  "libc 0.2.186",
  "log",
@@ -3516,20 +3394,20 @@ checksum = "4568f25ccbd45ab5d5603dc34318c1ec56b117531781260002151b8530a9f931"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "n-vm"
-version = "0.0.9"
-source = "git+https://github.com/githedgehog/testn.git?tag=v0.0.9#299344af36ed019a20ca2c4c2e8a7a0bfdb6934d"
+version = "0.0.10"
+source = "git+https://github.com/githedgehog/testn.git?tag=v0.0.10#e49aba8400beb2cb117a3f542b114080cf572283"
 dependencies = [
  "bollard",
  "capctl",
  "cloud-hypervisor-client",
  "command-fds",
  "n-vm-macros",
- "nix 0.30.1",
+ "nix 0.31.3",
  "serde",
  "serde_json",
  "tokio",
@@ -3543,21 +3421,12 @@ dependencies = [
 
 [[package]]
 name = "n-vm-macros"
-version = "0.0.9"
-source = "git+https://github.com/githedgehog/testn.git?tag=v0.0.9#299344af36ed019a20ca2c4c2e8a7a0bfdb6934d"
+version = "0.0.10"
+source = "git+https://github.com/githedgehog/testn.git?tag=v0.0.10#e49aba8400beb2cb117a3f542b114080cf572283"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
-]
-
-[[package]]
-name = "names"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7bddcd3bf5144b6392de80e04c347cd7fab2508f6df16a85fc496ecd5cec39bc"
-dependencies = [
- "rand 0.8.6",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3607,7 +3476,7 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0bd1ae6b4400acac3742103f95ffa7688b042f0a36d9adedf255356d20a9adc4"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "byteorder",
  "bytes",
  "chrono",
@@ -3661,7 +3530,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "45f18369c9c01970528485c0fb338040ab86e3433857e362cef20ff17ddd52eb"
 dependencies = [
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3678,7 +3547,7 @@ name = "netlink-packet-route"
 version = "0.25.1"
 source = "git+https://github.com/githedgehog/netlink-packet-route.git?branch=pr%2Fdaniel-noland%2Fswing4#09b8ffdf9b4e9bbc8780a3efb4ec3494ee7ee3fd"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "libc 0.2.186",
  "log",
  "netlink-packet-core",
@@ -3690,7 +3559,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df9854ea6ad14e3f4698a7f03b65bce0833dd2d81d594a0e4a984170537146b6"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "libc 0.2.186",
  "log",
  "netlink-packet-core",
@@ -3734,24 +3603,13 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "nix"
-version = "0.26.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "598beaf3cc6fdd9a5dfb1630c2800c7acd31df7aaf0f565796fba2b53ca1af1b"
-dependencies = [
- "bitflags 1.3.2",
- "cfg-if",
- "libc 0.2.186",
-]
-
 [[package]]
 name = "nix"
 version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "cfg-if",
  "cfg_aliases",
  "libc 0.2.186",
@@ -3764,7 +3622,7 @@ version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "cfg-if",
  "cfg_aliases",
  "libc 0.2.186",
@@ -3772,11 +3630,11 @@ dependencies = [
 
 [[package]]
 name = "nix"
-version = "0.31.2"
+version = "0.31.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d6d0705320c1e6ba1d912b5e37cf18071b6c2e9b7fa8215a1e8a7651966f5d3"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "cfg-if",
  "cfg_aliases",
  "libc 0.2.186",
@@ -3785,9 +3643,9 @@ dependencies = [
 
 [[package]]
 name = "no_std_io2"
-version = "0.9.3"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b51ed7824b6e07d354605f4abb3d9d300350701299da96642ee084f5ce631550"
+checksum = "418abd1b6d34fbf6cae440dc874771b0525a604428704c76e48b29a5e67b8003"
 dependencies = [
  "memchr",
 ]
@@ -3808,14 +3666,14 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "num-conv"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
 [[package]]
 name = "num-derive"
@@ -3825,7 +3683,7 @@ checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3852,7 +3710,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "block2",
  "dispatch2",
  "libc 0.2.186",
@@ -3865,7 +3723,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c71e34919aba0d701380d911702455038a8a3587467fe0141d6a71501e7ffe48"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "objc2",
  "objc2-core-foundation",
  "objc2-foundation",
@@ -3885,7 +3743,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "block2",
  "libc 0.2.186",
  "objc2",
@@ -3898,7 +3756,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "709fe137109bd1e8b5a99390f77a7d8b2961dafc1a1c5db8f2e60329ad6d895a"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "objc2",
  "objc2-core-foundation",
 ]
@@ -3919,7 +3777,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7216bd11cbda54ccabcab84d523dc93b858ec75ecfb3a7d89513fa22464da396"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "dispatch2",
  "libc 0.2.186",
  "objc2",
@@ -3929,21 +3787,22 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.29.0"
+version = "0.37.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21158b2c33aa6d4561f1c0a6ea283ca92bc54802a93b263e910746d679a7eb53"
+checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
 dependencies = [
- "flate2",
  "memchr",
 ]
 
 [[package]]
 name = "object"
-version = "0.37.3"
+version = "0.39.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
+checksum = "2e5a6c098c7a3b6547378093f5cc30bc54fd361ce711e05293a5cc589562739b"
 dependencies = [
+ "flate2",
  "memchr",
+ "ruzstd",
 ]
 
 [[package]]
@@ -3979,7 +3838,7 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f7476a5b122ff1fce7208e7ee9dccd0a516e835f5b8b19b8f3c98a34cf757c1"
 dependencies = [
- "indexmap 2.14.0",
+ "indexmap",
 ]
 
 [[package]]
@@ -4050,12 +3909,12 @@ dependencies = [
 
 [[package]]
 name = "pe-unwind-info"
-version = "0.4.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "500fa4cdeacd98997c5865e3d0d1cb8fe7e9d7d75ecc775e07989a433a9a9a59"
+checksum = "97f6fccfd2d9d2df765ca23ff85fe5cc437fb0e6d3e164e4d3cbe09d14780c93"
 dependencies = [
  "arrayvec",
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "thiserror",
  "zerocopy",
  "zerocopy-derive",
@@ -4067,7 +3926,7 @@ version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
 dependencies = [
- "base64 0.22.1",
+ "base64",
  "serde_core",
 ]
 
@@ -4079,9 +3938,9 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pest"
-version = "2.8.6"
+version = "2.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0848c601009d37dfa3430c4666e147e49cdcf1b92ecd3e63657d8a5f19da662"
+checksum = "47627dd7305c6a2d6c8c6bcd24c5a4c17dbbf425f4f9c5313e724b38fc9782e9"
 dependencies = [
  "memchr",
  "ucd-trie",
@@ -4089,9 +3948,9 @@ dependencies = [
 
 [[package]]
 name = "pest_derive"
-version = "2.8.6"
+version = "2.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11f486f1ea21e6c10ed15d5a7c77165d0ee443402f0780849d1768e7d9d6fe77"
+checksum = "4b4254325ecad416ab689e27ba51da03ba01a9632bc6e108f5fe7c3c4ad29d58"
 dependencies = [
  "pest",
  "pest_generator",
@@ -4099,25 +3958,24 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.8.6"
+version = "2.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8040c4647b13b210a963c1ed407c1ff4fdfa01c31d6d2a098218702e6664f94f"
+checksum = "6c4c0e91ead7a8f7acecbca6f003fc2e8282b1dbe2dd9c9d2f16aba42995e0a7"
 dependencies = [
  "pest",
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "pest_meta"
-version = "2.8.6"
+version = "2.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89815c69d36021a140146f26659a81d6c2afa33d216d736dd4be5381a7362220"
+checksum = "f9744bc48116fee06334924bb5f2bad41eed5e89bd26e29b0b799f9a3f82c210"
 dependencies = [
  "pest",
- "sha2 0.10.9",
 ]
 
 [[package]]
@@ -4146,7 +4004,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
  "phf_shared",
- "rand 0.8.6",
+ "rand 0.8.7",
 ]
 
 [[package]]
@@ -4160,22 +4018,22 @@ dependencies = [
 
 [[package]]
 name = "pin-project"
-version = "1.1.11"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1749c7ed4bcaf4c3d0a3efc28538844fb29bcdd7d2b67b2be7e20ba861ff517"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.11"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b20ed30f105399776b9c883e68e536ef602a16ae6f596d2c473591d6ad64c6"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4192,12 +4050,12 @@ checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 
 [[package]]
 name = "plist"
-version = "1.9.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "092791278e026273c1b65bbdcfbba3a300f2994c896bd01ab01da613c29c46f1"
+checksum = "7da1d65da6dd5d1e44199ac0f58712d241c0f439f80adea8924d832384087f85"
 dependencies = [
- "base64 0.22.1",
- "indexmap 2.14.0",
+ "base64",
+ "indexmap",
  "quick-xml",
  "serde",
  "time",
@@ -4205,9 +4063,9 @@ dependencies = [
 
 [[package]]
 name = "portable-atomic"
-version = "1.13.1"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
 
 [[package]]
 name = "portable-atomic-util"
@@ -4233,30 +4091,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
-[[package]]
-name = "pprof-pyroscope-fork"
-version = "0.1500.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79f090659c6f3f8c12785dabca0cb7f40154a40dc254c06848598ff31c3be1d8"
-dependencies = [
- "aligned-vec",
- "backtrace",
- "cfg-if",
- "findshlibs",
- "framehop",
- "libc 0.2.186",
- "log",
- "memmap2 0.5.10",
- "nix 0.26.4",
- "object 0.29.0",
- "once_cell",
- "smallvec",
- "spin",
- "symbolic-demangle",
- "tempfile",
- "thiserror",
-]
-
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -4268,9 +4102,9 @@ dependencies = [
 
 [[package]]
 name = "prefix-trie"
-version = "0.8.2"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23370be78b7e5bcbb0cab4a02047eb040279a693c78daad04c2c5f1c24a83503"
+checksum = "4cf6e3177f0684016a5c209b00882e15f8bdd3f3bb48f0491df10cd102d0c6e7"
 dependencies = [
  "either",
  "num-traits",
@@ -4292,16 +4126,6 @@ dependencies = [
  "yansi",
 ]
 
-[[package]]
-name = "prettyplease"
-version = "0.2.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
-dependencies = [
- "proc-macro2",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "proc-macro-crate"
 version = "2.0.0"
@@ -4330,7 +4154,7 @@ dependencies = [
  "proc-macro-error-attr2",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4348,7 +4172,7 @@ version = "0.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "25485360a54d6861439d60facef26de713b1e126bf015ec8f98239467a2b82f7"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "procfs-core",
  "rustix",
 ]
@@ -4359,15 +4183,15 @@ version = "0.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6401bf7b6af22f78b563665d15a22e9aef27775b79b149a66ca022468a4e405"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "hex",
 ]
 
 [[package]]
 name = "prost"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2ea70524a2f82d518bce41317d0fae74151505651af45faf1ffbd6fd33f0568"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -4375,15 +4199,15 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4403,24 +4227,33 @@ checksum = "7347867d0a7e1208d93b46767be83e2b8f978c3dad35f775ac8d8847551d6fe1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "pyroscope"
-version = "2.0.3"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc050356140f6c47dcaab95b6554ce12d461e4902c0a5baf4e888fcc86dcfaf4"
+checksum = "7b9adfbc87341b5976c0bbab196ed2e2c188e2acf9f4d434d46eb9433f0f529c"
 dependencies = [
- "lazy_static",
+ "aligned-vec",
+ "backtrace",
+ "findshlibs",
+ "framehop",
  "libc 0.2.186",
  "libflate",
  "log",
- "names",
- "pprof-pyroscope-fork",
+ "memmap2",
+ "nix 0.31.3",
+ "object 0.39.1",
+ "once_cell",
  "prost",
  "reqwest",
  "serde_json",
+ "smallvec",
+ "spin",
+ "symbolic-demangle",
+ "tempfile",
  "thiserror",
  "url",
  "uuid",
@@ -4443,18 +4276,18 @@ dependencies = [
 
 [[package]]
 name = "quick-xml"
-version = "0.39.2"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "958f21e8e7ceb5a1aa7fa87fab28e7c75976e0bfe7e23ff069e0a260f894067d"
+checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.45"
+version = "1.0.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
 dependencies = [
  "proc-macro2",
 ]
@@ -4479,18 +4312,18 @@ checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
 
 [[package]]
 name = "rancor"
-version = "0.1.1"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a063ea72381527c2a0561da9c80000ef822bdd7c3241b1cc1b12100e3df081ee"
+checksum = "daff8b7b3ccf5f7ba270b3e7a0a4d4c701c5797e38dec27c7e2c3dbb830fed1c"
 dependencies = [
  "ptr_meta",
 ]
 
 [[package]]
 name = "rand"
-version = "0.8.6"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
+checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
 dependencies = [
  "libc 0.2.186",
  "rand_chacha 0.3.1",
@@ -4499,9 +4332,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.4"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.5",
@@ -4509,12 +4342,12 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
  "chacha20",
- "getrandom 0.4.2",
+ "getrandom 0.4.3",
  "rand_core 0.10.1",
 ]
 
@@ -4582,9 +4415,9 @@ dependencies = [
 
 [[package]]
 name = "rapidhash"
-version = "4.4.1"
+version = "4.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e48930979c155e2f33aa36ab3119b5ee81332beb6482199a8ecd6029b80b59"
+checksum = "5da7e78a036ce858e8d55b7e7dc8ba3a88b78350fd2155d3591bbd966b58589e"
 dependencies = [
  "rustversion",
 ]
@@ -4595,7 +4428,7 @@ version = "11.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -4604,7 +4437,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -4644,14 +4477,14 @@ checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "regex"
-version = "1.12.3"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -4661,9 +4494,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.14"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -4672,31 +4505,31 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "rend"
-version = "0.5.3"
+version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cadadef317c2f20755a64d7fdc48f9e7178ee6b0e1f7fce33fa60f1d68a276e6"
+checksum = "663ba70707f96e871406fe10d68128412e619b06d1d47cb91c3a4c6501176240"
 dependencies = [
  "bytecheck",
 ]
 
 [[package]]
 name = "reqwest"
-version = "0.13.3"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62e0021ea2c22aed41653bc7e1419abb2c97e038ff2c33d0e1309e49a97deec0"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
 dependencies = [
- "base64 0.22.1",
+ "base64",
  "bytes",
  "futures-channel",
  "futures-core",
  "futures-util",
- "http 1.4.0",
+ "http",
  "http-body",
  "http-body-util",
  "hyper",
@@ -4734,14 +4567,14 @@ dependencies = [
 
 [[package]]
 name = "rkyv"
-version = "0.8.16"
+version = "0.8.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73389e0c99e664f919275ab5b5b0471391fe9a8de61e1dff9b1eaf56a90f16e3"
+checksum = "815cc8a37159a463064825246cadb07961e25cd9885908606f6d08a98d8f8874"
 dependencies = [
  "bytecheck",
  "bytes",
- "hashbrown 0.17.0",
- "indexmap 2.14.0",
+ "hashbrown 0.17.1",
+ "indexmap",
  "munge",
  "ptr_meta",
  "rancor",
@@ -4753,13 +4586,13 @@ dependencies = [
 
 [[package]]
 name = "rkyv_derive"
-version = "0.8.16"
+version = "0.8.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d2ed0b54125315fb36bd021e82d314d1c126548f871634b483f46b31d13cac6"
+checksum = "c0ed1a78a1b19d184b0daa629dd9a024573173ec7d485b287cb369fb3607cc1c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4793,15 +4626,15 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.27"
+version = "0.1.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d"
+checksum = "b74b56ffa8bb2830709a538c2cbcae9aa062db0d2a42563bfb09bdaae44020eb"
 
 [[package]]
 name = "rustc-hash"
-version = "2.1.2"
+version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
 
 [[package]]
 name = "rustc_version"
@@ -4818,18 +4651,18 @@ version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "errno",
  "libc 0.2.186",
  "linux-raw-sys",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "rustls"
-version = "0.23.40"
+version = "0.23.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
+checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -4842,9 +4675,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
 dependencies = [
  "openssl-probe",
  "rustls-pki-types",
@@ -4852,20 +4685,11 @@ dependencies = [
  "security-framework",
 ]
 
-[[package]]
-name = "rustls-pemfile"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
-dependencies = [
- "rustls-pki-types",
-]
-
 [[package]]
 name = "rustls-pki-types"
-version = "1.14.1"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
+checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
 dependencies = [
  "zeroize",
 ]
@@ -4884,30 +4708,24 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
-
-[[package]]
-name = "ryu"
 version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 
 [[package]]
-name = "safemem"
-version = "0.2.0"
+name = "ruzstd"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e27a8b19b835f7aea908818e871f5cc3a5a186550c30773be987e155e8163d8f"
+checksum = "a7c1c839d570d835527c9a5e4db7cb2198683a988cb9d7293fc8674e6bd58fc8"
+dependencies = [
+ "twox-hash",
+]
 
 [[package]]
-name = "scc"
-version = "2.4.0"
+name = "ryu"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46e6f046b7fef48e2660c57ed794263155d713de679057f2d0c169bfc6e756cc"
-dependencies = [
- "sdd",
-]
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "schannel"
@@ -4918,18 +4736,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "schemars"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
-dependencies = [
- "dyn-clone",
- "ref-cast",
- "serde",
- "serde_json",
-]
-
 [[package]]
 name = "schemars"
 version = "1.2.1"
@@ -4952,7 +4758,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "serde_derive_internals",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4967,12 +4773,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
-[[package]]
-name = "sdd"
-version = "3.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
-
 [[package]]
 name = "secrecy"
 version = "0.10.3"
@@ -4988,7 +4788,7 @@ version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.1",
  "core-foundation",
  "core-foundation-sys",
  "libc 0.2.186",
@@ -5048,7 +4848,7 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5059,14 +4859,14 @@ checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
  "itoa",
  "memchr",
@@ -5083,7 +4883,7 @@ checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5107,31 +4907,13 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "serde_with"
-version = "3.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f05839ce67618e14a09b286535c0d9c94e85ef25469b0e13cb4f844e5593eb19"
-dependencies = [
- "base64 0.22.1",
- "chrono",
- "hex",
- "indexmap 1.9.3",
- "indexmap 2.14.0",
- "schemars 0.9.0",
- "schemars 1.2.1",
- "serde_core",
- "serde_json",
- "time",
-]
-
 [[package]]
 name = "serde_yaml"
 version = "0.9.34+deprecated"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
 dependencies = [
- "indexmap 2.14.0",
+ "indexmap",
  "itoa",
  "ryu",
  "serde",
@@ -5144,7 +4926,7 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b4db627b98b36d4203a7b458cf3573730f2bb591b28871d916dfa9efabfd41f"
 dependencies = [
- "indexmap 2.14.0",
+ "indexmap",
  "itoa",
  "ryu",
  "serde",
@@ -5153,25 +4935,24 @@ dependencies = [
 
 [[package]]
 name = "serial_test"
-version = "3.4.0"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "911bd979bf1070a3f3aa7b691a3b3e9968f339ceeec89e08c280a8a22207a32f"
+checksum = "699f4197115b8a7e7ff19c9a315a4bd6fffec26cc4626ef45ecaea389e081c6d"
 dependencies = [
  "once_cell",
  "parking_lot",
- "scc",
  "serial_test_derive",
 ]
 
 [[package]]
 name = "serial_test_derive"
-version = "3.4.0"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a7d91949b85b0d2fb687445e448b40d322b6b3e4af6b44a29b21d9a5f33e6d9"
+checksum = "94e153fc76e1c6a068703d6d29c508a0b15c061c4b7e43da59cc097bc342673c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5180,17 +4961,6 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
 
-[[package]]
-name = "sha2"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "digest 0.10.7",
-]
-
 [[package]]
 name = "sha2"
 version = "0.11.0"
@@ -5198,8 +4968,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.0",
- "digest 0.11.3",
+ "cpufeatures",
+ "digest",
 ]
 
 [[package]]
@@ -5217,6 +4987,12 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
 [[package]]
 name = "shuttle"
 version = "0.9.1"
@@ -5230,7 +5006,7 @@ dependencies = [
  "corosensei",
  "hex",
  "owo-colors 3.5.0",
- "rand 0.8.6",
+ "rand 0.8.7",
  "rand_core 0.6.4",
  "rand_pcg",
  "scoped-tls",
@@ -5271,9 +5047,9 @@ dependencies = [
 
 [[package]]
 name = "simd-adler32"
-version = "0.3.9"
+version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
 
 [[package]]
 name = "simdutf8"
@@ -5313,15 +5089,15 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.15.1"
+version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 
 [[package]]
 name = "socket2"
-version = "0.6.3"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
  "libc 0.2.186",
  "windows-sys 0.61.2",
@@ -5329,9 +5105,9 @@ dependencies = [
 
 [[package]]
 name = "spin"
-version = "0.10.0"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+checksum = "8abadc99fd9c7bbb7d0ca2b31d72a067d0c0dcd7aad25ab8cac71ba91417694b"
 dependencies = [
  "lock_api",
 ]
@@ -5390,7 +5166,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5402,7 +5178,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5434,23 +5210,22 @@ checksum = "b7401a30af6cb5818bb64852270bb722533397edcfc7344954a38f420819ece2"
 
 [[package]]
 name = "symbolic-common"
-version = "12.18.3"
+version = "13.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "332615d90111d8eeaf86a84dc9bbe9f65d0d8c5cf11b4caccedc37754eb0dcfd"
+checksum = "ddfa0014ff4e423a1bb8881453c7a29181eb14fe1dbc8e0197ebfa081903f3ed"
 dependencies = [
  "debugid",
- "memmap2 0.9.10",
+ "memmap2",
  "stable_deref_trait",
  "uuid",
 ]
 
 [[package]]
 name = "symbolic-demangle"
-version = "12.18.3"
+version = "13.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "912017718eb4d21930546245af9a3475c9dccf15675a5c215664e76621afc471"
+checksum = "2a213276280a1a737ff5fb89ae2a70ba51d1d4608e74736beb92f257f125f1aa"
 dependencies = [
- "cpp_demangle",
  "rustc-demangle",
  "symbolic-common",
 ]
@@ -5468,9 +5243,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.117"
+version = "2.0.119"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5494,7 +5269,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5510,10 +5285,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand 2.4.1",
- "getrandom 0.4.2",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5523,7 +5298,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
 dependencies = [
  "rustix",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5553,26 +5328,25 @@ checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "thread_local"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "time"
-version = "0.3.47"
+version = "0.3.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+checksum = "18dfaaeddcb932337b5e7866ee7d0ce9b76d2fd092997146f187ec09b4558a50"
 dependencies = [
  "deranged",
- "itoa",
  "num-conv",
  "powerfmt",
  "serde_core",
@@ -5582,15 +5356,15 @@ dependencies = [
 
 [[package]]
 name = "time-core"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
 
 [[package]]
 name = "time-macros"
-version = "0.2.27"
+version = "0.2.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+checksum = "c431b87111666e491a90baa837f914fb45cd5dc3c268591b0220ff5057f2085f"
 dependencies = [
  "num-conv",
  "time-core",
@@ -5608,9 +5382,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -5623,9 +5397,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.52.1"
+version = "1.53.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67dee974fe86fd92cc45b7a95fdd2f99a36a6d7b0d431a231178d3d670bbcc6"
+checksum = "d988bcd52dbe076d3d46903332f58c912b87a2c49b1428419a5845154762ffee"
 dependencies = [
  "bytes",
  "libc 0.2.186",
@@ -5639,13 +5413,13 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.7.0"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+checksum = "6328af13490e73a9b4694030fafd93f8c8c6a9dede33e821c3fc63eddf8042ba"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5738,7 +5512,7 @@ version = "0.20.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "70f427fce4d84c72b5b732388bf4a9f4531b53f74e2887e3ecb2481f68f66d81"
 dependencies = [
- "indexmap 2.14.0",
+ "indexmap",
  "toml_datetime",
  "winnow 0.5.40",
 ]
@@ -5749,7 +5523,7 @@ version = "0.22.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
 dependencies = [
- "indexmap 2.14.0",
+ "indexmap",
  "serde",
  "serde_spanned",
  "toml_datetime",
@@ -5782,23 +5556,23 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.8"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
- "base64 0.22.1",
- "bitflags 2.11.1",
+ "base64",
+ "bitflags 2.13.1",
  "bytes",
  "futures-util",
- "http 1.4.0",
+ "http",
  "http-body",
- "iri-string",
  "mime",
  "pin-project-lite",
  "tower",
  "tower-layer",
  "tower-service",
  "tracing",
+ "url",
 ]
 
 [[package]]
@@ -5833,7 +5607,7 @@ checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5903,7 +5677,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ad06847b7afb65c7866a36664b75c40b895e318cea4f71299f013fb22965329d"
 dependencies = [
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5912,11 +5686,17 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "twox-hash"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ea3136b675547379c4bd395ca6b938e5ad3c3d20fad76e7fe85f9e0d011419c"
+
 [[package]]
 name = "typenum"
-version = "1.20.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
 name = "ucd-trie"
@@ -5944,9 +5724,9 @@ checksum = "3b09c83c3c29d37506a3e260c08c03743a6bb66a9cd432c6934ab501a190571f"
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.13.2"
+version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9629274872b2bfaf8d66f5f15725007f635594914870f65218920345aa11aa8c"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
 
 [[package]]
 name = "unicode-width"
@@ -6005,11 +5785,11 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.23.1"
+version = "1.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76"
+checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
 dependencies = [
- "getrandom 0.4.2",
+ "getrandom 0.4.3",
  "js-sys",
  "serde_core",
  "sha1_smol",
@@ -6035,7 +5815,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ba782755fc073877e567c2253c0be48e4aa9a254c232d36d3985dfae0bd5205"
 dependencies = [
  "libc 0.2.186",
- "nix 0.31.2",
+ "nix 0.31.3",
 ]
 
 [[package]]
@@ -6070,27 +5850,18 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasip2"
-version = "1.0.3+wasi-0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
-dependencies = [
- "wit-bindgen 0.57.1",
-]
-
-[[package]]
-name = "wasip3"
-version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+version = "1.0.4+wasi-0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
 dependencies = [
- "wit-bindgen 0.51.0",
+ "wit-bindgen",
 ]
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.120"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df52b6d9b87e0c74c9edfa1eb2d9bf85e5d63515474513aa50fa181b3c4f5db1"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -6101,9 +5872,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.70"
+version = "0.4.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af934872acec734c2d80e6617bbb5ff4f12b052dd8e6332b0817bce889516084"
+checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -6111,9 +5882,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.120"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78b1041f495fb322e64aca85f5756b2172e35cd459376e67f2a6c9dffcedb103"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -6121,65 +5892,31 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.120"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dcd0ff20416988a18ac686d4d4d0f6aae9ebf08a389ff5d29012b05af2a1b41"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
 dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.120"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49757b3c82ebf16c57d69365a142940b384176c24df52a087fb748e2085359ea"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
 dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "wasm-encoder"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
-dependencies = [
- "leb128fmt",
- "wasmparser",
-]
-
-[[package]]
-name = "wasm-metadata"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
-dependencies = [
- "anyhow",
- "indexmap 2.14.0",
- "wasm-encoder",
- "wasmparser",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
-dependencies = [
- "bitflags 2.11.1",
- "hashbrown 0.15.5",
- "indexmap 2.14.0",
- "semver",
-]
-
 [[package]]
 name = "web-sys"
-version = "0.3.97"
+version = "0.3.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2eadbac71025cd7b0834f20d1fe8472e8495821b4e9801eb0a60bd1f19827602"
+checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -6228,7 +5965,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -6239,7 +5976,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -6375,100 +6112,12 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "wit-bindgen"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
-dependencies = [
- "wit-bindgen-rust-macro",
-]
-
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
-[[package]]
-name = "wit-bindgen-core"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
-dependencies = [
- "anyhow",
- "heck 0.5.0",
- "wit-parser",
-]
-
-[[package]]
-name = "wit-bindgen-rust"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
-dependencies = [
- "anyhow",
- "heck 0.5.0",
- "indexmap 2.14.0",
- "prettyplease",
- "syn 2.0.117",
- "wasm-metadata",
- "wit-bindgen-core",
- "wit-component",
-]
-
-[[package]]
-name = "wit-bindgen-rust-macro"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
-dependencies = [
- "anyhow",
- "prettyplease",
- "proc-macro2",
- "quote",
- "syn 2.0.117",
- "wit-bindgen-core",
- "wit-bindgen-rust",
-]
-
-[[package]]
-name = "wit-component"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
-dependencies = [
- "anyhow",
- "bitflags 2.11.1",
- "indexmap 2.14.0",
- "log",
- "serde",
- "serde_derive",
- "serde_json",
- "wasm-encoder",
- "wasm-metadata",
- "wasmparser",
- "wit-parser",
-]
-
-[[package]]
-name = "wit-parser"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
-dependencies = [
- "anyhow",
- "id-arena",
- "indexmap 2.14.0",
- "log",
- "semver",
- "serde",
- "serde_derive",
- "serde_json",
- "unicode-xid",
- "wasmparser",
-]
-
 [[package]]
 name = "writeable"
 version = "0.6.3"
@@ -6498,9 +6147,9 @@ checksum = "bfe269e7b803a5e8e20cbd97860e136529cd83bf2c9c6d37b142467e7e1f051f"
 
 [[package]]
 name = "yoke"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
 dependencies = [
  "stable_deref_trait",
  "yoke-derive",
@@ -6515,35 +6164,35 @@ checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.8.48"
+version = "0.8.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9"
+checksum = "b7cbbc0a705a0fd05cc3676525980d2bf5a9bc4adac6d6475209a7887cf59d19"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.48"
+version = "0.8.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4"
+checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "zerofrom"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
 dependencies = [
  "zerofrom-derive",
 ]
@@ -6556,15 +6205,15 @@ checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
  "synstructure",
 ]
 
 [[package]]
 name = "zeroize"
-version = "1.8.2"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 
 [[package]]
 name = "zerotrie"
@@ -6596,11 +6245,11 @@ checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "zmij"
-version = "1.0.21"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/Cargo.toml b/Cargo.toml
index bea085ce5f..f41af4d83d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -85,41 +85,41 @@ vpcmap = { path = "./vpcmap", package = "dataplane-vpcmap", features = [] }
 # External
 afpacket = { version = "0.2.3", default-features = false, features = [] }
 ahash = { version = "0.8.12", default-features = false, features = [] }
-anyhow = { version = "1.0.102", default-features = false, features = ["std"] }
-arc-swap = { version = "1.9.1", default-features = false, features = [] }
-arrayvec = { version = "0.7.6", default-features = false, features = [] }
+anyhow = { version = "1.0.103", default-features = false, features = ["std"] }
+arc-swap = { version = "1.9.2", default-features = false, features = [] }
+arrayvec = { version = "0.7.8", default-features = false, features = [] }
 async-trait = { version = "0.1.89", default-features = false, features = [] }
 atomic-instant-full = { version = "0.1.1", default-features = false, features = [] }
 axum = { version = "0.8.9", default-features = false, features = [] }
 axum-server = { version = "0.8.0", default-features = false, features = [] }
 bindgen = { version = "0.72.1", default-features = false, features = [] }
-bitflags = { version = "2.11.1", default-features = false, features = [] }
+bitflags = { version = "2.13.1", default-features = false, features = [] }
 bnum = { version = "0.14.4", default-features = false, features = [] }
 bolero = { version = "0.13.4", default-features = false, features = [] }
 bytecheck = { version = "0.8.2", default-features = false, features = [] }
-bytes = { version = "1.11.1", default-features = false, features = [] }
+bytes = { version = "1.12.1", default-features = false, features = [] }
 caps = { version = "0.5.6", default-features = false, features = [] }
-chrono = { version = "0.4.44", default-features = false, features = [] }
-clap = { version = "4.6.1", default-features = true, features = [] }
+chrono = { version = "0.4.45", default-features = false, features = [] }
+clap = { version = "4.6.2", default-features = true, features = [] }
 color-eyre = { version = "0.6.5", default-features = false, features = [] }
 colored = { version = "3.1.1", default-features = false, features = [] }
 ctrlc = { version = "3.5.2", default-features = false, features = [] }
-dashmap = { version = "6.1.0", default-features = false, features = [] }
+dashmap = { version = "6.2.1", default-features = false, features = [] }
 derive_builder = { version = "0.20.2", default-features = false, features = [] }
 dotenvy = { version = "0.15.7", default-features = false, features = [] }
 downcast-rs = { version = "2.0.2", default-features = false, features = [] }
 doxygen-bindgen = { version = "0.1.3", default-features = false, features = [] }
 dyn-iter = { version = "1.0.1", default-features = false, features = [] }
-etherparse = { version = "0.20.1", default-features = false, features = [] }
+etherparse = { version = "0.20.3", default-features = false, features = [] }
 fixin = { git = "https://github.com/githedgehog/fixin", branch = "main", features = [] }
 futures = { version = "0.3.32", default-features = false, features = [] }
 futures-util = { version = "0.3.32", default-features = false, features = ["std"] }
-hashbrown = { version = "0.17.0", default-features = false, features = [] }
+hashbrown = { version = "0.17.1", default-features = false, features = [] }
 hwlocality = { version = "1.0.0-alpha.12", default-features = false, features = [] }
-hyper = { version = "1.9.0", default-features = false, features = [] }
+hyper = { version = "1.10.1", default-features = false, features = [] }
 hyper-util = { version = "0.1.20", default-features = false, features = [] }
 indenter = { version = "0.3.4", default-features = false, features = [] }
-inotify = { version = "0.11.1", default-features = false, features = [] }
+inotify = { version = "0.11.4", default-features = false, features = [] }
 ipnet = { version = "2.12.0", default-features = false, features = [] }
 k8s-openapi = { version = "0.27.1", default-features = false, features = [] }
 kanal = { version = "0.1.1", default-features = false, features = [] }
@@ -129,63 +129,63 @@ kube-core = { version = "3.1.0", default-features = false, features = [] }
 left-right = { git = "https://github.com/githedgehog/left-right.git", branch = "fredi/fix-writehandle-drop", default-features = false, features = [] }
 libc = { version = "1.0.0-alpha.3", default-features = false, features = [] }
 linkme = { version = "0.3.36", default-features = false, features = [] }
-log = { version = "0.4.29", default-features = false, features = [] } # TODO: try to remove this
+log = { version = "0.4.33", default-features = false, features = [] } # TODO: try to remove this
 loom = { version = "0.7.2", default-features = false, features = [] }
-memmap2 = { version = "0.9.10", default-features = false, features = [] }
-metrics = { version = "0.24.5", default-features = false, features = [] }
+memmap2 = { version = "0.9.11", default-features = false, features = [] }
+metrics = { version = "0.24.6", default-features = false, features = [] }
 metrics-exporter-prometheus = { version = "0.18.3", default-features = false, features = [] }
 miette = { version = "7.6.0", default-features = false, features = [] }
-mio = { version = "1.2.0", default-features = false, features = [] }
+mio = { version = "1.2.2", default-features = false, features = [] }
 multi_index_map = { version = "0.15.1", default-features = false, features = [] }
-n-vm = { git = "https://github.com/githedgehog/testn.git", tag = "v0.0.9", default-features = false, features = [], package = "n-vm" }
+n-vm = { git = "https://github.com/githedgehog/testn.git", tag = "v0.0.10", default-features = false, features = [], package = "n-vm" }
 netdev = { version = "0.43.0", default-features = false, features = [] }
 netgauze-bgp-pkt = { version = "0.11.0", features = [] }
 netgauze-bmp-pkt = { version = "0.11.0", features = ["codec"] }
-nix = { version = "0.31.2", default-features = false, features = [] }
+nix = { version = "0.31.3", default-features = false, features = [] }
 num-derive = { version = "0.4.2", default-features = false, features = [] }
 num-traits = { version = "0.2.19", default-features = false, features = [] }
 once_cell = { version = "1.21.4", default-features = false, features = [] }
 ordermap = { version = "1.2.0", default-features = false, features = [] }
 parking_lot = { version = "0.12.5", default-features = false, features = [] }
 pci-ids = { version = "0.2.6", default-features = false, features = [] }
-prefix-trie = { version = "0.8.2", default-features = false, features = [] }
+prefix-trie = { version = "0.8.4", default-features = false, features = [] }
 pretty_assertions = { version = "1.4.1", default-features = false, features = [] }
 priority-queue = { version = "2.7.0", default-features = false, features = [] }
 proc-macro2 = { version = "1.0.106", default-features = false, features = [] }
 procfs = { version = "0.18.0", default-features = false, features = [] }
-pyroscope = { version = "2.0.3", default-features = false, features = ["backend-pprof-rs"] }
-quote = { version = "1.0.45", default-features = false, features = [] }
-rand = { version = "0.10.1", default-features = false, features = ["thread_rng"] }
-rapidhash = { version = "4.4.1", default-features = false, features = [] }
+pyroscope = { version = "2.1.0", default-features = false, features = ["backend-pprof-rs"] }
+quote = { version = "1.0.46", default-features = false, features = [] }
+rand = { version = "0.10.2", default-features = false, features = ["thread_rng"] }
+rapidhash = { version = "4.5.1", default-features = false, features = [] }
 reedline = { version = "0.47.0", default-features = false, features = [] }
-rkyv = { version = "0.8.16", default-features = false, features = [] }
+rkyv = { version = "0.8.17", default-features = false, features = [] }
 roaring = { version = "0.11.4", default-features = false, features = [] }
 rtnetlink = { git = "https://github.com/githedgehog/rtnetlink.git", branch = "hh/tc-actions3", default-features = false, features = [] }
-rustls = { version = "0.23.40", default-features = false, features = [] }
+rustls = { version = "0.23.42", default-features = false, features = [] }
 schemars = { version = "1", default-features = false, features = [] }
 serde = { version = "1.0.228", default-features = false, features = [] }
-serde_json = { version = "1.0.149", default-features = false, features = [] }
+serde_json = { version = "1.0.150", default-features = false, features = [] }
 serde_yaml_ng = { version = "0.10.0", default-features = false, features = [] }
-serial_test = { version = "3.4.0", default-features = false, features = [] }
+serial_test = { version = "3.5.0", default-features = false, features = [] }
 sha2 = { version = "0.11.0", default-features = false, features = [] }
 shuttle = { version = "0.9.1", default-features = false, features = [] }
 small-map = { version = "0.1.5", default-features = false, features = [] }
 static_assertions = { version = "1.1.0", default-features = false, features = [] }
 strum = { version = "0.28.0", default-features = false, features = [] }
 strum_macros = { version = "0.28.0", default-features = false, features = [] }
-syn = { version = "2.0.117", default-features = false, features = [] }
+syn = { version = "2.0.119", default-features = false, features = [] }
 thiserror = { version = "2.0.18", default-features = false, features = [] }
-thread_local = { version = "1.1.9", default-features = false, features = [] }
-tokio = { version = "1.52.1", default-features = false, features = [] }
+thread_local = { version = "1.1.10", default-features = false, features = [] }
+tokio = { version = "1.53.0", default-features = false, features = [] }
 tokio-util = { version = "0.7.18", default-features = false, features = [] }
-tonic = { version = "0.14.5", default-features = false, features = [] }
+tonic = { version = "0.14.6", default-features = false, features = [] }
 tracing = { version = "0.1.44", default-features = false, features = [] }
 tracing-error = { version = "0.2.1", default-features = false, features = [] }
 tracing-subscriber = { version = "0.3.23", default-features = false, features = [] }
 tracing-test = { version = "0.2.6", default-features = false, features = [] }
 ureq = { version = "3.3.0", default-features = false, features = [] }
 url = { version = "2.5.8", default-features = false, features = [] }
-uuid = { version = "1.23.1", default-features = false, features = [] }
+uuid = { version = "1.24.0", default-features = false, features = [] }
 
 [profile.dev]
 panic = "unwind"
diff --git a/cli/bin/main.rs b/cli/bin/main.rs
index 3b7801b4f7..4dbdbbb0a6 100644
--- a/cli/bin/main.rs
+++ b/cli/bin/main.rs
@@ -37,7 +37,7 @@ fn ask_user(question: &str) -> bool {
     let mut answer = String::new();
     loop {
         println!("{question}");
-        answer.truncate(0);
+        answer.clear();
         let _ = stdin().read_line(&mut answer);
         if let Some('\n') = answer.chars().next_back() {
             answer.pop();
diff --git a/config/src/display.rs b/config/src/display.rs
index 09731c563d..8e939b78a8 100644
--- a/config/src/display.rs
+++ b/config/src/display.rs
@@ -78,7 +78,7 @@ impl Display for VpcExpose {
             if !nat.as_range.is_empty() {
                 write!(f, "{SEP}       as:")?;
                 nat.as_range.iter().for_each(|pfx| {
-                    let _ = write!(f, " {pfx} proto: {:?} NAT:{}", nat.proto, &nat.config);
+                    let _ = write!(f, " {pfx} proto: {:?} NAT:{}", nat.proto, nat.config);
                 });
                 carriage = true;
             }
diff --git a/dataplane/src/drivers/kernel/worker.rs b/dataplane/src/drivers/kernel/worker.rs
index 48a80935eb..7711638a9f 100644
--- a/dataplane/src/drivers/kernel/worker.rs
+++ b/dataplane/src/drivers/kernel/worker.rs
@@ -271,7 +271,7 @@ fn packet_recv(
     max_to_read: usize,
     pkts: &mut Vec<Box<Packet<TestBuffer>>>,
 ) -> Result<(), nix::Error> {
-    let mut raw = [0u8; 9100];
+    let mut raw = [0u8; 9600];
     let mut ret = Ok(());
     pkts.clear();
     while pkts.len() < max_to_read {
diff --git a/dataplane/src/packet_processor/egress.rs b/dataplane/src/packet_processor/egress.rs
index e6b75cded6..5e8a66b48d 100644
--- a/dataplane/src/packet_processor/egress.rs
+++ b/dataplane/src/packet_processor/egress.rs
@@ -27,6 +27,7 @@ pub struct Egress {
     atabler: AtableReader,
 }
 
+#[allow(dead_code)]
 fn determine_ether_type<Buf: PacketBufferMut>(packet: &Packet<Buf>) -> Option<EthType> {
     // FIXME(fredi): this should consider interface type; e.g. for vlan
     if packet.try_ipv4().is_some() {
@@ -40,8 +41,8 @@ fn determine_ether_type<Buf: PacketBufferMut>(packet: &Packet<Buf>) -> Option<Et
     }
 }
 
+#[allow(dead_code)]
 impl Egress {
-    #[allow(dead_code)]
     pub fn new(name: &str, iftr: IfTableReader, atabler: AtableReader) -> Self {
         let name = name.to_owned();
         Self {
diff --git a/deny.toml b/deny.toml
index f6173a17ac..cc4c4356e6 100644
--- a/deny.toml
+++ b/deny.toml
@@ -1,6 +1,15 @@
 # see https://github.com/EmbarkStudios/cargo-deny for docs
 [graph]
-targets = []
+# We only ship on Linux, so scope the dependency graph to the Linux targets we
+# actually build for. This keeps Windows/macOS-only crates (e.g. windows-sys,
+# winapi) out of advisory/license/ban checks, where they are dangerous noise.
+targets = [
+    "x86_64-unknown-linux-gnu",
+    "aarch64-unknown-linux-gnu",
+    "x86_64-unknown-linux-musl",
+    "aarch64-unknown-linux-musl",
+    "wasm32-wasip1",
+]
 #exclude = []
 all-features = false
 no-default-features = false
@@ -12,15 +21,10 @@ feature-depth = 1
 
 [advisories]
 ignore = [
+    # paste is unmaintained but is needed by netlink-packet-core.  We should submit a patch when possible.
     "RUSTSEC-2024-0436",
-    # this relates to the use of abandoned "safemem" crate in cloud-hypervisor.
-    # Since cloud-hypervisor is only a dev-dependency, we can safely ignore this.
-    "RUSTSEC-2023-0081",
-    # instant is unmaintained but is needed by afpacket with the tokio feature, remove when we stop using this crate in favor of our own
-    "RUSTSEC-2024-0384",
-    # rustls_pemfile is unmaintained, but we aren't actually even using it.  We don't enable the feature of bollard
-    # which would pull this in.
-    "RUSTSEC-2025-0134"
+    # proc-macro-error2 is unmaintained but is needed by multi_index_map_derive, and our own fixin; ignore until both dependencies have migrated away from it.
+    "RUSTSEC-2026-0173",
 ]
 
 [licenses]
diff --git a/flow-entry/src/flow_table/table.rs b/flow-entry/src/flow_table/table.rs
index 6a14d11a0d..c96a920df4 100644
--- a/flow-entry/src/flow_table/table.rs
+++ b/flow-entry/src/flow_table/table.rs
@@ -474,7 +474,7 @@ mod tests {
 
             flow_table.insert(flow_info).unwrap();
             let result = flow_table.remove(&flow_key).unwrap();
-            assert!(result.0 == flow_key);
+            assert_eq!(result.0, flow_key);
         }
 
         #[tokio::test]
diff --git a/flow-filter/src/setup.rs b/flow-filter/src/setup.rs
index 5189f7f7d9..ffa77600b3 100644
--- a/flow-filter/src/setup.rs
+++ b/flow-filter/src/setup.rs
@@ -479,7 +479,7 @@ fn get_split_prefixes_for_manifest(
             let mut fragments_to_check = vec![*prefix];
             'next_fragment: while let Some(fragment) = fragments_to_check.pop() {
                 // Split the fragment into sub-fragments as long as we find overlapping prefixes
-                for (overlap_prefix, _overlap_data) in overlaps.iter() {
+                for overlap_prefix in overlaps.keys() {
                     if fragment.overlaps(overlap_prefix) && !overlap_prefix.covers(&fragment) {
                         fragments_to_check.extend(split_overlapping(&fragment, overlap_prefix));
                         continue 'next_fragment;
diff --git a/justfile b/justfile
index f00041b451..56a13164b2 100644
--- a/justfile
+++ b/justfile
@@ -62,7 +62,7 @@ version_platform := if platform == "x86-64-v3" { "" } else { "-" + platform }
 version_profile := if profile == "release" { "" } else { "-" + profile }
 version_san := if sanitize == "" { "" } else { "-san." + replace(sanitize, ",", ".") }
 version_feat := if features == "" { "" } else { "-feat." + replace(features, ",", ".") }
-version := env("VERSION", "") || `git describe --tags --dirty --always` + version_platform + version_profile + version_san + version_feat + version_extra
+version := env("VERSION", `git describe --tags --dirty --always` + version_platform + version_profile + version_san + version_feat + version_extra)
 
 # Print version that will be used in the build
 version:
diff --git a/lpm/src/prefix/mod.rs b/lpm/src/prefix/mod.rs
index 2a91fd029d..236290f94b 100644
--- a/lpm/src/prefix/mod.rs
+++ b/lpm/src/prefix/mod.rs
@@ -1819,9 +1819,9 @@ mod tests {
 
                 if one == two {
                     // Consitency between PartialEq and PartialOrd
-                    assert!(one.partial_cmp(two) == Some(Ordering::Equal));
+                    assert_eq!(one.partial_cmp(two), Some(Ordering::Equal));
                     // PartialEq is symmetric
-                    assert!(two == one);
+                    assert_eq!(two, one);
                 }
 
                 if let (Ok(one_int), Ok(two_int)) = (u128::try_from(one), u128::try_from(two)) {
diff --git a/mgmt/src/processor/confbuild/namegen.rs b/mgmt/src/processor/confbuild/namegen.rs
index 3fd372023b..d22e72af94 100644
--- a/mgmt/src/processor/confbuild/namegen.rs
+++ b/mgmt/src/processor/confbuild/namegen.rs
@@ -66,7 +66,7 @@ impl VpcConfigNames for Vpc {
     fn import_plist_peer(&self, remote_name: &str) -> String {
         format!(
             "{}-FROM-{}",
-            &self.name.to_uppercase(),
+            self.name.to_uppercase(),
             remote_name.to_uppercase()
         )
     }
@@ -77,18 +77,18 @@ impl VpcConfigNames for Vpc {
     fn adv_plist(&self, remote_name: &str) -> String {
         format!(
             "ADV-TO-{}-FOR-{}",
-            &self.name.to_uppercase(),
+            self.name.to_uppercase(),
             remote_name.to_uppercase()
         )
     }
     fn adv_plist_desc(&self, remote_name: &str) -> String {
         format!(
             "Prefixes advertised to {} for {}",
-            &self.name.to_uppercase(),
+            self.name.to_uppercase(),
             remote_name.to_uppercase()
         )
     }
     fn adv_rmap(&self) -> String {
-        format!("ADV-TO-{}", &self.name.to_uppercase())
+        format!("ADV-TO-{}", self.name.to_uppercase())
     }
 }
diff --git a/nat/src/portfw/portfwtable/portrange.rs b/nat/src/portfw/portfwtable/portrange.rs
index 1d76de1cd3..56d21a035c 100644
--- a/nat/src/portfw/portfwtable/portrange.rs
+++ b/nat/src/portfw/portfwtable/portrange.rs
@@ -84,7 +84,7 @@ impl PortRange {
     /// Given a `PortRange` and a port, provide the corresponding port in another `PortRange`,
     /// provided that the port falls within ranges. Both ranges need to be of the same size.
     pub fn map_port_to(self, port: NonZero<u16>, other: Self) -> Option<NonZero<u16>> {
-        debug_assert!(self.len() == other.len());
+        debug_assert_eq!(self.len(), other.len());
         let index = self.indexof(port)?;
         other.get_port_at(index)
     }
diff --git a/nat/src/portfw/test.rs b/nat/src/portfw/test.rs
index 5fcc382854..51c822a926 100644
--- a/nat/src/portfw/test.rs
+++ b/nat/src/portfw/test.rs
@@ -364,7 +364,7 @@ mod nf_test {
         packet.try_tcp_mut().unwrap().set_ack(true);
         let output = process_packet(&mut pipeline, packet);
         assert!(output.meta().flow_info.is_some());
-        assert!(get_flow_status(&output) != Some(FlowStatus::Active)); // it may be None if the nf expiration removes it
+        assert_ne!(get_flow_status(&output), Some(FlowStatus::Active)); // it may be None if the nf expiration removes it
         assert_eq!(get_pfw_flow_status(&output), Some(NatFlowStatus::Closed));
         println!("{flow_table}");
         assert_eq!(flow_table.len().unwrap(), 2);
@@ -400,7 +400,7 @@ mod nf_test {
         packet.try_tcp_mut().unwrap().set_ack(true);
         let output = process_packet(&mut pipeline, packet);
         assert!(output.meta().flow_info.is_some());
-        assert!(get_flow_status(&output) != Some(FlowStatus::Active)); // may be cancelled or none
+        assert_ne!(get_flow_status(&output), Some(FlowStatus::Active)); // may be cancelled or none
         assert_eq!(get_pfw_flow_status(&output), Some(NatFlowStatus::Closed));
         println!("{flow_table}");
         assert_eq!(flow_table.len().unwrap(), 2);
@@ -446,7 +446,7 @@ mod nf_test {
         packet.try_tcp_mut().unwrap().set_ack(true);
         let output = process_packet(&mut pipeline, packet);
         assert!(output.meta().flow_info.is_some());
-        assert!(get_flow_status(&output) != Some(FlowStatus::Active)); // may be cancelled or none
+        assert_ne!(get_flow_status(&output), Some(FlowStatus::Active)); // may be cancelled or none
         assert_eq!(get_pfw_flow_status(&output), Some(NatFlowStatus::Closed));
         println!("{flow_table}");
         assert_eq!(flow_table.len().unwrap(), 2);
diff --git a/nat/src/stateful/apalloc/mod.rs b/nat/src/stateful/apalloc/mod.rs
index ce91b8d0e7..cb79e50683 100644
--- a/nat/src/stateful/apalloc/mod.rs
+++ b/nat/src/stateful/apalloc/mod.rs
@@ -441,7 +441,7 @@ mod tests {
             Ipv4Addr::new(1, 1, 1, 1),
             Ipv4Addr::new(1, 1, 1, 1),
         );
-        assert!(key1 == key2);
+        assert_eq!(key1, key2);
 
         let key1 = PoolTableKey::new(
             NextHeader::TCP,
diff --git a/nat/src/stateful/apalloc/port_alloc.rs b/nat/src/stateful/apalloc/port_alloc.rs
index e95f378892..51f7b9cb8a 100644
--- a/nat/src/stateful/apalloc/port_alloc.rs
+++ b/nat/src/stateful/apalloc/port_alloc.rs
@@ -720,7 +720,7 @@ impl<I: NatIpWithBitmap> AllocatedPortBlockMap<I> {
     fn allocated_port_ranges(&self) -> BTreeSet<PortRange> {
         let blocks = self.0.read().unwrap();
         let mut ranges = BTreeSet::<PortRange>::new();
-        for (_, block) in blocks.iter() {
+        for block in blocks.values() {
             if let Some(block) = block.upgrade() {
                 merge_ranges(&mut ranges, block.allocated_port_ranges());
             }
diff --git a/nat/src/stateful/nf.rs b/nat/src/stateful/nf.rs
index e9c7053110..b418d81df7 100644
--- a/nat/src/stateful/nf.rs
+++ b/nat/src/stateful/nf.rs
@@ -148,10 +148,7 @@ impl StatefulNat {
             | NatFlowStatus::CHalfClose
             | NatFlowStatus::SHalfClose
             | NatFlowStatus::LastAck => Some(Self::MASQUERADE_CLOSING_TIMEOUT),
-            NatFlowStatus::OneWay => {
-                warn!("Unexpected oneway state");
-                None
-            }
+            NatFlowStatus::OneWay => None,
         };
 
         // extend the duration of the flow according to the new status
diff --git a/nat/src/stateless/mod.rs b/nat/src/stateless/mod.rs
index 2a80c20882..918274ce53 100644
--- a/nat/src/stateless/mod.rs
+++ b/nat/src/stateless/mod.rs
@@ -261,10 +261,7 @@ impl StatelessNat {
         let nfi = self.name();
 
         // Get source and destination IP addresses
-        let Some((src_addr, dst_addr)) = packet
-            .ip_source()
-            .and_then(|src| packet.ip_destination().map(|dst| (src, dst)))
-        else {
+        let Some((src_addr, dst_addr)) = packet.ip_source().zip(packet.ip_destination()) else {
             error!("{nfi}: Failed to get IP addresses!");
             return Err(StatelessNatError::NoIpHeader);
         };
diff --git a/nat/src/stateless/setup/range_builder.rs b/nat/src/stateless/setup/range_builder.rs
index f4258b78ae..1aa66ad85c 100644
--- a/nat/src/stateless/setup/range_builder.rs
+++ b/nat/src/stateless/setup/range_builder.rs
@@ -336,7 +336,7 @@ fn create_new_ranges(
 
     match ip_addr_diff {
         0 => {
-            debug_assert!(addr_port_cursor.0 == range_end.0);
+            debug_assert_eq!(addr_port_cursor.0, range_end.0);
             // We're only covering a single IP address. Create the relevant port range over this single
             // address and return.
             ranges.push(IpPortRange {
diff --git a/nat/src/stateless/test.rs b/nat/src/stateless/test.rs
index 7b884815c1..347d537024 100644
--- a/nat/src/stateless/test.rs
+++ b/nat/src/stateless/test.rs
@@ -623,7 +623,8 @@ fn test_full_config() {
     config.validate().expect("Failed to validate config");
 
     let nat_tables = build_nat_configuration(&config.external.overlay.vpc_table).unwrap();
-    println!("Nat tables: {:#?}", &nat_tables);
+
+    println!("Nat tables: {nat_tables:#?}");
 
     let (mut nat, mut tablesw) = StatelessNat::new("stateless-nat");
     tablesw.update_nat_tables(nat_tables.clone());
diff --git a/net/src/buffer/test_buffer.rs b/net/src/buffer/test_buffer.rs
index 1b6829a06d..517749dc35 100644
--- a/net/src/buffer/test_buffer.rs
+++ b/net/src/buffer/test_buffer.rs
@@ -143,8 +143,9 @@ impl TrimFromStart for TestBuffer {
     type Error = MemoryBufferNotLongEnough;
     fn trim_from_start(&mut self, len: u16) -> Result<&mut [u8], MemoryBufferNotLongEnough> {
         debug_assert!((self.headroom + self.tailroom) as usize <= self.buffer.len());
-        debug_assert!(
-            (self.headroom + self.tailroom) as usize + self.as_ref().len() == self.buffer.len()
+        debug_assert_eq!(
+            (self.headroom + self.tailroom) as usize + self.as_ref().len(),
+            self.buffer.len()
         );
         if (self.headroom + self.tailroom + len) as usize > self.buffer.len() {
             return Err(MemoryBufferNotLongEnough);
@@ -158,8 +159,9 @@ impl TrimFromEnd for TestBuffer {
     type Error = MemoryBufferNotLongEnough;
     fn trim_from_end(&mut self, len: u16) -> Result<&mut [u8], MemoryBufferNotLongEnough> {
         debug_assert!((self.headroom + self.tailroom) as usize <= self.buffer.len());
-        debug_assert!(
-            (self.headroom + self.tailroom) as usize + self.as_ref().len() == self.buffer.len()
+        debug_assert_eq!(
+            (self.headroom + self.tailroom) as usize + self.as_ref().len(),
+            self.buffer.len()
         );
         if (self.headroom + self.tailroom + len) as usize > self.buffer.len() {
             return Err(MemoryBufferNotLongEnough);
diff --git a/net/src/eth/mac.rs b/net/src/eth/mac.rs
index ea7b5bc44a..e7bef0f689 100644
--- a/net/src/eth/mac.rs
+++ b/net/src/eth/mac.rs
@@ -3,7 +3,7 @@
 
 //! Mac address type and logic.
 
-use arrayvec::ArrayVec;
+use arrayvec::{ArrayString, ArrayVec};
 use std::{
     fmt::{Debug, Display, LowerHex, UpperHex},
     str::FromStr,
@@ -184,11 +184,15 @@ impl Mac {
 
 impl Display for Mac {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        use std::fmt::Write as _; // bring in scope
+        // MAC always renders as 17 chars
+        let mut buf = ArrayString::<17>::new();
         write!(
-            f,
-            "{:<02x}:{:<02x}:{:<02x}:{:<02x}:{:<02x}:{:<02x}",
+            buf,
+            "{:02x}:{:02x}:{:02x}:{:02x}:{:02x}:{:02x}",
             self.0[0], self.0[1], self.0[2], self.0[3], self.0[4], self.0[5]
-        )
+        )?;
+        f.pad(&buf)
     }
 }
 
diff --git a/nix/overlays/dataplane-dev.nix b/nix/overlays/dataplane-dev.nix
index c2fb0862f3..d086bf76ff 100644
--- a/nix/overlays/dataplane-dev.nix
+++ b/nix/overlays/dataplane-dev.nix
@@ -24,7 +24,12 @@ in
   cargo-bolero = prev.cargo-bolero.override { inherit (override-packages) rustPlatform; };
   cargo-deny = prev.cargo-deny.override { inherit (override-packages) rustPlatform; };
   cargo-edit = prev.cargo-edit.override { inherit (override-packages) rustPlatform; };
-  cargo-llvm-cov = prev.cargo-llvm-cov.override override-packages;
+  # We rebuild cargo-llvm-cov only to swap it onto our pinned rust-toolchain;
+  cargo-llvm-cov = (prev.cargo-llvm-cov.override override-packages).overrideAttrs (_: {
+    # the upstream package is already tested in nixpkgs. Its bundled test suite is
+    # sandbox-fragile so we skip tests here.
+    doCheck = false;
+  });
   cargo-nextest = prev.cargo-nextest.override override-packages;
   just = prev.just.override override-packages;
   npins = prev.npins.override { inherit (override-packages) rustPlatform; };
diff --git a/nix/overlays/dataplane.nix b/nix/overlays/dataplane.nix
index d8cd8c9c4d..d2711abe92 100644
--- a/nix/overlays/dataplane.nix
+++ b/nix/overlays/dataplane.nix
@@ -146,6 +146,15 @@ in
         version = sources.rdma-core.branch;
         src = sources.rdma-core.outPath;
 
+        # nixpkgs carries the "cmake-allow-overriding-sysusers.d-install-directory" patch, which turns SYSUSERS_DIR
+        # into a CMake cache variable.  Our pinned fork already cherry-picked that exact upstream commit (see the
+        # SYSUSERS_DIR cmakeFlag note below), so applying the nixpkgs patch on top fails with "Reversed (or previously
+        # applied) patch detected" and aborts patchPhase.  Drop that one patch by name (rather than clearing the whole
+        # list) so any future nixpkgs patches we *do* want still apply.
+        patches = builtins.filter (
+          p: !final.lib.hasInfix "cmake-allow-overriding-sysusers.d-install-directory" (toString p)
+        ) (orig.patches or [ ]);
+
         # Patching the shebang lines in the perl scripts causes nixgraph to (incorrectly) think we depend on perl at
         # runtime.  We absolutely do not (we don't even ship a perl interpreter), so don't patch these shebang lines.
         # In fact, we don't use any of the scripts from this package.
diff --git a/nix/pkgs/opengrep/binary.sri b/nix/pkgs/opengrep/binary.sri
index baa7b375a7..96ab27226b 100644
--- a/nix/pkgs/opengrep/binary.sri
+++ b/nix/pkgs/opengrep/binary.sri
@@ -1 +1 @@
-sha256-Ccu0yTjfaWJGAYpniCOtqo1lGndPMh/Rn7WtRMASmGA=
+sha256-msSuu0e6P3sNj8ZBrIdJy2wvJT9hYTGmfZYx4A1L6jM=
diff --git a/npins/default.nix b/npins/default.nix
index 884fc8cc58..8ec5eca6c8 100644
--- a/npins/default.nix
+++ b/npins/default.nix
@@ -65,7 +65,9 @@ let
         if pkgs == null then
           {
             inherit (builtins) fetchTarball fetchurl;
-            # For some fucking reason, fetchGit has a different signature than the other builtin fetchers …
+            # Frustratingly, due to flakes and `fetchTree`, `fetchGit`
+            # has a different signature than the other builtin
+            # fetchers
             fetchGit = args: (builtins.fetchGit args).outPath;
           }
         else
@@ -95,7 +97,6 @@ let
               };
           };
 
-      # Dispatch to the correct code path based on the type
       path =
         if spec.type == "Git" then
           mkGitSource fetchers spec
@@ -105,8 +106,8 @@ let
           mkPyPiSource fetchers spec
         else if spec.type == "Channel" then
           mkChannelSource fetchers spec
-        else if spec.type == "Tarball" then
-          mkTarballSource fetchers spec
+        else if spec.type == "Url" || spec.type == "MutableUrl" then
+          mkUrlSource fetchers spec
         else if spec.type == "Container" then
           mkContainerSource pkgs spec
         else
@@ -192,16 +193,20 @@ let
       sha256 = hash;
     };
 
-  mkTarballSource =
-    { fetchTarball, ... }:
+  mkUrlSource =
+    {
+      fetchTarball,
+      fetchurl,
+      ...
+    }:
     {
       url,
-      locked_url ? url,
       hash,
+      unpack,
       ...
     }:
-    fetchTarball {
-      url = locked_url;
+    (if unpack then fetchTarball else fetchurl) {
+      inherit url;
       sha256 = hash;
     };
 
@@ -211,16 +216,22 @@ let
       image_name,
       image_tag,
       image_digest,
+      hash,
       ...
-    }:
+    }@args:
     if pkgs == null then
       builtins.throw "container sources require passing in a Nixpkgs value: https://github.com/andir/npins/blob/master/README.md#using-the-nixpkgs-fetchers"
     else
-      pkgs.dockerTools.pullImage {
-        imageName = image_name;
-        imageDigest = image_digest;
-        finalImageTag = image_tag;
-      };
+      pkgs.dockerTools.pullImage (
+        {
+          imageName = image_name;
+          imageDigest = image_digest;
+          finalImageTag = image_tag;
+          hash = hash;
+        }
+        // (if args.arch or null != null then { arch = args.arch; } else { })
+      );
+
 in
 mkFunctor (
   {
@@ -231,7 +242,7 @@ mkFunctor (
       if builtins.isPath input then
         # while `readFile` will throw an error anyways if the path doesn't exist,
         # we still need to check beforehand because *our* error can be caught but not the one from the builtin
-        # *piegames sighs*
+        # See: <https://git.lix.systems/lix-project/lix/issues/1098>
         if builtins.pathExists input then
           builtins.fromJSON (builtins.readFile input)
         else
@@ -242,7 +253,7 @@ mkFunctor (
         throw "Unsupported input type ${builtins.typeOf input}, must be a path or an attrset";
     version = data.version;
   in
-  if version == 7 then
+  if version == 8 then
     builtins.mapAttrs (name: spec: mkFunctor (mkSource name spec)) data.pins
   else
     throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"
diff --git a/npins/sources.json b/npins/sources.json
index 37a5e52842..93732903ac 100644
--- a/npins/sources.json
+++ b/npins/sources.json
@@ -11,10 +11,10 @@
       "version_upper_bound": null,
       "release_prefix": null,
       "submodules": false,
-      "version": "v0.16.45",
-      "revision": "90de97946bb60aa82108d6dbb217cf10602d8709",
-      "url": "https://api.github.com/repos/KaTeX/KaTeX/tarball/refs/tags/v0.16.45",
-      "hash": "sha256-jODZp0M6OvUU+vqIhVT5DE+FusCjBC7fww2JKdZOPzA="
+      "version": "v0.18.0",
+      "revision": "4d9d0ae03841943ac3ccc63ad5708e15c46b187e",
+      "url": "https://api.github.com/repos/KaTeX/KaTeX/tarball/refs/tags/v0.18.0",
+      "hash": "sha256-O2jmMix0SiGpdu2sDIukReHcGOwh/6KqnCeOLzBfBrg="
     },
     "crane": {
       "type": "GitRelease",
@@ -27,10 +27,10 @@
       "version_upper_bound": null,
       "release_prefix": null,
       "submodules": false,
-      "version": "v0.23.3",
-      "revision": "9db02d41c4107fab6914b772dc3a27f7adfa2279",
-      "url": "https://api.github.com/repos/ipetkov/crane/tarball/refs/tags/v0.23.3",
-      "hash": "sha256-K0i9GoNk2To1RQkW348EY4c7RYf3mD74hWlGSc/9sk0="
+      "version": "v0.23.4",
+      "revision": "498d7e7b9b708d584cbc71ec083527f68114f9a3",
+      "url": "https://api.github.com/repos/ipetkov/crane/tarball/refs/tags/v0.23.4",
+      "hash": "sha256-nnGD2f8OlAZT2i5OfwikJsw+ifWfiA4d6A8BWlgOXV0="
     },
     "dpdk": {
       "type": "Git",
@@ -52,11 +52,11 @@
         "owner": "githedgehog",
         "repo": "dplane-plugin"
       },
-      "branch": "master",
+      "branch": "hh-master-10.6",
       "submodules": false,
-      "revision": "ef3e718651d59fd4da5787a9c05e06a594c0136c",
-      "url": "https://github.com/githedgehog/dplane-plugin/archive/ef3e718651d59fd4da5787a9c05e06a594c0136c.tar.gz",
-      "hash": "sha256-CRsHKk50XnV23uVJxjN9ZtsIFH/BwZYlW27UL4V0D6E="
+      "revision": "19d17cdba14bfca79fa6797e8459f217232f906c",
+      "url": "https://github.com/githedgehog/dplane-plugin/archive/19d17cdba14bfca79fa6797e8459f217232f906c.tar.gz",
+      "hash": "sha256-WDddiCEB2m0bhVH1pVAbRuVb9Ke3VxsGGLsOXcAx7uQ="
     },
     "dplane-rpc": {
       "type": "Git",
@@ -95,11 +95,11 @@
         "owner": "FRRouting",
         "repo": "frr"
       },
-      "branch": "stable/10.5",
+      "branch": "stable/10.6",
       "submodules": false,
-      "revision": "2c607aac405fce8421a97d1e5963f897897101e9",
-      "url": "https://github.com/FRRouting/frr/archive/2c607aac405fce8421a97d1e5963f897897101e9.tar.gz",
-      "hash": "sha256-pQTjPoh+QZFx5gS0qNn0+snRi07HotydTODsYOofIyk="
+      "revision": "521748debee7faa4f4c45c19f43a5bc9966ec4c9",
+      "url": "https://github.com/FRRouting/frr/archive/521748debee7faa4f4c45c19f43a5bc9966ec4c9.tar.gz",
+      "hash": "sha256-EA1smpgVtEKkPB07Lz79aj42+HB8IYt5pzcEOJkSBxs="
     },
     "frr-agent": {
       "type": "Git",
@@ -121,11 +121,11 @@
         "owner": "githedgehog",
         "repo": "frr"
       },
-      "branch": "hh-master-10.5",
+      "branch": "hh-master-10.6",
       "submodules": false,
-      "revision": "d6cbff16e2261a7e1a88c6369de9e5c1d1bdb4f7",
-      "url": "https://github.com/githedgehog/frr/archive/d6cbff16e2261a7e1a88c6369de9e5c1d1bdb4f7.tar.gz",
-      "hash": "sha256-dUjnWQFcP+iUcYl1vetWbawL9HZt8FmMzC0cJdUJrxI="
+      "revision": "b2ca1eb04c8746d17f11fe49181d1e2287be1470",
+      "url": "https://github.com/githedgehog/frr/archive/b2ca1eb04c8746d17f11fe49181d1e2287be1470.tar.gz",
+      "hash": "sha256-BsFh/T7VlIravMLA5m/mKjUy8bT9rnmLYzI0g/RX6J8="
     },
     "kopium": {
       "type": "GitRelease",
@@ -138,10 +138,10 @@
       "version_upper_bound": null,
       "release_prefix": null,
       "submodules": false,
-      "version": "0.23.0",
-      "revision": "1845872bfe6da7987f6f88e2ebf3dc9b011e3c04",
-      "url": "https://api.github.com/repos/kube-rs/kopium/tarball/refs/tags/0.23.0",
-      "hash": "sha256-QEdUALde9BVRioUlu6Y/zz7tZ0/lLxcteWQD92x4kvI="
+      "version": "0.24.1",
+      "revision": "644cdafe54d137a8476ecd527722dc3917a6ca5a",
+      "url": "https://api.github.com/repos/kube-rs/kopium/tarball/refs/tags/0.24.1",
+      "hash": "sha256-CU2j3VDZfq9DcDyAeZ8v6rRwE4YStUH7ugbmx2jW9+U="
     },
     "mermaid": {
       "type": "GitRelease",
@@ -154,16 +154,17 @@
       "version_upper_bound": null,
       "release_prefix": "mermaid@",
       "submodules": false,
-      "version": "mermaid@11.14.0",
-      "revision": "88e8e5e25c6a07d67dc024c13333b6e72bdb4b34",
-      "url": "https://api.github.com/repos/mermaid-js/mermaid/tarball/refs/tags/mermaid@11.14.0",
-      "hash": "sha256-TytcEn4Nf2Vg6ib+SPAanqjJKzCn/4vmRTIhvG1UAXY="
+      "version": "mermaid@11.16.0",
+      "revision": "5e3c88ea6d937a89078a5e8f1b2a6fd0ea391a5c",
+      "url": "https://api.github.com/repos/mermaid-js/mermaid/tarball/refs/tags/mermaid@11.16.0",
+      "hash": "sha256-GyOf/BU6eBX9vEH+rYFg2Uz4DPMUQ47mOdheittEgDQ="
     },
     "nixpkgs": {
       "type": "Channel",
       "name": "nixpkgs-unstable",
-      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre991389.73c703c22422/nixexprs.tar.xz",
-      "hash": "sha256-bA5oJv7j54PubdUbBlLCwdoK29G2+9sLnc8dDqLQ9YE="
+      "artifact": "nixexprs.tar.xz",
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1035929.59682e0069f0/nixexprs.tar.xz",
+      "hash": "sha256-keY82hYMWt1hWhFYWVNFYf/meYjxdMjs6AyePFzr+0I="
     },
     "opengrep": {
       "type": "GitRelease",
@@ -176,10 +177,10 @@
       "version_upper_bound": null,
       "release_prefix": null,
       "submodules": false,
-      "version": "v1.20.0",
-      "revision": "19a2dd0a3c964370d58ebc67e8ad7ce42079b665",
-      "url": "https://api.github.com/repos/opengrep/opengrep/tarball/refs/tags/v1.20.0",
-      "hash": "sha256-RVZ1yAdyas9rb1Xx01cbpZ6U/Q/NWwBEqeW+W/1rYM0="
+      "version": "v1.25.0",
+      "revision": "27b5fba1b315fbc63d0fd474d01f5d8235cc86e2",
+      "url": "https://api.github.com/repos/opengrep/opengrep/tarball/refs/tags/v1.25.0",
+      "hash": "sha256-yOjwwf+UX88mdhGCO5wLf2CMI5DKF3J1zAZPMwbgNzA="
     },
     "perftest": {
       "type": "Git",
@@ -190,9 +191,9 @@
       },
       "branch": "master",
       "submodules": false,
-      "revision": "c94e53866e28f8f66779c5656222109cd314997a",
-      "url": "https://github.com/linux-rdma/perftest/archive/c94e53866e28f8f66779c5656222109cd314997a.tar.gz",
-      "hash": "sha256-vimuYq7TFFFSmk17/yX15lBc48tcE3+PM/Gmrs8ecxo="
+      "revision": "4c260cb26f8c2d990863e71b3a9382893e9562ea",
+      "url": "https://github.com/linux-rdma/perftest/archive/4c260cb26f8c2d990863e71b3a9382893e9562ea.tar.gz",
+      "hash": "sha256-cdXUCNWd2l7WIREflaiwLRnMf3piN0zbZwLgJ18IKRY="
     },
     "rdma-core": {
       "type": "Git",
@@ -218,10 +219,10 @@
       "version_upper_bound": null,
       "release_prefix": null,
       "submodules": false,
-      "version": "1.95.0",
-      "revision": "60d4c03b1c63ee2d4046af32b9182b9600d28858",
-      "url": "https://api.github.com/repos/rust-lang/rust/tarball/refs/tags/1.95.0",
-      "hash": "sha256-+ME3g+ceS6QPVGQ2DoLu36KyTKn46f5WRzLrkqHy0rM="
+      "version": "1.97.1",
+      "revision": "bd3cd8fdf9945e13d317642df03363bfa1b4c30e",
+      "url": "https://api.github.com/repos/rust-lang/rust/tarball/refs/tags/1.97.1",
+      "hash": "sha256-wC6YRSVtOxp4qb0Wfl8FyZjkUemDmKETBa004R/f5a0="
     },
     "rust-overlay": {
       "type": "Git",
@@ -232,10 +233,10 @@
       },
       "branch": "master",
       "submodules": false,
-      "revision": "669151bbc7f2416b622af2f48e9136e2c9da5530",
-      "url": "https://github.com/oxalica/rust-overlay/archive/669151bbc7f2416b622af2f48e9136e2c9da5530.tar.gz",
-      "hash": "sha256-oE4lnjiBa3uE+dP9jM0jFzofP1xYIlK6IQBjLfWjH04="
+      "revision": "068175006cfb69d5b541a140ed93e361488c9e53",
+      "url": "https://github.com/oxalica/rust-overlay/archive/068175006cfb69d5b541a140ed93e361488c9e53.tar.gz",
+      "hash": "sha256-ohQQiPOngux8ofsrSlloHCMDhRMvocXqJiG8uH45Q5k="
     }
   },
-  "version": 7
+  "version": 8
 }
diff --git a/routing/src/cli/display.rs b/routing/src/cli/display.rs
index baab7c03d9..472c2ecb99 100644
--- a/routing/src/cli/display.rs
+++ b/routing/src/cli/display.rs
@@ -33,6 +33,7 @@ use crate::evpn::{RmacEntry, RmacStore, Vtep};
 
 use chrono::DateTime;
 use common::cliprovider::{Heading, line};
+
 use lpm::prefix::{IpPrefix, Ipv4Prefix, Ipv6Prefix};
 use lpm::trie::{PrefixMapTrie, TrieMap};
 use net::vxlan::Vni;
@@ -118,6 +119,9 @@ impl Display for NhopKey {
 impl Display for Nhop {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         write!(f, "{}", self.key)?;
+        if self.invalid.get() {
+            write!(f, " (INVALID)")?;
+        }
         fmt_nhop_resolvers(f, self, 2)
     }
 }
@@ -592,29 +596,42 @@ impl Display for IfTableAddress<'_> {
 //========================= Rmac Store ================================//
 macro_rules! RMAC_TBL_FMT {
     () => {
-        " {:<5} {:<20} {:<18}"
+        " {:<5} {:<20} {:<18} {:<8}"
     };
 }
 fn fmt_rmac_heading(f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
     writeln!(
         f,
         "{}",
-        format_args!(RMAC_TBL_FMT!(), "vni", "address", "mac")
+        format_args!(RMAC_TBL_FMT!(), "vni", "address", "mac", "status")
     )
 }
 
 impl Display for RmacEntry {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let valid = if self.is_stale() { "stale" } else { "ok" };
         write!(
             f,
             "{}",
-            format_args!(RMAC_TBL_FMT!(), self.vni.as_u32(), self.address, self.mac)
+            format_args!(
+                RMAC_TBL_FMT!(),
+                self.vni.as_u32(),
+                self.address,
+                self.mac,
+                valid
+            )
         )
     }
 }
 impl Display for RmacStore {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        Heading(format!("Router macs ({})", self.len())).fmt(f)?;
+        Heading(format!(
+            "Router macs (entries: {} stale: {})",
+            self.len(),
+            self.stale()
+        ))
+        .fmt(f)?;
+
         fmt_rmac_heading(f)?;
         for rmac in self.values() {
             writeln!(f, "{rmac}")?;
diff --git a/routing/src/config/mod.rs b/routing/src/config/mod.rs
index 8b65d3b378..b318925e4f 100644
--- a/routing/src/config/mod.rs
+++ b/routing/src/config/mod.rs
@@ -329,7 +329,7 @@ mod tests {
     fn test_apply_config(config: &RouterConfig, db: &mut RoutingDb) -> Result<(), RouterError> {
         config.apply(db)?;
         let iftr = db.iftw.enter().unwrap();
-        println!("\n{}", &db.vrftable);
+        println!("\n{}", db.vrftable);
         println!("\n{}", *iftr);
         println!("\n ████████ SUCCESSFULLY applied and verified config {} ███████\n", config.genid);
         Ok(())
diff --git a/routing/src/evpn/rmac.rs b/routing/src/evpn/rmac.rs
index 1c948cd790..e777edb885 100644
--- a/routing/src/evpn/rmac.rs
+++ b/routing/src/evpn/rmac.rs
@@ -8,33 +8,51 @@ use net::eth::mac::Mac;
 use net::vxlan::Vni;
 use std::collections::{HashMap, hash_map::Entry};
 use std::net::IpAddr;
-use tracing::debug;
+use std::time::{Duration, Instant};
+use tracing::{debug, warn};
 
-#[derive(Debug, Eq, Hash, PartialEq)]
+#[derive(Eq, PartialEq, Clone)]
 pub struct RmacEntry {
     pub address: IpAddr,
     pub mac: Mac,
     pub vni: Vni,
+    pub stale_t: Option<Instant>, // instant when the rmac was deleted
 }
 impl RmacEntry {
     #[allow(unused)]
     fn new(vni: Vni, address: IpAddr, mac: Mac) -> Self {
-        Self { address, mac, vni }
+        Self {
+            address,
+            mac,
+            vni,
+            stale_t: None,
+        }
+    }
+    #[must_use]
+    pub fn is_stale(&self) -> bool {
+        self.stale_t.is_some()
     }
 }
 
-#[derive(Debug)]
 /// Type that represents a collection of EVPN Rmac - IP mappings, per Vni
-pub struct RmacStore(HashMap<(IpAddr, Vni), RmacEntry, RandomState>);
+pub struct RmacStore {
+    table: HashMap<(IpAddr, Vni), RmacEntry, RandomState>,
+    stale: usize, // the number of stale entries
+}
 
 #[allow(clippy::new_without_default)]
 impl RmacStore {
+    const MAX_STALE_TIME: Duration = Duration::from_secs(10);
+
     //////////////////////////////////////////////////////////////////
     /// Create rmac table
     //////////////////////////////////////////////////////////////////
     #[must_use]
     pub(crate) fn new() -> Self {
-        Self(HashMap::with_hasher(RandomState::with_seed(0)))
+        Self {
+            table: HashMap::with_hasher(RandomState::with_seed(0)),
+            stale: 0,
+        }
     }
 
     //////////////////////////////////////////////////////////////////
@@ -43,48 +61,75 @@ impl RmacStore {
     #[cfg(test)]
     fn add_rmac(&mut self, vni: Vni, address: IpAddr, mac: Mac) -> Option<RmacEntry> {
         let rmac = RmacEntry::new(vni, address, mac);
-        self.0.insert((address, vni), rmac)
+        self.table.insert((address, vni), rmac)
     }
 
     //////////////////////////////////////////////////////////////////
-    /// Identical to `add_rmac`, but getting the entry as param
+    /// Add a `RmacEntry` to the rmac store. This method never fails.
     //////////////////////////////////////////////////////////////////
     pub fn add_rmac_entry(&mut self, entry: RmacEntry) {
         let vni = entry.vni;
         let mac = entry.mac;
         let address = entry.address;
-        if self.0.insert((entry.address, entry.vni), entry).is_some() {
-            debug!("Updated rmac for vni={vni} ip={address} to {mac}");
+        if let Some(old) = self.table.insert((entry.address, entry.vni), entry) {
+            if old.mac == mac {
+                debug!("Refreshed rmac for vni:{vni} ip:{address} as {mac}");
+            } else {
+                debug!(
+                    "Changed rmac for vni:{vni} ip:{address} {} -> {mac}",
+                    old.mac
+                );
+            }
+            if let Some(stale_t) = &old.stale_t {
+                debug!("The rmac was stale for {}s", stale_t.elapsed().as_secs());
+                self.stale = self.stale.saturating_sub(1);
+            }
         } else {
-            debug!("Registered rmac, vni={vni} ip={address} mac={mac}");
+            debug!("Registered rmac {mac} for vni:{vni} ip:{address}");
         }
     }
 
     //////////////////////////////////////////////////////////////////
-    /// Delete an [`RmacEntry`]. The mac address must match (sanity)
+    /// Delete the [`RmacEntry`] for a given `IpAddr` and `Vni`.
+    /// To be removed, the corresponding entry in the rmac store must
+    /// be marked as stale. This method returns a [`RmacEntry`]
+    /// if an entry was deleted and `None` otherwise.
     //////////////////////////////////////////////////////////////////
-    #[cfg(test)]
-    pub fn del_rmac(&mut self, vni: Vni, address: IpAddr, mac: Mac) {
+    pub fn del_rmac(&mut self, address: IpAddr, vni: Vni) -> Option<RmacEntry> {
         let key = (address, vni);
-        if let Entry::Occupied(o) = self.0.entry(key) {
-            if o.get().mac == mac {
-                self.0.remove_entry(&key);
+
+        if let Entry::Occupied(o) = self.table.entry(key) {
+            if !o.get().is_stale() {
+                return None;
+            }
+            let (_key, deleted) = self.table.remove_entry(&key).unzip();
+            debug_assert!(deleted.is_some());
+            if deleted.is_some() {
+                self.stale = self.stale.saturating_sub(1);
             }
+            return deleted;
         }
+        warn!("Could not delete rmac entry for vni:{vni} address:{address}: not found");
+        None
     }
 
     //////////////////////////////////////////////////////////////////
-    /// Identical to `del_rmac`, but getting the entry as param
+    /// Mark a `RmacEntry` as stale instead of deleting it immediately.
+    /// The entry will be kept for a certain amount of time and be
+    /// removed afterwards unless replaced by another one.
     //////////////////////////////////////////////////////////////////
-    pub fn del_rmac_entry(&mut self, entry: &RmacEntry) {
+    pub fn invalidate_rmac_entry(&mut self, entry: &RmacEntry) {
         let key = (entry.address, entry.vni);
-        if let Entry::Occupied(o) = self.0.entry(key) {
-            if o.get().mac == entry.mac {
-                self.0.remove_entry(&key);
+        if let Entry::Occupied(mut o) = self.table.entry(key) {
+            let current = o.get_mut();
+            if current.mac == entry.mac && !current.is_stale() {
                 debug!(
-                    "Removed router-mac entry for vni: {} ip: {} mac: {}",
-                    entry.vni, entry.address, entry.mac
+                    "Marked rmac {} for vni:{} ip:{} as stale",
+                    entry.mac, entry.vni, entry.address,
                 );
+                // recall time when it became stale
+                current.stale_t = Some(Instant::now());
+                self.stale = self.stale.saturating_add(1);
             }
         }
     }
@@ -94,14 +139,14 @@ impl RmacStore {
     //////////////////////////////////////////////////////////////////
     #[must_use]
     pub fn get_rmac(&self, vni: Vni, address: IpAddr) -> Option<&RmacEntry> {
-        self.0.get(&(address, vni))
+        self.table.get(&(address, vni))
     }
 
     //////////////////////////////////////////////////////////////////
     /// Immutable iterator over all [`RmacEntry`]ies
     //////////////////////////////////////////////////////////////////
     pub fn values(&self) -> impl Iterator<Item = &RmacEntry> {
-        self.0.values()
+        self.table.values()
     }
 
     //////////////////////////////////////////////////////////////////
@@ -110,13 +155,63 @@ impl RmacStore {
     #[allow(clippy::len_without_is_empty)]
     #[must_use]
     pub fn len(&self) -> usize {
-        self.0.len()
+        self.table.len()
+    }
+
+    #[must_use]
+    //////////////////////////////////////////////////////////////////
+    /// number of stale rmac entries
+    //////////////////////////////////////////////////////////////////
+    pub(crate) fn stale(&self) -> usize {
+        self.stale
+    }
+
+    //////////////////////////////////////////////////////////////////
+    /// flush all stale `RmacEntry`s kept for more than `Self::MAX_STALE_TIME`.
+    /// Returns a list of `Vni`s that had rmacs removed
+    //////////////////////////////////////////////////////////////////
+    pub fn flush_stale_rmacs(&mut self) -> Vec<Vni> {
+        if self.stale == 0 {
+            // nothing to do if no stale rmacs
+            return vec![];
+        }
+        // collect the keys of entries that have been stale for more than `Self::MAX_STALE_TIME` seconds
+        let stale: Vec<_> = self
+            .table
+            .values()
+            .filter_map(|e| {
+                if let Some(instant) = e.stale_t
+                    && instant.elapsed() > Self::MAX_STALE_TIME
+                {
+                    Some((e.address, e.vni))
+                } else {
+                    None
+                }
+            })
+            .collect();
+
+        // there may be stale entries, but not old enough
+        if stale.is_empty() {
+            return vec![];
+        }
+
+        debug!("Flushing {} router mac entries", stale.len());
+        let mut vnis = std::collections::HashSet::new();
+        for key in &stale {
+            if let Some(deleted) = self.del_rmac(key.0, key.1) {
+                vnis.insert(deleted.vni);
+            }
+        }
+
+        let vnis = vnis.into_iter().collect::<Vec<_>>();
+        debug!("Removed rmacs for vnis: {vnis:?}");
+        vnis
     }
 }
 
 #[cfg(test)]
 pub(crate) mod tests {
-    use super::RmacStore;
+    use super::{RmacEntry, RmacStore};
     use crate::evpn::vtep::Vtep;
     use crate::rib::vrf::tests::mk_addr;
     use net::eth::mac::Mac;
@@ -159,68 +254,68 @@ pub(crate) mod tests {
 
         let remote = mk_addr("7.0.0.1");
 
-        store.add_rmac(
+        // create 3 rmacs
+        let rmac1 = RmacEntry::new(
             new_vni(3001),
             remote,
             Mac::from([0x0, 0x0, 0x0, 0x0, 0x0, 0x01]),
         );
-        store.add_rmac(
+        let rmac2 = RmacEntry::new(
             new_vni(3002),
             remote,
             Mac::from([0x0, 0x0, 0x0, 0x0, 0x0, 0x02]),
         );
-        store.add_rmac(
+        let rmac3 = RmacEntry::new(
             new_vni(3003),
             remote,
             Mac::from([0x0, 0x0, 0x0, 0x0, 0x0, 0x03]),
         );
-        assert_eq!(store.0.len(), 3);
+
+        // add to store
+        store.add_rmac_entry(rmac1.clone());
+        store.add_rmac_entry(rmac2.clone());
+        store.add_rmac_entry(rmac3.clone());
+        assert_eq!(store.len(), 3);
 
         // add duplicate
-        store.add_rmac(
-            new_vni(3003),
-            remote,
-            Mac::from([0x0, 0x0, 0x0, 0x0, 0x0, 0x03]),
-        );
-        assert_eq!(store.0.len(), 3, "Duplicate should not be stored");
+        store.add_rmac_entry(rmac3.clone());
+        assert_eq!(store.len(), 3, "Duplicate should not be stored");
 
-        // remove first
-        store.del_rmac(
-            new_vni(3001),
-            remote,
-            Mac::from([0x0, 0x0, 0x0, 0x0, 0x0, 0x01]),
-        );
-        assert_eq!(store.0.len(), 2, "Should have one less entry");
+        // remove first: won't be deleted since it is not marked as stale
+        let deleted = store.del_rmac(rmac1.address, rmac1.vni);
+        assert!(deleted.is_none());
+        assert_eq!(store.len(), 3, "Shouldn't be deleted");
 
-        // remove second, but with wrong MAC
-        store.del_rmac(
-            new_vni(3002),
-            remote,
-            Mac::from([0xb, 0xa, 0xd, 0xb, 0xa, 0xd]),
-        );
-        assert_eq!(store.0.len(), 2, "No entry should have been deleted");
+        // invalidate (make stale) and remove: should succeed
+        store.invalidate_rmac_entry(&rmac1);
+        assert_eq!(store.stale(), 1);
+        let deleted = store.del_rmac(rmac1.address, rmac1.vni);
+        assert!(deleted.is_some());
+        assert_eq!(store.len(), 2, "Should have one less entry");
+        assert_eq!(store.stale(), 0);
 
         // get second
-        let r = store.get_rmac(new_vni(3002), remote);
+        let r = store.get_rmac(rmac2.vni, rmac2.address);
         assert!(r.is_some());
-        assert_eq!(r.unwrap().mac, Mac::from([0x0, 0x0, 0x0, 0x0, 0x0, 0x02]));
+        assert_eq!(r.unwrap().mac, rmac2.mac);
+        assert_eq!(r.unwrap().vni, rmac2.vni);
+        assert_eq!(r.unwrap().address, rmac2.address);
 
-        // replace/update second
-        let r = store.add_rmac(
-            new_vni(3002),
-            remote,
-            Mac::from([0x11, 0x22, 0x33, 0x44, 0x55, 0x66]),
-        );
-        assert!(r.is_some());
-        assert_eq!(r.unwrap().mac, Mac::from([0x0, 0x0, 0x0, 0x0, 0x0, 0x02]));
+        // invalidate second
+        store.invalidate_rmac_entry(&rmac2);
+        assert_eq!(store.stale(), 1);
+
+        // replace/update second: mac should be changed and entry no longer be invalid
+        let mut rmac2_modified_mac = rmac2.clone();
+        rmac2_modified_mac.mac = Mac::from([0x11, 0x22, 0x33, 0x44, 0x55, 0x66]);
+        store.add_rmac_entry(rmac2_modified_mac.clone());
+        assert_eq!(store.stale(), 0);
 
         // get second and check that its MAC was updated
-        let r = store.get_rmac(new_vni(3002), remote);
+        let r = store.get_rmac(rmac2.vni, rmac2.address);
         assert!(r.is_some());
-        assert_eq!(
-            r.unwrap().mac,
-            Mac::from([0x11, 0x22, 0x33, 0x44, 0x55, 0x66])
-        );
+        assert_eq!(r.unwrap().mac, rmac2_modified_mac.mac);
+        assert!(!r.unwrap().is_stale());
     }
 
     #[test]
diff --git a/routing/src/fib/fibtype.rs b/routing/src/fib/fibtype.rs
index 18d9704252..7cc5e46c9d 100644
--- a/routing/src/fib/fibtype.rs
+++ b/routing/src/fib/fibtype.rs
@@ -314,7 +314,7 @@ impl Absorb<FibChange> for Fib {
         }
     }
     fn sync_with(&mut self, first: &Self) {
-        assert!(self.id != FibKey::Unset);
+        assert_ne!(self.id, FibKey::Unset);
         assert_eq!(self.id, first.id);
         debug!("Internal LR state for fib {} is now synced", self.id);
     }
diff --git a/routing/src/frr/frrmi.rs b/routing/src/frr/frrmi.rs
index cfd2d96886..5d7d26853f 100644
--- a/routing/src/frr/frrmi.rs
+++ b/routing/src/frr/frrmi.rs
@@ -336,9 +336,9 @@ impl Frrmi {
                 }
                 Ok(_) => {
                     if self.readb.next_read_len() == 0 {
-                        match self.readb.deserialize() {
-                            Ok(response) => return Ok(Some(response)),
-                            Err(e) => return Err(e),
+                        {
+                            let response = self.readb.deserialize()?;
+                            return Ok(Some(response));
                         }
                     }
                     // did not receive the complete message and need to read more
diff --git a/routing/src/frr/renderer/bgp.rs b/routing/src/frr/renderer/bgp.rs
index ea15857df5..2b5be7f89d 100644
--- a/routing/src/frr/renderer/bgp.rs
+++ b/routing/src/frr/renderer/bgp.rs
@@ -136,92 +136,92 @@ fn bgp_neigh_options(neigh: &BgpNeighbor, prefix: &str) -> ConfigBuilder {
     if neigh.is_peer_group() {
         neigh
             .remote_as
-            .map(|asn| cfg += format!(" {} remote-as {asn}", &prefix));
+            .map(|asn| cfg += format!(" {prefix} remote-as {asn}"));
     }
 
     /* description */
     neigh
         .description
         .as_ref()
-        .map(|d| cfg += format!(" {} description {d}", &prefix));
+        .map(|d| cfg += format!(" {prefix} description {d}"));
 
     /* update source */
     neigh
         .update_source
         .as_ref()
-        .map(|source| cfg += format!(" {} update-source {}", &prefix, source.rendered()));
+        .map(|source| cfg += format!(" {} update-source {}", prefix, source.rendered()));
 
     /* route-map in */
     neigh
         .route_map_in
         .as_ref()
-        .map(|rmap| cfg += format!(" {} route-map {rmap} in", &prefix));
+        .map(|rmap| cfg += format!(" {prefix} route-map {rmap} in"));
 
     /* route-map out */
     neigh
         .route_map_out
         .as_ref()
-        .map(|rmap| cfg += format!(" {} route-map {rmap} out", &prefix));
+        .map(|rmap| cfg += format!(" {prefix} route-map {rmap} out"));
 
     /* weight */
     neigh
         .weight
         .as_ref()
-        .map(|weight| cfg += format!(" {} weight {weight}", &prefix));
+        .map(|weight| cfg += format!(" {prefix} weight {weight}"));
 
     /* send communities */
     neigh
         .send_community
         .as_ref()
-        .map(|com| cfg += format!(" {} send-community {}", &prefix, com.rendered()));
+        .map(|com| cfg += format!(" {} send-community {}", prefix, com.rendered()));
 
     /* ebgp multihop */
     neigh
         .ebgp_multihop
         .as_ref()
-        .map(|max_hops| cfg += format!(" {} ebgp-multihop {max_hops}", &prefix));
+        .map(|max_hops| cfg += format!(" {prefix} ebgp-multihop {max_hops}"));
 
     /* ttl security */
     neigh
         .ttl_sec_hops
         .as_ref()
-        .map(|hops| cfg += format!(" {} ttl-security hops {hops}", &prefix));
+        .map(|hops| cfg += format!(" {prefix} ttl-security hops {hops}"));
 
     /* advertisement interval */
     neigh
         .advertisement_interval
         .as_ref()
-        .map(|interval| cfg += format!(" {} advertisement-interval {interval}", &prefix));
+        .map(|interval| cfg += format!(" {prefix} advertisement-interval {interval}"));
 
     /* connect timer */
     neigh
         .timer_connect
         .as_ref()
-        .map(|timer| cfg += format!(" {} timers connect {timer}", &prefix));
+        .map(|timer| cfg += format!(" {prefix} timers connect {timer}"));
 
     /* delay-open timer */
     neigh
         .timer_delay_open
         .as_ref()
-        .map(|timer| cfg += format!(" {} timers delayopen {timer}", &prefix));
+        .map(|timer| cfg += format!(" {prefix} timers delayopen {timer}"));
 
     /* max prefixes in */
     neigh
         .maximum_prefix
         .as_ref()
-        .map(|num| cfg += format!(" {} maximum-prefix {num}", &prefix));
+        .map(|num| cfg += format!(" {prefix} maximum-prefix {num}"));
 
     /* max prefixes out */
     neigh
         .maximum_prefix_out
         .as_ref()
-        .map(|num| cfg += format!(" {} maximum-prefix-out {num}", &prefix));
+        .map(|num| cfg += format!(" {prefix} maximum-prefix-out {num}"));
 
     /* TCP MSS  */
     neigh
         .tcp_mss
         .as_ref()
-        .map(|mss| cfg += format!(" {} tcp-mss {mss}", &prefix));
+        .map(|mss| cfg += format!(" {prefix} tcp-mss {mss}"));
 
     cfg
 }
diff --git a/routing/src/frr/renderer/interface.rs b/routing/src/frr/renderer/interface.rs
index 2e8ef33228..71998f23cf 100644
--- a/routing/src/frr/renderer/interface.rs
+++ b/routing/src/frr/renderer/interface.rs
@@ -23,7 +23,7 @@ impl Rendered for InterfaceAddress {
         format!(
             " {} address {}/{}",
             ip_address_type_str(&self.address),
-            &self.address,
+            self.address,
             self.mask_len
         )
     }
diff --git a/routing/src/frr/renderer/vrf.rs b/routing/src/frr/renderer/vrf.rs
index 4994929eeb..51aed5fe80 100644
--- a/routing/src/frr/renderer/vrf.rs
+++ b/routing/src/frr/renderer/vrf.rs
@@ -13,7 +13,7 @@ impl Render for VrfConfig {
         let mut cfg = ConfigBuilder::new();
         if !self.default {
             cfg += MARKER;
-            cfg += format!("vrf {}", &self.name);
+            cfg += format!("vrf {}", self.name);
         }
 
         /* static routes */
diff --git a/routing/src/interfaces/mod.rs b/routing/src/interfaces/mod.rs
index 6c86cb0848..d8b4b4bc76 100644
--- a/routing/src/interfaces/mod.rs
+++ b/routing/src/interfaces/mod.rs
@@ -99,7 +99,7 @@ pub mod tests {
     // create a test interface table and display it
     pub fn build_test_iftable() -> IfTable {
         let iftable = populate_test_iftable();
-        println!("{}", &iftable);
+        println!("{iftable}");
         iftable
     }
 
diff --git a/routing/src/rib/nexthop.rs b/routing/src/rib/nexthop.rs
index 47ff76ff8c..7820190b15 100644
--- a/routing/src/rib/nexthop.rs
+++ b/routing/src/rib/nexthop.rs
@@ -17,6 +17,7 @@ use std::net::IpAddr;
 use std::option::Option;
 
 use net::interface::InterfaceIndex;
+use std::cell::Cell;
 use std::cell::RefCell;
 use std::rc::{Rc, Weak};
 #[cfg(test)]
@@ -39,6 +40,7 @@ pub struct Nhop {
     pub(crate) resolvers: RefCell<Vec<Weak<Nhop>>>,
     pub(crate) instructions: RefCell<Vec<PktInstruction>>,
     pub(crate) fibgroup: RefCell<FibGroup>,
+    pub(crate) invalid: Cell<bool>,
 }
 
 #[derive(Debug, Default, Copy, Clone, Hash, Eq, PartialEq, PartialOrd, Ord)]
@@ -167,6 +169,7 @@ impl Nhop {
             resolvers: RefCell::new(Vec::new()),
             instructions: RefCell::new(Vec::with_capacity(2)),
             fibgroup: RefCell::new(FibGroup::new()),
+            invalid: Cell::new(false),
         }
     }
 
@@ -755,7 +758,7 @@ mod tests {
         assert!(res.contains(&NhopKey::with_addr_ifindex("10.0.0.1", 1)));
         assert!(res.contains(&NhopKey::with_addr_ifindex("10.0.0.5", 2)));
         assert!(res.contains(&NhopKey::with_addr_ifindex("10.0.0.9", 3)));
-        println!("{:#?}", &res);
+        println!("{res:#?}");
     }
 
     #[test]
@@ -774,7 +777,7 @@ mod tests {
         assert!(res.contains(&NhopKey::with_addr_ifindex("10.0.0.1", 1)));
         assert!(res.contains(&NhopKey::with_addr_ifindex("10.0.0.5", 2)));
         assert!(res.contains(&NhopKey::with_addr_ifindex("10.0.0.9", 3)));
-        println!("{:#?}", &res);
+        println!("{res:#?}");
     }
 
     #[test]
@@ -808,7 +811,7 @@ mod tests {
         // similar using next-hop store method that looks up the next-hop first
         let res = store.resolve_by_addr(&("7.0.0.1".parse().unwrap()));
         assert!(res.is_some());
-        println!("{:#?}", &res);
+        println!("{res:#?}");
     }
 
     #[traced_test]
diff --git a/routing/src/rib/rib2fib.rs b/routing/src/rib/rib2fib.rs
index 013a3aac6b..56be4e5577 100644
--- a/routing/src/rib/rib2fib.rs
+++ b/routing/src/rib/rib2fib.rs
@@ -24,31 +24,48 @@ impl Nhop {
     #[allow(clippy::single_match_else)]
     #[must_use]
     fn build_pkt_instructions(&self, rstore: &RmacStore) -> Vec<PktInstruction> {
+        // mark as valid for the time being
+        self.invalid.set(false);
+
         let mut instructions = Vec::with_capacity(2);
+
+        // local route
         if self.key.origin == RouteOrigin::Local {
             match self.key.ifindex {
                 Some(if_index) => instructions.push(PktInstruction::Local(if_index)),
                 None => {
-                    warn!("packet is locally destined but has no target interface index: dropping");
+                    self.invalid.set(true);
+                    warn!("Unknown ifindex for local next-hop. Will set action drop");
                     instructions.push(PktInstruction::Drop);
                 }
             }
             return instructions;
         }
+
+        // an explicit drop
         if self.key.fwaction == FwAction::Drop {
             instructions.push(PktInstruction::Drop);
             return instructions;
         }
+
+        // encapsulation
         if let Some(encap) = self.key.encap {
-            let mut inst_encap = encap;
-            match inst_encap {
+            let mut encap_instr = encap;
+            let ok = match encap_instr {
                 Encapsulation::Vxlan(ref mut vxlan) => vxlan.resolve(rstore),
-                Encapsulation::Mpls(_) => {}
+                Encapsulation::Mpls(_) => true, // set to true for tests, actually unsupported
+            };
+            if ok {
+                instructions.push(PktInstruction::Encap(encap_instr));
+                let egress =
+                    EgressObject::new(self.key.ifindex, self.key.address, self.key.ifname.clone());
+                instructions.push(PktInstruction::Egress(egress));
+            } else {
+                // resolution of encap instructions failed. Keep the route with action drop and mark the nhop as invalid
+                self.invalid.set(true);
+                instructions = vec![PktInstruction::Drop];
+                warn!("Nhop {self} became invalid");
             }
-            instructions.push(PktInstruction::Encap(inst_encap));
-            let egress =
-                EgressObject::new(self.key.ifindex, self.key.address, self.key.ifname.clone());
-            instructions.push(PktInstruction::Egress(egress));
             return instructions;
         }
         if self.key.ifindex.is_some() {
@@ -131,8 +148,10 @@ impl Nhop {
 
 impl VxlanEncapsulation {
     /// Resolve a Vxlan encapsulation object. The local vtep information is not used
-    /// in this process. We only resolve the destination mac.
-    pub(crate) fn resolve(&mut self, rstore: &RmacStore) {
+    /// in this process. We only resolve the destination mac. If no entry is found,
+    /// the vxlan object will have no MAC. If an entry is hit, the vxlan encap object
+    /// surely gets a MAC, whether the entry is stale or not.
+    pub(crate) fn resolve(&mut self, rstore: &RmacStore) -> bool {
         self.dmac = rstore.get_rmac(self.vni, self.remote).map(|e| e.mac);
         if self.dmac.is_none() {
             warn!(
@@ -141,5 +160,7 @@ impl VxlanEncapsulation {
                 self.remote
             );
         }
+        // ok if we found a mac, even if the entry is stale
+        self.dmac.is_some()
     }
 }
diff --git a/routing/src/rib/vrftable.rs b/routing/src/rib/vrftable.rs
index a2749909d6..d370a74664 100644
--- a/routing/src/rib/vrftable.rs
+++ b/routing/src/rib/vrftable.rs
@@ -390,6 +390,17 @@ impl VrfTable {
         }
     }
 
+    //////////////////////////////////////////////////////////////////
+    /// Refresh the fib groups for all vrfs that have a vni in the
+    /// provided set
+    //////////////////////////////////////////////////////////////////
+    pub fn refresh_fibs_by_vni(&mut self, vnis: &[Vni], rstore: &RmacStore) {
+        let (vrfs, vrf0) = self.values_mut_except_default();
+        for vrf in vrfs.filter(|v| v.vni.is_some_and(|vni| vnis.contains(&vni))) {
+            vrf.refresh_fib(rstore, Some(vrf0));
+        }
+    }
+
     /////////////////////////////////////////////////////////////////////////
     // Set/unset stale flag for all routes in all vrfs
     /////////////////////////////////////////////////////////////////////////
diff --git a/routing/src/router/cpi.rs b/routing/src/router/cpi.rs
index 3794738a12..eb8089f336 100644
--- a/routing/src/router/cpi.rs
+++ b/routing/src/router/cpi.rs
@@ -256,7 +256,7 @@ impl RpcOperation for Rmac {
         let Ok(rmac) = RmacEntry::try_from(self) else {
             return RpcResultCode::Failure;
         };
-        rmac_store.del_rmac_entry(&rmac);
+        rmac_store.invalidate_rmac_entry(&rmac);
         RpcResultCode::Ok
     }
 }
diff --git a/routing/src/router/rio.rs b/routing/src/router/rio.rs
index 861d91098f..ae17964c11 100644
--- a/routing/src/router/rio.rs
+++ b/routing/src/router/rio.rs
@@ -459,6 +459,13 @@ pub(crate) fn start_rio(
 
             /* handle control-channel messages */
             handle_ctl_msg(&mut rio, &mut db);
+
+            /* remove stale router mac entries (if aged). If rmacs were deleted, refresh the
+            fibs for the vrfs with the corresponding vnis */
+            let vnis = db.rmac_store.flush_stale_rmacs();
+            if !vnis.is_empty() {
+                db.vrftable.refresh_fibs_by_vni(&vnis, &db.rmac_store);
+            }
         }
     };
     let handle = thread::Builder::new()
diff --git a/routing/src/router/rpc_adapt.rs b/routing/src/router/rpc_adapt.rs
index 702a937fe7..49f9852df0 100644
--- a/routing/src/router/rpc_adapt.rs
+++ b/routing/src/router/rpc_adapt.rs
@@ -93,6 +93,7 @@ impl TryFrom<&Rmac> for RmacEntry {
                 error!("Received router mac with invalid vni {}", value.vni);
                 RouterError::VniInvalid(value.vni)
             })?,
+            stale_t: None,
         })
     }
 }
diff --git a/scripts/doc/custom-header.html b/scripts/doc/custom-header.html
index e86cf397e5..4374ea6d0e 100644
--- a/scripts/doc/custom-header.html
+++ b/scripts/doc/custom-header.html
@@ -49,15 +49,15 @@
     };
 </script>
 
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.16.45/dist/katex.min.css" integrity="sha384-UA8juhPf75SzzAMA/4fo3yOU7sBJ0om7SCD2GHq0fZqZco6tr1UCV7nUbk9J90JM" crossorigin="anonymous" />
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.18.0/dist/katex.min.css" integrity="sha384-KfwFj/Q/jGrY4ijtfzWyW5NXzT5irvfnTq6aRnH2xPvLzLdi1XyVr7w4l2uwTq0V" crossorigin="anonymous" />
 
 <!-- The loading of KaTeX is deferred to speed up page rendering -->
-<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.45/dist/katex.min.js" integrity="sha384-Tt7wBxLKwSzFVRET4O4U9H6v8MNaQ/CjN2FMP4xFm0ErrFu6aNqoonRVW5W40iGI" crossorigin="anonymous"></script>
+<script defer src="https://cdn.jsdelivr.net/npm/katex@0.18.0/dist/katex.min.js" integrity="sha384-OE4SMRr5gMJQzKSD08J46vKsKgY8NxVtO1LW+/q3NJ0WHsGsdN4oebgEjwwWuyvG" crossorigin="anonymous"></script>
 
 <!-- To automatically render math in text elements, include the auto-render extension: -->
 <script
     defer
-    src="https://cdn.jsdelivr.net/npm/katex@0.16.45/dist/contrib/auto-render.min.js"
+    src="https://cdn.jsdelivr.net/npm/katex@0.18.0/dist/contrib/auto-render.min.js"
     integrity="sha384-bjyGPfbij8/NDKJhSGZNP/khQVgtHUE5exjm4Ydllo42FwIgYsdLO2lXGmRBf5Mz"
     crossorigin="anonymous"
     onload="katexStuff();"
@@ -75,8 +75,8 @@
 
 <script
     defer
-    src="https://cdn.jsdelivr.net/npm/mermaid@11.14.0/dist/mermaid.min.js"
-    integrity="sha384-1CMXl090wj8Dd6YfnzSQUOgWbE6suWCaenYG7pox5AX7apTpY3PmJMeS2oPql4Gk"
+    src="https://cdn.jsdelivr.net/npm/mermaid@11.16.0/dist/mermaid.min.js"
+    integrity="sha384-T/0lMUdJpd2S1ZHtRiofG3htU3xPCrFVeAQ1UUE2TJwlEJSV5NUwn30kP28n238E"
     crossorigin="anonymous"
     onload="mermaidStuff();"
 ></script>
diff --git a/scripts/gen-pins.sh b/scripts/gen-pins.sh
index 7c40ade204..08cc9fef56 100755
--- a/scripts/gen-pins.sh
+++ b/scripts/gen-pins.sh
@@ -57,12 +57,12 @@ npins add github kube-rs kopium
 npins add github githedgehog fabric # Will pick highest tagged version on pin bump
 npins freeze fabric
 
-npins add github FRRouting frr --branch stable/10.5 # floats with branch on pin bump
-npins add github --name frr-dp githedgehog frr --branch hh-master-10.5 # floats with branch on pin bump
+npins add github FRRouting frr --branch stable/10.6 # floats with branch on pin bump
+npins add github --name frr-dp githedgehog frr --branch hh-master-10.6 # floats with branch on pin bump
 
 npins add github githedgehog frr-agent --branch master # floats with branch on pin bump
 npins add github githedgehog dplane-rpc --branch master # floats with branch on pin bump
-npins add github githedgehog dplane-plugin --branch master # floats with branch on pin bump
+npins add github githedgehog dplane-plugin --branch hh-master-10.6 # floats with branch on pin bump
 
 npins add github opengrep opengrep
 npins add github mermaid-js mermaid --release-prefix "mermaid@"