diff --git a/Cargo.lock b/Cargo.lock
index e0373013..6feb18f5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2936,9 +2936,9 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "libmimalloc-sys"
-version = "0.1.48"
+version = "0.1.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2892ae4ea6fa2cb7acb0e236a6880d39523239cd9089de71d220910ccc806790"
+checksum = "6a45a52f43e1c16f667ccfe4dd8c85b7f7c204fd5e3bf46c5b0db9a5c3c0b8e9"
 dependencies = [
  "cc",
 ]
@@ -4217,9 +4217,9 @@ dependencies = [
 
 [[package]]
 name = "mimalloc"
-version = "0.1.51"
+version = "0.1.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebca48a43116bc25f18a61360f1be98412f50cc218f5e52c823086b999a4a21a"
+checksum = "2d4139bb28d14ad1facf21d5eb8825051b326e172d216b39f6d31df53cc97862"
 dependencies = [
  "libmimalloc-sys",
 ]
@@ -6022,9 +6022,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
  "itoa",
  "memchr",
@@ -6935,9 +6935,9 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.10"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68d6fdd9f81c2819c9a8b0e0cd91660e7746a8e6ea2ba7c6b2b057985f6bcb51"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
  "base64",
  "bitflags 2.11.1",
diff --git a/Cargo.toml b/Cargo.toml
index 54c4d450..3c196cc9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -228,7 +228,7 @@ pprof               = { version = "0.15.0", default-features = false, features =
 # `--features mimalloc-allocator` / `--features jemalloc-allocator` so a
 # release build can A/B the allocator under concurrent load without changing
 # code. Not added to the default dependency graph anywhere.
-mimalloc            = { version = "0.1.51", default-features = false }
+mimalloc            = { version = "0.1.52", default-features = false }
 tikv-jemallocator   = { version = "0.6.1", default-features = false }
 proptest            = "1.11.0"
 prometheus          = { version = "0.14.0", features = ["process"] }
@@ -243,7 +243,7 @@ rustybuzz           = "0.20.1"
 rstar               = "0.12.2"
 schemars            = "1.2.1"
 serde               = { version = "1.0.228", features = ["derive", "rc"] }
-serde_json          = "1.0.149"
+serde_json          = "1.0.150"
 serde_yaml_ng       = "0.10.0"
 # shapefile decoder for mars-source-vectorfile; geo-types feature enables
 # the Shape -> geo_types::Geometry conversion path that geozero lowers to WKB.
@@ -263,7 +263,7 @@ tokio-postgres      = { version = "0.7.17", features = ["with-uuid-1"] }
 tokio-postgres-rustls = "0.13.0"
 tokio-util          = { version = "0.7.18", features = ["rt"] }
 tower               = "0.5.3"
-tower-http          = { version = "0.6.10", features = ["trace", "timeout", "limit", "cors"] }
+tower-http          = { version = "0.6.11", features = ["trace", "timeout", "limit", "cors"] }
 # opt-in per-IP rate limit (interfaces.rate_limit). default-features off so we
 # skip the bundled tonic integration; axum-only keeps the dep graph slim.
 tower_governor      = { version = "0.8.0", default-features = false, features = ["axum"] }