diff --git a/image/apko.lock.yaml b/image/apko.lock.yaml
index da858a1..7dd9958 100644
--- a/image/apko.lock.yaml
+++ b/image/apko.lock.yaml
@@ -293,7 +293,7 @@ contents:
     - systemd-sysupdate=262.2-r2
     - systemd-timesyncd=262.2-r2
     - systemd-userdb=262.2-r2
-    - task=3.54.0-r6
+    - task=3.54.0-r7
     - tecla=51.0-r0
     - tela-icon-theme=2026.08.10-r4
     - tinysparql=3.12.0-r0
@@ -339,9 +339,9 @@ contents:
     - bubblewrap=0.13.1-r0
     - build-base=1-r10
     - busybox=1.38.0-r3
-    - bzip2=1.0.8-r29
-    - bzip2-dev=1.0.8-r29
-    - bzip2-doc=1.0.8-r29
+    - bzip2=1.0.8-r30
+    - bzip2-dev=1.0.8-r30
+    - bzip2-doc=1.0.8-r30
     - ca-certificates=20261020-r0
     - ca-certificates-bundle=20261020-r0
     - ca-certificates-doc=20261020-r0
@@ -350,15 +350,15 @@ contents:
     - cairo-gobject=1.18.6-r1
     - cairo-tools=1.18.6-r1
     - cairomm=1.19.1-r5
-    - containerd-2=2.4.2-r5
-    - containerd-service-2=2.4.2-r5
-    - containerd-shim-runc-v2-2=2.4.2-r5
-    - containerd-stress-2=2.4.2-r5
+    - containerd-2=2.4.2-r6
+    - containerd-service-2=2.4.2-r6
+    - containerd-shim-runc-v2-2=2.4.2-r6
+    - containerd-stress-2=2.4.2-r6
     - coreutils=9.12-r7
     - coreutils-doc=9.12-r7
     - cryptsetup=2.8.8-r3
     - cryptsetup-doc=2.8.8-r3
-    - ctr-2=2.4.2-r5
+    - ctr-2=2.4.2-r6
     - cups=2.4.20-r0
     - cups-doc=2.4.20-r0
     - cups-filters=2.0.1-r1
@@ -374,14 +374,14 @@ contents:
     - dmidecode=3.7-r4
     - dmidecode-doc=3.7-r4
     - docbook-xml=4.5-r8
-    - docker-29=29.9.2-r0
-    - docker-cli=29.9.2-r0
-    - docker-cli-buildx=0.38.1-r0
-    - docker-cli-doc=29.9.2-r0
-    - docker-compose=5.7.0-r0
-    - docker-init-29=29.9.2-r0
-    - dockerd-29=29.9.2-r0
-    - dockerd-service-29=29.9.2-r0
+    - docker-29=29.9.3-r0
+    - docker-cli=29.9.3-r0
+    - docker-cli-buildx=0.38.2-r0
+    - docker-cli-doc=29.9.3-r0
+    - docker-compose=5.7.0-r1
+    - docker-init-29=29.9.3-r0
+    - dockerd-29=29.9.3-r0
+    - dockerd-service-29=29.9.3-r0
     - dosfstools=4.2-r46
     - dosfstools-doc=4.2-r46
     - e2fsprogs=1.47.4-r5
@@ -391,7 +391,7 @@ contents:
     - ell=0.83-r3
     - enchant2=2.8.21-r1
     - enchant2-doc=2.8.21-r1
-    - expat-dev=2.10.0-r0
+    - expat-dev=2.10.0-r1
     - ffmpeg-9.0-libavcodec63=9.0.2-r9
     - ffmpeg-9.0-libavfilter12=9.0.2-r9
     - ffmpeg-9.0-libavformat63=9.0.2-r9
@@ -399,7 +399,7 @@ contents:
     - ffmpeg-9.0-libswresample7=9.0.2-r9
     - ffmpeg-9.0-libswscale10=9.0.2-r9
     - fio=3.43-r0
-    - firefox=159.0-r0
+    - firefox=159.0.1-r0
     - font-noto=2026.11.01-r0
     - font-noto-common=2026.11.01-r0
     - font-noto-emoji=2.057-r0
@@ -640,15 +640,15 @@ contents:
     - git=2.56.0-r3
     - git-doc=2.56.0-r3
     - glib-gir=2.90.1-r0
-    - glibc-2.44=2.44-r12
-    - glibc-2.44-dev=2.44-r12
-    - glibc-2.44-iconv=2.44-r12
-    - glibc-2.44-locale-en=2.44-r12
-    - glibc-2.44-locale-es=2.44-r12
-    - glibc-2.44-locale-posix=2.44-r12
-    - glycin-2=2.2.5-r2
-    - glycin-2-gtk4=2.2.5-r2
-    - glycin-2-libs=2.2.5-r2
+    - glibc-2.44=2.44-r14
+    - glibc-2.44-dev=2.44-r14
+    - glibc-2.44-iconv=2.44-r14
+    - glibc-2.44-locale-en=2.44-r14
+    - glibc-2.44-locale-es=2.44-r14
+    - glibc-2.44-locale-posix=2.44-r14
+    - glycin-2=2.2.6-r0
+    - glycin-2-gtk4=2.2.6-r0
+    - glycin-2-libs=2.2.6-r0
     - gmp=6.3.0-r12
     - gmp-dev=6.3.0-r12
     - gnupg-gpgconf=2.4.9-r12
@@ -668,23 +668,23 @@ contents:
     - groff=1.24.2-r2
     - groff-base=1.24.2-r2
     - groff-doc=1.24.2-r2
-    - gst-libav-1.28=1.28.8-r0
-    - gst-plugins-base-1.28=1.28.8-r0
-    - gst-plugins-base-1.28-doc=1.28.8-r0
-    - gst-plugins-base-1.28-lang=1.28.8-r0
-    - gstreamer-1.28=1.28.8-r0
-    - gstreamer-1.28-doc=1.28.8-r0
+    - gst-libav-1.28=1.28.9-r0
+    - gst-plugins-base-1.28=1.28.9-r0
+    - gst-plugins-base-1.28-doc=1.28.9-r0
+    - gst-plugins-base-1.28-lang=1.28.9-r0
+    - gstreamer-1.28=1.28.9-r0
+    - gstreamer-1.28-doc=1.28.9-r0
     - gtk-3=3.24.52-r5
     - gtk-3-doc=3.24.52-r5
     - gtk-3-lang=3.24.52-r5
     - gtk-3-update-icon-cache=3.24.52-r5
     - gtk-4=4.24.1-r1
     - gtk-4-lang=4.24.1-r1
-    - harfbuzz=15.0.0-r3
+    - harfbuzz=15.1.0-r0
     - heimdal-libs=7.8.0-r55
     - hicolor-icon-theme=0.18-r8
     - hwdata-pci=0.413-r0
-    - hwdata-usb=0.412-r0
+    - hwdata-usb=0.413-r0
     - i2c-tools-doc=4.4-r14
     - icu78-data-full=78.3-r4
     - icu79-data-full=79.1-r1
@@ -710,19 +710,19 @@ contents:
     - kmod-doc=34.3-r0
     - kmod-libs=34.3-r0
     - krb5-conf=1.0-r10
-    - krb5-libs=1.22.2-r5
+    - krb5-libs=1.22.2-r6
     - lame-libs=4.0-r2
-    - ld-linux-2.44=2.44-r12
+    - ld-linux-2.44=2.44-r14
     - less=712-r0
     - less-doc=712-r0
-    - libLLVM-23=23.1.4-r1
+    - libLLVM-23=23.1.5-r0
     - libacl1=2.4.0-r5
     - libaio=0.3.113-r10
     - libarchive=3.8.11-r0
     - libassuan=3.0.2-r12
     - libasyncns=0.8-r9
     - libatomic=16.2.0-r2
-    - libattr1=2.6.0-r5
+    - libattr1=2.6.0-r6
     - libaudit=4.2.1-r4
     - libblkid=2.42.4-r2
     - libboost-filesystem=1.88.0-r7
@@ -733,12 +733,12 @@ contents:
     - libbrotlidec1=1.2.1-r3
     - libbrotlienc1=1.2.1-r3
     - libbsd=0.12.2-r11
-    - libbz2-1=1.0.8-r29
+    - libbz2-1=1.0.8-r30
     - libcap=2.78-r4
     - libcap-ng=0.9.6-r1
     - libcom_err=1.47.4-r5
-    - libcrypt1-2.44=2.44-r12
-    - libcupsfilters=2.2.1-r3
+    - libcrypt1-2.44=2.44-r14
+    - libcupsfilters=2.2.1-r4
     - libcurl-openssl4=8.23.0-r3
     - libdaemon=0.14-r7
     - libdav1d=1.5.4-r4
@@ -751,7 +751,7 @@ contents:
     - libevdev=1.14.0-r2
     - libevent=2.1.13-r3
     - libexif-libs=0.6.26-r5
-    - libexpat1=2.10.0-r0
+    - libexpat1=2.10.0-r1
     - libfdisk=2.42.4-r2
     - libffi=3.8.0-r2
     - libffi-dev=3.8.0-r2
@@ -787,7 +787,7 @@ contents:
     - liblcms2-2=2.20-r1
     - libldap-2.7=2.7.2-r0
     - libltdl=2.5.4-r5
-    - liblz4-1=1.10.0-r12
+    - liblz4-1=1.11.0-r0
     - libmd=1.3.0-r2
     - libmnl=1.0.5-r10
     - libmount=2.42.4-r2
@@ -796,7 +796,7 @@ contents:
     - libnl3=3.12.0-r7
     - libnotify=0.8.9-r2
     - libnspr=4.40-r2
-    - libnss=3.132-r0
+    - libnss=3.133-r0
     - libnvme=1.16.2-r8
     - libogg-libs=1.3.6-r10
     - libopenjph0.32=0.32.0-r0
@@ -804,14 +804,14 @@ contents:
     - libpaper-doc=2.2.8-r5
     - libpathrs=0.2.5-r6
     - libpciaccess=0.19-r4
-    - libpcre2-16-0=10.49-r2
-    - libpcre2-32-0=10.49-r2
-    - libpcre2-8-0=10.49-r2
-    - libpcre2-posix-3=10.49-r2
+    - libpcre2-16-0=10.49-r3
+    - libpcre2-32-0=10.49-r3
+    - libpcre2-8-0=10.49-r3
+    - libpcre2-posix-3=10.49-r3
     - libpipeline=1.5.8-r10
-    - libpng-dev=1.6.59-r1
-    - libpng16-16=1.6.59-r1
-    - libppd=2.1.1-r0
+    - libpng-dev=1.6.59-r2
+    - libpng16-16=1.6.59-r2
+    - libppd=2.1.1-r1
     - libproc-2-0=4.0.7-r3
     - libpsl=0.23.3-r4
     - libpulse=17.0-r13
@@ -834,7 +834,7 @@ contents:
     - libsm=1.2.6-r6
     - libsm-dev=1.2.6-r6
     - libsmartcols=2.42.4-r2
-    - libsmbclient=4.25.1-r0
+    - libsmbclient=4.25.1-r1
     - libsndfile=1.2.2-r6
     - libsndfile-doc=1.2.2-r6
     - libsodium=1.0.22-r4
@@ -850,7 +850,7 @@ contents:
     - libtool-doc=2.5.4-r5
     - libtraceevent=1.9.1-r0
     - libtracefs=1.8.4-r0
-    - libunistring=1.5-r0
+    - libunistring=1.5-r1
     - liburcu=0.15.7-r3
     - libusb=1.0.30-r3
     - libuuid=2.42.4-r2
@@ -858,7 +858,7 @@ contents:
     - libverto=0.3.2-r11
     - libvorbis=1.3.7-r14
     - libvpx=1.17.0-r2
-    - libwbclient=4.25.1-r0
+    - libwbclient=4.25.1-r1
     - libwebp=1.6.0-r7
     - libx11-6=1.8.14-r4
     - libx11-data=1.8.14-r4
@@ -870,8 +870,8 @@ contents:
     - libxcb=1.17.0-r19
     - libxcb-dev=1.17.0-r19
     - libxcomposite=0.4.7-r5
-    - libxcrypt=4.5.2-r7
-    - libxcrypt-dev=4.5.2-r7
+    - libxcrypt=4.5.2-r8
+    - libxcrypt-dev=4.5.2-r8
     - libxcursor=1.2.3-r7
     - libxcvt=0.1.3-r12
     - libxcvt-doc=0.1.3-r12
@@ -904,7 +904,7 @@ contents:
     - libzip=1.12.1-r0
     - libzip-doc=1.12.1-r0
     - libzstd1=1.5.7-r13
-    - linux-headers=7.3.1-r0
+    - linux-headers=7.3.3-r0
     - linux-pam=1.7.3-r3
     - lm-sensors=3.6.2-r4
     - lm-sensors-detect=3.6.2-r4
@@ -914,8 +914,8 @@ contents:
     - lsof=4.99.7-r3
     - lsof-doc=4.99.7-r3
     - lua5.4-libs=5.4.9-r2
-    - lz4=1.10.0-r12
-    - lz4-doc=1.10.0-r12
+    - lz4=1.11.0-r0
+    - lz4-doc=1.11.0-r0
     - lzo=2.10-r12
     - make=4.4.1-r15
     - make-doc=4.4.1-r15
@@ -939,7 +939,7 @@ contents:
     - ngtcp2=1.26.0-r0
     - npth-libs=1.8-r16
     - nsenter=2.42.4-r2
-    - nss-mdns=0.15.1-r0
+    - nss-mdns=0.15.1-r1
     - oniguruma=6.9.10-r7
     - opencore-amr=0.1.6-r6
     - openh264=2.7.0-r0
@@ -951,8 +951,8 @@ contents:
     - openssl-4.0-libcrypto=4.0.3-r8
     - openssl-4.0-libssl=4.0.3-r8
     - openssl-provider-legacy-allowed=4.1.0-r0
-    - openvpn=2.7.8-r2
-    - openvpn-doc=2.7.8-r2
+    - openvpn=2.7.9-r0
+    - openvpn-doc=2.7.9-r0
     - opus=1.6.1-r5
     - orc=0.4.44-r0
     - p11-kit=0.26.5-r2
@@ -960,10 +960,10 @@ contents:
     - pango=1.58.2-r1
     - parted=3.8-r1
     - parted-doc=3.8-r1
-    - pciutils=3.10.0-r44
-    - pciutils-doc=3.10.0-r44
-    - pciutils-libs=3.10.0-r44
-    - pcre2-dev=10.49-r2
+    - pciutils=3.10.0-r45
+    - pciutils-doc=3.10.0-r45
+    - pciutils-libs=3.10.0-r45
+    - pcre2-dev=10.49-r3
     - pdfio=1.6.6-r0
     - perl=5.44.0-r4
     - perl-doc=5.44.0-r4
@@ -975,14 +975,14 @@ contents:
     - polkit=128-r0
     - polkit-doc=128-r0
     - polkit-lang=128-r0
-    - poppler=26.10.0-r0
-    - poppler-glib=26.10.0-r0
-    - poppler-utils=26.10.0-r0
+    - poppler=26.11.0-r0
+    - poppler-glib=26.11.0-r0
+    - poppler-utils=26.11.0-r0
     - popt=1.19-r13
     - popt-lang=1.19-r13
     - posix-cc-wrappers=2-r10
-    - posix-libc-utils-2.44=2.44-r12
-    - posix-libc-utils-bin-2.44=2.44-r12
+    - posix-libc-utils-2.44=2.44-r14
+    - posix-libc-utils-bin-2.44=2.44-r14
     - powertop=2.16.1-r1
     - powertop-doc=2.16.1-r1
     - procps=4.0.7-r3
@@ -991,26 +991,26 @@ contents:
     - py3-pip-wheel=26.2.2-r2
     - py3.13-backports.tarfile=1.2.0-r6
     - py3.13-cairo=1.29.2-r2
-    - py3.13-cffi=2.1.1-r1
-    - py3.13-click=8.5.0-r0
-    - py3.13-colorama=0.4.6-r12
+    - py3.13-cffi=2.1.1-r2
+    - py3.13-click=8.5.1-r0
+    - py3.13-colorama=0.4.6-r13
     - py3.13-cryptography=50.0.2-r4
     - py3.13-gobject3=3.58.1-r1
     - py3.13-importlib-metadata=10.1.0-r0
     - py3.13-jaraco.classes=3.4.0-r12
-    - py3.13-jaraco.context=6.1.2-r1
-    - py3.13-jaraco.functools=4.6.0-r0
-    - py3.13-jeepney=0.9.0-r5
+    - py3.13-jaraco.context=6.1.2-r2
+    - py3.13-jaraco.functools=4.6.0-r1
+    - py3.13-jeepney=0.9.0-r6
     - py3.13-keyring=25.7.0-r2
-    - py3.13-more-itertools=11.2.1-r0
+    - py3.13-more-itertools=11.2.1-r1
     - py3.13-psutil=7.2.2-r5
     - py3.13-pycparser=3.12-r0
     - py3.13-python-dateutil=4.0.0-r0
     - py3.13-secretstorage=3.5.0-r3
     - py3.13-setuptools=84.2.1-r0
-    - py3.13-six=1.17.0-r8
+    - py3.13-six=1.17.0-r9
     - py3.13-typing-extensions=4.16.0-r0
-    - py3.13-tzdata=2026.6-r0
+    - py3.13-tzdata=2026.6-r1
     - py3.13-zipp=4.1.2-r0
     - python-3.13=3.13.18_git20261030-r0
     - python-3.13-base=3.13.18_git20261030-r0
@@ -1024,8 +1024,8 @@ contents:
     - runc=1.5.2-r7
     - runc-doc=1.5.2-r7
     - runuser=2.42.4-r2
-    - samba-libs=4.25.1-r0
-    - samba-util-libs=4.25.1-r0
+    - samba-libs=4.25.1-r1
+    - samba-util-libs=4.25.1-r1
     - sbc=2.2-r1
     - script=2.42.4-r2
     - setarch=2.42.4-r2
@@ -1046,9 +1046,9 @@ contents:
     - sqlite-doc=3.54.1-r0
     - sqlite-libs=3.54.1-r0
     - startup-notification=0.12-r8
-    - stress-ng=0.22.01-r0
-    - stress-ng-doc=0.22.01-r0
-    - tailscale=1.104.4-r0
+    - stress-ng=0.22.02-r0
+    - stress-ng-doc=0.22.02-r0
+    - tailscale=1.104.5-r1
     - talloc=2.5.0-r2
     - tdb=1.4.15-r6
     - tevent=0.17.2-r1
@@ -1066,10 +1066,10 @@ contents:
     - util-linux-misc=2.42.4-r2
     - util-linux-su=2.42.4-r2
     - util-macros=1.20.2-r5
-    - vim=9.2.1276-r0
-    - vim-doc=9.2.1276-r0
-    - vulkan-loader=1.4.367-r0
-    - vulkan-loader-libs=1.4.367-r0
+    - vim=9.2.1302-r0
+    - vim-doc=9.2.1302-r0
+    - vulkan-loader=1.4.368-r0
+    - vulkan-loader-libs=1.4.368-r0
     - wayland-libs-client=1.26.0-r3
     - wayland-libs-cursor=1.26.0-r3
     - wayland-libs-egl=1.26.0-r3
@@ -1094,15 +1094,15 @@ contents:
     - xprop=1.2.8-r5
     - xprop-doc=1.2.8-r5
     - xtrans=1.6.0-r4
-    - xz=5.8.4-r0
-    - xz-doc=5.8.4-r0
+    - xz=5.8.4-r1
+    - xz-doc=5.8.4-r1
     - yaml=0.2.5-r12
     - zeromq=4.3.5-r15
     - zeromq-doc=4.3.5-r15
     - zfs=2.4.4-r4
     - zfs-doc=2.4.4-r4
-    - zlib=1.3.2.1_rc20260921-r1
-    - zlib-dev=1.3.2.1_rc20260921-r1
+    - zlib=1.3.2.1_rc20260921-r2
+    - zlib-dev=1.3.2.1_rc20260921-r2
     - zram-generator=1.2.1-r4
     - zstd=1.5.7-r13
     - zstd-doc=1.5.7-r13
diff --git a/image/initrd/apko.lock.yaml b/image/initrd/apko.lock.yaml
index 1b6b9da..e0099da 100644
--- a/image/initrd/apko.lock.yaml
+++ b/image/initrd/apko.lock.yaml
@@ -46,61 +46,61 @@ contents:
     - fribidi=1.0.18-r2
     - fstrim=2.42.4-r2
     - gdbm=1.26-r9
-    - glibc-2.44=2.44-r12
-    - glibc-2.44-locale-posix=2.44-r12
+    - glibc-2.44=2.44-r14
+    - glibc-2.44-locale-posix=2.44-r14
     - graphite2=1.3.15-r6
-    - harfbuzz=15.0.0-r3
+    - harfbuzz=15.1.0-r0
     - heimdal-libs=7.8.0-r55
     - json-c=0.19-r2
     - keyutils-libs=1.6.3-r41
     - kmod=34.3-r0
     - kmod-libs=34.3-r0
     - krb5-conf=1.0-r10
-    - krb5-libs=1.22.2-r5
-    - ld-linux-2.44=2.44-r12
+    - krb5-libs=1.22.2-r6
+    - ld-linux-2.44=2.44-r14
     - libacl1=2.4.0-r5
     - libaio=0.3.113-r10
     - libarchive=3.8.11-r0
-    - libattr1=2.6.0-r5
+    - libattr1=2.6.0-r6
     - libaudit=4.2.1-r4
     - libblkid=2.42.4-r2
     - libbrotlicommon1=1.2.1-r3
     - libbrotlidec1=1.2.1-r3
     - libbrotlienc1=1.2.1-r3
-    - libbz2-1=1.0.8-r29
+    - libbz2-1=1.0.8-r30
     - libcap-ng=0.9.6-r1
     - libcom_err=1.47.4-r5
-    - libcrypt1-2.44=2.44-r12
+    - libcrypt1-2.44=2.44-r14
     - libcurl-openssl4=8.23.0-r3
     - libdrm-libs=2.4.134-r5
     - libevdev=1.14.0-r2
-    - libexpat1=2.10.0-r0
+    - libexpat1=2.10.0-r1
     - libfdisk=2.42.4-r2
     - libffi=3.8.0-r2
     - libfontconfig1=2.18.3-r5
     - libgcc=16.2.0-r2
     - libidn2=2.3.8-r12
     - libldap-2.7=2.7.2-r0
-    - liblz4-1=1.10.0-r12
+    - liblz4-1=1.11.0-r0
     - libmount=2.42.4-r2
     - libnghttp2-14=1.71.0-r0
     - libpciaccess=0.19-r4
-    - libpcre2-8-0=10.49-r2
-    - libpng16-16=1.6.59-r1
+    - libpcre2-8-0=10.49-r3
+    - libpng16-16=1.6.59-r2
     - libpsl=0.23.3-r4
     - libseccomp=2.6.1-r4
     - libselinux=3.11-r2
     - libsepol=3.11-r3
     - libsmartcols=2.42.4-r2
     - libssh=0.12.2-r3
-    - libunistring=1.5-r0
+    - libunistring=1.5-r1
     - libuuid=2.42.4-r2
     - libverto=0.3.2-r11
     - libx11-6=1.8.14-r4
     - libx11-data=1.8.14-r4
     - libxau=1.0.12-r11
     - libxcb=1.17.0-r19
-    - libxcrypt=4.5.2-r7
+    - libxcrypt=4.5.2-r8
     - libxdmcp=1.1.5-r14
     - libxext6=1.3.7-r5
     - libxft=2.3.9-r8
@@ -110,7 +110,7 @@ contents:
     - libzstd1=1.5.7-r13
     - linux-pam=1.7.3-r3
     - lmdb=0.9.35-r3
-    - lz4=1.10.0-r12
+    - lz4=1.11.0-r0
     - mount=2.42.4-r2
     - ncurses=6.6.20261031-r0
     - ncurses-terminfo-base=6.6.20261031-r0
@@ -136,6 +136,6 @@ contents:
     - wayland-libs-client=1.26.0-r3
     - wolfi-baselayout=20230201-r31
     - xkeyboard-config=2.49-r0
-    - xz=5.8.4-r0
-    - zlib=1.3.2.1_rc20260921-r1
+    - xz=5.8.4-r1
+    - zlib=1.3.2.1_rc20260921-r2
     - zstd=1.5.7-r13
diff --git a/recipes/task.yaml b/recipes/task.yaml
index de58001..395dad2 100644
--- a/recipes/task.yaml
+++ b/recipes/task.yaml
@@ -4,7 +4,7 @@
 package:
   name: task
   version: 3.54.0
-  epoch: 6
+  epoch: 7
   description: A task runner and build tool (Taskfile.yml)
   copyright:
     - license: MIT
@@ -22,11 +22,12 @@ pipeline:
       tag: v${{package.version}}
       expected-commit: b5aef1c287a9be8038347a17646bdf4bc7185bce
 
-  # v3.54.0 pins go-jose 4.1.4, which GHSA-mgcc-cww5-fp2q (High) names; drop this when a release of
-  # Task's pins 4.1.6 or newer.
+  # v3.54.0 pins go-jose 4.1.4, which GHSA-mgcc-cww5-fp2q (High) names, and klauspost/compress
+  # 1.19.2, which GO-2026-6865 (High) names; drop each when a release of Task's pins go-jose 4.1.6
+  # and compress 1.20.2 or newer (main has both).
   - uses: go/bump
     with:
-      deps: github.com/go-jose/go-jose/v4@v4.1.6
+      deps: github.com/go-jose/go-jose/v4@v4.1.6 github.com/klauspost/compress@v1.20.2
 
   # The version is internal/version/version.txt, embedded; -buildvcs=false keeps a commit and
   # "dirty" out of it, which the checkout's own state would add.