From 5d88e2d03372255eeaa65dc4b5428e9f9b1a1bae Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 18:57:29 +0000
Subject: [PATCH 1/2] fix(deps): update rust-minor

---
 crates/morphir-core/Cargo.toml               |  2 +-
 crates/morphir-ext-example/Cargo.toml        |  2 +-
 crates/morphir-extension-sdk/Cargo.toml      |  4 +-
 crates/morphir-kb/Cargo.toml                 |  2 +-
 crates/morphir-mck-adapter/Cargo.toml        |  4 +-
 crates/morphir-package/Cargo.toml            |  6 +--
 crates/morphir-wasm-binding/Cargo.toml       |  2 +-
 third_party/morphir-package-tough/Cargo.lock | 50 ++++++++++----------
 third_party/morphir-package-tough/Cargo.toml |  8 ++--
 9 files changed, 40 insertions(+), 40 deletions(-)

diff --git a/crates/morphir-core/Cargo.toml b/crates/morphir-core/Cargo.toml
index e79a6229c..3dadc87a4 100644
--- a/crates/morphir-core/Cargo.toml
+++ b/crates/morphir-core/Cargo.toml
@@ -53,4 +53,4 @@ num-bigint = "0.5"
 
 [dev-dependencies]
 morphir-gherkin = { path = "../morphir-gherkin" }
-rstest = "0.27"
+rstest = "0.28"
diff --git a/crates/morphir-ext-example/Cargo.toml b/crates/morphir-ext-example/Cargo.toml
index 417faa144..2b17f90d8 100644
--- a/crates/morphir-ext-example/Cargo.toml
+++ b/crates/morphir-ext-example/Cargo.toml
@@ -23,7 +23,7 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 
 # WASI bindings
-wit-bindgen = "0.62.0"
+wit-bindgen = "0.63.0"
 
 [package.metadata.component]
 package = "morphir:ext-example"
diff --git a/crates/morphir-extension-sdk/Cargo.toml b/crates/morphir-extension-sdk/Cargo.toml
index 27afeb687..1d5734698 100644
--- a/crates/morphir-extension-sdk/Cargo.toml
+++ b/crates/morphir-extension-sdk/Cargo.toml
@@ -30,12 +30,12 @@ percent-encoding = { workspace = true }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { version = "1.0", features = ["raw_value"] }
 semver = { version = "1", features = ["serde"] }
-base64 = "0.22.1"
+base64 = "0.23.0"
 sha2 = "0.11"
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 # ion-rs 1.0.1 unconditionally enables Chrono's browser bindings. Keep this
 # reader native-only until a non-browser Ion reader is qualified for MEP WASM.
-ion-rs = { version = "=1.0.1", features = ["experimental-reader-writer", "experimental-tooling-apis"] }
+ion-rs = { version = "=1.2.0", features = ["experimental-reader-writer", "experimental-tooling-apis"] }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 # Plugin development kit for WASM guests. Native hosts must not link guest imports.
diff --git a/crates/morphir-kb/Cargo.toml b/crates/morphir-kb/Cargo.toml
index f697c752f..1d40a4155 100644
--- a/crates/morphir-kb/Cargo.toml
+++ b/crates/morphir-kb/Cargo.toml
@@ -15,7 +15,7 @@ thiserror = { workspace = true }
 regex = "1"
 sha2 = "0.11"
 chrono = "0.4"
-rusqlite = { version = "0.40", features = ["bundled"] }
+rusqlite = { version = "0.41", features = ["bundled"] }
 walkdir = "2"
 
 [dev-dependencies]
diff --git a/crates/morphir-mck-adapter/Cargo.toml b/crates/morphir-mck-adapter/Cargo.toml
index 76d639f04..9a9b2f829 100644
--- a/crates/morphir-mck-adapter/Cargo.toml
+++ b/crates/morphir-mck-adapter/Cargo.toml
@@ -27,8 +27,8 @@ anyhow = { workspace = true }
 tempfile = { workspace = true }
 tokio = { version = "1", features = ["rt"] }
 package_tough = { package = "morphir-package-tough", path = "../../third_party/morphir-package-tough", default-features = false, features = ["experimental-storage"] }
-rusqlite = "=0.40.2"
-base64 = "0.22"
+rusqlite = "=0.41.1"
+base64 = "0.23"
 sha2 = "0.11"
 
 [dev-dependencies]
diff --git a/crates/morphir-package/Cargo.toml b/crates/morphir-package/Cargo.toml
index 5ea732c4f..f76b48e49 100644
--- a/crates/morphir-package/Cargo.toml
+++ b/crates/morphir-package/Cargo.toml
@@ -14,12 +14,12 @@ morphir-core = { path = "../morphir-core", version = "0.2.0" }
 serde = { version = "1", features = ["derive"] }
 serde_json = { version = "1", features = ["raw_value", "arbitrary_precision"] }
 sha2 = "0.11"
-jsonschema = { version = "0.56", default-features = false }
+jsonschema = { version = "0.60", default-features = false }
 thiserror.workspace = true
 # Preserve Noble zip215:false: canonical points, non-small-order A, cofactored equation.
 ed25519-zebra = { version = "4.2", default-features = false, features = ["std"] }
 curve25519-dalek = { version = "5.0", default-features = false, features = ["alloc"] }
-base64 = "0.22"
+base64 = "0.23"
 
 package_tough = { package = "morphir-package-tough", path = "../../third_party/morphir-package-tough", default-features = false, features = ["experimental-storage"] }
 async-trait = "0.1"
@@ -29,7 +29,7 @@ futures = "0.3"
 url = "2"
 
 fs2 = "0.4"
-rusqlite = { version = "=0.40.2", features = ["bundled"] }
+rusqlite = { version = "=0.41.1", features = ["bundled"] }
 tempfile = "3"
 
 [dev-dependencies]
diff --git a/crates/morphir-wasm-binding/Cargo.toml b/crates/morphir-wasm-binding/Cargo.toml
index 186322b9b..cd990df87 100644
--- a/crates/morphir-wasm-binding/Cargo.toml
+++ b/crates/morphir-wasm-binding/Cargo.toml
@@ -27,7 +27,7 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 
 # WASM generation
-wasm-encoder = "0.259"
+wasm-encoder = "0.262"
 
 # Base64 encoding for binary output
 base64 = "0.23"
diff --git a/third_party/morphir-package-tough/Cargo.lock b/third_party/morphir-package-tough/Cargo.lock
index 99417fea9..9127e1608 100644
--- a/third_party/morphir-package-tough/Cargo.lock
+++ b/third_party/morphir-package-tough/Cargo.lock
@@ -19,13 +19,13 @@ checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
 [[package]]
 name = "async-recursion"
-version = "1.1.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
+checksum = "4f8abc12baad266b1c8cec146854c195b5864b4221d4b2ca7296a7ae82d9e451"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -62,9 +62,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.18.1"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
+checksum = "048006790404103c488e6c5616b3e7e702a71292aadda08e8f7698a9e0d2eb53"
 dependencies = [
  "aws-lc-fips-sys",
  "aws-lc-sys",
@@ -74,9 +74,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.45.0"
+version = "0.47.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
+checksum = "8bfbe32ac36b3c428696ce315464181bc4029d689fd58e3f2a4e58c252242f52"
 dependencies = [
  "cc",
  "cmake",
@@ -471,7 +471,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1151,9 +1151,9 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.38.2"
+version = "0.39.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8"
+checksum = "14a5f01b87b92705d07b433c06f96cbc764637d81a0bffb5734ce17cf0f9a2b3"
 dependencies = [
  "cc",
  "pkg-config",
@@ -1244,7 +1244,7 @@ dependencies = [
  "tokio-test",
  "tokio-util",
  "typed-path",
- "untrusted 0.7.1",
+ "untrusted 0.9.0",
  "url",
  "walkdir",
 ]
@@ -1509,9 +1509,9 @@ dependencies = [
 
 [[package]]
 name = "rusqlite"
-version = "0.40.2"
+version = "0.41.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3"
+checksum = "da9bba6f3506135e120a6586df05be18b48d18896600646a4bec8f993d91a594"
 dependencies = [
  "bitflags 2.13.2",
  "fallible-iterator",
@@ -1547,7 +1547,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1604,7 +1604,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1821,9 +1821,9 @@ checksum = "ba467056f1b547ed52077911161fc86985becbc60e8e1857c8a144dab0def891"
 
 [[package]]
 name = "snafu"
-version = "0.8.9"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e84b3f4eacbf3a1ce05eac6763b4d629d60cbc94d632e4092c54ade71f1e1a2"
+checksum = "e45cb604038abb7b926b679887b3226d8d0f23874b66623625a0454be425a4b7"
 dependencies = [
  "futures-core",
  "pin-project",
@@ -1832,9 +1832,9 @@ dependencies = [
 
 [[package]]
 name = "snafu-derive"
-version = "0.8.9"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
+checksum = "287f59010008f0d7cf5e3b03196d666c1acc46c8d3e9cf34c28a1a7157601e72"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -1938,7 +1938,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1979,9 +1979,9 @@ checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
 
 [[package]]
 name = "tokio"
-version = "1.53.1"
+version = "1.54.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
 dependencies = [
  "bytes",
  "libc",
@@ -2121,9 +2121,9 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "typed-path"
-version = "0.9.3"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82205ffd44a9697e34fc145491aa47310f9871540bb7909eaa9365e0a9a46607"
+checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"
 
 [[package]]
 name = "typenum"
@@ -2306,7 +2306,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
diff --git a/third_party/morphir-package-tough/Cargo.toml b/third_party/morphir-package-tough/Cargo.toml
index 24784b436..828cfde8a 100644
--- a/third_party/morphir-package-tough/Cargo.toml
+++ b/third_party/morphir-package-tough/Cargo.toml
@@ -164,7 +164,7 @@ features = ["arbitrary_precision", "raw_value"]
 version = "1"
 
 [dependencies.snafu]
-version = "0.8"
+version = "0.9"
 features = ["futures"]
 
 [dependencies.tempfile]
@@ -186,10 +186,10 @@ version = "0.7"
 features = ["io"]
 
 [dependencies.typed-path]
-version = "0.9"
+version = "0.13"
 
 [dependencies.untrusted]
-version = "0.7.1"
+version = "0.9.0"
 
 [dependencies.url]
 version = "2"
@@ -234,7 +234,7 @@ path = "tests/experimental_storage.rs"
 required-features = ["experimental-storage"]
 
 [dev-dependencies.rusqlite]
-version = "=0.40.2"
+version = "=0.41.1"
 features = ["bundled"]
 
 [dev-dependencies.ed25519-zebra]

From 1457ed9de471863630b5ecd4b52a67ee69180999 Mon Sep 17 00:00:00 2001
From: Damian Reeves <957246+DamianReeves@users.noreply.github.com>
Date: Thu, 29 Oct 2026 02:54:50 -0500
Subject: [PATCH 2/2] fix(deps): keep lock-step versions in the rust-minor
 update

Three of the 0.x "minor" updates in this group are breaking, because
each crate has to match another crate's version:

- getrandom stays at 0.2 in morphir-gleam-binding. The dependency only
  turns on the `custom` feature of the 0.2 copy that gleam-core's
  dependencies use on wasm32-unknown-unknown; 0.4 has no such feature
  and would add an unrelated copy.
- ecow stays at =0.2.6, the version gleam-core uses, because
  morphir-gleam-binding passes EcoString values to and from gleam-core.
- untrusted stays at 0.7.1 in morphir-package-tough, because aws-lc-rs
  1.18 takes an untrusted 0.7 Reader.

rusqlite 0.41 returns an iterator from Statement::column_names, so drop
the redundant into_iter() that clippy now rejects. The lock file is
resolved again; Renovate's update had failed on getrandom and left the
old versions in place.

Verified with cargo clippy --all-targets --all-features -D warnings,
mise run test:unit (1209 passed) and cargo test --workspace
--all-features --tests (4014 passed).

Beads: morphir-x4ep.3

Claude-Session: https://claude.ai/code/session_016vWNpLC7n2Fat4wgyZR75p
---
 Cargo.lock                                   | 200 +++++++++++--------
 crates/morphir-kb/src/index.rs               |   2 +-
 third_party/morphir-package-tough/Cargo.lock |   2 +-
 third_party/morphir-package-tough/Cargo.toml |   2 +-
 4 files changed, 122 insertions(+), 84 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 80e1757c6..f6c75ed65 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -636,15 +636,6 @@ dependencies = [
  "winx",
 ]
 
-[[package]]
-name = "castaway"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dec551ab6e7578819132c713a93c022a05d60159dc86e7a7050223577484c55a"
-dependencies = [
- "rustversion",
-]
-
 [[package]]
 name = "cbc"
 version = "0.2.1"
@@ -818,20 +809,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "compact_str"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fd622ebbb56a5b2ccb651b32b911cdeb2a9b4b11776b2473bf26a26a286244e"
-dependencies = [
- "castaway",
- "cfg-if",
- "itoa",
- "rustversion",
- "ryu",
- "static_assertions",
-]
-
 [[package]]
 name = "concurrent-queue"
 version = "2.5.0"
@@ -1836,6 +1813,12 @@ version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
 [[package]]
 name = "foldhash"
 version = "0.2.0"
@@ -2167,6 +2150,17 @@ dependencies = [
  "allocator-api2",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.1.5",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
@@ -2175,7 +2169,7 @@ checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 dependencies = [
  "allocator-api2",
  "equivalent",
- "foldhash",
+ "foldhash 0.2.0",
  "serde",
  "serde_core",
 ]
@@ -2188,7 +2182,7 @@ checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 dependencies = [
  "allocator-api2",
  "equivalent",
- "foldhash",
+ "foldhash 0.2.0",
 ]
 
 [[package]]
@@ -2624,17 +2618,16 @@ checksum = "2f0fb0570afe1fed943c5c3d4102d5358592d8625fda6a0007fdbe65a92fba96"
 
 [[package]]
 name = "ion-rs"
-version = "1.0.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "285b4429808446f30da668d210beaeb7ab82defb6045e261c6cdfaeafe565552"
+checksum = "5b6ca78404dbb25f628b942e4438d80014f6095f36f96fc9bfaa490400bc4635"
 dependencies = [
  "arrayvec 0.7.8",
  "base64 0.12.3",
  "bumpalo",
- "chrono",
- "compact_str",
  "delegate",
  "generic-array",
+ "hashbrown 0.15.5",
  "ice_code",
  "memchr",
  "num-bigint 0.4.8",
@@ -2960,9 +2953,9 @@ dependencies = [
 
 [[package]]
 name = "jsonschema"
-version = "0.56.0"
+version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6a806f80c1f5560431009ce5ec29b59d38f950e0cd7db5f1b8925e6d8104e21"
+checksum = "a42a11b47492e6a2cc76e9c7bcc8077776cb31dac444e0795d7f61bcc6441c08"
 dependencies = [
  "ahash",
  "bytecount",
@@ -2988,23 +2981,24 @@ dependencies = [
 
 [[package]]
 name = "jsonschema-regex"
-version = "0.56.0"
+version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb862addfa7782108933abcf842fe25334523a9df5b89ea4d9620e3dd7b42181"
+checksum = "107aeb6ff14b8deb5610096a8ce5c554ec89806b521147eaeb3cae05b07edb7a"
 dependencies = [
  "regex-syntax",
 ]
 
 [[package]]
 name = "jsonschema-value"
-version = "0.56.0"
+version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a05cd404c5ff6e2731dbbf7e290a27417750acfb59e329560a1d0af384c93fb0"
+checksum = "e281d6b177bb4834f2ffd6f92aa0443cffe29c996b251c8d94eb6f456186feba"
 dependencies = [
  "ahash",
  "bytecount",
  "fraction",
  "getrandom 0.3.4",
+ "memchr",
  "num-cmp",
  "num-traits",
  "serde_json",
@@ -3164,9 +3158,9 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.38.2"
+version = "0.39.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8"
+checksum = "14a5f01b87b92705d07b433c06f96cbc764637d81a0bffb5734ce17cf0f9a2b3"
 dependencies = [
  "cc",
  "pkg-config",
@@ -3558,14 +3552,14 @@ dependencies = [
  "morphir-ext-core",
  "serde",
  "serde_json",
- "wit-bindgen 0.62.0",
+ "wit-bindgen 0.63.0",
 ]
 
 [[package]]
 name = "morphir-extension-sdk"
 version = "0.4.0"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
  "extism-pdk",
  "ion-rs",
  "morphir-json",
@@ -3661,7 +3655,7 @@ name = "morphir-mck-adapter"
 version = "0.2.0"
 dependencies = [
  "anyhow",
- "base64 0.22.1",
+ "base64 0.23.1",
  "morphir-common",
  "morphir-core",
  "morphir-package",
@@ -3692,7 +3686,7 @@ name = "morphir-package"
 version = "0.2.0"
 dependencies = [
  "async-trait",
- "base64 0.22.1",
+ "base64 0.23.1",
  "bytes",
  "cucumber",
  "curve25519-dalek 5.0.0",
@@ -3737,11 +3731,11 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_plain",
- "snafu",
+ "snafu 0.9.2",
  "tempfile",
  "tokio",
  "tokio-util",
- "typed-path 0.9.3",
+ "typed-path 0.13.0",
  "untrusted 0.7.1",
  "url",
  "walkdir",
@@ -3808,7 +3802,7 @@ dependencies = [
  "morphir-extension-sdk",
  "serde",
  "serde_json",
- "wasm-encoder 0.259.0",
+ "wasm-encoder 0.262.0",
 ]
 
 [[package]]
@@ -4734,9 +4728,9 @@ dependencies = [
 
 [[package]]
 name = "referencing"
-version = "0.56.0"
+version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3b4a92fac7e28c27de3ad26df2ecb9e652f227b258e845af034052e5b22c96c"
+checksum = "f42818036d3b37cda6bd4c494543158a36e431cb717015ef7c93acc6ba214d3b"
 dependencies = [
  "ahash",
  "fluent-uri",
@@ -4894,9 +4888,9 @@ dependencies = [
 
 [[package]]
 name = "rstest"
-version = "0.27.0"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "948203e6d13b83e51a90d7cf236dd58a0065f23f4b902f00f306e7eb2bd09b9c"
+checksum = "b376e512f30a7686a8dbc6aeaace99b3ade1c26c1c63473473a817ade226dafc"
 dependencies = [
  "futures-timer",
  "futures-util",
@@ -4905,9 +4899,9 @@ dependencies = [
 
 [[package]]
 name = "rstest_macros"
-version = "0.27.0"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8d92eaf7b6e51e12471d71ddc72608e7151573de44099aacfbb1128177c0da4"
+checksum = "88512dbfb5b73a0dfa38aef7bc73b5657035fce477b923faf12d332dd83051ea"
 dependencies = [
  "cfg-if",
  "glob",
@@ -4923,9 +4917,9 @@ dependencies = [
 
 [[package]]
 name = "rusqlite"
-version = "0.40.2"
+version = "0.41.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3"
+checksum = "da9bba6f3506135e120a6586df05be18b48d18896600646a4bec8f993d91a594"
 dependencies = [
  "bitflags 2.13.1",
  "fallible-iterator",
@@ -5542,7 +5536,18 @@ checksum = "6e84b3f4eacbf3a1ce05eac6763b4d629d60cbc94d632e4092c54ade71f1e1a2"
 dependencies = [
  "futures-core",
  "pin-project",
- "snafu-derive",
+ "snafu-derive 0.8.9",
+]
+
+[[package]]
+name = "snafu"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e45cb604038abb7b926b679887b3226d8d0f23874b66623625a0454be425a4b7"
+dependencies = [
+ "futures-core",
+ "pin-project",
+ "snafu-derive 0.9.2",
 ]
 
 [[package]]
@@ -5557,6 +5562,18 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "snafu-derive"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "287f59010008f0d7cf5e3b03196d666c1acc46c8d3e9cf34c28a1a7157601e72"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "socket2"
 version = "0.6.5"
@@ -5624,12 +5641,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "static_assertions"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
-
 [[package]]
 name = "streaming-iterator"
 version = "0.1.9"
@@ -6089,7 +6100,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_plain",
- "snafu",
+ "snafu 0.8.9",
  "tempfile",
  "tokio",
  "tokio-util",
@@ -6269,6 +6280,12 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
 
+[[package]]
+name = "typed-path"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"
+
 [[package]]
 name = "typenum"
 version = "1.20.1"
@@ -6644,16 +6661,26 @@ dependencies = [
  "wasmparser 0.259.0",
 ]
 
+[[package]]
+name = "wasm-encoder"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4495a6f85dd94c411c749303efcbc5defade0b0cbdbc0541495241ab917a9b5a"
+dependencies = [
+ "leb128fmt",
+ "wasmparser 0.262.0",
+]
+
 [[package]]
 name = "wasm-metadata"
-version = "0.259.0"
+version = "0.262.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7bf119eb01f4a246864c10bd87c8f26c566350abb25aa4d5273c415bbab338"
+checksum = "c86ff6668190d9fb70372b306b4f9fe8930f0e2f57ce72e4922bf2f117900949"
 dependencies = [
  "anyhow",
  "indexmap",
- "wasm-encoder 0.259.0",
- "wasmparser 0.259.0",
+ "wasm-encoder 0.262.0",
+ "wasmparser 0.262.0",
 ]
 
 [[package]]
@@ -6674,6 +6701,17 @@ name = "wasmparser"
 version = "0.259.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0f7c12eac7bb587801590f6a67ff0bc84d0748513864b71108e4b311cc3df694"
+dependencies = [
+ "bitflags 2.13.1",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "974d643b125b272607e2fff8012ea14a8328acd7621e4bafa7afb32500052b1b"
 dependencies = [
  "bitflags 2.13.1",
  "hashbrown 0.17.1",
@@ -7463,9 +7501,9 @@ checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
 name = "wit-bindgen"
-version = "0.62.0"
+version = "0.63.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53cb4b5556c3a791e86838ea287782bdafa704d55b0e68b5b81a3a16b9ea5f4b"
+checksum = "b85a987ab61d365382d25c7d47e26edd48941b3bf6e3fbf76eff918bc71dab06"
 dependencies = [
  "bitflags 2.13.1",
  "wit-bindgen-rust-macro",
@@ -7473,20 +7511,20 @@ dependencies = [
 
 [[package]]
 name = "wit-bindgen-core"
-version = "0.62.0"
+version = "0.63.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72ad22a37ecbc0e1fdca34d2b670ba41368cb0920735643e00fdf39a16ee5431"
+checksum = "775e122e390603abfacd548027016cd0113a6e2bf2f8ce6bdd3658b013456ea8"
 dependencies = [
  "anyhow",
  "heck",
- "wit-parser 0.259.0",
+ "wit-parser 0.262.0",
 ]
 
 [[package]]
 name = "wit-bindgen-rust"
-version = "0.62.0"
+version = "0.63.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84ba5213d4332c260a0d4e69e34b0f7e4b85ddae10b6ebfbac00d9c185ba628a"
+checksum = "84e26e13b9d972026778d2ffb7985736de116026fdc8d9464f966e12df2eb240"
 dependencies = [
  "anyhow",
  "heck",
@@ -7500,9 +7538,9 @@ dependencies = [
 
 [[package]]
 name = "wit-bindgen-rust-macro"
-version = "0.62.0"
+version = "0.63.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f19d63da8e478a370ef8192d90ccb517965b7747d6b46cd2d831dd0ef4d2541"
+checksum = "16a008a0d6b4840677326beb4edbeb210a2f1b7d0183fb7cc33f466b90fd7fb6"
 dependencies = [
  "anyhow",
  "macro-string",
@@ -7516,9 +7554,9 @@ dependencies = [
 
 [[package]]
 name = "wit-component"
-version = "0.259.0"
+version = "0.262.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "092f783dee3253265fcde131475055f8c275ac0176a9c0396db1dc7b5544bfb4"
+checksum = "078def49fdb49cab405c3006e05793b3fdaf7069126ba6b9c97d01ec8c98fe4c"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -7527,10 +7565,10 @@ dependencies = [
  "serde",
  "serde_derive",
  "serde_json",
- "wasm-encoder 0.259.0",
+ "wasm-encoder 0.262.0",
  "wasm-metadata",
- "wasmparser 0.259.0",
- "wit-parser 0.259.0",
+ "wasmparser 0.262.0",
+ "wit-parser 0.262.0",
 ]
 
 [[package]]
@@ -7554,9 +7592,9 @@ dependencies = [
 
 [[package]]
 name = "wit-parser"
-version = "0.259.0"
+version = "0.262.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6390f4f02493ce678d509c859cf1698e38929fb75c8012a6ee2f7d6b6cb66cd7"
+checksum = "00f0dc051466ffe46787721fca3d088536f158ae400be044f1b1c386ba9397ad"
 dependencies = [
  "anyhow",
  "hashbrown 0.17.1",
@@ -7568,7 +7606,7 @@ dependencies = [
  "serde_derive",
  "serde_json",
  "unicode-ident",
- "wasmparser 0.259.0",
+ "wasmparser 0.262.0",
 ]
 
 [[package]]
diff --git a/crates/morphir-kb/src/index.rs b/crates/morphir-kb/src/index.rs
index 1e86b67bb..5dd488d85 100644
--- a/crates/morphir-kb/src/index.rs
+++ b/crates/morphir-kb/src/index.rs
@@ -493,7 +493,7 @@ fn run_query(db: &Path, sql: &str, binds: Vec<Value>) -> rusqlite::Result<Rows>
         OpenFlags::SQLITE_OPEN_READ_ONLY | OpenFlags::SQLITE_OPEN_NO_MUTEX,
     )?;
     let mut stmt = conn.prepare(sql)?;
-    let columns: Vec<String> = stmt.column_names().into_iter().map(String::from).collect();
+    let columns: Vec<String> = stmt.column_names().map(String::from).collect();
     let ncols = columns.len();
     let mut out = Vec::new();
     let mut rows = stmt.query(params_from_iter(binds))?;
diff --git a/third_party/morphir-package-tough/Cargo.lock b/third_party/morphir-package-tough/Cargo.lock
index 9127e1608..02b22ecb2 100644
--- a/third_party/morphir-package-tough/Cargo.lock
+++ b/third_party/morphir-package-tough/Cargo.lock
@@ -1244,7 +1244,7 @@ dependencies = [
  "tokio-test",
  "tokio-util",
  "typed-path",
- "untrusted 0.9.0",
+ "untrusted 0.7.1",
  "url",
  "walkdir",
 ]
diff --git a/third_party/morphir-package-tough/Cargo.toml b/third_party/morphir-package-tough/Cargo.toml
index 828cfde8a..950f80060 100644
--- a/third_party/morphir-package-tough/Cargo.toml
+++ b/third_party/morphir-package-tough/Cargo.toml
@@ -189,7 +189,7 @@ features = ["io"]
 version = "0.13"
 
 [dependencies.untrusted]
-version = "0.9.0"
+version = "0.7.1"
 
 [dependencies.url]
 version = "2"