diff --git a/Cargo.lock b/Cargo.lock
index ac9ce35..dd2c87a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1387,11 +1387,11 @@ dependencies = [
 
 [[package]]
 name = "hashlink"
-version = "0.11.1"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824e001ac4f3012dd16a264bec811403a67ca9deb6c102fc5049b32c4574b35f"
+checksum = "32069d97bb81e38fa67eab65e3393bf804bb85969f2bc06bf13f64aef5aba248"
 dependencies = [
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
@@ -4576,13 +4576,13 @@ checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
 
 [[package]]
 name = "yaml-rust2"
-version = "0.11.0"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "631a50d867fafb7093e709d75aaee9e0e0d5deb934021fcea25ac2fe09edc51e"
+checksum = "c6edb26322e610d4f04b7cd34478317685d24d0999437e551fb97c5441151041"
 dependencies = [
  "arraydeque",
  "encoding_rs",
- "hashlink 0.11.1",
+ "hashlink 0.12.1",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index bb5e53f..42978a5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -76,7 +76,7 @@ toml = "1.1"
 # tags, matching the no-tags/no-object-construction requirement for
 # untrusted manifest parsing. Chosen over serde_yaml, which is upstream
 # maintenance-only.
-yaml-rust2 = "0.11"
+yaml-rust2 = "0.12"
 
 # JS/TS parser for `javascript_static`'s bounded AST-based capability
 # analysis of untrusted `.js`/`.mjs`/`.cjs`/`.ts`/`.tsx`/`.jsx` package