diff --git a/httpsig-hyper/Cargo.toml b/httpsig-hyper/Cargo.toml
index 1fa586c..096f538 100644
--- a/httpsig-hyper/Cargo.toml
+++ b/httpsig-hyper/Cargo.toml
@@ -15,13 +15,13 @@ rust-version.workspace = true
 [dependencies]
 httpsig = { path = "../httpsig", version = "0.0.16" }
 
-thiserror = { version = "1.0.63" }
+thiserror = { version = "1.0.64" }
 tracing = { version = "0.1.40" }
 futures = { version = "0.3.30", default-features = false, features = [
   "std",
   "async-await",
 ] }
-indexmap = { version = "2.4.0" }
+indexmap = { version = "2.5.0" }
 
 # content digest with rfc8941 structured field values
 sha2 = { version = "0.10.8", default-features = false }
@@ -34,11 +34,11 @@ base64 = { version = "0.22.1" }
 http = { version = "1.1.0" }
 http-body = { version = "1.0.1" }
 http-body-util = { version = "0.1.2" }
-bytes = { version = "1.7.1" }
+bytes = { version = "1.7.2" }
 
 
 [dev-dependencies]
-tokio = { version = "1.39.3", default-features = false, features = [
+tokio = { version = "1.40.0", default-features = false, features = [
   "macros",
   "rt-multi-thread",
 ] } # testing only
diff --git a/httpsig/Cargo.toml b/httpsig/Cargo.toml
index 08f7c13..59530d4 100644
--- a/httpsig/Cargo.toml
+++ b/httpsig/Cargo.toml
@@ -13,10 +13,10 @@ rust-version.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-thiserror = { version = "1.0.63" }
+thiserror = { version = "1.0.64" }
 tracing = { version = "0.1.40" }
 rustc-hash = { version = "2.0.0" }
-indexmap = { version = "2.4.0" }
+indexmap = { version = "2.5.0" }
 fxhash = { version = "0.2.1" }
 rand = { version = "0.8.5" }
 
@@ -40,7 +40,7 @@ p384 = { version = "0.13.0", default-features = false, features = [
 ] }
 hmac = { version = "0.12.1" }
 sha2 = { version = "0.10.8", default-features = false }
-bytes = { version = "1.7.1" }
+bytes = { version = "1.7.2" }
 
 # encoding
 base64 = { version = "0.22.1" }