diff --git a/Cargo.lock b/Cargo.lock
index c96ed10..8619815 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2206,11 +2206,11 @@ checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
 [[package]]
 name = "flatbuffers"
-version = "24.12.23"
+version = "25.12.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f1baf0dbf96932ec9a3038d57900329c015b0bfb7b63d904f3bc27e2b02a096"
+checksum = "35f6839d7b3b98adde531effaf34f0c2badc6f4735d26fe74709d8e513a96ef3"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.11.1",
  "rustc_version",
 ]
 
@@ -3232,7 +3232,7 @@ dependencies = [
  "gif",
  "image-webp",
  "num-traits",
- "png",
+ "png 0.17.16",
  "zune-core",
  "zune-jpeg",
 ]
@@ -3322,7 +3322,7 @@ dependencies = [
  "iris-vector",
  "loki-file-access",
  "loki-opc",
- "png",
+ "png 0.18.1",
  "quick-xml 0.36.2",
  "thiserror 2.0.18",
  "tracing",
@@ -3371,7 +3371,7 @@ name = "iris-ops"
 version = "0.1.0"
 dependencies = [
  "loro",
- "lz4_flex",
+ "lz4_flex 0.13.1",
  "thiserror 2.0.18",
  "tracing",
  "uuid",
@@ -3946,7 +3946,7 @@ dependencies = [
  "bytes",
  "ensure-cov",
  "loro-common",
- "lz4_flex",
+ "lz4_flex 0.11.6",
  "once_cell",
  "quick_cache",
  "rustc-hash 2.1.2",
@@ -5236,6 +5236,19 @@ dependencies = [
  "miniz_oxide",
 ]
 
+[[package]]
+name = "png"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+dependencies = [
+ "bitflags 2.11.1",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide",
+]
+
 [[package]]
 name = "polling"
 version = "3.11.0"
@@ -7285,7 +7298,7 @@ dependencies = [
  "futures-intrusive",
  "log",
  "peniko",
- "png",
+ "png 0.17.16",
  "skrifa 0.37.0",
  "static_assertions",
  "thiserror 2.0.18",
diff --git a/Cargo.toml b/Cargo.toml
index f3db8b6..9319671 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -58,8 +58,8 @@ loro            = { version = "1" }
 thiserror       = { version = "2" }
 uuid            = { version = "1", features = ["v4"] }
 tracing         = { version = "0.1" }
-lz4_flex        = { version = "0.11" }
-flatbuffers     = { version = "24" }
+lz4_flex        = { version = "0.13" }
+flatbuffers     = { version = "25" }
 # EXR: desktop uses openexr-rs (C++ bindings); mobile uses exr (pure Rust)
 # Feature-gated per platform — see iris-aif/Cargo.toml
 exr             = { version = "1" }
@@ -68,7 +68,7 @@ quick-xml       = { version = "0.36" }
 serde           = { version = "1", features = ["derive"] }
 proptest        = { version = "1" }
 bytemuck        = { version = "1", features = ["derive"] }
-png             = { version = "0.17" }
+png             = { version = "0.18" }
 image           = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp"] }
 # PSD/PSB import (SPEC.md §5.1 names the `psd` crate for reading)
 psd             = { version = "0.3" }