diff --git a/HISTORY.md b/HISTORY.md
index 96c95f7..23436df 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==================
+
+* deps: encodeurl@~2.0.0
+
 1.16.1 / 2024-09-11
 ===================
 
diff --git a/package.json b/package.json
index 2d72f0a..638af11 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,7 @@
   "license": "MIT",
   "repository": "expressjs/serve-static",
   "dependencies": {
-    "encodeurl": "~1.0.2",
+    "encodeurl": "~2.0.0",
     "escape-html": "~1.0.3",
     "parseurl": "~1.3.3",
     "send": "0.19.0"