diff --git a/httpsig-hyper/Cargo.toml b/httpsig-hyper/Cargo.toml
index 190e35d..05ce8f5 100644
--- a/httpsig-hyper/Cargo.toml
+++ b/httpsig-hyper/Cargo.toml
@@ -21,7 +21,7 @@ futures = { version = "0.3.30", default-features = false, features = [
   "std",
   "async-await",
 ] }
-indexmap = { version = "2.2.5" }
+indexmap = { version = "2.2.6" }
 
 # content digest with rfc8941 structured field values
 sha2 = { version = "0.10.8", default-features = false }
@@ -34,11 +34,11 @@ base64 = { version = "0.22.0" }
 http = { version = "1.1.0" }
 http-body = { version = "1.0.0" }
 http-body-util = { version = "0.1.1" }
-bytes = { version = "1.5.0" }
+bytes = { version = "1.6.0" }
 
 
 [dev-dependencies]
-tokio = { version = "1.36.0", default-features = false, features = [
+tokio = { version = "1.37.0", default-features = false, features = [
   "macros",
   "rt-multi-thread",
 ] } # testing only
diff --git a/httpsig/Cargo.toml b/httpsig/Cargo.toml
index ffd17eb..8acb9c3 100644
--- a/httpsig/Cargo.toml
+++ b/httpsig/Cargo.toml
@@ -16,7 +16,7 @@ rust-version.workspace = true
 thiserror = { version = "1.0.58" }
 tracing = { version = "0.1.40" }
 rustc-hash = { version = "1.1.0" }
-indexmap = { version = "2.2.5" }
+indexmap = { version = "2.2.6" }
 fxhash = { version = "0.2.1" }
 rand = { version = "0.8.5" }
 
@@ -40,7 +40,7 @@ p384 = { version = "0.13.0", default-features = false, features = [
 ] }
 hmac = { version = "0.12.1" }
 sha2 = { version = "0.10.8", default-features = false }
-bytes = { version = "1.5.0" }
+bytes = { version = "1.6.0" }
 
 # encoding
 base64 = { version = "0.22.0" }