diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index b24d2261..753ce6ec 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -17,19 +17,19 @@ confirmModulesPurge: false
 managePackageManagerVersions: false
 
 catalog:
-  '@anthropic-ai/claude-code': 2.1.217
+  '@anthropic-ai/claude-code': 2.1.220
   '@anthropic-ai/mcpb': 1.2.0
   '@redwoodjs/agent-ci': 0.17.1
   '@shadscan/cli': 0.5.0
   '@sinclair/typebox': 0.34.52
   '@socketregistry/packageurl-js': 1.5.0
-  '@socketregistry/packageurl-js-stable': npm:@socketregistry/packageurl-js@1.4.8
+  '@socketregistry/packageurl-js-stable': npm:@socketregistry/packageurl-js@1.5.0
   '@socketsecurity/lib': 6.5.2
   '@socketsecurity/lib-stable': npm:@socketsecurity/lib@6.5.2
   '@socketsecurity/registry': 2.0.5
   '@socketsecurity/registry-stable': npm:@socketsecurity/registry@2.0.5
   '@socketsecurity/sdk': 4.1.3
-  '@socketsecurity/sdk-stable': npm:@socketsecurity/sdk@4.1.2
+  '@socketsecurity/sdk-stable': npm:@socketsecurity/sdk@4.1.3
   '@types/mdast': 4.0.4
   '@types/node': 26.1.1
   '@types/semver': 7.7.1
@@ -113,13 +113,13 @@ overrides:
   'yaml@2': '2.9.0'
 
   # Repo-specific overrides below.
-  '@hono/node-server': '1.19.14'
+  '@hono/node-server': '1.19.15'
   'fast-uri': '3.1.4'
   # GHSA-xrhx-7g5j-rcj5 IPv6 deny-rule bypass / GHSA-3hrh-pfw6-9m5x Set-Cookie
   # injection / GHSA-f577-qrjj-4474 JWT scheme / GHSA-2gcr-mfcq-wcc3 mount
   # prefix; transitive via @modelcontextprotocol/sdk, fixed in 4.12.21
-  'hono': '4.12.31'
-  'ip-address': '10.2.0'
+  'hono': '4.12.32'
+  'ip-address': '10.3.1'
   # CVE-2026-... node-forge prototype-pollution-class advisories #55/#57/#59/#61
   'node-forge': '1.4.0'
   # GHSA-9wv6-86v2-598j path-to-regexp DoS / GHSA-rhx6-c78j-4q9w; advisories #51/#53
@@ -169,9 +169,9 @@ minimumReleaseAgeExclude:
   # obug + verkit — new dev-only transitives of taze 19.16.0 (same owner
   # directive); exact-pinned so future versions re-soak.
 
-# Transitional: warn (not error) while the socket-registry CI install chain
-# still ships pnpm 11.5.1 and this repo runs 11.6.0. Restore to error once the
-# registry reusable-workflow nested pin delivers 11.6.0.
+  # Transitional: warn (not error) while the socket-registry CI install chain
+  # still ships pnpm 11.5.1 and this repo runs 11.6.0. Restore to error once the
+  # registry reusable-workflow nested pin delivers 11.6.0.
 pmOnFail: warn
 resolutionMode: highest
 saveExact: true