diff --git a/extensions/memory-lancedb/package.json b/extensions/memory-lancedb/package.json
index bdd681299b..421e49a8c6 100644
--- a/extensions/memory-lancedb/package.json
+++ b/extensions/memory-lancedb/package.json
@@ -5,7 +5,7 @@
   "description": "OpenClaw LanceDB-backed long-term memory plugin with auto-recall/capture",
   "dependencies": {
     "@lancedb/lancedb": "^0.23.0",
-    "@sinclair/typebox": "0.34.47",
+    "@sinclair/typebox": "0.34.48",
     "openai": "^6.17.0"
   },
   "openclaw": {
diff --git a/extensions/voice-call/package.json b/extensions/voice-call/package.json
index b78db15f17..8d238eb99e 100644
--- a/extensions/voice-call/package.json
+++ b/extensions/voice-call/package.json
@@ -4,7 +4,7 @@
   "type": "module",
   "description": "OpenClaw voice-call plugin",
   "dependencies": {
-    "@sinclair/typebox": "0.34.47",
+    "@sinclair/typebox": "0.34.48",
     "ws": "^8.19.0",
     "zod": "^4.3.6"
   },
diff --git a/extensions/zalouser/package.json b/extensions/zalouser/package.json
index 8dba846d54..c2cd11a349 100644
--- a/extensions/zalouser/package.json
+++ b/extensions/zalouser/package.json
@@ -4,7 +4,7 @@
   "type": "module",
   "description": "OpenClaw Zalo Personal Account plugin via zca-cli",
   "dependencies": {
-    "@sinclair/typebox": "0.34.47",
+    "@sinclair/typebox": "0.34.48",
     "openclaw": "workspace:*"
   },
   "openclaw": {
diff --git a/package.json b/package.json
index 318e10d96e..ebbff3bf32 100644
--- a/package.json
+++ b/package.json
@@ -168,7 +168,7 @@
     "@mariozechner/pi-coding-agent": "0.50.7",
     "@mariozechner/pi-tui": "0.50.7",
     "@mozilla/readability": "^0.6.0",
-    "@sinclair/typebox": "0.34.47",
+    "@sinclair/typebox": "0.34.48",
     "@slack/bolt": "^4.6.0",
     "@slack/web-api": "^7.13.0",
     "@whiskeysockets/baileys": "7.0.0-rc.9",
@@ -186,7 +186,7 @@
     "express": "^5.2.1",
     "file-type": "^21.3.0",
     "grammy": "^1.39.3",
-    "hono": "4.11.4",
+    "hono": "4.11.7",
     "jiti": "^2.6.1",
     "json5": "^2.2.3",
     "jszip": "^3.10.1",
@@ -201,7 +201,7 @@
     "qrcode-terminal": "^0.12.0",
     "sharp": "^0.34.5",
     "sqlite-vec": "0.1.7-alpha.2",
-    "tar": "7.5.4",
+    "tar": "7.5.7",
     "tslog": "^4.10.2",
     "undici": "^7.19.2",
     "ws": "^8.19.0",