diff --git a/OVERRIDES.md b/OVERRIDES.md
index 8a5eafb..d41a45d 100644
--- a/OVERRIDES.md
+++ b/OVERRIDES.md
@@ -75,6 +75,7 @@ accepts the patched release.
 | Example                   | Override                                                                  | Reason and removal condition                                                                                                                                                                                                 | Advisory                                                                                                                                                                                                                                                                                                                                                                         |
 | ------------------------- | ------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `firebase-functions`      | `qs: 6.16.0`                                                              | Express/body-parser pins keep an affected qs 6 release. Remove once their resolved qs is 6.16.0 or later.                                                                                                                    | [GHSA-4mjr-xmp4-gh2g](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g), [GHSA-x5fp-wj9c-mxmx](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx)                                                                                                                                                                                                                               |
+| `firebase-functions`      | `get-uri > basic-ftp: 6.2.1`                                               | Firebase Tools' PAC proxy path uses get-uri, which pins basic-ftp 5.x. get-uri's FTP calls remain available in 6.x; the safer default rejects FTP transfers to a separate host. Remove when get-uri permits basic-ftp 6.2.1 or later. | [GHSA-c475-qrg2-pj4r](https://github.com/advisories/GHSA-c475-qrg2-pj4r) |
 | `genkit-agent`            | `qs: 6.16.0`                                                              | Express/body-parser pins keep an affected qs 6 release. Remove once their resolved qs is 6.16.0 or later.                                                                                                                    | [GHSA-4mjr-xmp4-gh2g](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g), [GHSA-x5fp-wj9c-mxmx](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx)                                                                                                                                                                                                                               |
 | `react-router`            | `qs: 6.16.0`                                                              | Express/body-parser pins keep an affected qs 6 release. Remove once their resolved qs is 6.16.0 or later.                                                                                                                    | [GHSA-4mjr-xmp4-gh2g](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g), [GHSA-x5fp-wj9c-mxmx](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx)                                                                                                                                                                                                                               |
 | `react-router-middleware` | `qs: 6.16.0`                                                              | Express/body-parser pins keep an affected qs 6 release. Remove once their resolved qs is 6.16.0 or later.                                                                                                                    | [GHSA-4mjr-xmp4-gh2g](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g), [GHSA-x5fp-wj9c-mxmx](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx)                                                                                                                                                                                                                               |
diff --git a/examples/bun/package.json b/examples/bun/package.json
index 02da3b9..8223a03 100644
--- a/examples/bun/package.json
+++ b/examples/bun/package.json
@@ -22,11 +22,11 @@
     "start": "bun run src/index.ts"
   },
   "dependencies": {
-    "@arcjet/bun": "1.12.0",
-    "@arcjet/inspect": "1.12.0"
+    "@arcjet/bun": "1.13.0",
+    "@arcjet/inspect": "1.13.0"
   },
   "devDependencies": {
-    "@types/bun": "1.3.14",
+    "@types/bun": "1.4.0",
     "typescript": "5.9.3"
   }
 }
diff --git a/examples/firebase-functions/package-lock.json b/examples/firebase-functions/package-lock.json
index 6e232e7..62f2c07 100644
--- a/examples/firebase-functions/package-lock.json
+++ b/examples/firebase-functions/package-lock.json
@@ -4751,9 +4751,9 @@
       "license": "MIT"
     },
     "node_modules/basic-ftp": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.3.1.tgz",
-      "integrity": "sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-6.2.1.tgz",
+      "integrity": "sha512-bK67isD+lKq46AU8vNtjvMaT2ZqAOAmNCbxUHlFBRD4k15NWxyEjmaKtZPlgce58So4BNTjITGQOVTjL9y0ECA==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/examples/firebase-functions/package.json b/examples/firebase-functions/package.json
index c0bba8b..57ffd01 100644
--- a/examples/firebase-functions/package.json
+++ b/examples/firebase-functions/package.json
@@ -41,6 +41,9 @@
     },
     "firebase-tools": {
       "csv-parse": "7.0.2"
+    },
+    "get-uri": {
+      "basic-ftp": "6.2.1"
     }
   }
 }
diff --git a/examples/mastra-agent/package-lock.json b/examples/mastra-agent/package-lock.json
index 9d41a91..50ab404 100644
--- a/examples/mastra-agent/package-lock.json
+++ b/examples/mastra-agent/package-lock.json
@@ -8,8 +8,8 @@
       "license": "Apache-2.0",
       "dependencies": {
         "@arcjet/guard": "1.13.0",
-        "@mastra/core": "1.59.0",
-        "zod": "4.4.3"
+        "@mastra/core": "1.63.2",
+        "zod": "4.5.4"
       },
       "devDependencies": {
         "@types/node": "24.13.3",
@@ -447,9 +447,9 @@
       }
     },
     "node_modules/@mastra/core": {
-      "version": "1.59.0",
-      "resolved": "https://registry.npmjs.org/@mastra/core/-/core-1.59.0.tgz",
-      "integrity": "sha512-LMPkEtGcAeaCBq0IPPk/yuaaA/p8+BJjaZnNREkoJ4l7p5/CBpFqu3fHfMoBLoiabqCqF+5kaw6JFNztq/4Vtw==",
+      "version": "1.63.2",
+      "resolved": "https://registry.npmjs.org/@mastra/core/-/core-1.63.2.tgz",
+      "integrity": "sha512-BHVDF4GtQnIqRND/lPVVoTnmoNzZ7+voz+EpI4YSY0W7In6c/EOrmMnshuNQSDJ9NpxQNrwip0WGYpRYwzFirQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "@a2a-js/sdk-v0_3": "npm:@a2a-js/sdk@~0.3.14",
@@ -2411,9 +2411,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
-      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "version": "4.5.4",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.5.4.tgz",
+      "integrity": "sha512-sC95tT5iHHH9gtpj6A81kh+NEaRAUFN+qlUPDUbRfOMvNf5QCBqsb3WgvnpVtK5Y+4UfA6KqufotuTvMGiTlsA==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
diff --git a/examples/mastra-agent/package.json b/examples/mastra-agent/package.json
index 5d7f9b5..bd4178c 100644
--- a/examples/mastra-agent/package.json
+++ b/examples/mastra-agent/package.json
@@ -25,8 +25,8 @@
   },
   "dependencies": {
     "@arcjet/guard": "1.13.0",
-    "@mastra/core": "1.59.0",
-    "zod": "4.4.3"
+    "@mastra/core": "1.63.2",
+    "zod": "4.5.4"
   },
   "devDependencies": {
     "@types/node": "24.13.3",