diff --git a/go.mod b/go.mod
index 64b4ed7..6a67d32 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ replace (
 
 require (
 	github.com/git-pkgs/git-pkgs v0.16.3-0.20260616222849-2ff8b4c9b7f2
-	github.com/git-pkgs/manifests v0.12.0
+	github.com/git-pkgs/manifests v0.12.1
 	github.com/git-pkgs/markup v0.1.1
 	github.com/git-pkgs/purl v0.1.20
 	github.com/git-pkgs/sbom v0.1.6
@@ -237,7 +237,7 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.28.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/mod v0.41.0 // indirect
 	golang.org/x/net v0.58.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
diff --git a/go.sum b/go.sum
index cebbaeb..d51989a 100644
--- a/go.sum
+++ b/go.sum
@@ -206,8 +206,8 @@ github.com/git-pkgs/gittuf v0.14.2-0.20260829093243-4ef544965d1c h1:DVDJMvrY3CAf
 github.com/git-pkgs/gittuf v0.14.2-0.20260829093243-4ef544965d1c/go.mod h1:ZQjrQlKQo4c3/ulEQm1ktl7Hx9S/0dw0ADybbjg1I+o=
 github.com/git-pkgs/go-git/v6 v6.0.0-alpha.4.0.20260616095141-9661cc6ee6c8 h1:6GMqtI6YYfV6UabYfx4kpRrjMP2iYVJPoKPOy5+9Srg=
 github.com/git-pkgs/go-git/v6 v6.0.0-alpha.4.0.20260616095141-9661cc6ee6c8/go.mod h1:4ODa/G7hPWrh4Y+7lmt59Ij3zW38IEfvRoAZxLYYBhc=
-github.com/git-pkgs/manifests v0.12.0 h1:5YQUUKekrx6tOKhC0zdaBBB2+nq6eTB9AqyiR1mYvXk=
-github.com/git-pkgs/manifests v0.12.0/go.mod h1:9oe+LQ84i6JmUiKXAmuUUm3OfvFaAR+3AhBUu1KeBYI=
+github.com/git-pkgs/manifests v0.12.1 h1:++HzL3Dfi060sQGg6U2viZZnO80cnw8OBokMF9EzDQw=
+github.com/git-pkgs/manifests v0.12.1/go.mod h1:fCgHIUuGunqJ4do1I8fOXU2IlXvaVMVkD5Vhv03+CNA=
 github.com/git-pkgs/markup v0.1.1 h1:qFPY2w4a6gYx0yg1/JCxBweHOphHLFgpu3Zth66FVkY=
 github.com/git-pkgs/markup v0.1.1/go.mod h1:wgpUZVSYekAqlWa7VCtRHLNPWNRUb56jHRAejN+HW7E=
 github.com/git-pkgs/pom v0.1.7 h1:4yKdtw6eyShtjul6bcZdyz7yLQ+jdrYeYkKbskDGi4c=
@@ -664,8 +664,9 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
 go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=