diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e5b53e6..8302f24 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c50e689..0e36f19 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,9 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
 
diff --git a/dependi-lsp/Cargo.lock b/dependi-lsp/Cargo.lock
index 925608d..af43670 100644
--- a/dependi-lsp/Cargo.lock
+++ b/dependi-lsp/Cargo.lock
@@ -262,7 +262,7 @@ dependencies = [
 
 [[package]]
 name = "dependi-lsp"
-version = "0.1.0"
+version = "0.3.1"
 dependencies = [
  "anyhow",
  "chrono",
@@ -341,9 +341,9 @@ checksum = "3a3076410a55c90011c298b04d0cfa770b00fa04e1e3c97d3f6c9de105a03844"
 
 [[package]]
 name = "foldhash"
-version = "0.1.5"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
 [[package]]
 name = "form_urlencoded"
@@ -466,26 +466,20 @@ checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 
 [[package]]
 name = "hashbrown"
-version = "0.15.5"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 dependencies = [
  "foldhash",
 ]
 
-[[package]]
-name = "hashbrown"
-version = "0.16.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
-
 [[package]]
 name = "hashlink"
-version = "0.10.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
+checksum = "ea0b22561a9c04a7cb1a302c013e0259cd3b4bb619f145b32f72b8b4bcbed230"
 dependencies = [
- "hashbrown 0.15.5",
+ "hashbrown 0.16.1",
 ]
 
 [[package]]
@@ -793,9 +787,9 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.35.0"
+version = "0.36.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "133c182a6a2c87864fe97778797e46c7e999672690dc9fa3ee8e241aa4a9c13f"
+checksum = "95b4103cffefa72eb8428cb6b47d6627161e51c2739fc5e3b734584157bc642a"
 dependencies = [
  "cc",
  "pkg-config",
@@ -1136,9 +1130,9 @@ checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
 
 [[package]]
 name = "reqwest"
-version = "0.12.25"
+version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6eff9328d40131d43bd911d42d79eb6a47312002a4daefc9e37f17e74a7701a"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
  "base64",
  "bytes",
@@ -1188,9 +1182,9 @@ dependencies = [
 
 [[package]]
 name = "rusqlite"
-version = "0.37.0"
+version = "0.38.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "165ca6e57b20e1351573e3729b958bc62f0e48025386970b6e4d29e7a7e71f3f"
+checksum = "f1c93dd1c9683b438c392c492109cb702b8090b2bfc8fed6f6e4eb4523f17af3"
 dependencies = [
  "bitflags 2.10.0",
  "fallible-iterator",
@@ -1198,6 +1192,7 @@ dependencies = [
  "hashlink",
  "libsqlite3-sys",
  "smallvec",
+ "sqlite-wasm-rs",
 ]
 
 [[package]]
@@ -1297,15 +1292,15 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.145"
+version = "1.0.148"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
+checksum = "3084b546a1dd6289475996f182a22aba973866ea8e8b02c51d9f46b1336a22da"
 dependencies = [
  "itoa",
  "memchr",
- "ryu",
  "serde",
  "serde_core",
+ "zmij",
 ]
 
 [[package]]
@@ -1399,6 +1394,19 @@ dependencies = [
  "windows-sys 0.60.2",
 ]
 
+[[package]]
+name = "sqlite-wasm-rs"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05e98301bf8b0540c7de45ecd760539b9c62f5772aed172f08efba597c11cd5d"
+dependencies = [
+ "cc",
+ "hashbrown 0.16.1",
+ "js-sys",
+ "thiserror",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -1687,9 +1695,9 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
 [[package]]
 name = "tracing"
-version = "0.1.43"
+version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d15d90a0b5c19378952d479dc858407149d7bb45a14de0142f6c534b16fc647"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
  "pin-project-lite",
  "tracing-attributes",
@@ -1709,9 +1717,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-core"
-version = "0.1.35"
+version = "0.1.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a04e24fab5c89c6a36eb8558c9656f30d81de51dfa4d3b45f26b21d61fa0a6c"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
  "once_cell",
  "valuable",
@@ -2252,3 +2260,9 @@ dependencies = [
  "quote",
  "syn",
 ]
+
+[[package]]
+name = "zmij"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9747e91771f56fd7893e1164abd78febd14a670ceec257caad15e051de35f06"
diff --git a/dependi-lsp/Cargo.toml b/dependi-lsp/Cargo.toml
index be0178c..545125a 100644
--- a/dependi-lsp/Cargo.toml
+++ b/dependi-lsp/Cargo.toml
@@ -16,21 +16,19 @@ path = "src/main.rs"
 
 [dependencies]
 tower-lsp = "0.20"
-tokio = { version = "1", features = ["full"] }
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
-reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
-dashmap = "6"
-toml = "0.9"
-semver = "1"
-tracing = "0.1"
-tracing-subscriber = { version = "0.3", features = ["env-filter"] }
-anyhow = "1"
-thiserror = "2"
-rusqlite = { version = "0.37", features = ["bundled"] }
+tokio = { version = "1.48", features = ["full"] }
+serde = { version = "1.0.228", features = ["derive"] }
+serde_json = "1.0.148"
+reqwest = { version = "0.12.28", features = ["json", "rustls-tls"], default-features = false }
+dashmap = "6.1"
+toml = "0.9.8"
+semver = "1.0.27"
+tracing = "0.1.44"
+tracing-subscriber = { version = "0.3.22", features = ["env-filter"] }
+anyhow = "1.0.100"
+thiserror = "2.0.17"
+rusqlite = { version = "0.38", features = ["bundled"] }
 dirs = "6"
 serde_yaml = "0.9"
-chrono = "0.4"
-clap = { version = "4", features = ["derive"] }
-# rustsec = "0.30"  # TODO: Re-enable when API is stable
-# parking_lot = "0.12"  # For rustsec client
+chrono = "0.4.42"
+clap = { version = "4.5.53", features = ["derive"] }
diff --git a/dependi-lsp/src/cache/sqlite.rs b/dependi-lsp/src/cache/sqlite.rs
index 7f56fff..af7e8b5 100644
--- a/dependi-lsp/src/cache/sqlite.rs
+++ b/dependi-lsp/src/cache/sqlite.rs
@@ -9,12 +9,12 @@ use rusqlite::{Connection, params};
 use crate::registries::VersionInfo;
 
 /// Default TTL for cache entries (1 hour)
-const DEFAULT_TTL_SECS: u64 = 3600;
+const DEFAULT_TTL_SECS: i64 = 3600;
 
 /// SQLite-based persistent cache
 pub struct SqliteCache {
     conn: Mutex<Connection>,
-    ttl_secs: u64,
+    ttl_secs: i64,
 }
 
 impl SqliteCache {
@@ -81,7 +81,7 @@ impl SqliteCache {
         let conn = self.conn.lock().unwrap();
         let now = current_timestamp();
 
-        let result: Result<(String, u64, u64), _> = conn.query_row(
+        let result: Result<(String, i64, i64), _> = conn.query_row(
             "SELECT data, inserted_at, ttl_secs FROM packages WHERE key = ?",
             [key],
             |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?)),
@@ -131,11 +131,11 @@ impl SqliteCache {
 }
 
 /// Get current Unix timestamp
-fn current_timestamp() -> u64 {
+fn current_timestamp() -> i64 {
     SystemTime::now()
         .duration_since(UNIX_EPOCH)
         .unwrap_or_default()
-        .as_secs()
+        .as_secs() as i64
 }
 
 #[cfg(test)]
diff --git a/dependi-zed/Cargo.lock b/dependi-zed/Cargo.lock
index 998ed42..186443c 100644
--- a/dependi-zed/Cargo.lock
+++ b/dependi-zed/Cargo.lock
@@ -49,7 +49,7 @@ dependencies = [
 
 [[package]]
 name = "dependi-zed"
-version = "0.1.0"
+version = "0.3.1"
 dependencies = [
  "zed_extension_api",
 ]
@@ -759,9 +759,9 @@ dependencies = [
 
 [[package]]
 name = "zed_extension_api"
-version = "0.5.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40ef88a8e5aeff67b0996b1795d56338f04c02de95f1f147577944aa37b801d6"
+checksum = "0729d50b4ca0a7e28e590bbe32e3ca0194d97ef654961451a424c661a366fca0"
 dependencies = [
  "serde",
  "serde_json",
diff --git a/dependi-zed/Cargo.toml b/dependi-zed/Cargo.toml
index 765085a..4aa3e4e 100644
--- a/dependi-zed/Cargo.toml
+++ b/dependi-zed/Cargo.toml
@@ -10,4 +10,4 @@ authors = ["Mathieu"]
 crate-type = ["cdylib"]
 
 [dependencies]
-zed_extension_api = "0.5"
+zed_extension_api = "0.7"
diff --git a/dependi-zed/src/lib.rs b/dependi-zed/src/lib.rs
index 2b16826..e893b40 100644
--- a/dependi-zed/src/lib.rs
+++ b/dependi-zed/src/lib.rs
@@ -10,10 +10,10 @@ impl DependiExtension {
         language_server_id: &LanguageServerId,
     ) -> Result<String> {
         // Return cached path if valid
-        if let Some(path) = &self.cached_binary_path {
-            if std::fs::metadata(path).map(|m| m.is_file()).unwrap_or(false) {
-                return Ok(path.clone());
-            }
+        if let Some(path) = &self.cached_binary_path
+            && std::fs::metadata(path).map(|m| m.is_file()).unwrap_or(false)
+        {
+            return Ok(path.clone());
         }
 
         // Download from GitHub releases