diff --git a/src/go.mod b/src/go.mod
index 17c1a601..d70004aa 100644
--- a/src/go.mod
+++ b/src/go.mod
@@ -1,6 +1,6 @@
 module github.com/dechristopher/lio
 
-go 1.25.7
+go 1.26.0
 
 require (
 	github.com/a-h/templ v0.3.1020
@@ -21,10 +21,10 @@ require (
 	github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c
 	github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef
 	github.com/valyala/fastjson v1.6.10
-	golang.org/x/crypto v0.54.0
+	golang.org/x/crypto v0.56.0
 	golang.org/x/image v0.44.0
 	golang.org/x/sync v0.22.0
-	golang.org/x/text v0.40.0
+	golang.org/x/text v0.41.0
 )
 
 require (
diff --git a/src/go.sum b/src/go.sum
index e463bac9..1a84790b 100644
--- a/src/go.sum
+++ b/src/go.sum
@@ -168,6 +168,8 @@ golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
 golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
 golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
 golang.org/x/image v0.44.0 h1:+tDekMZED9+LrtB3G5xzRggpVh9CARjZqROla3R3R+I=
 golang.org/x/image v0.44.0/go.mod h1:V8K3KE9KKKE+pLpQDOeN18w9oacNSvy1tDOirTu4xtY=
 golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
@@ -182,6 +184,8 @@ golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
 golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/src/vendor/golang.org/x/crypto/acme/jws.go b/src/vendor/golang.org/x/crypto/acme/jws.go
index 68502756..2df17ddd 100644
--- a/src/vendor/golang.org/x/crypto/acme/jws.go
+++ b/src/vendor/golang.org/x/crypto/acme/jws.go
@@ -103,9 +103,7 @@ func jwsEncodeJSON(claimset interface{}, key crypto.Signer, kid KeyID, nonce, ur
 		}
 		payload = base64.RawURLEncoding.EncodeToString(cs)
 	}
-	hash := sha.New()
-	hash.Write([]byte(phead + "." + payload))
-	sig, err := jwsSign(key, sha, hash.Sum(nil))
+	sig, err := jwsSign(key, sha, []byte(phead+"."+payload))
 	if err != nil {
 		return nil, err
 	}
@@ -195,14 +193,13 @@ func jwkEncode(pub crypto.PublicKey) (string, error) {
 	return "", ErrUnsupportedKey
 }
 
-// jwsSign signs the digest using the given key.
-// The hash is unused for ECDSA keys.
-func jwsSign(key crypto.Signer, hash crypto.Hash, digest []byte) ([]byte, error) {
+// jwsSign signs the payload using the given key.
+func jwsSign(key crypto.Signer, hash crypto.Hash, payload []byte) ([]byte, error) {
 	switch pub := key.Public().(type) {
 	case *rsa.PublicKey:
-		return key.Sign(rand.Reader, digest, hash)
+		return crypto.SignMessage(key, rand.Reader, payload, hash)
 	case *ecdsa.PublicKey:
-		sigASN1, err := key.Sign(rand.Reader, digest, hash)
+		sigASN1, err := crypto.SignMessage(key, rand.Reader, payload, hash)
 		if err != nil {
 			return nil, err
 		}
diff --git a/src/vendor/golang.org/x/crypto/acme/types.go b/src/vendor/golang.org/x/crypto/acme/types.go
index 65d69b26..4df7e6df 100644
--- a/src/vendor/golang.org/x/crypto/acme/types.go
+++ b/src/vendor/golang.org/x/crypto/acme/types.go
@@ -114,14 +114,15 @@ type Error struct {
 }
 
 func (e *Error) Error() string {
-	str := fmt.Sprintf("%d %s: %s", e.StatusCode, e.ProblemType, e.Detail)
+	var sb strings.Builder
+	fmt.Fprintf(&sb, "%d %s: %s", e.StatusCode, e.ProblemType, e.Detail)
 	if len(e.Subproblems) > 0 {
-		str += fmt.Sprintf("; subproblems:")
+		sb.WriteString("; subproblems:")
 		for _, sp := range e.Subproblems {
-			str += fmt.Sprintf("\n\t%s", sp)
+			fmt.Fprintf(&sb, "\n\t%s", sp)
 		}
 	}
-	return str
+	return sb.String()
 }
 
 // AuthorizationError indicates that an authorization for an identifier
diff --git a/src/vendor/golang.org/x/crypto/ocsp/ocsp.go b/src/vendor/golang.org/x/crypto/ocsp/ocsp.go
index e6c645e7..23c39e73 100644
--- a/src/vendor/golang.org/x/crypto/ocsp/ocsp.go
+++ b/src/vendor/golang.org/x/crypto/ocsp/ocsp.go
@@ -85,7 +85,8 @@ type certID struct {
 
 // https://tools.ietf.org/html/rfc2560#section-4.1.1
 type ocspRequest struct {
-	TBSRequest tbsRequest
+	TBSRequest        tbsRequest
+	OptionalSignature asn1.RawValue `asn1:"explicit,tag:0,optional"`
 }
 
 type tbsRequest struct {
@@ -321,10 +322,10 @@ type Request struct {
 func (req *Request) Marshal() ([]byte, error) {
 	hashAlg := getOIDFromHashAlgorithm(req.HashAlgorithm)
 	if hashAlg == nil {
-		return nil, errors.New("Unknown hash algorithm")
+		return nil, errors.New("unknown hash algorithm")
 	}
 	return asn1.Marshal(ocspRequest{
-		tbsRequest{
+		TBSRequest: tbsRequest{
 			Version: 0,
 			RequestList: []request{
 				{
@@ -418,8 +419,10 @@ func (p ParseError) Error() string {
 }
 
 // ParseRequest parses an OCSP request in DER form. It only supports
-// requests for a single certificate. Signed requests are not supported.
-// If a request includes a signature, it will result in a ParseError.
+// requests for a single certificate identifier. If a request includes
+// multiple certificate identifiers, only the first will be included in
+// the parsed Request. Signed requests are not supported. If a request
+// includes a signature, it will result in a ParseError.
 func ParseRequest(bytes []byte) (*Request, error) {
 	var req ocspRequest
 	rest, err := asn1.Unmarshal(bytes, &req)
@@ -430,6 +433,10 @@ func ParseRequest(bytes []byte) (*Request, error) {
 		return nil, ParseError("trailing data in OCSP request")
 	}
 
+	if len(req.OptionalSignature.FullBytes) > 0 {
+		return nil, ParseError("signed OCSP requests are not supported")
+	}
+
 	if len(req.TBSRequest.RequestList) == 0 {
 		return nil, ParseError("OCSP request contains no request body")
 	}
diff --git a/src/vendor/golang.org/x/text/secure/precis/nickname.go b/src/vendor/golang.org/x/text/secure/precis/nickname.go
index 11e0ccbb..73b8f0e7 100644
--- a/src/vendor/golang.org/x/text/secure/precis/nickname.go
+++ b/src/vendor/golang.org/x/text/secure/precis/nickname.go
@@ -44,24 +44,25 @@ func (t *nickAdditionalMapping) Transform(dst, src []byte, atEOF bool) (nDst, nS
 	//         to a single ASCII space character (e.g., "St  Peter" is
 	//         mapped to "St Peter").
 	for nSrc < len(src) {
-		r, size := utf8.DecodeRune(src[nSrc:])
-		if size == 0 { // Incomplete UTF-8 encoding
-			if !atEOF {
-				return nDst, nSrc, transform.ErrShortSrc
-			}
-			size = 1
+		if !utf8.FullRune(src[nSrc:]) && !atEOF {
+			return nDst, nSrc, transform.ErrShortSrc
 		}
+		r, size := utf8.DecodeRune(src[nSrc:])
 		if unicode.Is(unicode.Zs, r) {
 			t.prevSpace = true
 		} else {
 			if t.prevSpace && t.notStart {
+				if nDst >= len(dst) {
+					return nDst, nSrc, transform.ErrShortDst
+				}
 				dst[nDst] = ' '
 				nDst += 1
+				t.prevSpace = false
 			}
-			if size != copy(dst[nDst:], src[nSrc:nSrc+size]) {
-				nDst += size
+			if len(dst)-nDst < size {
 				return nDst, nSrc, transform.ErrShortDst
 			}
+			copy(dst[nDst:], src[nSrc:nSrc+size])
 			nDst += size
 			t.prevSpace = false
 			t.notStart = true
diff --git a/src/vendor/golang.org/x/text/secure/precis/profile.go b/src/vendor/golang.org/x/text/secure/precis/profile.go
index bdd991bb..e62e79ba 100644
--- a/src/vendor/golang.org/x/text/secure/precis/profile.go
+++ b/src/vendor/golang.org/x/text/secure/precis/profile.go
@@ -349,13 +349,13 @@ func (c *checker) Reset() {
 func (c *checker) span(src []byte, atEOF bool) (n int, err error) {
 	for n < len(src) {
 		e, sz := dpTrie.lookup(src[n:])
-		d := categoryTransitions[category(e&catMask)]
 		if sz == 0 {
 			if !atEOF {
 				return n, transform.ErrShortSrc
 			}
 			return n, errDisallowedRune
 		}
+		d := categoryTransitions[category(e&catMask)]
 		doLookAhead := false
 		if property(e) < c.p.class.validFrom {
 			if d.rule == nil {
@@ -389,6 +389,9 @@ func (c *checker) span(src []byte, atEOF bool) (n int, err error) {
 		n += sz
 	}
 	if m := c.beforeBits >> finalShift; c.beforeBits&m != m || c.termBits != 0 {
+		if !atEOF {
+			return n, transform.ErrShortSrc
+		}
 		err = errContext
 	}
 	return n, err
@@ -396,8 +399,9 @@ func (c *checker) span(src []byte, atEOF bool) (n int, err error) {
 
 // TODO: we may get rid of this transform if transform.Chain understands
 // something like a Spanner interface.
-func (c checker) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
+func (c *checker) Transform(dst, src []byte, atEOF bool) (nDst, nSrc int, err error) {
 	short := false
+
 	if len(dst) < len(src) {
 		src = src[:len(dst)]
 		atEOF = false
diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt
index c4e2edb0..260d60a8 100644
--- a/src/vendor/modules.txt
+++ b/src/vendor/modules.txt
@@ -270,8 +270,8 @@ go.uber.org/multierr
 # go.yaml.in/yaml/v3 v3.0.4
 ## explicit; go 1.16
 go.yaml.in/yaml/v3
-# golang.org/x/crypto v0.54.0
-## explicit; go 1.25.0
+# golang.org/x/crypto v0.56.0
+## explicit; go 1.26.0
 golang.org/x/crypto/acme
 golang.org/x/crypto/acme/autocert
 golang.org/x/crypto/argon2
@@ -304,7 +304,7 @@ golang.org/x/sync/semaphore
 golang.org/x/sys/cpu
 golang.org/x/sys/unix
 golang.org/x/sys/windows
-# golang.org/x/text v0.40.0
+# golang.org/x/text v0.41.0
 ## explicit; go 1.25.0
 golang.org/x/text/cases
 golang.org/x/text/encoding