diff --git a/json/internal/utf8x/_asm/go.mod b/json/internal/utf8x/_asm/go.mod
index cb4c47b..b1fbecb 100644
--- a/json/internal/utf8x/_asm/go.mod
+++ b/json/internal/utf8x/_asm/go.mod
@@ -5,7 +5,7 @@ go 1.25.0
 require github.com/mmcloughlin/avo v0.6.1-0.20260701065415-16419356370f
 
 require (
-	golang.org/x/mod v0.39.0 // indirect
+	golang.org/x/mod v0.40.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/tools v0.48.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 )
diff --git a/json/internal/utf8x/_asm/go.sum b/json/internal/utf8x/_asm/go.sum
index 4f81822..6d506d0 100644
--- a/json/internal/utf8x/_asm/go.sum
+++ b/json/internal/utf8x/_asm/go.sum
@@ -2,9 +2,9 @@ github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/mmcloughlin/avo v0.6.1-0.20260701065415-16419356370f h1:eLpJhGSyRTsY+l0MFH5zGdcm15rwu7Cm48S257NMHRQ=
 github.com/mmcloughlin/avo v0.6.1-0.20260701065415-16419356370f/go.mod h1:+Pk+j3KceMwAIGb32HZSCvkMCzJvxy6xCRk+urz7iPw=
-golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74=
-golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
-golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
diff --git a/json/lexers/default-lexer/internal/strscan/_asm/go.mod b/json/lexers/default-lexer/internal/strscan/_asm/go.mod
index f8a0cf0..06bfabb 100644
--- a/json/lexers/default-lexer/internal/strscan/_asm/go.mod
+++ b/json/lexers/default-lexer/internal/strscan/_asm/go.mod
@@ -5,7 +5,7 @@ go 1.25.0
 require github.com/mmcloughlin/avo v0.6.1-0.20260701065415-16419356370f
 
 require (
-	golang.org/x/mod v0.39.0 // indirect
+	golang.org/x/mod v0.40.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/tools v0.48.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 )
diff --git a/json/lexers/default-lexer/internal/strscan/_asm/go.sum b/json/lexers/default-lexer/internal/strscan/_asm/go.sum
index 4f81822..6d506d0 100644
--- a/json/lexers/default-lexer/internal/strscan/_asm/go.sum
+++ b/json/lexers/default-lexer/internal/strscan/_asm/go.sum
@@ -2,9 +2,9 @@ github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/mmcloughlin/avo v0.6.1-0.20260701065415-16419356370f h1:eLpJhGSyRTsY+l0MFH5zGdcm15rwu7Cm48S257NMHRQ=
 github.com/mmcloughlin/avo v0.6.1-0.20260701065415-16419356370f/go.mod h1:+Pk+j3KceMwAIGb32HZSCvkMCzJvxy6xCRk+urz7iPw=
-golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74=
-golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
-golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=