diff --git a/Cargo.lock b/Cargo.lock
index 15ee90f41e8..3df382a67db 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5446,9 +5446,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.13.2"
+version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 
 [[package]]
 name = "socket2"
@@ -5462,9 +5462,9 @@ dependencies = [
 
 [[package]]
 name = "spdx"
-version = "0.10.8"
+version = "0.10.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58b69356da67e2fc1f542c71ea7e654a361a79c938e4424392ecf4fa065d2193"
+checksum = "c3e17e880bafaeb362a7b751ec46bdc5b61445a188f80e0606e68167cd540fa3"
 dependencies = [
  "smallvec",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index b805befde6c..73b84bb3192 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -120,7 +120,7 @@ sentry = { version = "=0.41.0", features = ["tracing", "tower", "tower-axum-matc
 serde = { version = "=1.0.219", features = ["derive"] }
 serde_json = "=1.0.140"
 sha2 = "=0.10.9"
-spdx = "=0.10.8"
+spdx = "=0.10.9"
 tar = "=0.4.44"
 tempfile = "=3.20.0"
 thiserror = "=2.0.12"