diff --git a/Cargo.toml b/Cargo.toml
index 375d7ac..3c41a57 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -17,9 +17,10 @@ rustdoc-args = ["--cfg", "docsrs"]
 default = []
 azurite = []
 blocking = ["testcontainers/blocking"]
-watchdog = ["testcontainers/watchdog"]
+docker-compose = ["testcontainers/docker-compose"]
 http_wait = ["testcontainers/http_wait"]
 properties-config = ["testcontainers/properties-config"]
+watchdog = ["testcontainers/watchdog"]
 json = ["serde", "serde_json"]
 anvil = []
 arrow_flightsql = []
@@ -72,13 +73,13 @@ weaviate = ["http_wait"]
 [dependencies]
 parse-display = { version = "0.10", optional = true, default-features = false, features = [
 ] }
-rcgen = { version = "0.13.1", features = [
+rcgen = { version = "0.14.5", features = [
     "pem",
     "ring",
 ], default-features = false, optional = true }
 serde = { version = "1.0.217", features = ["derive"], optional = true }
 serde_json = { version = "1.0.138", optional = true }
-testcontainers = { version = "0.25.0" }
+testcontainers = { version = "0.26.0" }
 
 
 [dev-dependencies]
@@ -118,7 +119,7 @@ serde_json = { version = "1.0.138" }
 serial_test = "3.1.1"
 surrealdb = { version = "2.2.1" }
 tar = "0.4.40"
-testcontainers = { version = "0.25.0", features = ["blocking"] }
+testcontainers = { version = "0.26.0", features = ["blocking"] }
 # To use Tiberius on macOS, rustls is needed instead of native-tls
 # https://github.com/prisma/tiberius/tree/v0.12.2#encryption-tlsssl
 tiberius = { version = "0.12.3", default-features = false, features = [
@@ -128,15 +129,15 @@ tiberius = { version = "0.12.3", default-features = false, features = [
 tokio = { version = "1", features = ["macros"] }
 tokio-util = { version = "0.7.10", features = ["compat"] }
 tokio-zookeeper = "0.4.0"
-kube = { version = "1.1.0", features = ["runtime"] }
-k8s-openapi = { version = "0.25", features = ["v1_30"] }
+kube = { version = "2.0.1", features = ["runtime"] }
+k8s-openapi = { version = "0.26", features = ["v1_30"] }
 clickhouse = { version = "0.13" }
 vaultrs = "0.7.2"
 openssl-sys = { version = "0.9.103", features = ["vendored"] }
 native-tls = { version = "0.2.12", features = ["vendored"] }
 pulsar = "6.3"
 rqlite-rs = "0.6"
-azure_core = "0.27.0"
+azure_core = "0.30.1"
 azure_storage_blobs = "0.21.0"
 azure_storage = "0.21.0"
 base64 = "0.22.1"
diff --git a/examples/localstack.rs b/examples/localstack.rs
index c16539e..a65a150 100644
--- a/examples/localstack.rs
+++ b/examples/localstack.rs
@@ -20,7 +20,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error + 'static>> {
     let creds = s3::config::Credentials::new("fake", "fake", None, None, "test");
 
     let config = aws_sdk_s3::config::Builder::default()
-        .behavior_version(BehaviorVersion::v2025_01_17())
+        .behavior_version(BehaviorVersion::v2025_08_07())
         .region(Region::new("us-east-1"))
         .credentials_provider(creds)
         .endpoint_url(endpoint_url)
diff --git a/src/gitea/mod.rs b/src/gitea/mod.rs
index e279f2e..14bfc36 100644
--- a/src/gitea/mod.rs
+++ b/src/gitea/mod.rs
@@ -1,7 +1,7 @@
 /// Self-hosted git server with https/http/ssh access, uses [Gitea](https://docs.gitea.com/).
 use std::result::Result;
 
-use rcgen::{BasicConstraints, CertificateParams, IsCa, KeyPair};
+use rcgen::{BasicConstraints, CertificateParams, IsCa, Issuer, KeyPair};
 use testcontainers::{
     core::{
         wait::HttpWaitStrategy, CmdWaitFor, ContainerPort, ContainerState, ExecCommand, WaitFor,
@@ -631,7 +631,6 @@ impl GiteaTlsCert {
         let ca_key = KeyPair::generate().unwrap();
         let mut ca_cert = CertificateParams::new(vec!["Gitea root CA".to_string()]).unwrap();
         ca_cert.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
-        let ca_cert = ca_cert.self_signed(&ca_key).unwrap();
 
         // prepare SANs
         let mut hostnames = vec![
@@ -646,11 +645,13 @@ impl GiteaTlsCert {
 
         // and generate server key and cert
         let key = KeyPair::generate().unwrap();
+        let issuer = Issuer::from_params(&ca_cert, &ca_key);
         let cert = CertificateParams::new(hostnames)
             .unwrap()
-            .signed_by(&key, &ca_cert, &ca_key)
+            .signed_by(&key, &issuer)
             .unwrap();
 
+        let ca_cert = ca_cert.self_signed(&ca_key).unwrap();
         Self {
             cert: cert.pem(),
             key: key.serialize_pem(),
diff --git a/src/localstack/mod.rs b/src/localstack/mod.rs
index 2417881..c18f076 100644
--- a/src/localstack/mod.rs
+++ b/src/localstack/mod.rs
@@ -70,7 +70,7 @@ mod tests {
 
         let region_provider = RegionProviderChain::default_provider().or_else("us-east-1");
         let creds = sqs::config::Credentials::new("fake", "fake", None, None, "test");
-        let config = aws_config::defaults(BehaviorVersion::v2025_01_17())
+        let config = aws_config::defaults(BehaviorVersion::v2025_08_07())
             .region(region_provider)
             .credentials_provider(creds)
             .endpoint_url(format!("http://{host_ip}:{host_port}"))