diff --git a/.config/fleet/pnpm-workspace.fleet.yaml b/.config/fleet/pnpm-workspace.fleet.yaml
index 324e2594..03ff3f1c 100644
--- a/.config/fleet/pnpm-workspace.fleet.yaml
+++ b/.config/fleet/pnpm-workspace.fleet.yaml
@@ -23,7 +23,7 @@ catalog:
   '@socketsecurity/lib': 6.5.1
   '@socketsecurity/registry': 2.0.5
   '@socketsecurity/sdk': 4.1.2
-  '@socketregistry/packageurl-js-stable': 'npm:@socketregistry/packageurl-js@1.4.8'
+  '@socketregistry/packageurl-js-stable': 'npm:@socketregistry/packageurl-js@1.5.0'
   '@socketsecurity/lib-stable': 'npm:@socketsecurity/lib@6.5.1'
   '@socketsecurity/registry-stable': 'npm:@socketsecurity/registry@2.0.5'
   '@socketsecurity/sdk-stable': 'npm:@socketsecurity/sdk@4.1.2'
@@ -52,7 +52,7 @@ catalog:
   # logic; runs standalone in vitest. Soaked (4.9.0 published 2026-07-08). See
   # .claude/skills/fleet/property-and-fuzz-testing.
   'fast-check': 4.9.0
-  'magic-string': 1.0.0
+  'magic-string': 1.1.0
   'markdownlint-cli2': 0.23.1
   'mdast-util-from-markdown': 2.0.3
   'micromark': 4.0.2
@@ -68,7 +68,7 @@ catalog:
   # marks 15.0.0 deprecated as "released accidentally" and the fix lives
   # in 15.0.0-beta.14, a beta still inside the 7-day soak; bump to the
   # stabilized 15.x when it ships.
-  'nock': 14.0.16
+  'nock': 15.0.0
   'npm-run-all2': 9.0.2
   'oxfmt': 0.60.0
   'oxlint': 1.75.0
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 41e60c15..e464b7e1 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -281,8 +281,8 @@ catalogs:
       specifier: 0.34.52
       version: 0.34.52
     '@socketregistry/packageurl-js-stable':
-      specifier: npm:@socketregistry/packageurl-js@1.4.8
-      version: 1.4.8
+      specifier: npm:@socketregistry/packageurl-js@1.5.0
+      version: 1.5.0
     '@socketsecurity/lib-stable':
       specifier: npm:@socketsecurity/lib@6.5.1
       version: 6.5.1
@@ -452,7 +452,7 @@ importers:
         version: 1.5.0
       '@socketregistry/packageurl-js-stable':
         specifier: 'catalog:'
-        version: '@socketregistry/packageurl-js@1.4.8'
+        version: '@socketregistry/packageurl-js@1.5.0'
       '@socketsecurity/lib':
         specifier: 6.5.1
         version: 6.5.1(typescript@7.0.2)
@@ -808,7 +808,7 @@ importers:
     dependencies:
       '@socketregistry/packageurl-js-stable':
         specifier: 'catalog:'
-        version: '@socketregistry/packageurl-js@1.4.8'
+        version: '@socketregistry/packageurl-js@1.5.0'
       '@socketsecurity/lib-stable':
         specifier: 'catalog:'
         version: '@socketsecurity/lib@6.5.1(typescript@7.0.2)'
@@ -2291,7 +2291,7 @@ importers:
         version: 0.34.52
       '@socketregistry/packageurl-js-stable':
         specifier: 'catalog:'
-        version: '@socketregistry/packageurl-js@1.4.8'
+        version: '@socketregistry/packageurl-js@1.5.0'
       '@socketsecurity/lib-stable':
         specifier: 'catalog:'
         version: '@socketsecurity/lib@6.5.1(typescript@7.0.2)'
@@ -3730,10 +3730,6 @@ packages:
     resolution: {integrity: sha512-MZ5dyXOtiEc7q3801T+2EmKkxrd55BOSQnG8z/8/IkIJzDxqBxGGBKVyixqFm3W657TyUEBfIT9iWgSB6ipFsA==}
     engines: {node: '>=18'}
 
-  '@socketregistry/packageurl-js@1.4.8':
-    resolution: {integrity: sha512-u9Mlg3zeiCr8FHdG6Sxd4T8dWS/zVzW270tS67JdDra2hrzPfgsmbWr7itlQc/0P9uWX6gslISs88YQvi3Z5SQ==}
-    engines: {node: '>=24', npm: '>=12.0.0', pnpm: '>=11.0.5'}
-
   '@socketregistry/packageurl-js@1.5.0':
     resolution: {integrity: sha512-Yqnq50McfKVqKCUKRIhW3XcnjxzFoysBDkUktOuLzOdy4cWi0smVqvLNSkS3f4sdDJYpRBjcxTlb2ajHr+cURQ==}
     engines: {node: '>=24', npm: '>=12.0.1', pnpm: '>=11.0.5'}
@@ -6914,8 +6910,6 @@ snapshots:
 
   '@socketregistry/hasown@1.0.7': {}
 
-  '@socketregistry/packageurl-js@1.4.8': {}
-
   '@socketregistry/packageurl-js@1.5.0': {}
 
   '@socketregistry/safe-buffer@1.0.9': {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 8d681b12..62bd1d78 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -13,7 +13,7 @@ catalog:
   '@shadscan/cli': 0.2.0
   '@sinclair/typebox': 0.34.52
   '@socketregistry/packageurl-js': 1.5.0
-  '@socketregistry/packageurl-js-stable': npm:@socketregistry/packageurl-js@1.4.8
+  '@socketregistry/packageurl-js-stable': npm:@socketregistry/packageurl-js@1.5.0
   '@socketsecurity/lib': 6.5.1
   '@socketsecurity/lib-stable': npm:@socketsecurity/lib@6.5.1
   '@socketsecurity/registry': 2.0.5