diff --git a/Cargo.lock b/Cargo.lock
index 0380d464..e29638e8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -116,9 +116,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "arbitrary"
diff --git a/deny.toml b/deny.toml
index 2f1d6c19..603dae13 100644
--- a/deny.toml
+++ b/deny.toml
@@ -16,6 +16,14 @@ ignore = [
     # 0.16.3) but ratatui 0.29 pins the older minor; cvg dash never
     # exercises IterMut. Revisit at the next ratatui upgrade.
     { id = "RUSTSEC-2026-0002", reason = "lru v0.12.5 transitive via ratatui 0.29; cvg dash does not call IterMut. Revisit when ratatui bumps lru" },
+    # lopdf 0.34.0 can stack-overflow on deeply nested PDF objects when
+    # parsing (RUSTSEC-2026-0187, fixed in 0.42.0). convergio-reports
+    # uses lopdf exclusively for PDF *generation* (Document::new,
+    # Stream, Operation, xobject::image_from) — it never calls
+    # Document::load / load_mem or any other parse entry point on
+    # untrusted input. The vulnerable parser is compiled in but never
+    # reached at runtime. Revisit when lopdf 0.42 API is adopted.
+    { id = "RUSTSEC-2026-0187", reason = "lopdf via convergio-reports; only PDF write path used — load* parse APIs never called. Revisit when lopdf bumped to >= 0.42.0" },
 ]
 
 [licenses]
@@ -61,7 +69,6 @@ skip = [
     { crate = "getrandom@0.3.4", reason = "additional version pulled in by fastembed transitive (ADR-0038, F1-β)" },
     { crate = "hashbrown@0.15.5", reason = "transitive duplicate from current lockfile; ratchet when upstreams converge" },
     { crate = "hashbrown@0.16.1", reason = "additional version pulled in by fastembed transitive (ADR-0038, F1-β)" },
-    { crate = "redox_syscall@0.5.18", reason = "transitive duplicate from current lockfile; ratchet when upstreams converge" },
     { crate = "thiserror@1.0.69", reason = "transitive duplicate from current lockfile; ratchet when upstreams converge" },
     { crate = "thiserror-impl@1.0.69", reason = "transitive duplicate from current lockfile; ratchet when upstreams converge" },
     { crate = "wit-bindgen@0.51.0", reason = "transitive duplicate from current lockfile; ratchet when upstreams converge" },