diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 661444495..94eaa281b 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -46,8 +46,7 @@ jobs:
         run: gh release upload --clobber
           v${{ github.event.inputs.version }}
           ../$FILENAME.tar.xz
-        working-directory:
-          ${{ env.FILENAME }}
+        working-directory: ${{ env.FILENAME }}
         env:
           # using this token rather than github.token due to `release not found` bug
           # https://github.com/pkgxdev/cli/issues/5252
@@ -90,6 +89,15 @@ jobs:
         with:
           name: srcs
 
+      # debian:buster is archived, so we need to fix its sources.list
+      - name: fix debian:buster
+        if: ${{ matrix.platform.container == 'debian:buster-slim' }}
+        run: sed -i 's/deb.debian.org/archive.debian.org/g' /etc/apt/sources.list
+
+      - run: |
+          apt-get update
+          apt-get install curl gcc perl-modules openssl make xz-utils --yes
+
       - uses: pkgxdev/setup@v4
         with:
           +: ${{ matrix.platform.pkgs }}
diff --git a/.github/workflows/ci.ca-cert.yml b/.github/workflows/ci.ca-cert.yml
index 2f0f784e5..76cdc3666 100644
--- a/.github/workflows/ci.ca-cert.yml
+++ b/.github/workflows/ci.ca-cert.yml
@@ -16,7 +16,7 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: debian:buster-slim
+    container: debian:bullseye-slim
     steps:
       - uses: actions/checkout@v5
       - run: apt-get update && apt-get install -y curl gcc perl make
@@ -30,7 +30,7 @@ jobs:
   test:
     needs: build
     runs-on: ubuntu-latest
-    container: debian:buster-slim
+    container: debian:bullseye-slim
     steps:
       - uses: actions/download-artifact@v6
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9e6a7822c..cb660a05c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -119,7 +119,7 @@ jobs:
       - run: pkgx -qq git --version
       - run: pkgx -s git --version
       - run: pkgx -j +git
-      - run: pkgx git\* --version  # test star constraints are valid
+      - run: pkgx git\* --version # test star constraints are valid
       - run: pkgx /usr/bin/awk --version
       - run: pkgx +yarnpkg.com yarn --version
       - run: pkgx +yarnpkg.com -- yarn --version
@@ -129,9 +129,11 @@ jobs:
       - run: pkgx -v +agg
       # testing we correctly handle +pkg syntax for pkgs with no env
       - run: pkgx +curl.se/ca-certs
+      # regression test: cargo has deep deps on linux that exercise range intersection
+      - run: pkgx +cargo
 
-      - run: '! pkgx flubber-flubbles'  # cmd not found machinery
-      - run: '! pkgx --sync flubber-flubbles'  # cmd not found machinery separate if branch
+      - run: "! pkgx flubber-flubbles" # cmd not found machinery
+      - run: "! pkgx --sync flubber-flubbles" # cmd not found machinery separate if branch
 
       # create a fork bomb, but since it’s via pkgx we prevent it
       - run: |
@@ -166,7 +168,7 @@ jobs:
           pkgx -Q
 
       - run: if [ $(find ~/.pkgx -name .tmp\* -type d | wc -l) -gt 0 ]; then
-            exit 1;
+          exit 1;
           fi
 
       - name: --shebang test 1
@@ -178,7 +180,7 @@ jobs:
       - name: --shebang test 2
         run: test $(pkgx -q! echo fail hi) = hi
 
-      - name: '@latest'
+      - name: "@latest"
         run: |
           pkgx semverator eq $(pkgx krampus=0.2.0 --version) 0.2.0
           pkgx semverator gt $(pkgx krampus@latest --version) 0.2.0
@@ -230,7 +232,7 @@ jobs:
   test-minimal-container:
     needs: fmt
     runs-on: ubuntu-latest
-    container: debian:buster-slim
+    container: debian:bullseye-slim
     steps:
       - uses: actions/checkout@v5
       - run: apt-get update && apt-get install -y curl make gcc perl
diff --git a/Cargo.lock b/Cargo.lock
index 0d35aeb23..6922dff3d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -28,9 +28,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.97"
+version = "1.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcfed56ad506cb2c684a14971b8861fdc3baaaae314b9e5f9bb532cbe3ba7a4f"
+checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
 [[package]]
 name = "async-compression"
@@ -126,15 +126,15 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "console"
-version = "0.15.10"
+version = "0.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea3c6ecd8059b57859df5c69830340ed3c41d30e3da0c1cbed90a96ac853041b"
+checksum = "03e45a4a8926227e4197636ba97a9fc9b00477e9f4bd711395687c5f0734bec4"
 dependencies = [
  "encode_unicode",
  "libc",
  "once_cell",
  "unicode-width",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -735,14 +735,14 @@ dependencies = [
 
 [[package]]
 name = "indicatif"
-version = "0.17.11"
+version = "0.18.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "183b3088984b400f4cfac3620d5e076c84da5364016b4f49473de574b2586235"
+checksum = "9375e112e4b463ec1b1c6c011953545c65a30164fbab5b581df32b3abf0dcb88"
 dependencies = [
  "console",
- "number_prefix",
  "portable-atomic",
  "unicode-width",
+ "unit-prefix",
  "web-time",
 ]
 
@@ -776,13 +776,13 @@ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
 [[package]]
 name = "libc"
-version = "0.2.169"
+version = "0.2.180"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
+checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
 
 [[package]]
 name = "libpkgx"
-version = "0.7.0"
+version = "0.7.1"
 dependencies = [
  "anyhow",
  "async-compression",
@@ -819,9 +819,9 @@ dependencies = [
 
 [[package]]
 name = "libsemverator"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89e47a57b20d7a6bef8207b1360f81143a39d45c051098a749789a550356a225"
+checksum = "506e8f975ce4cdbac0b8ee267182e3a4a5aa4fe371f91ab3ea38c629c56f6b76"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -832,9 +832,9 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.31.0"
+version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad8935b44e7c13394a179a438e0cebba0fe08fe01b54f152e29a93b5cf993fd4"
+checksum = "133c182a6a2c87864fe97778797e46c7e999672690dc9fa3ee8e241aa4a9c13f"
 dependencies = [
  "cc",
  "pkg-config",
@@ -931,9 +931,9 @@ dependencies = [
 
 [[package]]
 name = "nix"
-version = "0.29.0"
+version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
+checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
  "bitflags 2.7.0",
  "cfg-if",
@@ -941,12 +941,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "number_prefix"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
-
 [[package]]
 name = "object"
 version = "0.36.7"
@@ -1065,7 +1059,7 @@ checksum = "953ec861398dccce10c670dfeaf3ec4911ca479e9c02154b3a215178c5f566f2"
 
 [[package]]
 name = "pkgx"
-version = "2.7.0"
+version = "2.7.1"
 dependencies = [
  "console",
  "indicatif",
@@ -1224,9 +1218,9 @@ dependencies = [
 
 [[package]]
 name = "rusqlite"
-version = "0.33.0"
+version = "0.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c6d5e5acb6f6129fe3f7ba0a7fc77bca1942cb568535e18e7bc40262baf3110"
+checksum = "165ca6e57b20e1351573e3729b958bc62f0e48025386970b6e4d29e7a7e71f3f"
 dependencies = [
  "bitflags 2.7.0",
  "fallible-iterator",
@@ -1721,6 +1715,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fc81956842c57dac11422a97c3b8195a1ff727f06e85c84ed2e8aa277c9a0fd"
 
+[[package]]
+name = "unit-prefix"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81e544489bf3d8ef66c953931f56617f423cd4b5494be343d9b9d3dda037b9a3"
+
 [[package]]
 name = "unsafe-libyaml"
 version = "0.2.11"
@@ -1908,6 +1908,12 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
 [[package]]
 name = "windows-registry"
 version = "0.2.0"
@@ -1956,6 +1962,15 @@ dependencies = [
  "windows-targets",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml
index 321f1cf36..4d584b2d3 100644
--- a/crates/cli/Cargo.toml
+++ b/crates/cli/Cargo.toml
@@ -3,7 +3,7 @@ name = "pkgx"
 description = "Run anything"
 authors = ["Max Howell <mxcl@me.com>", "Jacob Heider <jacob@pkgx.dev>"]
 license = "Apache-2.0"
-version = "2.7.0"
+version = "2.7.1"
 edition = "2021"
 repository = "https://github.com/pkgxdev/pkgx"
 
@@ -15,13 +15,13 @@ indicatif = "0.18.3"
 nix = { version = "0.30.1", features = ["process"] }
 serde_json = "1.0.135"
 serde = { version = "1.0", features = ["derive"] }
-libpkgx = { version = "0.7.0", path = "../lib" }
+libpkgx = { version = "0.7.1", path = "../lib" }
 console = { version = "0.16", default-features = false, features = [
   "ansi-parsing",
 ] }
 
 [target.'cfg(not(target_os = "macos"))'.dependencies]
-rusqlite = { version = "0.33.0", features = ["bundled"] }
+rusqlite = { version = "0.37.0", features = ["bundled"] }
 native-tls = { version = "0.2", features = ["vendored"] }
 # ^^ this is a transitive dependency
 # ^^ we vendor OpenSSL ∵ we want to be standalone and just work inside minimal docker images
diff --git a/crates/cli/src/dump.rs b/crates/cli/src/dump.rs
index 624c3fff0..06b2c09b2 100644
--- a/crates/cli/src/dump.rs
+++ b/crates/cli/src/dump.rs
@@ -44,10 +44,11 @@ pub fn dump(
                 }
 
                 let programs = pantry_db::programs_for_project(&project, &conn)?;
-                let companions = pantry_db::companions_for_projects(&[project.clone()], &conn)?
-                    .iter()
-                    .map(|c| c.to_string())
-                    .collect::<Vec<String>>();
+                let companions =
+                    pantry_db::companions_for_projects(std::slice::from_ref(&project), &conn)?
+                        .iter()
+                        .map(|c| c.to_string())
+                        .collect::<Vec<String>>();
 
                 let pkg = JsonV2Pkg {
                     path: installation.path,
diff --git a/crates/cli/src/execve.rs b/crates/cli/src/execve.rs
index 7d2e74ff0..ca072be21 100644
--- a/crates/cli/src/execve.rs
+++ b/crates/cli/src/execve.rs
@@ -47,7 +47,7 @@ pub fn execve(
     // Replace the process with the new command, arguments, and environment
     let execve_result = nix_execve(&c_command, &c_args, &c_env);
     if execve_result.is_err() {
-        let errno = execve_result.unwrap_err();
+        let Err(errno) = execve_result;
         return Err(format!("execve failed with errno: {}", errno).into());
     }
 
diff --git a/crates/lib/Cargo.toml b/crates/lib/Cargo.toml
index e039edecd..5cd0e7d2a 100644
--- a/crates/lib/Cargo.toml
+++ b/crates/lib/Cargo.toml
@@ -3,7 +3,7 @@ name = "libpkgx"
 description = "Install and run `pkgx` packages"
 authors = ["Max Howell <mxcl@me.com>", "Jacob Heider <jacob@pkgx.dev>"]
 license = "Apache-2.0"
-version = "0.7.0"
+version = "0.7.1"
 edition = "2021"
 repository = "https://github.com/pkgxdev/pkgx"
 
@@ -13,7 +13,7 @@ crate-type = ["cdylib", "rlib"]
 [dependencies]
 anyhow = "1.0.95"
 dirs-next = "2.0"
-libsemverator = { version = "0.10.0", features = ["serde"] }
+libsemverator = { version = "0.10.1", features = ["serde"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_yaml = "0.9"
 tokio = { version = "1.43", features = ["full", "rt-multi-thread"] }
@@ -33,4 +33,4 @@ fs2 = "0.4.3"
 tempfile = "3.16.0"
 
 [target.'cfg(not(target_os = "macos"))'.dependencies]
-rusqlite = { version = "0.33.0", features = ["bundled"] }
+rusqlite = { version = "0.37.0", features = ["bundled"] }
diff --git a/crates/lib/src/client.rs b/crates/lib/src/client.rs
index 696ca3da3..dee6fc029 100644
--- a/crates/lib/src/client.rs
+++ b/crates/lib/src/client.rs
@@ -29,8 +29,8 @@ fn get_user_agent() -> String {
     let os = std::env::consts::OS;
     let arch = std::env::consts::ARCH;
     let group = env::var("PKGX_USER_AGENT_GROUP");
-    let name = if group.is_ok() {
-        format!("pkgx[{}]", group.unwrap())
+    let name = if let Ok(valid_group) = group {
+        format!("pkgx[{}]", valid_group)
     } else {
         "pkgx".to_string()
     };
diff --git a/crates/lib/src/install.rs b/crates/lib/src/install.rs
index bf097ea5f..ca6441398 100644
--- a/crates/lib/src/install.rs
+++ b/crates/lib/src/install.rs
@@ -98,9 +98,7 @@ where
         }
     });
 
-    let stream = stream
-        .map_err(|e| futures::io::Error::new(futures::io::ErrorKind::Other, e))
-        .into_async_read();
+    let stream = stream.map_err(futures::io::Error::other).into_async_read();
     let stream = stream.compat();
 
     // Step 2: Create a XZ decoder
@@ -169,8 +167,7 @@ async fn symlink(installation: &Installation, config: &Config) -> Result<(), Box
     };
     let most_minor = versions
         .iter()
-        .filter(|(version, _)| minor_range.satisfies(version))
-        .next_back()
+        .rfind(|(version, _)| minor_range.satisfies(version))
         .ok_or_else(|| {
             anyhow::anyhow!(
                 "Could not find most minor version for {}",
@@ -189,8 +186,7 @@ async fn symlink(installation: &Installation, config: &Config) -> Result<(), Box
 
     let most_major = versions
         .iter()
-        .filter(|(version, _)| major_range.satisfies(version))
-        .next_back()
+        .rfind(|(version, _)| major_range.satisfies(version))
         .ok_or_else(|| anyhow::anyhow!("Could not find most major version"))?;
 
     if most_major.0 != installation.pkg.version {
diff --git a/crates/lib/src/sync.rs b/crates/lib/src/sync.rs
index 6d75138c5..f5df20954 100644
--- a/crates/lib/src/sync.rs
+++ b/crates/lib/src/sync.rs
@@ -58,9 +58,7 @@ async fn download_and_extract_pantry(url: &str, dest: &PathBuf) -> Result<(), Bo
 
     let stream = rsp.bytes_stream();
 
-    let stream = stream
-        .map_err(|e| futures::io::Error::new(futures::io::ErrorKind::Other, e))
-        .into_async_read();
+    let stream = stream.map_err(futures::io::Error::other).into_async_read();
     let stream = stream.compat();
 
     let decoder = XzDecoder::new(stream);