diff --git a/Cargo.lock b/Cargo.lock
index 03f74ac..01ba342 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -908,7 +908,7 @@ dependencies = [
  "thiserror 2.0.18",
  "tikv-jemallocator",
  "tokio",
- "tower-http",
+ "tower-http 0.7.0",
  "windows-sys 0.61.2",
  "zip 8.6.0",
 ]
@@ -4375,7 +4375,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower",
- "tower-http",
+ "tower-http 0.6.11",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -4409,7 +4409,7 @@ dependencies = [
  "tokio",
  "tokio-util",
  "tower",
- "tower-http",
+ "tower-http 0.6.11",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -5613,7 +5613,7 @@ dependencies = [
  "serde_with",
  "swift-rs",
  "thiserror 2.0.18",
- "toml 0.9.12+spec-1.1.0",
+ "toml 1.0.6+spec-1.1.0",
  "url",
  "urlpattern",
  "uuid",
@@ -5996,6 +5996,21 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "tower-http"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b11f75e912b0c2be01b63d8cf8057b8c3f97cf34abb3d431a3a4c8675498e233"
+dependencies = [
+ "bitflags 2.11.0",
+ "bytes",
+ "http",
+ "percent-encoding",
+ "pin-project-lite",
+ "tower-layer",
+ "tower-service",
+]
+
 [[package]]
 name = "tower-layer"
 version = "0.3.3"
diff --git a/chess-db/Cargo.toml b/chess-db/Cargo.toml
index 62f0459..698f44c 100644
--- a/chess-db/Cargo.toml
+++ b/chess-db/Cargo.toml
@@ -35,7 +35,7 @@ serde_json = "1"
 # HTTP server
 axum = "0.8"
 # CORS so the bundled webview (origin tauri://localhost) can call the sidecar.
-tower-http = { version = "0.6", features = ["cors"] }
+tower-http = { version = "0.7", features = ["cors"] }
 
 # Error handling
 anyhow = "1"