diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 49baa32..06ed811 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ jobs:
       with:
         python-version: "3.14"
 
-    - uses: astral-sh/setup-uv@v10.2.0
+    - uses: astral-sh/setup-uv@v10.3.0
     - run: uvx --with tox-uv tox -e py,style,ty,pyrefly,pyright,mypy,zuban
     - run: uv build
     - name: Publish to PyPI
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 2a76478..b53fce0 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -26,7 +26,7 @@ jobs:
       with:
         python-version: ${{ matrix.python-version }}
 
-    - uses: astral-sh/setup-uv@v10.2.0
+    - uses: astral-sh/setup-uv@v10.3.0
     - run: uvx --with tox-uv tox -e py
 
     - uses: coverallsapp/github-action@v2
@@ -55,5 +55,5 @@ jobs:
       with:
         python-version: "3.14"
 
-    - uses: astral-sh/setup-uv@v10.2.0
+    - uses: astral-sh/setup-uv@v10.3.0
     - run: uvx --with tox-uv tox -e style,ty,pyrefly,pyright,mypy,zuban
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8ea5f04..2f199f8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,7 +3,7 @@
 ## v2.1.0
 
 - portable-python's code is now checked by multiple type checkers on every change
-- Bumped SQLite to 3.53.4 and gettext-tiny to 0.3.3; re-checked every other component against upstream (all already current, or deliberately held back — see the `version` property comments).
+- Bumped OpenSSL to 3.5.9, SQLite to 3.53.4, xz to 5.8.4 and gettext-tiny to 0.3.3; re-checked every other component against upstream (all already current, or deliberately held back — see the `version` property comments).
 - Bug fixes:
   - With `cpython-use-github: true`, a failed GitHub API call (e.g. rate limiting) crashed with a stack trace
   - A build where `bin/python` could not be found crashed (instead of reporting it) when `cpython-validate-script` or `cpython-additional-packages` was configured
diff --git a/requirements.txt b/requirements.txt
index 812d78a..a5abbb0 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,30 +1,28 @@
 # This file was autogenerated by uv via the following command:
 #    uv pip compile pyproject.toml --universal -o requirements.txt --python-version 3.10 --group dev
-certifi==2026.6.17
+certifi==2026.10.19
     # via requests
-charset-normalizer==3.4.7
+charset-normalizer==3.5.2
     # via requests
-click==8.4.1
+click==8.5.0
     # via portable-python (pyproject.toml)
 colorama==0.4.6 ; sys_platform == 'win32'
-    # via
-    #   click
-    #   pytest
-coverage==7.14.2
+    # via pytest
+coverage==7.16.2
     # via pytest-cov
 exceptiongroup==1.3.1 ; python_full_version < '3.11'
     # via pytest
-idna==3.18
+idna==3.20
     # via requests
-iniconfig==2.3.0
+iniconfig==2.3.1
     # via pytest
-packaging==26.2
+packaging==26.3
     # via pytest
-pluggy==1.6.0
+pluggy==1.7.0
     # via
     #   pytest
     #   pytest-cov
-pygments==2.20.0
+pygments==2.21.0
     # via pytest
 pytest==9.1.1
     # via pytest-cov
@@ -34,15 +32,15 @@ pyyaml==6.0.3
     # via portable-python (pyproject.toml)
 requests==2.34.2
     # via portable-python (pyproject.toml)
-runez==5.9.1
+runez==5.11.1
     # via portable-python (pyproject.toml)
-tomli==2.4.1 ; python_full_version <= '3.11'
+tomli==2.5.0 ; python_full_version <= '3.11'
     # via
     #   coverage
     #   pytest
-typing-extensions==4.15.0 ; python_full_version < '3.11'
+typing-extensions==4.16.0 ; python_full_version < '3.11'
     # via exceptiongroup
-urllib3==2.7.0
+urllib3==2.8.0
     # via
     #   portable-python (pyproject.toml)
     #   requests
diff --git a/src/portable_python/cpython.py b/src/portable_python/cpython.py
index fcc38aa..f5f8024 100644
--- a/src/portable_python/cpython.py
+++ b/src/portable_python/cpython.py
@@ -339,7 +339,7 @@ def _apply_pep668(self):
 
     def _relativize_shebangs(self):
         """Autocorrect shebangs in bin/ folder, making them relative to the location of the python executable"""
-        for folder in (self.bin_folder, self.prefix_config_folder):
+        for folder in filter(None, (self.bin_folder, self.prefix_config_folder)):
             for path in runez.ls_dir(folder):
                 if path != self.bin_python and runez.is_executable(path) and not path.is_symlink():
                     self._relativize_shebang_file(path)
diff --git a/src/portable_python/external/xcpython.py b/src/portable_python/external/xcpython.py
index 758144b..1b54be1 100644
--- a/src/portable_python/external/xcpython.py
+++ b/src/portable_python/external/xcpython.py
@@ -185,9 +185,9 @@ def url(self):
     def version(self):
         # 3.5 is LTS, supported until Apr 2030 (3.0 EOL Sept 2026)
         # Stay on the 3.5 LTS line: 3.6.x and 4.0.x have shipped but are not verified for cpython builds
-        # (python-build-standalone pins 3.5.7 as well)
+        # (python-build-standalone pins 3.5.x as well)
         # Check https://github.com/openssl/openssl/releases and https://endoflife.date/openssl
-        return self.cfg_version("3.5.7")
+        return self.cfg_version("3.5.9")
 
     def c_configure_args(self):
         if config_args := self.cfg_configure(self.deps_lib_dir, self.deps_lib64_dir):
@@ -391,7 +391,7 @@ def url(self):
     @property
     def version(self):
         # Check https://github.com/tukaani-project/xz/releases
-        return self.cfg_version("5.8.3")
+        return self.cfg_version("5.8.4")
 
     def c_configure_args(self):
         if config_args := self.cfg_configure(self.deps_lib_dir, self.deps_lib64_dir):
diff --git a/src/portable_python/inspector.py b/src/portable_python/inspector.py
index 9b941a1..2b52739 100644
--- a/src/portable_python/inspector.py
+++ b/src/portable_python/inspector.py
@@ -153,7 +153,7 @@ def __repr__(self):
         return runez.short(self.filepath)
 
     @runez.cached_property
-    def additional_info(self):
+    def additional_info(self) -> "SoInfo | str | None":
         path = self.filepath
         if path:
             if is_dyn_lib(path):
@@ -180,7 +180,7 @@ def report_rows(self):
                 version = runez.bold(version)
 
         info = self.additional_info
-        if hasattr(info, "represented"):
+        if isinstance(info, SoInfo):
             info = info.represented()
 
         else:
diff --git a/tests/test_failed.py b/tests/test_failed.py
index fd56566..424303b 100644
--- a/tests/test_failed.py
+++ b/tests/test_failed.py
@@ -7,7 +7,7 @@ def test_build_bogus_platform(cli):
 def test_failed_build(cli):
     cli.run("-tmacos-arm64", "build", "3.12.0")
     assert cli.failed
-    assert "Error while compiling xz:5.8.3: ForbiddenHttpError" in cli.logged
+    assert "Error while compiling xz:5.8.4: ForbiddenHttpError" in cli.logged
     assert "Overall compilation failed:" in cli.logged
 
 
diff --git a/tests/test_inspector.py b/tests/test_inspector.py
index 6c94094..da72cd1 100644
--- a/tests/test_inspector.py
+++ b/tests/test_inspector.py
@@ -26,7 +26,9 @@ def test_inspect_python(temp_folder, monkeypatch):
     PPG.grab_config("foo.yml")
     inspector = PythonInspector("invoker")
     assert str(inspector)
-    assert str(inspector.module_info["_ctypes"])
+    module_info = inspector.module_info
+    assert module_info
+    assert str(module_info["_ctypes"])
     r = inspector.full_so_report
     assert r.ok
 
@@ -44,6 +46,7 @@ def test_inspect_python(temp_folder, monkeypatch):
     PPG.grab_config(target="linux-x86_64")
     monkeypatch.setitem(PPG.config.default.data, "linux", {"allowed-system-libs": "/foo"})
     problem = r.get_problem(True)
+    assert problem
     assert problem.startswith("Uses system libs:")
 
 
@@ -90,6 +93,7 @@ def test_inspect_problematic(temp_folder):
     assert "_tkinter*_failed.so" in report  # Failed modules are marked as such (cpython renames them `*_failed.so`)
 
     problem = inspector.full_so_report.get_problem(portable=False)
+    assert problem
     assert problem.startswith("\n-- 3 problematic\n")