diff --git a/Cargo.lock b/Cargo.lock
index ed4c7638..6bb2699d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -19,9 +19,9 @@ checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
 [[package]]
 name = "adler2"
-version = "2.0.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "aho-corasick"
@@ -117,19 +117,42 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "autocfg"
-version = "1.4.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fcc8f365936c834db5514fc45aee5b1202d677e6b40e48468aaaa8183ca8c7"
+dependencies = [
+ "aws-lc-sys",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61b1d86e7705efe1be1b569bab41d4fa1e14e220b60a160f78de2db687add079"
+dependencies = [
+ "bindgen",
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+]
 
 [[package]]
 name = "axum"
-version = "0.7.9"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
+checksum = "021e862c184ae977658b36c4500f7feac3221ca5da43e3f25bd04ab6c79a29b5"
 dependencies = [
- "async-trait",
  "axum-core",
  "bytes",
+ "form_urlencoded",
  "futures-util",
  "http",
  "http-body",
@@ -147,7 +170,7 @@ dependencies = [
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
- "sync_wrapper 1.0.1",
+ "sync_wrapper 1.0.2",
  "tower 0.5.2",
  "tower-layer",
  "tower-service",
@@ -156,20 +179,19 @@ dependencies = [
 
 [[package]]
 name = "axum-core"
-version = "0.4.5"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
+checksum = "68464cd0412f486726fb3373129ef5d2993f90c34bc2bc1c1e9943b2f4fc7ca6"
 dependencies = [
- "async-trait",
  "bytes",
- "futures-util",
+ "futures-core",
  "http",
  "http-body",
  "http-body-util",
  "mime",
  "pin-project-lite",
  "rustversion",
- "sync_wrapper 1.0.1",
+ "sync_wrapper 1.0.2",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -177,22 +199,21 @@ dependencies = [
 
 [[package]]
 name = "axum-extra"
-version = "0.9.6"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c794b30c904f0a1c2fb7740f7df7f7972dfaa14ef6f57cb6178dc63e5dca2f04"
+checksum = "45bf463831f5131b7d3c756525b305d40f1185b688565648a92e1392ca35713d"
 dependencies = [
  "axum",
  "axum-core",
  "bytes",
- "fastrand",
  "futures-util",
  "headers",
  "http",
  "http-body",
  "http-body-util",
  "mime",
- "multer",
  "pin-project-lite",
+ "rustversion",
  "serde",
  "tower 0.5.2",
  "tower-layer",
@@ -201,37 +222,36 @@ dependencies = [
 
 [[package]]
 name = "axum-server"
-version = "0.6.0"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1ad46c3ec4e12f4a4b6835e173ba21c25e484c9d02b49770bf006ce5367c036"
+checksum = "495c05f60d6df0093e8fb6e74aa5846a0ad06abaf96d76166283720bf740f8ab"
 dependencies = [
  "arc-swap",
  "bytes",
- "futures-util",
+ "fs-err",
  "http",
  "http-body",
- "http-body-util",
  "hyper",
  "hyper-util",
  "pin-project-lite",
- "rustls 0.21.12",
+ "rustls 0.23.28",
  "rustls-pemfile",
+ "rustls-pki-types",
  "tokio",
- "tokio-rustls 0.24.1",
- "tower 0.4.13",
+ "tokio-rustls 0.26.2",
  "tower-service",
 ]
 
 [[package]]
 name = "backtrace"
-version = "0.3.74"
+version = "0.3.75"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d82cb332cdfaed17ae235a638438ac4d4839913cc2af585c3c6746e8f8bee1a"
+checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
 dependencies = [
  "addr2line",
  "cfg-if",
  "libc",
- "miniz_oxide 0.8.8",
+ "miniz_oxide 0.8.9",
  "object",
  "rustc-demangle",
  "windows-targets 0.52.6",
@@ -261,18 +281,21 @@ version = "0.69.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.9.1",
  "cexpr",
  "clang-sys",
- "itertools",
+ "itertools 0.12.1",
  "lazy_static",
  "lazycell",
+ "log",
+ "prettyplease",
  "proc-macro2",
  "quote",
  "regex",
  "rustc-hash",
  "shlex",
  "syn",
+ "which",
 ]
 
 [[package]]
@@ -283,9 +306,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.9.0"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
+checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
 
 [[package]]
 name = "blake2b_simd"
@@ -309,9 +332,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.17.0"
+version = "3.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf"
+checksum = "793db76d6187cd04dff33004d8e6c9cc4e05cd330500379d2394209271b4aeee"
 
 [[package]]
 name = "bytemuck"
@@ -359,9 +382,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.21"
+version = "1.2.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8691782945451c1c383942c4874dbe63814f61cb57ef773cda2972682b7bb3c0"
+checksum = "956a5e21988b87f372569b66183b78babf23ebc2e744b733e4350a752c4dafac"
 dependencies = [
  "jobserver",
  "libc",
@@ -379,9 +402,9 @@ dependencies = [
 
 [[package]]
 name = "cfg-if"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
 
 [[package]]
 name = "cfg_aliases"
@@ -452,6 +475,15 @@ version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
 
+[[package]]
+name = "cmake"
+version = "0.1.54"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7caa3f9de89ddbe2c607f4101924c5abec803763ae9534e4f4d7d8f84aa81f0"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "color_quant"
 version = "1.1.0"
@@ -513,7 +545,7 @@ dependencies = [
  "threadpool",
  "tikv-jemallocator",
  "tokio",
- "tower 0.4.13",
+ "tower 0.5.2",
  "tower-http",
  "tower-service",
  "tracing",
@@ -559,9 +591,9 @@ checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.12"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
 dependencies = [
  "libc",
 ]
@@ -717,6 +749,12 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
 [[package]]
 name = "ed25519"
 version = "2.2.3"
@@ -744,18 +782,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.12.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3dca9240753cf90908d7e4aac30f630662b02aebaa1b58a3cadabdb23385b58b"
-
-[[package]]
-name = "encoding_rs"
-version = "0.8.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
-dependencies = [
- "cfg-if",
-]
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
 
 [[package]]
 name = "enum-as-inner"
@@ -775,6 +804,16 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
+[[package]]
+name = "errno"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "778e2ac28f6c47af28e4907f13ffd1e1ddbd400980a9abd7c8df189bf578a5ad"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "fallible-iterator"
 version = "0.3.0"
@@ -787,12 +826,6 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
 
-[[package]]
-name = "fastrand"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
-
 [[package]]
 name = "fdeflate"
 version = "0.3.4"
@@ -853,6 +886,22 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "fs-err"
+version = "3.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88d7be93788013f265201256d58f04936a8079ad5dc898743aa20525f503b683"
+dependencies = [
+ "autocfg",
+ "tokio",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
 [[package]]
 name = "futures-channel"
 version = "0.3.31"
@@ -958,15 +1007,15 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi 0.11.1+wasi-snapshot-preview1",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "getrandom"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0"
+checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
 dependencies = [
  "cfg-if",
  "libc",
@@ -998,9 +1047,9 @@ checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
 
 [[package]]
 name = "h2"
-version = "0.4.8"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5017294ff4bb30944501348f6f8e42e6ad28f42c8bbef7a74029aff064a4e3c2"
+checksum = "a9421a676d1b147b16b82c9225157dc629087ef8ec4d5e2960f9437a90dac0a5"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1023,9 +1072,9 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hashbrown"
-version = "0.15.3"
+version = "0.15.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84b26c544d002229e640969970a2e74021aadf6e2f96372b9c58eff97de08eb3"
+checksum = "5971ac85611da7067dbfcabef3c70ebb5606018acd9e2a3903a0da507521e0d5"
 dependencies = [
  "foldhash",
 ]
@@ -1036,16 +1085,16 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
 dependencies = [
- "hashbrown 0.15.3",
+ "hashbrown 0.15.4",
 ]
 
 [[package]]
 name = "headers"
-version = "0.4.0"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "322106e6bd0cba2d5ead589ddb8150a13d7c4217cf80d7c4f682ca994ccc6aa9"
+checksum = "b3314d5adb5d94bcdf56771f2e50dbbc80bb4bdf88967526706205ac9eff24eb"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.1",
  "bytes",
  "headers-core",
  "http",
@@ -1142,6 +1191,15 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "home"
+version = "0.5.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "hostname"
 version = "0.3.1"
@@ -1185,9 +1243,9 @@ dependencies = [
 
 [[package]]
 name = "http-body-util"
-version = "0.1.1"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0475f8b2ac86659c21b64320d5d653f9efe42acd2a4e560073ec61a155a34f1d"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
  "bytes",
  "futures-core",
@@ -1277,20 +1335,21 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.5"
+version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b875924a60b96e5d7b9ae7b066540b1dd1cbd90d1828f54c92e02a283351c56"
+checksum = "dc2fdfdbff08affe55bb779f33b053aa1fe5dd5b54c257343c17edfa55711bdb"
 dependencies = [
  "bytes",
  "futures-channel",
+ "futures-core",
  "futures-util",
  "http",
  "http-body",
  "hyper",
+ "libc",
  "pin-project-lite",
  "socket2",
  "tokio",
- "tower 0.4.13",
  "tower-service",
  "tracing",
 ]
@@ -1470,7 +1529,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
 dependencies = [
  "equivalent",
- "hashbrown 0.15.3",
+ "hashbrown 0.15.4",
  "serde",
 ]
 
@@ -1507,6 +1566,15 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "1.0.15"
@@ -1519,15 +1587,15 @@ version = "0.1.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "38f262f097c174adebe41eb73d66ae9c06b2844fb0da69969647bbddd9b0538a"
 dependencies = [
- "getrandom 0.3.2",
+ "getrandom 0.3.3",
  "libc",
 ]
 
 [[package]]
 name = "js-sys"
-version = "0.3.74"
+version = "0.3.77"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a865e038f7f6ed956f788f0d7d60c541fff74c7bd74272c5d4cf15c63743e705"
+checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f"
 dependencies = [
  "once_cell",
  "wasm-bindgen",
@@ -1600,18 +1668,18 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.172"
+version = "0.2.174"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
+checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
 
 [[package]]
 name = "libloading"
-version = "0.8.3"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c2a198fb6b0eada2a8df47933734e6d35d350665a33a3593d7164fa52c75c19"
+checksum = "07033963ba89ebaf1584d767badaa2e8fcec21aedea6b8c0346d487d49c28667"
 dependencies = [
  "cfg-if",
- "windows-targets 0.52.6",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
@@ -1620,7 +1688,7 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.9.1",
  "libc",
 ]
 
@@ -1652,6 +1720,12 @@ version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
 
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
+
 [[package]]
 name = "litemap"
 version = "0.8.0"
@@ -1729,15 +1803,15 @@ dependencies = [
 
 [[package]]
 name = "matchit"
-version = "0.7.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
 [[package]]
 name = "memchr"
-version = "2.7.4"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
 
 [[package]]
 name = "mime"
@@ -1763,22 +1837,22 @@ dependencies = [
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.8"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be647b768db090acb35d5ec5db2b0e1f1de11133ca123b9eacf5137868f892a"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
 dependencies = [
  "adler2",
 ]
 
 [[package]]
 name = "mio"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
+checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
 dependencies = [
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
- "windows-sys 0.52.0",
+ "wasi 0.11.1+wasi-snapshot-preview1",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -1800,30 +1874,13 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "multer"
-version = "3.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83e87776546dc87511aa5ee218730c92b666d7264ab6ed41f9d215af9cd5224b"
-dependencies = [
- "bytes",
- "encoding_rs",
- "futures-util",
- "http",
- "httparse",
- "memchr",
- "mime",
- "spin",
- "version_check",
-]
-
 [[package]]
 name = "nix"
 version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.9.1",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -2084,18 +2141,18 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "pin-project"
-version = "1.1.5"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
+checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.5"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
+checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2151,9 +2208,9 @@ dependencies = [
 
 [[package]]
 name = "portable-atomic"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "350e9b48cbc6b0e028b0473b114454c6316e57336ee184ceab6e53f72c178b3e"
+checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
 
 [[package]]
 name = "potential_utf"
@@ -2179,6 +2236,16 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "prettyplease"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "061c1221631e079b26479d25bbf2275bfe5917ae8419cd7e34f13bfc2aa7539a"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
 [[package]]
 name = "proc-macro-crate"
 version = "3.1.0"
@@ -2227,7 +2294,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools",
+ "itertools 0.14.0",
  "proc-macro2",
  "quote",
  "syn",
@@ -2316,7 +2383,7 @@ version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
 dependencies = [
- "getrandom 0.3.2",
+ "getrandom 0.3.3",
 ]
 
 [[package]]
@@ -2325,7 +2392,7 @@ version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b6dfecf2c74bce2466cabf93f6664d6998a69eb21e39f4207930065b27b771f"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.9.1",
 ]
 
 [[package]]
@@ -2452,8 +2519,8 @@ dependencies = [
 
 [[package]]
 name = "ruma"
-version = "0.12.2"
-source = "git+https://github.com/ruma/ruma.git#469a185332d109b227351bf39544732da05aded7"
+version = "0.12.3"
+source = "git+https://github.com/ruma/ruma.git#a0e8064064dbdc6c935394c72c6f43d7bd89b92d"
 dependencies = [
  "assign",
  "js_int",
@@ -2471,8 +2538,8 @@ dependencies = [
 
 [[package]]
 name = "ruma-appservice-api"
-version = "0.12.1"
-source = "git+https://github.com/ruma/ruma.git#469a185332d109b227351bf39544732da05aded7"
+version = "0.12.2"
+source = "git+https://github.com/ruma/ruma.git#a0e8064064dbdc6c935394c72c6f43d7bd89b92d"
 dependencies = [
  "js_int",
  "ruma-common",
@@ -2483,8 +2550,8 @@ dependencies = [
 
 [[package]]
 name = "ruma-client-api"
-version = "0.20.2"
-source = "git+https://github.com/ruma/ruma.git#469a185332d109b227351bf39544732da05aded7"
+version = "0.20.3"
+source = "git+https://github.com/ruma/ruma.git#a0e8064064dbdc6c935394c72c6f43d7bd89b92d"
 dependencies = [
  "as_variant",
  "assign",
@@ -2507,7 +2574,7 @@ dependencies = [
 [[package]]
 name = "ruma-common"
 version = "0.15.2"
-source = "git+https://github.com/ruma/ruma.git#469a185332d109b227351bf39544732da05aded7"
+source = "git+https://github.com/ruma/ruma.git#a0e8064064dbdc6c935394c72c6f43d7bd89b92d"
 dependencies = [
  "as_variant",
  "base64 0.22.1",
@@ -2537,8 +2604,8 @@ dependencies = [
 
 [[package]]
 name = "ruma-events"
-version = "0.30.2"
-source = "git+https://github.com/ruma/ruma.git#469a185332d109b227351bf39544732da05aded7"
+version = "0.30.3"
+source = "git+https://github.com/ruma/ruma.git#a0e8064064dbdc6c935394c72c6f43d7bd89b92d"
 dependencies = [
  "as_variant",
  "indexmap 2.9.0",
@@ -2561,7 +2628,7 @@ dependencies = [
 [[package]]
 name = "ruma-federation-api"
 version = "0.11.1"
-source = "git+https://github.com/ruma/ruma.git#469a185332d109b227351bf39544732da05aded7"
+source = "git+https://github.com/ruma/ruma.git#a0e8064064dbdc6c935394c72c6f43d7bd89b92d"
 dependencies = [
  "bytes",
  "headers",
@@ -2583,7 +2650,7 @@ dependencies = [
 [[package]]
 name = "ruma-identifiers-validation"
 version = "0.10.1"
-source = "git+https://github.com/ruma/ruma.git#469a185332d109b227351bf39544732da05aded7"
+source = "git+https://github.com/ruma/ruma.git#a0e8064064dbdc6c935394c72c6f43d7bd89b92d"
 dependencies = [
  "js_int",
  "thiserror 2.0.12",
@@ -2592,7 +2659,7 @@ dependencies = [
 [[package]]
 name = "ruma-macros"
 version = "0.15.1"
-source = "git+https://github.com/ruma/ruma.git#469a185332d109b227351bf39544732da05aded7"
+source = "git+https://github.com/ruma/ruma.git#a0e8064064dbdc6c935394c72c6f43d7bd89b92d"
 dependencies = [
  "cfg-if",
  "proc-macro-crate",
@@ -2607,7 +2674,7 @@ dependencies = [
 [[package]]
 name = "ruma-push-gateway-api"
 version = "0.11.0"
-source = "git+https://github.com/ruma/ruma.git#469a185332d109b227351bf39544732da05aded7"
+source = "git+https://github.com/ruma/ruma.git#a0e8064064dbdc6c935394c72c6f43d7bd89b92d"
 dependencies = [
  "js_int",
  "ruma-common",
@@ -2619,7 +2686,7 @@ dependencies = [
 [[package]]
 name = "ruma-signatures"
 version = "0.17.1"
-source = "git+https://github.com/ruma/ruma.git#469a185332d109b227351bf39544732da05aded7"
+source = "git+https://github.com/ruma/ruma.git#a0e8064064dbdc6c935394c72c6f43d7bd89b92d"
 dependencies = [
  "base64 0.22.1",
  "ed25519-dalek",
@@ -2635,7 +2702,7 @@ dependencies = [
 [[package]]
 name = "ruma-state-res"
 version = "0.13.0"
-source = "git+https://github.com/ruma/ruma.git#469a185332d109b227351bf39544732da05aded7"
+source = "git+https://github.com/ruma/ruma.git#a0e8064064dbdc6c935394c72c6f43d7bd89b92d"
 dependencies = [
  "js_int",
  "ruma-common",
@@ -2653,7 +2720,7 @@ version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a22715a5d6deef63c637207afbe68d0c72c3f8d0022d7cf9714c442d6157606b"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.9.1",
  "fallible-iterator",
  "fallible-streaming-iterator",
  "hashlink",
@@ -2700,9 +2767,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.24"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+checksum = "989e6739f80c4ad5b13e0fd7fe89531180375b18520cc8c82080e4dc4035b84f"
 
 [[package]]
 name = "rustc-hash"
@@ -2720,15 +2787,16 @@ dependencies = [
 ]
 
 [[package]]
-name = "rustls"
-version = "0.21.12"
+name = "rustix"
+version = "0.38.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
+checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
 dependencies = [
- "log",
- "ring",
- "rustls-webpki 0.101.7",
- "sct",
+ "bitflags 2.9.1",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -2745,6 +2813,20 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.23.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7160e3e10bf4535308537f3c4e1641468cd0e485175d6163087c0393c7d46643"
+dependencies = [
+ "aws-lc-rs",
+ "once_cell",
+ "rustls-pki-types",
+ "rustls-webpki 0.103.3",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rustls-native-certs"
 version = "0.7.0"
@@ -2760,11 +2842,10 @@ dependencies = [
 
 [[package]]
 name = "rustls-pemfile"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
 dependencies = [
- "base64 0.22.1",
  "rustls-pki-types",
 ]
 
@@ -2777,16 +2858,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "rustls-webpki"
-version = "0.101.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
-dependencies = [
- "ring",
- "untrusted",
-]
-
 [[package]]
 name = "rustls-webpki"
 version = "0.102.4"
@@ -2799,10 +2870,22 @@ dependencies = [
 ]
 
 [[package]]
-name = "rustversion"
-version = "1.0.17"
+name = "rustls-webpki"
+version = "0.103.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "955d28af4278de8121b7ebeb796b6a45735dc01436d898801014aced2773a3d6"
+checksum = "e4a72fe2bcf7a6ac6fd7d0b9e5cb68aeb7d4c0a0271730218b3e92d43b4eb435"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a0d197bd2c9dc6e53b84da9556a69ba4cdfab8619eb41a8bd1cc2027a0f6b1d"
 
 [[package]]
 name = "ryu"
@@ -2831,16 +2914,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
-[[package]]
-name = "sct"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
-dependencies = [
- "ring",
- "untrusted",
-]
-
 [[package]]
 name = "sd-notify"
 version = "0.4.5"
@@ -2856,7 +2929,7 @@ version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c627723fd09706bacdb5cf41499e95098555af3c3c29d014dc3c458ef6be11c0"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.9.1",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -2926,9 +2999,9 @@ dependencies = [
 
 [[package]]
 name = "serde_path_to_error"
-version = "0.1.16"
+version = "0.1.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af99884400da37c88f5e9146b7f1fd0fbcae8f6eec4e9da38b67d05486f814a6"
+checksum = "59fab13f937fa393d08645bf3a84bdfe86e296747b506ada67bb15f10f218b2a"
 dependencies = [
  "itoa",
  "serde",
@@ -3060,35 +3133,26 @@ dependencies = [
 
 [[package]]
 name = "slab"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
-dependencies = [
- "autocfg",
-]
+checksum = "04dc19736151f35336d325007ac991178d504a119863a2fcb3758cdb5e52c50d"
 
 [[package]]
 name = "smallvec"
-version = "1.15.0"
+version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8917285742e9f3e1683f0a9c4e6b57960b7314d0b08d30d1ecd426713ee2eee9"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 
 [[package]]
 name = "socket2"
-version = "0.5.9"
+version = "0.5.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f5fd57c80058a56cf5c777ab8a126398ece8e442983605d280a44ce79d0edef"
+checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "spin"
-version = "0.9.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
-
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -3116,15 +3180,15 @@ dependencies = [
 
 [[package]]
 name = "subtle"
-version = "2.5.0"
+version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.101"
+version = "2.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ce2b7fc941b3a24138a0a7cf8e858bfc6a992e7978a068a5c760deb0ed43caf"
+checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3139,9 +3203,9 @@ checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
 
 [[package]]
 name = "sync_wrapper"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7065abeca94b6a8a577f9bd45aa0867a2238b74e8eb67cf10d492bc39351394"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
 
 [[package]]
 name = "synstructure"
@@ -3297,9 +3361,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.45.0"
+version = "1.45.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2513ca694ef9ede0fb23fe71a4ee4107cb102b9dc1930f6d0fd77aae068ae165"
+checksum = "75ef51a33ef1da925cea3e4eb122833cb377c61439ca401b770f54902b806779"
 dependencies = [
  "backtrace",
  "bytes",
@@ -3323,16 +3387,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "tokio-rustls"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
-dependencies = [
- "rustls 0.21.12",
- "tokio",
-]
-
 [[package]]
 name = "tokio-rustls"
 version = "0.25.0"
@@ -3344,6 +3398,16 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tokio-rustls"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e727b36a1a0e8b74c376ac2211e40c2c8af09fb4013c60d910495810f008e9b"
+dependencies = [
+ "rustls 0.23.28",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-socks"
 version = "0.5.1"
@@ -3487,24 +3551,23 @@ dependencies = [
  "futures-core",
  "futures-util",
  "pin-project-lite",
- "sync_wrapper 1.0.1",
+ "sync_wrapper 1.0.2",
  "tower-layer",
  "tower-service",
 ]
 
 [[package]]
 name = "tower-http"
-version = "0.5.2"
+version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
+checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.9.1",
  "bytes",
  "http",
  "http-body",
- "http-body-util",
  "pin-project-lite",
- "tower 0.4.13",
+ "tower 0.5.2",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -3528,7 +3591,6 @@ version = "0.1.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
 dependencies = [
- "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -3536,9 +3598,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.28"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
+checksum = "1b1ffbcf9c6f6b99d386e7444eb608ba646ae452a36b39737deb9663b610f662"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3547,9 +3609,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-core"
-version = "0.1.33"
+version = "0.1.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e672c95779cf947c5311f83787af4fa8fffd12fb27e4993211a84bdfd9610f9c"
+checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
 dependencies = [
  "once_cell",
  "valuable",
@@ -3621,9 +3683,9 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "typenum"
-version = "1.17.0"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
 
 [[package]]
 name = "typewit"
@@ -3696,9 +3758,9 @@ dependencies = [
 
 [[package]]
 name = "valuable"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
 [[package]]
 name = "vcpkg"
@@ -3723,9 +3785,9 @@ dependencies = [
 
 [[package]]
 name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
+version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasi"
@@ -3738,24 +3800,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.97"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d15e63b4482863c109d70a7b8706c1e364eb6ea449b201a76c5b89cedcec2d5c"
+checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5"
 dependencies = [
  "cfg-if",
  "once_cell",
+ "rustversion",
  "wasm-bindgen-macro",
 ]
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.97"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d36ef12e3aaca16ddd3f67922bc63e48e953f126de60bd33ccc0101ef9998cd"
+checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6"
 dependencies = [
  "bumpalo",
  "log",
- "once_cell",
  "proc-macro2",
  "quote",
  "syn",
@@ -3776,9 +3838,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.97"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "705440e08b42d3e4b36de7d66c944be628d579796b8090bfa3471478a2260051"
+checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -3786,9 +3848,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.97"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98c9ae5a76e46f4deecd0f0255cc223cfa18dc9b261213b8aa0c7b36f61b3f1d"
+checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3799,9 +3861,12 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.97"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ee99da9c5ba11bd675621338ef6fa52296b76b83305e9b6e5c77d4c286d6d49"
+checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d"
+dependencies = [
+ "unicode-ident",
+]
 
 [[package]]
 name = "web-sys"
@@ -3829,6 +3894,18 @@ version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53a85b86a771b1c87058196170769dd264f66c0782acf1ae6cc51bfd64b39082"
 
+[[package]]
+name = "which"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
+dependencies = [
+ "either",
+ "home",
+ "once_cell",
+ "rustix",
+]
+
 [[package]]
 name = "widestring"
 version = "1.1.0"
@@ -4178,7 +4255,7 @@ version = "0.39.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
 dependencies = [
- "bitflags 2.9.0",
+ "bitflags 2.9.1",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 2ea00cab..557b155b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -28,18 +28,17 @@ workspace = true
 
 [dependencies]
 # Web framework
-# Can't bump until https://github.com/ruma/ruma/pull/1846 is merged or superseded
-axum = { version = "0.7", default-features = false, features = [
+axum = { version = "0.8", default-features = false, features = [
   "form",
   "http1",
   "http2",
   "json",
   "matched-path",
 ], optional = true }
-axum-extra = { version = "0.9", features = ["typed-header"] }
-axum-server = { version = "0.6", features = ["tls-rustls"] }
-tower = { version = "0.4", features = ["util"] }
-tower-http = { version = "0.5", features = [
+axum-extra = { version = "0.10", features = ["typed-header"] }
+axum-server = { version = "0.7", features = ["tls-rustls"] }
+tower = { version = "0.5", features = ["util"] }
+tower-http = { version = "0.6", features = [
   "add-extension",
   "cors",
   "sensitive-headers",
diff --git a/src/api/appservice_server.rs b/src/api/appservice_server.rs
index 641e9532..fe4c1cb4 100644
--- a/src/api/appservice_server.rs
+++ b/src/api/appservice_server.rs
@@ -1,4 +1,4 @@
-use crate::{services, utils, Error, Result, MATRIX_VERSIONS};
+use crate::{services, utils, Error, Result, SUPPORTED_VERSIONS};
 use bytes::BytesMut;
 use ruma::api::{appservice::Registration, IncomingResponse, OutgoingRequest, SendAccessToken};
 use std::{fmt::Debug, mem, time::Duration};
@@ -28,7 +28,7 @@ where
         .try_into_http_request::<BytesMut>(
             &destination,
             SendAccessToken::IfRequired(hs_token),
-            MATRIX_VERSIONS,
+            &SUPPORTED_VERSIONS,
         )
         .unwrap()
         .map(|body| body.freeze());
diff --git a/src/api/client_server/capabilities.rs b/src/api/client_server/capabilities.rs
index 60ebf627..4bba3adc 100644
--- a/src/api/client_server/capabilities.rs
+++ b/src/api/client_server/capabilities.rs
@@ -1,6 +1,7 @@
 use crate::{services, Result, Ruma};
 use ruma::api::client::discovery::get_capabilities::{
-    self, Capabilities, RoomVersionStability, RoomVersionsCapability,
+    self,
+    v3::{Capabilities, RoomVersionStability, RoomVersionsCapability},
 };
 use std::collections::BTreeMap;
 
diff --git a/src/api/client_server/sync.rs b/src/api/client_server/sync.rs
index 50a1cb81..6580da6a 100644
--- a/src/api/client_server/sync.rs
+++ b/src/api/client_server/sync.rs
@@ -1779,16 +1779,7 @@ pub async fn sync_events_v5_route(
                 ),
                 num_live: None, // Count events in timeline greater than global sync counter
                 bump_stamp,
-                heroes: if body
-                    .room_subscriptions
-                    .get(room_id)
-                    .map(|sub| sub.include_heroes.unwrap_or_default())
-                    .unwrap_or_default()
-                {
-                    Some(heroes)
-                } else {
-                    None
-                },
+                heroes: Some(heroes),
             },
         );
     }
diff --git a/src/api/ruma_wrapper/axum.rs b/src/api/ruma_wrapper/axum.rs
index 4be5ec2b..f933796e 100644
--- a/src/api/ruma_wrapper/axum.rs
+++ b/src/api/ruma_wrapper/axum.rs
@@ -1,7 +1,6 @@
 use std::{collections::BTreeMap, iter::FromIterator, str};
 
 use axum::{
-    async_trait,
     body::Body,
     extract::{FromRequest, Path},
     response::{IntoResponse, Response},
@@ -34,10 +33,10 @@ enum Token {
     None,
 }
 
-#[async_trait]
 impl<T, S> FromRequest<S> for Ruma<T>
 where
     T: IncomingRequest,
+    S: Sync,
 {
     type Rejection = Error;
 
@@ -65,7 +64,13 @@ where
         };
 
         let metadata = T::METADATA;
-        let auth_header: Option<TypedHeader<Authorization<Bearer>>> = parts.extract().await?;
+        let auth_header: Option<TypedHeader<Authorization<Bearer>>> =
+            // If X-Matrix signatures are used, it causes this extraction to fail with an error
+            if metadata.authentication != AuthScheme::ServerSignatures {
+                parts.extract().await?
+            } else {
+                None
+            };
         let path_params: Path<Vec<String>> = parts.extract().await?;
 
         let query = parts.uri.query().unwrap_or_default();
diff --git a/src/api/server_server.rs b/src/api/server_server.rs
index 4bb93414..946f02f4 100644
--- a/src/api/server_server.rs
+++ b/src/api/server_server.rs
@@ -7,7 +7,7 @@ use crate::{
         media::FileMeta,
         pdu::{gen_event_id_canonical_json, PduBuilder},
     },
-    services, utils, Error, PduEvent, Result, Ruma, MATRIX_VERSIONS,
+    services, utils, Error, PduEvent, Result, Ruma, SUPPORTED_VERSIONS,
 };
 use axum::{response::IntoResponse, Json};
 use axum_extra::headers::{CacheControl, Header};
@@ -214,7 +214,7 @@ where
         .try_into_http_request::<Vec<u8>>(
             &actual_destination_str,
             SendAccessToken::IfRequired(""),
-            MATRIX_VERSIONS,
+            &SUPPORTED_VERSIONS,
         )
         .map_err(|e| {
             warn!(
diff --git a/src/lib.rs b/src/lib.rs
index 3741ee6b..a2406137 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -8,17 +8,23 @@ mod utils;
 // Not async due to services() being used in many closures, and async closures are not stable as of writing
 // This is the case for every other occurrence of sync Mutex/RwLock, except for database related ones, where
 // the current maintainer (Timo) has asked to not modify those
-use std::sync::RwLock;
+use std::{
+    collections::BTreeSet,
+    sync::{LazyLock, RwLock},
+};
 
 pub use api::ruma_wrapper::{Ruma, RumaResponse};
 pub use config::Config;
 pub use database::KeyValueDatabase;
-use ruma::api::MatrixVersion;
+use ruma::api::{MatrixVersion, SupportedVersions};
 pub use service::{pdu::PduEvent, Services};
 pub use utils::error::{Error, Result};
 
 pub static SERVICES: RwLock<Option<&'static Services>> = RwLock::new(None);
-pub const MATRIX_VERSIONS: &[MatrixVersion] = &[MatrixVersion::V1_13];
+pub static SUPPORTED_VERSIONS: LazyLock<SupportedVersions> = LazyLock::new(|| SupportedVersions {
+    versions: BTreeSet::from_iter([MatrixVersion::V1_13]),
+    features: Vec::new(),
+});
 
 pub fn services() -> &'static Services {
     SERVICES
diff --git a/src/main.rs b/src/main.rs
index 3b9763c4..4af1162c 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -401,23 +401,23 @@ fn routes(config: &Config) -> Router {
         // Ruma doesn't have support for multiple paths for a single endpoint yet, and these routes
         // share one Ruma request / response type pair with {get,send}_state_event_for_key_route
         .route(
-            "/_matrix/client/r0/rooms/:room_id/state/:event_type",
+            "/_matrix/client/r0/rooms/{room_id}/state/{event_type}",
             get(client_server::get_state_events_for_empty_key_route)
                 .put(client_server::send_state_event_for_empty_key_route),
         )
         .route(
-            "/_matrix/client/v3/rooms/:room_id/state/:event_type",
+            "/_matrix/client/v3/rooms/{room_id}/state/{event_type}",
             get(client_server::get_state_events_for_empty_key_route)
                 .put(client_server::send_state_event_for_empty_key_route),
         )
         // These two endpoints allow trailing slashes
         .route(
-            "/_matrix/client/r0/rooms/:room_id/state/:event_type/",
+            "/_matrix/client/r0/rooms/{room_id}/state/{event_type}/",
             get(client_server::get_state_events_for_empty_key_route)
                 .put(client_server::send_state_event_for_empty_key_route),
         )
         .route(
-            "/_matrix/client/v3/rooms/:room_id/state/:event_type/",
+            "/_matrix/client/v3/rooms/{room_id}/state/{event_type}/",
             get(client_server::get_state_events_for_empty_key_route)
                 .put(client_server::send_state_event_for_empty_key_route),
         )
@@ -459,11 +459,11 @@ fn routes(config: &Config) -> Router {
         .ruma_route(client_server::get_hierarchy_route)
         .ruma_route(client_server::well_known_client)
         .route(
-            "/_matrix/client/r0/rooms/:room_id/initialSync",
+            "/_matrix/client/r0/rooms/{room_id}/initialSync",
             get(initial_sync),
         )
         .route(
-            "/_matrix/client/v3/rooms/:room_id/initialSync",
+            "/_matrix/client/v3/rooms/{room_id}/initialSync",
             get(initial_sync),
         )
         .route("/", get(it_works))
@@ -477,7 +477,7 @@ fn routes(config: &Config) -> Router {
                 get(server_server::get_server_keys_route),
             )
             .route(
-                "/_matrix/key/v2/server/:key_id",
+                "/_matrix/key/v2/server/{key_id}",
                 get(server_server::get_server_keys_deprecated_route),
             )
             .ruma_route(server_server::get_public_rooms_route)
@@ -509,8 +509,8 @@ fn routes(config: &Config) -> Router {
             .ruma_route(server_server::well_known_server)
     } else {
         router
-            .route("/_matrix/federation/*path", any(federation_disabled))
-            .route("/_matrix/key/*path", any(federation_disabled))
+            .route("/_matrix/federation/{*path}", any(federation_disabled))
+            .route("/_matrix/key/{*path}", any(federation_disabled))
             .route("/.well-known/matrix/server", any(federation_disabled))
     }
 }
@@ -595,12 +595,11 @@ pub trait RumaHandler<T> {
 
 macro_rules! impl_ruma_handler {
     ( $($ty:ident),* $(,)? ) => {
-        #[axum::async_trait]
         #[allow(non_snake_case)]
         impl<Req, E, F, Fut, $($ty,)*> RumaHandler<($($ty,)* Ruma<Req>,)> for F
         where
             Req: IncomingRequest + Send + 'static,
-            F: FnOnce($($ty,)* Ruma<Req>) -> Fut + Clone + Send + 'static,
+            F: FnOnce($($ty,)* Ruma<Req>) -> Fut + Clone + Send + Sync + 'static,
             Fut: Future<Output = Result<Req::OutgoingResponse, E>>
                 + Send,
             E: IntoResponse,
diff --git a/src/service/pdu.rs b/src/service/pdu.rs
index d6b309c4..441a187f 100644
--- a/src/service/pdu.rs
+++ b/src/service/pdu.rs
@@ -408,6 +408,13 @@ impl state_res::Event for PduEvent {
     fn redacts(&self) -> Option<&Self::Id> {
         self.redacts.as_ref()
     }
+
+    // We currently don't store rejected events (see steps 6-8 of `handle_incoming_pdu`), even
+    // though we should according to the spec:
+    // https://spec.matrix.org/v1.14/rooms/v11/#rejected-events
+    fn rejected(&self) -> bool {
+        false
+    }
 }
 
 // These impl's allow us to dedup state snapshots when resolving state
diff --git a/src/service/pusher/mod.rs b/src/service/pusher/mod.rs
index dede74b0..89e3f518 100644
--- a/src/service/pusher/mod.rs
+++ b/src/service/pusher/mod.rs
@@ -2,7 +2,7 @@ mod data;
 pub use data::Data;
 use ruma::{events::AnySyncTimelineEvent, push::PushConditionPowerLevelsCtx};
 
-use crate::{services, Error, PduEvent, Result, MATRIX_VERSIONS};
+use crate::{services, Error, PduEvent, Result, SUPPORTED_VERSIONS};
 use bytes::BytesMut;
 use ruma::{
     api::{
@@ -58,7 +58,7 @@ impl Service {
             .try_into_http_request::<BytesMut>(
                 &destination,
                 SendAccessToken::IfRequired(""),
-                MATRIX_VERSIONS,
+                &SUPPORTED_VERSIONS,
             )
             .map_err(|e| {
                 warn!("Failed to find destination {}: {}", destination, e);
diff --git a/src/service/rooms/event_handler/mod.rs b/src/service/rooms/event_handler/mod.rs
index 200e9c2b..f61f59a2 100644
--- a/src/service/rooms/event_handler/mod.rs
+++ b/src/service/rooms/event_handler/mod.rs
@@ -51,25 +51,26 @@ impl Service {
     /// 0. Check the server is in the room
     /// 1. Skip the PDU if we already know about it
     /// 1.1. Remove unsigned field
-    /// 2. Check signatures, otherwise drop
-    /// 3. Check content hash, redact if doesn't match
-    /// 4. Fetch any missing auth events doing all checks listed here starting at 1. These are not
+    /// 2. Check event is valid, otherwise drop
+    /// 3. Check signatures, otherwise drop
+    /// 4. Check content hash, redact if doesn't match
+    /// 5. Fetch any missing auth events doing all checks listed here starting at 1. These are not
     ///    timeline events
-    /// 5. Reject "due to auth events" if can't get all the auth events or some of the auth events are
+    /// 6. Reject "due to auth events" if can't get all the auth events or some of the auth events are
     ///    also rejected "due to auth events"
-    /// 6. Reject "due to auth events" if the event doesn't pass auth based on the auth events
-    /// 7. Persist this event as an outlier
-    /// 8. If not timeline event: stop
-    /// 9. Fetch any missing prev events doing all checks listed here starting at 1. These are timeline
+    /// 7. Reject "due to auth events" if the event doesn't pass auth based on the auth events
+    /// 8. Persist this event as an outlier
+    /// 9. If not timeline event: stop
+    /// 10. Fetch any missing prev events doing all checks listed here starting at 1. These are timeline
     ///    events
-    /// 10. Fetch missing state and auth chain events by calling /state_ids at backwards extremities
+    /// 11. Fetch missing state and auth chain events by calling /state_ids at backwards extremities
     ///     doing all the checks in this list starting at 1. These are not timeline events
-    /// 11. Check the auth of the event passes based on the state of the event
-    /// 12. Ensure that the state is derived from the previous current state (i.e. we calculated by
+    /// 12. Check the auth of the event passes based on the state of the event
+    /// 13. Ensure that the state is derived from the previous current state (i.e. we calculated by
     ///     doing state res where one of the inputs was a previously trusted set of state, don't just
     ///     trust a set of state we got from a remote)
-    /// 13. Use state resolution to find new room state
-    /// 14. Check if the event passes auth based on the "current state" of the room, if not soft fail it
+    /// 14. Use state resolution to find new room state
+    /// 15. Check if the event passes auth based on the "current state" of the room, if not soft fail it
     // We use some AsyncRecursiveType hacks here so we can call this async function recursively
     #[tracing::instrument(skip(self, value, is_timeline_event, pub_key_map))]
     pub(crate) async fn handle_incoming_pdu<'a>(
@@ -135,7 +136,7 @@ impl Service {
             .await?;
         self.check_room_id(room_id, &incoming_pdu)?;
 
-        // 8. if not timeline event: stop
+        // 9. if not timeline event: stop
         if !is_timeline_event {
             return Ok(None);
         }
@@ -145,7 +146,7 @@ impl Service {
             return Ok(None);
         }
 
-        // 9. Fetch any missing prev events doing all checks listed here starting at 1. These are timeline events
+        // 10. Fetch any missing prev events doing all checks listed here starting at 1. These are timeline events
         let (sorted_prev_events, mut eventid_info) = self
             .fetch_unknown_prev_events(
                 origin,
@@ -313,8 +314,9 @@ impl Service {
             // 1.1. Remove unsigned field
             value.remove("unsigned");
 
-            // 2. Check signatures, otherwise drop
-            // 3. check content hash, redact if doesn't match
+            // 2. Check event is valid, otherwise drop
+            // 3. Check signatures, otherwise drop
+            // 4. check content hash, redact if doesn't match
             let create_event_content: RoomCreateEventContent =
                 serde_json::from_str(create_event.content.get()).map_err(|e| {
                     error!("Invalid create event: {}", e);
@@ -326,6 +328,15 @@ impl Service {
                 .rules()
                 .expect("Supported room version has rules");
 
+            debug!("Checking format of join event PDU");
+            if let Err(e) = state_res::check_pdu_format(&value, &room_version_rules.event_format) {
+                warn!("Invalid PDU with event ID {event_id} received: {e}");
+                return Err(Error::BadRequest(
+                    ErrorKind::InvalidParam,
+                    "Received Invalid PDU",
+                ));
+            }
+
             // TODO: For RoomVersion6 we must check that Raw<..> is canonical do we anywhere?: https://matrix.org/docs/spec/rooms/v6#canonical-json
 
             // We go through all the signatures we see on the value and fetch the corresponding signing
@@ -421,8 +432,8 @@ impl Service {
             self.check_room_id(room_id, &incoming_pdu)?;
 
             if !auth_events_known {
-                // 4. fetch any missing auth events doing all checks listed here starting at 1. These are not timeline events
-                // 5. Reject "due to auth events" if can't get all the auth events or some of the auth events are also rejected "due to auth events"
+                // 5. fetch any missing auth events doing all checks listed here starting at 1. These are not timeline events
+                // 6. Reject "due to auth events" if can't get all the auth events or some of the auth events are also rejected "due to auth events"
                 // NOTE: Step 5 is not applied anymore because it failed too often
                 debug!(event_id = ?incoming_pdu.event_id, "Fetching auth events");
                 self.fetch_and_handle_outliers(
@@ -440,7 +451,7 @@ impl Service {
                 .await;
             }
 
-            // 6. Reject "due to auth events" if the event doesn't pass auth based on the auth events
+            // 7. Reject "due to auth events" if the event doesn't pass auth based on the auth events
             debug!(
                 "Auth check for {} based on auth events",
                 incoming_pdu.event_id
@@ -448,6 +459,7 @@ impl Service {
 
             // Build map of auth events
             let mut auth_events = HashMap::new();
+            let mut auth_events_by_event_id = HashMap::new();
             for id in &incoming_pdu.auth_events {
                 let auth_event = match services().rooms.timeline.get_pdu(id)? {
                     Some(e) => e,
@@ -457,46 +469,33 @@ impl Service {
                     }
                 };
 
-                self.check_room_id(room_id, &auth_event)?;
-
-                match auth_events.entry((
-                    auth_event.kind.to_string().into(),
-                    auth_event
-                        .state_key
-                        .clone()
-                        .expect("all auth events have state keys"),
-                )) {
-                    hash_map::Entry::Vacant(v) => {
-                        v.insert(auth_event);
-                    }
-                    hash_map::Entry::Occupied(_) => {
-                        return Err(Error::BadRequest(
-                            ErrorKind::InvalidParam,
-                            "Auth event's type and state_key combination exists multiple times.",
-                        ));
-                    }
-                }
+                auth_events_by_event_id.insert(auth_event.event_id.clone(), auth_event.clone());
+                auth_events.insert(
+                    (
+                        StateEventType::from(auth_event.kind.to_string()),
+                        auth_event
+                            .state_key
+                            .clone()
+                            .expect("all auth events have state keys"),
+                    ),
+                    auth_event,
+                );
             }
 
-            // The original create event must be in the auth events
-            if !matches!(
-                auth_events
-                    .get(&(StateEventType::RoomCreate, "".to_owned()))
-                    .map(|a| a.as_ref()),
-                Some(_) | None
-            ) {
-                return Err(Error::BadRequest(
-                    ErrorKind::InvalidParam,
-                    "Incoming event refers to wrong create event.",
-                ));
-            }
-
-            if state_res::event_auth::auth_check(
+            // first time we are doing any sort of auth check, so we check state-independent
+            // auth rules in addition to the state-dependent ones.
+            if state_res::check_state_independent_auth_rules(
                 &room_version_rules.authorization,
                 &incoming_pdu,
-                |k, s| auth_events.get(&(k.to_string().into(), s.to_owned())),
+                |event_id| auth_events_by_event_id.get(event_id),
             )
             .is_err()
+                || state_res::check_state_dependent_auth_rules(
+                    &room_version_rules.authorization,
+                    &incoming_pdu,
+                    |k, s| auth_events.get(&(k.to_string().into(), s.to_owned())),
+                )
+                .is_err()
             {
                 return Err(Error::BadRequest(
                     ErrorKind::InvalidParam,
@@ -506,7 +505,7 @@ impl Service {
 
             debug!("Validation successful.");
 
-            // 7. Persist the event as an outlier.
+            // 8. Persist the event as an outlier.
             services()
                 .rooms
                 .outlier
@@ -557,7 +556,7 @@ impl Service {
             .rules()
             .expect("Supported room version has rules");
 
-        // 10. Fetch missing state and auth chain events by calling /state_ids at backwards extremities
+        // 11. Fetch missing state and auth chain events by calling /state_ids at backwards extremities
         //     doing all the checks in this list starting at 1. These are not timeline events.
 
         // TODO: if we know the prev_events of the incoming event we can avoid the request and build
@@ -807,8 +806,8 @@ impl Service {
             state_at_incoming_event.expect("we always set this to some above");
 
         debug!("Starting auth check");
-        // 11. Check the auth of the event passes based on the state of the event
-        if state_res::event_auth::auth_check(
+        // 12. Check the auth of the event passes based on the state of the event
+        if state_res::check_state_dependent_auth_rules(
             &room_version_rules.authorization,
             &incoming_pdu,
             |k, s| {
@@ -840,7 +839,7 @@ impl Service {
             &room_version_rules.authorization,
         )?;
 
-        let soft_fail = state_res::event_auth::auth_check(
+        let soft_fail = state_res::check_state_dependent_auth_rules(
             &room_version_rules.authorization,
             &incoming_pdu,
             |k, s| auth_events.get(&(k.clone(), s.to_owned())),
@@ -891,7 +890,7 @@ impl Service {
                     }
                 };
 
-        // 13. Use state resolution to find new room state
+        // 14. Use state resolution to find new room state
 
         // We start looking at current room state now, so lets lock the room
         let mutex_state = Arc::clone(
@@ -974,7 +973,7 @@ impl Service {
                 .await?;
         }
 
-        // 14. Check if the event passes auth based on the "current state" of the room, if not soft fail it
+        // 15. Check if the event passes auth based on the "current state" of the room, if not soft fail it
         debug!("Starting soft fail auth check");
 
         if soft_fail {
@@ -1399,7 +1398,7 @@ impl Service {
             }
         }
 
-        let sorted = state_res::lexicographical_topological_sort(&graph, |event_id| {
+        let sorted = state_res::reverse_topological_power_sort(&graph, |event_id| {
             // This return value is the key used for sorting events,
             // events are then sorted by power level, time,
             // and lexically by event_id.
diff --git a/src/service/rooms/helpers/mod.rs b/src/service/rooms/helpers/mod.rs
index 920c7f3a..a9d6c409 100644
--- a/src/service/rooms/helpers/mod.rs
+++ b/src/service/rooms/helpers/mod.rs
@@ -169,6 +169,18 @@ impl Service {
                 }
             }
 
+            let rules = room_version_id
+                .rules()
+                .expect("Supported room version has rules");
+
+            debug!("Checking format of join event PDU");
+            if let Err(e) = state_res::check_pdu_format(&join_event, &rules.event_format) {
+                warn!(
+                    "Invalid PDU with event ID {event_id} received from `/send_join` response: {e}"
+                );
+                return Err(Error::BadServerResponse("Received Invalid PDU"));
+            }
+
             services().rooms.short.get_or_create_shortroomid(room_id)?;
 
             info!("Parsing join event");
@@ -240,28 +252,32 @@ impl Service {
             }
 
             info!("Running send_join auth check");
-            if let Err(e) = state_res::event_auth::auth_check(
-                &room_version_id
-                    .rules()
-                    .expect("Supported room version has rules")
-                    .authorization,
+            if let Err(e) = state_res::check_state_independent_auth_rules(
+                &rules.authorization,
                 &parsed_join_pdu,
-                |k, s| {
-                    services()
-                        .rooms
-                        .timeline
-                        .get_pdu(
-                            state.get(
-                                &services()
-                                    .rooms
-                                    .short
-                                    .get_or_create_shortstatekey(&k.to_string().into(), s)
-                                    .ok()?,
-                            )?,
-                        )
-                        .ok()?
-                },
-            ) {
+                |event_id| services().rooms.timeline.get_pdu(event_id).ok().flatten(),
+            )
+            .and_then(|_| {
+                state_res::check_state_dependent_auth_rules(
+                    &rules.authorization,
+                    &parsed_join_pdu,
+                    |k, s| {
+                        services()
+                            .rooms
+                            .timeline
+                            .get_pdu(
+                                state.get(
+                                    &services()
+                                        .rooms
+                                        .short
+                                        .get_or_create_shortstatekey(&k.to_string().into(), s)
+                                        .ok()?,
+                                )?,
+                            )
+                            .ok()?
+                    },
+                )
+            }) {
                 warn!("Auth check failed: {e}");
                 return Err(Error::BadRequest(
                     ErrorKind::InvalidParam,
@@ -674,6 +690,15 @@ async fn validate_and_add_event_id(
         }
     }
 
+    let rules = &room_version
+        .rules()
+        .expect("Supported room version has rules");
+
+    if let Err(e) = state_res::check_pdu_format(&value, &rules.event_format) {
+        warn!("Invalid PDU with event ID {event_id} received from `/send_join` response: {e}");
+        return Err(Error::BadServerResponse("Received Invalid PDU"));
+    }
+
     let origin_server_ts = value.get("origin_server_ts").ok_or_else(|| {
         error!("Invalid PDU, no origin_server_ts field");
         Error::BadRequest(
@@ -702,13 +727,7 @@ async fn validate_and_add_event_id(
             .globals
             .filter_keys_server_map(unfiltered_keys, origin_server_ts, room_version);
 
-    if let Err(e) = ruma::signatures::verify_event(
-        &keys,
-        &value,
-        &room_version
-            .rules()
-            .expect("Supported room version has rules"),
-    ) {
+    if let Err(e) = ruma::signatures::verify_event(&keys, &value, rules) {
         warn!("Event {} failed verification {:?} {}", event_id, pdu, e);
         back_off(event_id).await;
         return Err(Error::BadServerResponse("Event failed verification."));
diff --git a/src/service/rooms/timeline/mod.rs b/src/service/rooms/timeline/mod.rs
index 32144f7d..85236c16 100644
--- a/src/service/rooms/timeline/mod.rs
+++ b/src/service/rooms/timeline/mod.rs
@@ -713,6 +713,10 @@ impl Service {
             &content,
             &room_version_rules.authorization,
         )?;
+        let mut auth_events_by_event_id = HashMap::new();
+        for event in auth_events.values() {
+            auth_events_by_event_id.insert(event.event_id.clone(), event.clone());
+        }
 
         // Our depth is the maximum depth of prev_events + 1
         let depth = prev_events
@@ -769,10 +773,18 @@ impl Service {
             signatures: None,
         };
 
-        if state_res::auth_check(&room_version_rules.authorization, &pdu, |k, s| {
-            auth_events.get(&(k.clone(), s.to_owned()))
-        })
+        if state_res::check_state_independent_auth_rules(
+            &room_version_rules.authorization,
+            &pdu,
+            |event_id| auth_events_by_event_id.get(event_id),
+        )
         .is_err()
+            || state_res::check_state_dependent_auth_rules(
+                &room_version_rules.authorization,
+                &pdu,
+                |k, s| auth_events.get(&(k.clone(), s.to_owned())),
+            )
+            .is_err()
         {
             return Err(Error::BadRequest(
                 ErrorKind::forbidden(),
@@ -814,6 +826,14 @@ impl Service {
             }
         }
 
+        if let Err(e) = state_res::check_pdu_format(&pdu_json, &room_version_rules.event_format) {
+            warn!("locally constructed event is not a valid PDU: {e}");
+            return Err(Error::BadRequest(
+                ErrorKind::InvalidParam,
+                "Event is invalid",
+            ));
+        }
+
         // Generate event id
         pdu.event_id = EventId::parse_arc(format!(
             "${}",