diff --git a/Cargo.lock b/Cargo.lock
index 3de0016d..f9a9ee82 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7494,9 +7494,9 @@ dependencies = [
 
 [[package]]
 name = "toon-format"
-version = "0.4.5"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5933bebbba70ee979314a8ecb021f53075a63984f94f89a10b4bdcf0af6c62b6"
+checksum = "8f89570c1a68d73941f728cca32a4345b2ffca36667ad921af336c60309a3e7e"
 dependencies = [
  "indexmap 2.13.0",
  "serde",
diff --git a/apps/core/Cargo.toml b/apps/core/Cargo.toml
index 911d4a00..64a8ac03 100644
--- a/apps/core/Cargo.toml
+++ b/apps/core/Cargo.toml
@@ -149,7 +149,7 @@ toml.workspace = true
 # syntect -> plist -> quick-xml. Core calls only `encode`/`decode` from the
 # library, so none of that is reachable — and quick-xml 0.38 carries
 # RUSTSEC-2026-0194/0195 with no upgrade path while syntect pins it.
-toon-format = { version = "0.4", optional = true, default-features = false }
+toon-format = { version = "0.5", optional = true, default-features = false }
 tower = { workspace = true, optional = true }
 tower-http = { workspace = true, optional = true }
 tracing.workspace = true