diff --git a/Cargo.lock b/Cargo.lock
index ae11295ac..9cf1a7261 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1400,9 +1400,9 @@ checksum = "45e700c2d1c3feea9b695e79b2dfeeb93040556a58c556fae23f71b1e6b449fd"
 
 [[package]]
 name = "cxx"
-version = "1.0.194"
+version = "1.0.195"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "747d8437319e3a2f43d93b341c137927ca70c0f5dabeea7a005a73665e247c7e"
+checksum = "201f2332bd98022973bbf50c87f2d2f8151200f43e640da370901b20f1bea9d3"
 dependencies = [
  "cc",
  "cxx-build",
@@ -1415,9 +1415,9 @@ dependencies = [
 
 [[package]]
 name = "cxx-build"
-version = "1.0.194"
+version = "1.0.195"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0f4697d190a142477b16aef7da8a99bfdc41e7e8b1687583c0d23a79c7afc1e"
+checksum = "02da7762e3807681f61c4561f34e1ff791417334294b225dbe22236459c9deef"
 dependencies = [
  "cc",
  "codespan-reporting",
@@ -1430,9 +1430,9 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.194"
+version = "1.0.195"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0956799fa8678d4c50eed028f2de1c0552ae183c76e976cf7ca8c4e36a7c328"
+checksum = "21c216b8cd7c26c2798bbecdb13de2f8dc65239b9ed892756deacff10fc0fa64"
 dependencies = [
  "clap 4.6.1",
  "codespan-reporting",
@@ -1444,15 +1444,15 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.194"
+version = "1.0.195"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23384a836ab4f0ad98ace7e3955ad2de39de42378ab487dc28d3990392cb283a"
+checksum = "61c618f09812e388d1d065fd43fdc4340fade506ab2e0903397bf238650fce45"
 
 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.194"
+version = "1.0.195"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6acc6b5822b9526adfb4fc377b67128fdd60aac757cc4a741a6278603f763cf"
+checksum = "415b113deba00cc605302b9b0b4974ab3d57c41135d81737cd47b89dbaa17c38"
 dependencies = [
  "indexmap 2.14.0",
  "proc-macro2",
diff --git a/go/pecos/go.mod b/go/pecos/go.mod
index 5e83b19bb..88b2d2a5b 100644
--- a/go/pecos/go.mod
+++ b/go/pecos/go.mod
@@ -1,3 +1,3 @@
 module github.com/PECOS-packages/PECOS/go/pecos
 
-go 1.26.4
+go 1.26.5
diff --git a/osv-scanner.toml b/osv-scanner.toml
index 2b7b40a28..7801ed9f0 100644
--- a/osv-scanner.toml
+++ b/osv-scanner.toml
@@ -114,3 +114,21 @@ reason = "Transitive via rustpython-parser in the experimental zlup frontend; un
 id = "RUSTSEC-2025-0100"
 # unic-ucd-ident@0.9.0 -- unmaintained. Same chain/owner as RUSTSEC-2025-0075.
 reason = "Transitive via rustpython-parser in the experimental zlup frontend; unmaintained-crate warning, parser-internal Unicode tables, no exploit path."
+
+[[IgnoredVulns]]
+id = "RUSTSEC-2026-0196"
+# cgmath@0.18.0 -- unmaintained; 0.18.0 is the latest release (no fix exists).
+# Chains: cgmath -> hugr-core -> hugr -> tket -> pecos-hugr, and
+#         cgmath -> tket (dev-dependency) -> pecos-hugr.
+# Upstream owners: https://github.com/CQCL/hugr and https://github.com/CQCL/tket2
+# (awaiting a maintained geometry dep).
+reason = "Transitive via hugr-core and tket; unmaintained-crate warning, no exploit path in PECOS."
+
+[[IgnoredVulns]]
+id = "RUSTSEC-2026-0197"
+# cgmath@0.18.0 -- unsound Matrix{2,3,4}::swap_columns(a, a): identical indices
+# create aliasing mutable refs passed to ptr::swap -> UB. No patched release.
+# Chains: cgmath -> hugr-core -> hugr -> tket -> pecos-hugr, and
+#         cgmath -> tket (dev-dependency) -> pecos-hugr.
+# Upstream owners: https://github.com/CQCL/hugr and https://github.com/CQCL/tket2.
+reason = "Transitive via hugr-core and tket; no swap_columns call exists in PECOS or in the pinned hugr-core 0.27.1/tket 0.19.0 sources, and no fixed cgmath release exists. Re-check on hugr/tket bumps."