diff --git a/.project-settings.env b/.project-settings.env
index 67a4dbc..815e523 100644
--- a/.project-settings.env
+++ b/.project-settings.env
@@ -1,5 +1,5 @@
 GOLANGCI_LINT_VERSION=v2.12.2
-BUF_VERSION=v1.69.0
+BUF_VERSION=v1.70.0
 GO_VERSION=1.26.4
 GCI_PREFIX=github.com/hyp3rd/hypercache
 PROTO_ENABLED=false
diff --git a/Makefile b/Makefile
index 99a3cec..fd91d4a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 include .project-settings.env
 
 GOLANGCI_LINT_VERSION ?= v2.12.2
-BUF_VERSION ?= v1.69.0
+BUF_VERSION ?= v1.70.0
 GO_VERSION ?= 1.26.4
 GCI_PREFIX ?= github.com/hyp3rd/hypercache
 PROTO_ENABLED ?= true
diff --git a/cmd/hypercache-server/mtls_test.go b/cmd/hypercache-server/mtls_test.go
index a32dda0..497f518 100644
--- a/cmd/hypercache-server/mtls_test.go
+++ b/cmd/hypercache-server/mtls_test.go
@@ -14,6 +14,8 @@ import (
 	"path/filepath"
 	"testing"
 	"time"
+
+	"github.com/stretchr/testify/assert"
 )
 
 // writeTestCertPair generates a self-signed cert + key and writes
@@ -121,9 +123,7 @@ func assertStandardTLSConfig(t *testing.T, cfg envConfig) {
 		t.Fatalf("err = %v", err)
 	}
 
-	if got == nil {
-		t.Fatalf("got nil, want *tls.Config")
-	}
+	assert.NotNil(t, got, "got nil, want *tls.Config")
 
 	if got.ClientAuth != tls.NoClientCert {
 		t.Errorf("ClientAuth = %v, want NoClientCert (no CA was configured)", got.ClientAuth)
diff --git a/cspell.config.yaml b/cspell.config.yaml
index 7cf76d8..be4e476 100644
--- a/cspell.config.yaml
+++ b/cspell.config.yaml
@@ -203,6 +203,7 @@ words:
   - neighbouring
   - nestif
   - Newf
+  - Nilf
   - nilnil
   - nindent
   - noctx
diff --git a/go.mod b/go.mod
index eb8b845..9085b05 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/goccy/go-json v0.10.6
 	github.com/gofiber/fiber/v3 v3.3.0
 	github.com/hyp3rd/ewrap v1.5.1
-	github.com/hyp3rd/sectools v1.2.6
+	github.com/hyp3rd/sectools v1.2.7
 	github.com/redis/go-redis/v9 v9.20.0
 	github.com/stretchr/testify v1.11.1
 	github.com/ugorji/go/codec v1.3.1
@@ -18,9 +18,9 @@ require (
 	go.opentelemetry.io/otel/sdk v1.44.0
 	go.opentelemetry.io/otel/sdk/metric v1.44.0
 	go.opentelemetry.io/otel/trace v1.44.0
-	golang.org/x/crypto v0.52.0
+	golang.org/x/crypto v0.53.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.20.0
+	golang.org/x/sync v0.21.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -29,7 +29,7 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/gofiber/schema v1.7.2 // indirect
+	github.com/gofiber/schema v1.8.0 // indirect
 	github.com/gofiber/utils/v2 v2.1.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/klauspost/compress v1.18.6 // indirect
@@ -43,6 +43,6 @@ require (
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 030aff4..3673efe 100644
--- a/go.sum
+++ b/go.sum
@@ -23,8 +23,8 @@ github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU=
 github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/gofiber/fiber/v3 v3.3.0 h1:QBd3sYCqdy6Qs5gJYzSw4I4SbqL204jPqpdub/ueiw8=
 github.com/gofiber/fiber/v3 v3.3.0/go.mod h1:YH7/TAoRaU4kF8slDCtQuFJ1NzC+3MtxUI4KfvQtaIA=
-github.com/gofiber/schema v1.7.2 h1:/0+siRIDYfMTh/edbdSNDXYZESBAFAu0CjKDUjo3g9Q=
-github.com/gofiber/schema v1.7.2/go.mod h1:lmbXPQ8hvzXSLkdS2DS7pb4kpunC2Roh7Sj3HMjGfzA=
+github.com/gofiber/schema v1.8.0 h1:NGsC9toPHmj8Xg4KpznuXBzNmHG6V5YV0tXKpKMcmis=
+github.com/gofiber/schema v1.8.0/go.mod h1:lmbXPQ8hvzXSLkdS2DS7pb4kpunC2Roh7Sj3HMjGfzA=
 github.com/gofiber/utils/v2 v2.1.0 h1:WSu4COJhJw9moNfJu2nQvaM9AFvAQ/nZbigjhHqKgOQ=
 github.com/gofiber/utils/v2 v2.1.0/go.mod h1:DdOgEVwQTi8cou/AKWPqhXOR4fHGRVhA/rEWL3IXG7Q=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
@@ -33,8 +33,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/hyp3rd/ewrap v1.5.1 h1:rnLaig+rnpBYkL7vQsvLUJGQpCLa/Yl5RRAnWjphJPs=
 github.com/hyp3rd/ewrap v1.5.1/go.mod h1:Pbote45XDYyodYzdcUH7xnWmnI6SSewbOYtTlRSsfvw=
-github.com/hyp3rd/sectools v1.2.6 h1:WCrBOazUmZUSHHw34zxK41m5arK+GJ4P9nX/ZFzUc6U=
-github.com/hyp3rd/sectools v1.2.6/go.mod h1:qCk5b23hquPRpe/Bi8/Kavh63nFzQ6ad8GSYW1t2h4g=
+github.com/hyp3rd/sectools v1.2.7 h1:gQRtEGm1YLOhJq2z58gTa8pUX/lIt3a6hQPYw2r97Ak=
+github.com/hyp3rd/sectools v1.2.7/go.mod h1:n4NvttH652ijiMgHz24HGObvOsK+KXND2Mv4X31ObJs=
 github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
 github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
@@ -91,18 +91,18 @@ go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
 golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/pkg/stats/histogramcollector_test.go b/pkg/stats/histogramcollector_test.go
index a12bc59..9372d27 100644
--- a/pkg/stats/histogramcollector_test.go
+++ b/pkg/stats/histogramcollector_test.go
@@ -6,6 +6,8 @@ import (
 	"sync/atomic"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+
 	"github.com/hyp3rd/hypercache/internal/constants"
 )
 
@@ -156,9 +158,8 @@ func TestHistogramStatsCollector_BoundedSamples(t *testing.T) {
 	}
 
 	stat := c.GetStats()[constants.StatHistogram.String()]
-	if stat == nil {
-		t.Fatalf("missing stat")
-	}
+
+	assert.NotNil(t, stat, "missing stat")
 
 	if stat.Count != 100 {
 		t.Errorf("lifetime Count = %d, want 100", stat.Count)
@@ -224,9 +225,8 @@ func TestHistogramStatsCollector_ConcurrentRecord(t *testing.T) {
 	readerWG.Wait()
 
 	stat := c.GetStats()[constants.StatIncr.String()]
-	if stat == nil {
-		t.Fatalf("missing stat after concurrent recording")
-	}
+
+	assert.NotNil(t, stat, "missing stat after concurrent recording")
 
 	wantCount := int64(writers * perWriter)
 	if int64(stat.Count) != wantCount {
@@ -351,9 +351,8 @@ func TestHistogramStatsCollector_AtomicMinMaxRace(t *testing.T) {
 	wg.Wait()
 
 	stat := c.GetStats()[constants.StatIncr.String()]
-	if stat == nil {
-		t.Fatalf("missing stat")
-	}
+
+	assert.NotNil(t, stat, "missing stat")
 
 	if stat.Min != 0 {
 		t.Errorf("Min = %d, want 0", stat.Min)
diff --git a/tests/dist_logging_test.go b/tests/dist_logging_test.go
index e30e135..a7bd881 100644
--- a/tests/dist_logging_test.go
+++ b/tests/dist_logging_test.go
@@ -6,6 +6,8 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+
 	"github.com/hyp3rd/hypercache/pkg/backend"
 )
 
@@ -135,9 +137,7 @@ func TestDistMemory_LoggerEmitsListenerStart(t *testing.T) {
 		}
 	}
 
-	if startRec == nil {
-		t.Fatalf("expected `dist HTTP listener started` record; got %d records", len(records))
-	}
+	assert.NotNilf(t, startRec, "expected `dist HTTP listener started` record; got %d records", len(records))
 
 	if startRec.Level != slog.LevelInfo {
 		t.Fatalf("expected Info level, got %v", startRec.Level)
diff --git a/tests/merkle_single_missing_key_test.go b/tests/merkle_single_missing_key_test.go
index 2ddcf74..91bd408 100644
--- a/tests/merkle_single_missing_key_test.go
+++ b/tests/merkle_single_missing_key_test.go
@@ -5,6 +5,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/assert"
+
 	"github.com/hyp3rd/hypercache/pkg/backend"
 	cache "github.com/hyp3rd/hypercache/pkg/cache/v2"
 )
@@ -57,9 +59,8 @@ func TestMerkleSingleMissingKey(t *testing.T) {
 	}
 
 	got, _ := db.Get(ctx, "k1")
-	if got == nil {
-		t.Fatalf("expected key pulled")
-	}
+
+	assert.NotNil(t, got, "expected key pulled")
 
 	if bs, ok := got.Value.([]byte); !ok || string(bs) != "v1" {
 		t.Fatalf("unexpected value %v", got.Value)
diff --git a/tests/merkle_sync_test.go b/tests/merkle_sync_test.go
index 9792911..f959ee2 100644
--- a/tests/merkle_sync_test.go
+++ b/tests/merkle_sync_test.go
@@ -5,6 +5,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/assert"
+
 	"github.com/hyp3rd/hypercache/pkg/backend"
 	cache "github.com/hyp3rd/hypercache/pkg/cache/v2"
 )
@@ -42,9 +44,9 @@ func TestMerkleSyncConvergence(t *testing.T) {
 		itA, _ := dmA.Get(ctx, k)
 
 		itB, _ := dmB.Get(ctx, k)
-		if itA == nil || itB == nil {
-			t.Fatalf("missing key %s after sync", k)
-		}
+
+		assert.NotNil(t, itA, "missing key %s after sync", k)
+		assert.NotNil(t, itB, "missing key %s after sync", k)
 
 		if itB.Version < itA.Version {
 			t.Fatalf("expected B version >= A version for %s", k)