diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a1dada0..7641c67 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -173,7 +173,7 @@ jobs:
         # These three exact advisories affect APIs absent from Hydra's locked source closure.
         # RUSTSEC-2024-0429 is limited to glib::VariantStrIter methods. RUSTSEC-2026-0002 is
         # limited to lru::LruCache::iter_mut. RUSTSEC-2026-0253 is limited to LruCache::pop();
-        # locked glyphon 0.6 calls pop_lru(), not pop(), and its GlyphonCacheKey is Copy. This is
+        # locked glyphon 0.7 calls pop_lru(), not pop(), and its GlyphonCacheKey is Copy. This is
         # Hydra's locked-source reachability assessment, not an upstream guarantee. Remove an lru
         # exception when the locked graph uses a RustSec-declared fixed lru, or when glyphon moves
         # off the affected lru; either change requires renderer requalification. Keep every other
diff --git a/Cargo.lock b/Cargo.lock
index 91a3d8b..f0da9bd 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -340,30 +340,15 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
-[[package]]
-name = "bit-set"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0481a0e032742109b1133a095184ee93d88f3dc9e0d28a5d033dc77a073f44f"
-dependencies = [
- "bit-vec 0.7.0",
-]
-
 [[package]]
 name = "bit-set"
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
 dependencies = [
- "bit-vec 0.8.0",
+ "bit-vec",
 ]
 
-[[package]]
-name = "bit-vec"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2c54ff287cfc0a34f38a6b832ea1bd8e448a330b3e40a50859e6488bee07f22"
-
 [[package]]
 name = "bit-vec"
 version = "0.8.0"
@@ -576,37 +561,6 @@ dependencies = [
  "unicode-width 0.1.14",
 ]
 
-[[package]]
-name = "com"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e17887fd17353b65b1b2ef1c526c83e26cd72e74f598a8dc1bee13a48f3d9f6"
-dependencies = [
- "com_macros",
-]
-
-[[package]]
-name = "com_macros"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d375883580a668c7481ea6631fc1a8863e33cc335bf56bfad8d7e6d4b04b13a5"
-dependencies = [
- "com_macros_support",
- "proc-macro2",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "com_macros_support"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad899a1087a9296d5644792d7cb72b8e34c1bec8e7d4fbc002230169a6e8710c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "combine"
 version = "4.6.7"
@@ -830,17 +784,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"
 
-[[package]]
-name = "d3d12"
-version = "22.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdbd1f579714e3c809ebd822c81ef148b1ceaeb3d535352afc73fd0c4c6a0017"
-dependencies = [
- "bitflags 2.13.0",
- "libloading",
- "winapi",
-]
-
 [[package]]
 name = "deranged"
 version = "0.5.8"
@@ -975,7 +918,7 @@ version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "521e380c0c8afb8d9a1e83a1822ee03556fc3e3e7dbc1fd30be14e37f9cb3f89"
 dependencies = [
- "bit-set 0.8.0",
+ "bit-set",
  "cssparser",
  "foldhash 0.2.0",
  "html5ever",
@@ -1560,9 +1503,9 @@ dependencies = [
 
 [[package]]
 name = "glow"
-version = "0.13.1"
+version = "0.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd348e04c43b32574f2de31c8bb397d96c9fcfa1371bd4ca6d8bdc464ab121b1"
+checksum = "d51fa363f025f5c111e03f13eda21162faeacb6911fe8caa0c0349f9cf0c4483"
 dependencies = [
  "js-sys",
  "slotmap",
@@ -1581,9 +1524,9 @@ dependencies = [
 
 [[package]]
 name = "glyphon"
-version = "0.6.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b11b1afb04c1a1be055989042258499473d0a9447f16450b433aba10bc2a46e7"
+checksum = "36257cc8db90a3c90c500c283a0ca5a403da50fd2ae1db83bff06f7fecfbde7d"
 dependencies = [
  "cosmic-text",
  "etagere",
@@ -1624,15 +1567,14 @@ dependencies = [
 
 [[package]]
 name = "gpu-allocator"
-version = "0.26.0"
+version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdd4240fc91d3433d5e5b0fc5b67672d771850dc19bbee03c1381e19322803d7"
+checksum = "c151a2a5ef800297b4e79efa4f4bec035c5f51d5ae587287c9b952bdf734cacd"
 dependencies = [
  "log",
  "presser",
  "thiserror 1.0.69",
- "winapi",
- "windows 0.52.0",
+ "windows 0.58.0",
 ]
 
 [[package]]
@@ -1740,21 +1682,6 @@ dependencies = [
  "hashbrown 0.14.5",
 ]
 
-[[package]]
-name = "hassle-rs"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af2a7e73e1f34c48da31fb668a907f250794837e08faa144fd24f0b8b741e890"
-dependencies = [
- "bitflags 2.13.0",
- "com",
- "libc",
- "libloading",
- "thiserror 1.0.69",
- "widestring",
- "winapi",
-]
-
 [[package]]
 name = "heck"
 version = "0.4.1"
@@ -2381,12 +2308,12 @@ dependencies = [
 
 [[package]]
 name = "naga"
-version = "22.1.0"
+version = "23.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bd5a652b6faf21496f2cfd88fc49989c8db0825d1f6746b1a71a6ede24a63ad"
+checksum = "364f94bc34f61332abebe8cad6f6cd82a5b65cff22c828d05d0968911462ca4f"
 dependencies = [
  "arrayvec",
- "bit-set 0.6.0",
+ "bit-set",
  "bitflags 2.13.0",
  "cfg_aliases 0.1.1",
  "codespan-reporting",
@@ -3878,7 +3805,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
 dependencies = [
  "proc-macro2",
- "quote",
  "unicode-ident",
 ]
 
@@ -4736,8 +4662,8 @@ dependencies = [
  "webview2-com-sys",
  "windows 0.61.3",
  "windows-core 0.61.2",
- "windows-implement",
- "windows-interface",
+ "windows-implement 0.60.2",
+ "windows-interface 0.59.3",
 ]
 
 [[package]]
@@ -4764,9 +4690,9 @@ dependencies = [
 
 [[package]]
 name = "wgpu"
-version = "22.1.0"
+version = "23.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1d1c4ba43f80542cf63a0a6ed3134629ae73e8ab51e4b765a67f3aa062eb433"
+checksum = "80f70000db37c469ea9d67defdc13024ddf9a5f1b89cb2941b812ad7cde1735a"
 dependencies = [
  "arrayvec",
  "cfg_aliases 0.1.1",
@@ -4789,12 +4715,12 @@ dependencies = [
 
 [[package]]
 name = "wgpu-core"
-version = "22.1.0"
+version = "23.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0348c840d1051b8e86c3bcd31206080c5e71e5933dabd79be1ce732b0b2f089a"
+checksum = "d63c3c478de8e7e01786479919c8769f62a22eec16788d8c2ac77ce2c132778a"
 dependencies = [
  "arrayvec",
- "bit-vec 0.7.0",
+ "bit-vec",
  "bitflags 2.13.0",
  "cfg_aliases 0.1.1",
  "document-features",
@@ -4814,25 +4740,24 @@ dependencies = [
 
 [[package]]
 name = "wgpu-hal"
-version = "22.0.0"
+version = "23.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6bbf4b4de8b2a83c0401d9e5ae0080a2792055f25859a02bf9be97952bbed4f"
+checksum = "89364b8a0b211adc7b16aeaf1bd5ad4a919c1154b44c9ce27838213ba05fd821"
 dependencies = [
  "android_system_properties",
  "arrayvec",
  "ash",
- "bit-set 0.6.0",
+ "bit-set",
  "bitflags 2.13.0",
  "block",
+ "bytemuck",
  "cfg_aliases 0.1.1",
  "core-graphics-types 0.1.3",
- "d3d12",
  "glow",
  "glutin_wgl_sys",
  "gpu-alloc",
  "gpu-allocator",
  "gpu-descriptor",
- "hassle-rs",
  "js-sys",
  "khronos-egl",
  "libc",
@@ -4854,26 +4779,21 @@ dependencies = [
  "wasm-bindgen",
  "web-sys",
  "wgpu-types",
- "winapi",
+ "windows 0.58.0",
+ "windows-core 0.58.0",
 ]
 
 [[package]]
 name = "wgpu-types"
-version = "22.0.0"
+version = "23.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc9d91f0e2c4b51434dfa6db77846f2793149d8e73f800fa2e41f52b8eac3c5d"
+checksum = "610f6ff27778148c31093f3b03abc4840f9636d58d597ca2f5977433acfe0068"
 dependencies = [
  "bitflags 2.13.0",
  "js-sys",
  "web-sys",
 ]
 
-[[package]]
-name = "widestring"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
-
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -4907,11 +4827,11 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windows"
-version = "0.52.0"
+version = "0.58.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e48a53791691ab099e5e2ad123536d0fff50652600abaf43bbf952894110d0be"
+checksum = "dd04d41d93c4992d421894c18c8b43496aa748dd4c081bac0dc93eb0489272b6"
 dependencies = [
- "windows-core 0.52.0",
+ "windows-core 0.58.0",
  "windows-targets 0.52.6",
 ]
 
@@ -4939,10 +4859,14 @@ dependencies = [
 
 [[package]]
 name = "windows-core"
-version = "0.52.0"
+version = "0.58.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
+checksum = "6ba6d44ec8c2591c134257ce647b7ea6b20335bf6379a27dac5f1641fcf59f99"
 dependencies = [
+ "windows-implement 0.58.0",
+ "windows-interface 0.58.0",
+ "windows-result 0.2.0",
+ "windows-strings 0.1.0",
  "windows-targets 0.52.6",
 ]
 
@@ -4952,11 +4876,11 @@ version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
 dependencies = [
- "windows-implement",
- "windows-interface",
+ "windows-implement 0.60.2",
+ "windows-interface 0.59.3",
  "windows-link 0.1.3",
- "windows-result",
- "windows-strings",
+ "windows-result 0.3.4",
+ "windows-strings 0.4.2",
 ]
 
 [[package]]
@@ -4970,6 +4894,17 @@ dependencies = [
  "windows-threading",
 ]
 
+[[package]]
+name = "windows-implement"
+version = "0.58.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bbd5b46c938e506ecbce286b6628a02171d56153ba733b6c741fc627ec9579b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "windows-implement"
 version = "0.60.2"
@@ -4981,6 +4916,17 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "windows-interface"
+version = "0.58.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053c4c462dc91d3b1504c6fe5a726dd15e216ba718e84a0e46a88fbe5ded3515"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "windows-interface"
 version = "0.59.3"
@@ -5014,6 +4960,15 @@ dependencies = [
  "windows-link 0.1.3",
 ]
 
+[[package]]
+name = "windows-result"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d1043d8214f791817bab27572aaa8af63732e11bf84aa21a45a78d6c317ae0e"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.3.4"
@@ -5023,6 +4978,16 @@ dependencies = [
  "windows-link 0.1.3",
 ]
 
+[[package]]
+name = "windows-strings"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd9b125c486025df0eabcb585e62173c6c9eddcec5d117d3b6e8c30e2ee4d10"
+dependencies = [
+ "windows-result 0.2.0",
+ "windows-targets 0.52.6",
+]
+
 [[package]]
 name = "windows-strings"
 version = "0.4.2"
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
index 52df21d..0371a9d 100644
--- a/DEVELOPMENT.md
+++ b/DEVELOPMENT.md
@@ -163,7 +163,7 @@ rename them without a reviewed migration.
 CI fails on new Rust soundness advisories. Three exact advisories are reviewed exceptions in the
 locked Linux graphics stack. RUSTSEC-2024-0429 affects `glib::VariantStrIter` methods that Hydra
 does not call. RUSTSEC-2026-0002 affects `lru::LruCache::iter_mut`, which neither Hydra nor locked
-glyphon 0.6 calls. RUSTSEC-2026-0253 affects `lru::LruCache::pop()`; locked glyphon 0.6 calls
+glyphon 0.7 calls. RUSTSEC-2026-0253 affects `lru::LruCache::pop()`; locked glyphon 0.7 calls
 `pop_lru()` rather than `pop()`, and its `GlyphonCacheKey` is `Copy`. That reachability conclusion is
 Hydra's reading of the locked source, not an upstream guarantee.
 
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 9779290..77b0749 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -4,9 +4,9 @@ Hydra Local is Apache-2.0 licensed. It depends on third-party software under the
 listed below. This inventory is generated from the exact locked Rust and dashboard
 dependency graphs; it does not change or replace any upstream licence.
 
-- `Cargo.lock` SHA-256: `08b7b5a4d1704710329af2ec0c8b50e879da5926ad35c7d9b82915ee2a93cbb4`
-- `dashboard-ui/package-lock.json` SHA-256: `fcd145c1adb7ee07d0a75fed9a5431d917331d196adab83e227ec3419af5a6bf`
-- Rust dependency versions: 547
+- `Cargo.lock` SHA-256: `5c1a6a5750386110a42e7957f36cc4c094205c705780e3ca54c1f17c6aa65ed5`
+- `dashboard-ui/package-lock.json` SHA-256: `f797f86b630338688c0357e0aa9980300d403bb92b768e92dc6457d73a087073`
+- Rust dependency versions: 543
 - npm dependency versions: 197
 
 The source repository does not vendor these dependencies. Package managers retrieve each
@@ -66,9 +66,7 @@ obligation that applies to the exact dependency set they ship.
 | `atomic-waker` | `1.1.2` | `Apache-2.0 OR MIT` | [source](https://github.com/smol-rs/atomic-waker) |
 | `autocfg` | `1.5.1` | `Apache-2.0 OR MIT` | [source](https://github.com/cuviper/autocfg) |
 | `base64` | `0.22.1` | `MIT OR Apache-2.0` | [source](https://github.com/marshallpierce/rust-base64) |
-| `bit-set` | `0.6.0` | `MIT/Apache-2.0` | [source](https://github.com/contain-rs/bit-set) |
 | `bit-set` | `0.8.0` | `Apache-2.0 OR MIT` | [source](https://github.com/contain-rs/bit-set) |
-| `bit-vec` | `0.7.0` | `MIT/Apache-2.0` | [source](https://github.com/contain-rs/bit-vec) |
 | `bit-vec` | `0.8.0` | `Apache-2.0 OR MIT` | [source](https://github.com/contain-rs/bit-vec) |
 | `bitflags` | `1.3.2` | `MIT/Apache-2.0` | [source](https://github.com/bitflags/bitflags) |
 | `bitflags` | `2.13.0` | `MIT OR Apache-2.0` | [source](https://github.com/bitflags/bitflags) |
@@ -93,9 +91,6 @@ obligation that applies to the exact dependency set they ship.
 | `cfg_aliases` | `0.2.1` | `MIT` | [source](https://github.com/katharostech/cfg_aliases) |
 | `clipboard-win` | `5.4.1` | `BSL-1.0` | [source](https://github.com/DoumanAsh/clipboard-win) |
 | `codespan-reporting` | `0.11.1` | `Apache-2.0` | [source](https://github.com/brendanzab/codespan) |
-| `com` | `0.6.0` | `MIT` | [source](https://github.com/microsoft/com-rs) |
-| `com_macros` | `0.6.0` | `MIT` | [source](https://github.com/microsoft/com-rs) |
-| `com_macros_support` | `0.6.0` | `MIT` | [source](https://github.com/microsoft/com-rs) |
 | `combine` | `4.6.7` | `MIT` | [source](https://github.com/Marwes/combine) |
 | `compact_str` | `0.8.2` | `MIT` | [source](https://github.com/ParkMyCar/compact_str) |
 | `concurrent-queue` | `2.5.0` | `Apache-2.0 OR MIT` | [source](https://github.com/smol-rs/concurrent-queue) |
@@ -117,7 +112,6 @@ obligation that applies to the exact dependency set they ship.
 | `cssparser` | `0.36.0` | `MPL-2.0` | [source](https://github.com/servo/rust-cssparser) |
 | `cssparser-macros` | `0.6.1` | `MPL-2.0` | [source](https://github.com/servo/rust-cssparser) |
 | `cursor-icon` | `1.2.0` | `MIT OR Apache-2.0 OR Zlib` | [source](https://github.com/rust-windowing/cursor-icon) |
-| `d3d12` | `22.0.0` | `MIT OR Apache-2.0` | [source](https://github.com/gfx-rs/wgpu/tree/trunk/d3d12) |
 | `deranged` | `0.5.8` | `MIT OR Apache-2.0` | [source](https://github.com/jhpratt/deranged) |
 | `derive_more` | `2.1.1` | `MIT` | [source](https://github.com/JelteF/derive_more) |
 | `derive_more-impl` | `2.1.1` | `MIT` | [source](https://github.com/JelteF/derive_more) |
@@ -189,13 +183,13 @@ obligation that applies to the exact dependency set they ship.
 | `glib` | `0.18.5` | `MIT` | [source](https://github.com/gtk-rs/gtk-rs-core) |
 | `glib-macros` | `0.18.5` | `MIT` | [source](https://github.com/gtk-rs/gtk-rs-core) |
 | `glib-sys` | `0.18.1` | `MIT` | [source](https://github.com/gtk-rs/gtk-rs-core) |
-| `glow` | `0.13.1` | `MIT OR Apache-2.0 OR Zlib` | [source](https://github.com/grovesNL/glow) |
+| `glow` | `0.14.2` | `MIT OR Apache-2.0 OR Zlib` | [source](https://github.com/grovesNL/glow) |
 | `glutin_wgl_sys` | `0.6.1` | `Apache-2.0` | [source](https://github.com/rust-windowing/glutin) |
-| `glyphon` | `0.6.0` | `MIT OR Apache-2.0 OR Zlib` | [source](https://github.com/grovesNL/glyphon) |
+| `glyphon` | `0.7.0` | `MIT OR Apache-2.0 OR Zlib` | [source](https://github.com/grovesNL/glyphon) |
 | `gobject-sys` | `0.18.0` | `MIT` | [source](https://github.com/gtk-rs/gtk-rs-core) |
 | `gpu-alloc` | `0.6.0` | `MIT OR Apache-2.0` | [source](https://github.com/zakarumych/gpu-alloc) |
 | `gpu-alloc-types` | `0.3.0` | `MIT OR Apache-2.0` | [source](https://github.com/zakarumych/gpu-alloc) |
-| `gpu-allocator` | `0.26.0` | `MIT OR Apache-2.0` | [source](https://github.com/Traverse-Research/gpu-allocator) |
+| `gpu-allocator` | `0.27.0` | `MIT OR Apache-2.0` | [source](https://github.com/Traverse-Research/gpu-allocator) |
 | `gpu-descriptor` | `0.3.2` | `MIT OR Apache-2.0` | [source](https://github.com/zakarumych/gpu-descriptor) |
 | `gpu-descriptor-types` | `0.2.0` | `MIT OR Apache-2.0` | [source](https://github.com/zakarumych/gpu-descriptor) |
 | `gtk` | `0.18.2` | `MIT` | [source](https://github.com/gtk-rs/gtk3-rs) |
@@ -205,7 +199,6 @@ obligation that applies to the exact dependency set they ship.
 | `hashbrown` | `0.15.5` | `MIT OR Apache-2.0` | [source](https://github.com/rust-lang/hashbrown) |
 | `hashbrown` | `0.17.1` | `MIT OR Apache-2.0` | [source](https://github.com/rust-lang/hashbrown) |
 | `hashlink` | `0.9.1` | `MIT OR Apache-2.0` | [source](https://github.com/kyren/hashlink) |
-| `hassle-rs` | `0.11.0` | `MIT` | [source](https://github.com/Traverse-Research/hassle-rs) |
 | `heck` | `0.4.1` | `MIT OR Apache-2.0` | [source](https://github.com/withoutboats/heck) |
 | `heck` | `0.5.0` | `MIT OR Apache-2.0` | [source](https://github.com/withoutboats/heck) |
 | `hermit-abi` | `0.5.2` | `MIT OR Apache-2.0` | [source](https://github.com/hermit-os/hermit-rs) |
@@ -263,7 +256,7 @@ obligation that applies to the exact dependency set they ship.
 | `metal` | `0.29.0` | `MIT OR Apache-2.0` | [source](https://github.com/gfx-rs/metal-rs) |
 | `mio` | `1.2.1` | `MIT` | [source](https://github.com/tokio-rs/mio) |
 | `miow` | `0.6.1` | `MIT OR Apache-2.0` | [source](https://github.com/yoshuawuyts/miow) |
-| `naga` | `22.1.0` | `MIT OR Apache-2.0` | [source](https://github.com/gfx-rs/wgpu/tree/trunk/naga) |
+| `naga` | `23.1.0` | `MIT OR Apache-2.0` | [source](https://github.com/gfx-rs/wgpu/tree/trunk/naga) |
 | `ndk` | `0.9.0` | `MIT OR Apache-2.0` | [source](https://github.com/rust-mobile/ndk) |
 | `ndk-context` | `0.1.1` | `MIT OR Apache-2.0` | [source](https://github.com/rust-windowing/android-ndk-rs) |
 | `ndk-sys` | `0.5.0+25.2.9519653` | `MIT OR Apache-2.0` | [source](https://github.com/rust-mobile/ndk) |
@@ -501,27 +494,30 @@ obligation that applies to the exact dependency set they ship.
 | `webview2-com` | `0.38.2` | `MIT` | [source](https://github.com/wravery/webview2-rs) |
 | `webview2-com-macros` | `0.8.1` | `MIT` | [source](https://github.com/wravery/webview2-rs) |
 | `webview2-com-sys` | `0.38.2` | `MIT` | [source](https://github.com/wravery/webview2-rs) |
-| `wgpu` | `22.1.0` | `MIT OR Apache-2.0` | [source](https://github.com/gfx-rs/wgpu) |
-| `wgpu-core` | `22.1.0` | `MIT OR Apache-2.0` | [source](https://github.com/gfx-rs/wgpu) |
-| `wgpu-hal` | `22.0.0` | `MIT OR Apache-2.0` | [source](https://github.com/gfx-rs/wgpu) |
-| `wgpu-types` | `22.0.0` | `MIT OR Apache-2.0` | [source](https://github.com/gfx-rs/wgpu) |
-| `widestring` | `1.2.1` | `MIT OR Apache-2.0` | [source](https://github.com/VoidStarKat/widestring-rs) |
+| `wgpu` | `23.0.1` | `MIT OR Apache-2.0` | [source](https://github.com/gfx-rs/wgpu) |
+| `wgpu-core` | `23.0.1` | `MIT OR Apache-2.0` | [source](https://github.com/gfx-rs/wgpu) |
+| `wgpu-hal` | `23.0.1` | `MIT OR Apache-2.0` | [source](https://github.com/gfx-rs/wgpu) |
+| `wgpu-types` | `23.0.0` | `MIT OR Apache-2.0` | [source](https://github.com/gfx-rs/wgpu) |
 | `winapi` | `0.3.9` | `MIT/Apache-2.0` | [source](https://github.com/retep998/winapi-rs) |
 | `winapi-i686-pc-windows-gnu` | `0.4.0` | `MIT/Apache-2.0` | [source](https://github.com/retep998/winapi-rs) |
 | `winapi-util` | `0.1.11` | `Unlicense OR MIT` | [source](https://github.com/BurntSushi/winapi-util) |
 | `winapi-x86_64-pc-windows-gnu` | `0.4.0` | `MIT/Apache-2.0` | [source](https://github.com/retep998/winapi-rs) |
-| `windows` | `0.52.0` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
+| `windows` | `0.58.0` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
 | `windows` | `0.61.3` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
 | `windows-collections` | `0.2.0` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
-| `windows-core` | `0.52.0` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
+| `windows-core` | `0.58.0` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
 | `windows-core` | `0.61.2` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
 | `windows-future` | `0.2.1` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
+| `windows-implement` | `0.58.0` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
 | `windows-implement` | `0.60.2` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
+| `windows-interface` | `0.58.0` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
 | `windows-interface` | `0.59.3` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
 | `windows-link` | `0.1.3` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
 | `windows-link` | `0.2.1` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
 | `windows-numerics` | `0.2.0` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
+| `windows-result` | `0.2.0` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
 | `windows-result` | `0.3.4` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
+| `windows-strings` | `0.1.0` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
 | `windows-strings` | `0.4.2` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
 | `windows-sys` | `0.45.0` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
 | `windows-sys` | `0.52.0` | `MIT OR Apache-2.0` | [source](https://github.com/microsoft/windows-rs) |
diff --git a/maestro-renderer/Cargo.toml b/maestro-renderer/Cargo.toml
index fefd40c..86e9bf1 100644
--- a/maestro-renderer/Cargo.toml
+++ b/maestro-renderer/Cargo.toml
@@ -13,8 +13,14 @@ rust-version.workspace = true
 maestro-shell = { path = "../maestro-shell" }
 serde = { workspace = true }
 serde_json = { workspace = true }
-wgpu = "22"
-glyphon = "0.6"
+# WGPU 23 stopped replacing winit's macOS NSView root layer with CAMetalLayer and instead renders
+# into a sublayer. The old layer-hosting path disabled AppKit's draw/update callbacks and could
+# leave event-driven terminal frames cached until a later mouse/scroll window event caused another
+# redraw. Keep this at 23+ unless the macOS redraw qualification is repeated against a successor.
+wgpu = "23"
+# Glyphon 0.7 is the matching text stack for WGPU 23; keeping these on one WGPU generation avoids
+# duplicate device/type graphs and ensures text is rendered into the corrected macOS surface.
+glyphon = "0.7"
 pollster = "0.3"
 bytemuck = { version = "1", features = ["derive"] }
 [target.'cfg(target_os = "macos")'.dependencies]
diff --git a/maestro-renderer/src/lib.rs b/maestro-renderer/src/lib.rs
index 2f692db..3ae5ea2 100644
--- a/maestro-renderer/src/lib.rs
+++ b/maestro-renderer/src/lib.rs
@@ -52,9 +52,9 @@ mod host_event;
 // Platform-neutral window-service boundary (redraw/size/scale/cursor/title/attention/IME). App routes its
 // outbound window-service calls through the `HostServices` trait so no toolkit type reaches those call sites.
 mod host_services;
-// The full-window macOS CAMetalLayer can trail AppKit's content allocation by one compositor frame
-// during a live resize. Keep the native backing beneath it opaque and theme-dark so that interval
-// cannot expose NSWindow's default light background.
+// The full-window macOS Metal sublayer can trail AppKit's content allocation by one compositor
+// frame during a live resize. Keep the native backing beneath it opaque and theme-dark so that
+// interval cannot expose NSWindow's default light background.
 #[cfg(target_os = "macos")]
 mod macos_window_backing;
 // The macOS winit → HostEvent adapter (preserves the current winit event order/meaning).
diff --git a/maestro-renderer/src/macos_window_backing.rs b/maestro-renderer/src/macos_window_backing.rs
index 22992db..eb8873b 100644
--- a/maestro-renderer/src/macos_window_backing.rs
+++ b/maestro-renderer/src/macos_window_backing.rs
@@ -1,10 +1,10 @@
 //! Opaque AppKit backing beneath macOS's full-window WGPU surface.
 //!
-//! WGPU replaces winit's content-view layer with a `CAMetalLayer`. During a live width resize,
-//! AppKit can expose newly allocated content pixels before the next Metal drawable is presented.
-//! `NSWindow` otherwise supplies its dynamic system background there, which is light in the default
-//! appearance. The backing is not a terminal geometry or presentation owner; it is only the final
-//! opaque fill under the WGPU layer and child WKWebViews.
+//! WGPU 23 keeps winit's content-view layer and presents through a Metal sublayer. During a live
+//! width resize, AppKit can still expose newly allocated content pixels before the next Metal
+//! drawable is presented. `NSWindow` otherwise supplies its dynamic system background there, which
+//! is light in the default appearance. The backing is not a terminal geometry or presentation
+//! owner; it is only the final opaque fill under the WGPU sublayer and child WKWebViews.
 
 use crate::theme::{self, RendererTheme};
 use objc2_app_kit::{NSColor, NSView};
diff --git a/maestro-renderer/src/render.rs b/maestro-renderer/src/render.rs
index 0fa0d49..9a34945 100644
--- a/maestro-renderer/src/render.rs
+++ b/maestro-renderer/src/render.rs
@@ -655,7 +655,7 @@ impl Renderer {
             layout: Some(&pipeline_layout),
             vertex: wgpu::VertexState {
                 module: &shader,
-                entry_point: "vs_main",
+                entry_point: Some("vs_main"),
                 compilation_options: Default::default(),
                 buffers: &[wgpu::VertexBufferLayout {
                     array_stride: std::mem::size_of::<QuadInstance>() as wgpu::BufferAddress,
@@ -676,7 +676,7 @@ impl Renderer {
             },
             fragment: Some(wgpu::FragmentState {
                 module: &shader,
-                entry_point: "fs_main",
+                entry_point: Some("fs_main"),
                 compilation_options: Default::default(),
                 targets: &[Some(wgpu::ColorTargetState {
                     format,
diff --git a/scripts/third-party-license-policy.json b/scripts/third-party-license-policy.json
index b613c1a..76b0490 100644
--- a/scripts/third-party-license-policy.json
+++ b/scripts/third-party-license-policy.json
@@ -1,27 +1,27 @@
 {
   "schema": "hydra.third-party-license-policy.v2",
-  "cargo_lock_sha256": "5dc38d6f0875deea16c6911860ed69c2c6e8390e6946d68e52872ea45c596c86",
+  "cargo_lock_sha256": "5c1a6a5750386110a42e7957f36cc4c094205c705780e3ca54c1f17c6aa65ed5",
   "npm_lock_sha256": "f797f86b630338688c0357e0aa9980300d403bb92b768e92dc6457d73a087073",
   "targets": {
     "aarch64-apple-darwin": {
       "family": "macos",
       "cargo_packages": 252,
-      "cargo_closure_sha256": "ab4af8e60bdc5da0ffd029918025b69b1835e45e2e2149e5170d44d095944f89"
+      "cargo_closure_sha256": "14bbb1b02118726e1ec7d7cd307672ebc03fe612068f0f6312ed4b188e214043"
     },
     "x86_64-apple-darwin": {
       "family": "macos",
       "cargo_packages": 252,
-      "cargo_closure_sha256": "ab4af8e60bdc5da0ffd029918025b69b1835e45e2e2149e5170d44d095944f89"
+      "cargo_closure_sha256": "14bbb1b02118726e1ec7d7cd307672ebc03fe612068f0f6312ed4b188e214043"
     },
     "aarch64-unknown-linux-gnu": {
       "family": "linux",
       "cargo_packages": 296,
-      "cargo_closure_sha256": "43ace126583e2accb1e3564b64d110edfd0160602914a6eb2dfbae002806eafe"
+      "cargo_closure_sha256": "bb491cd6fd56b41b4c8cfd4afca321340389095486988c5a7a8a507e4897d599"
     },
     "x86_64-unknown-linux-gnu": {
       "family": "linux",
       "cargo_packages": 296,
-      "cargo_closure_sha256": "43ace126583e2accb1e3564b64d110edfd0160602914a6eb2dfbae002806eafe"
+      "cargo_closure_sha256": "bb491cd6fd56b41b4c8cfd4afca321340389095486988c5a7a8a507e4897d599"
     }
   },
   "npm_runtime": {
@@ -96,7 +96,7 @@
     "gpu-descriptor-types@0.2.0": { "license": "MIT OR Apache-2.0", "text": "Apache-2.0" },
     "hexf-parse@0.2.1": { "license": "CC0-1.0", "text": "CC0-1.0" },
     "malloc_buf@0.0.6": { "license": "MIT", "text": "MIT" },
-    "naga@22.1.0": { "license": "MIT OR Apache-2.0", "text": "Apache-2.0" },
+    "naga@23.1.0": { "license": "MIT OR Apache-2.0", "text": "Apache-2.0" },
     "objc-sys@0.3.5": { "license": "MIT", "text": "MIT" },
     "objc2@0.5.2": { "license": "MIT", "text": "MIT" },
     "objc2@0.6.4": { "license": "MIT", "text": "MIT" },