diff --git a/Cargo.lock b/Cargo.lock
index af787b3e..056ee511 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -486,9 +486,9 @@ checksum = "78cc372d058dcf6d5ecd98510e7fbc9e5aec4d21de70f65fea8fecebcd881bd4"
 
 [[package]]
 name = "globset"
-version = "0.4.8"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10463d9ff00a2a068db14231982f5132edebad0d7660cd956a1c30292dbcbfbd"
+checksum = "0a1e17342619edbc21a964c2afbeb6c820c6a2560032872f397bb97ea127bd0a"
 dependencies = [
  "aho-corasick",
  "bstr",
diff --git a/tough/Cargo.toml b/tough/Cargo.toml
index 4647b1b7..e1b6cb01 100644
--- a/tough/Cargo.toml
+++ b/tough/Cargo.toml
@@ -11,7 +11,7 @@ edition = "2018"
 [dependencies]
 chrono = { version = "0.4.11", features = ["serde"] }
 dyn-clone = "1.0.5"
-globset = { version = "0.4.8" }
+globset = { version = "0.4.9" }
 hex = "0.4.2"
 log = "0.4.8"
 olpc-cjson = { version = "0.1.0", path = "../olpc-cjson" }