diff --git a/Cargo.lock b/Cargo.lock
index a592407..450d458 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -345,9 +345,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.5"
+version = "4.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "301b56658598e48f3648647ac6fc887be7e7108eddfa4e9b63fcf3ec58c0cadf"
+checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -355,9 +355,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.5"
+version = "4.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94a65403d1a1bd28f7dc68eb8506e8874808ee5eecb59298de588e2e1407a078"
+checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
 dependencies = [
  "anstream",
  "anstyle",
@@ -367,9 +367,9 @@ dependencies = [
 
 [[package]]
 name = "clap_complete"
-version = "4.6.8"
+version = "4.6.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f84a88507dbd05c695f2cb5e8558e747179134005e9893882dec964190ed89"
+checksum = "3be2ad0423bdbbb0e25bc89add796f3559706d4a95e1bc98e4d9662a957b6a19"
 dependencies = [
  "clap",
 ]
@@ -931,9 +931,9 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.38.1"
+version = "0.38.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6c19a05435c21ac299d71b6a9c13db3e3f47c520517d58990a462a1397a61db"
+checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8"
 dependencies = [
  "cc",
  "pkg-config",
@@ -1551,7 +1551,7 @@ checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
 [[package]]
 name = "retch-cli"
-version = "0.6.18"
+version = "0.6.19"
 dependencies = [
  "anyhow",
  "base64",
@@ -1602,9 +1602,9 @@ dependencies = [
 
 [[package]]
 name = "rusqlite"
-version = "0.40.1"
+version = "0.40.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11438310b19e3109b6446c33d1ed5e889428cf2e278407bc7896bc4aaea43323"
+checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3"
 dependencies = [
  "bitflags",
  "fallible-iterator",
diff --git a/Cargo.toml b/Cargo.toml
index ebdb252..942cf60 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -6,7 +6,7 @@ members = [
 
 [package]
 name = "retch-cli"
-version = "0.6.18"
+version = "0.6.19"
 edition = "2021"
 authors = ["Ken Tobias"]
 description = "A fast, feature-rich system information fetcher written in Rust (similar to fastfetch or neofetch)"
diff --git a/NOTES.md b/NOTES.md
index 89fb716..df6ed29 100644
--- a/NOTES.md
+++ b/NOTES.md
@@ -96,7 +96,28 @@ The `retch-sysinfo` crate can be used independently as a library for cross-platf
 
 ---
 
-## Current State (v0.6.18)
+## Current State (v0.6.19)
+- **v0.6.19 — dependency bumps (consolidated Dependabot #188)** (chore; no runtime behavior
+  change). Rolls Dependabot's PR onto a gated branch so the release hygiene it bypasses —
+  version bump, NOTES entry, man regen — is actually done, following the #167/v0.6.3 and
+  #184/v0.6.16 pattern.
+  - **3 direct crates + 2 transitive** (`cargo-dependencies` group, #188), all patch-level and
+    **lockfile-only** — every spec is a caret range, so both `Cargo.toml` manifests are
+    untouched: `clap` 4.6.5→4.6.6 (pulls `clap_builder` 4.6.5→4.6.6), `clap_complete`
+    4.6.8→4.6.9, `rusqlite` 0.40.1→0.40.2 (pulls `libsqlite3-sys` 0.38.1→0.38.2). The
+    resulting `Cargo.lock` was **diff-verified byte-identical** to what Dependabot generated on
+    #188, so this carries exactly the change its green CI validated.
+  - **`rusqlite` warranted a live check, not just a green suite.** It is a *direct* dependency
+    of `retch-sysinfo` and the crate v0.6.18's `Packages` fix had just started using
+    differently (`open_with_flags` + `SQLITE_OPEN_READ_ONLY | SQLITE_OPEN_URI |
+    SQLITE_OPEN_NO_MUTEX` over a `file:…?immutable=1` URI). `libsqlite3-sys` also bundles
+    SQLite itself, so a bump changes the engine that has to honour `immutable=1` — and the
+    `rpm_db_uri` unit tests only assert string construction, so they could not catch a
+    behavioural change there. Verified live as an unprivileged user: `Packages: 2509`,
+    unchanged. **Any future `rusqlite`/`libsqlite3-sys` bump deserves the same one-command
+    check** — `retch --fields packages` without sudo.
+  - `retch-cli` → 0.6.19; `retch-sysinfo` unchanged at `0.1.53` (no source change — only its
+    transitive lockfile deps moved, same call as v0.6.3). Patch bump.
 - **v0.6.18 — `Packages` without root, Rio detection under `sudo`, and aspect-correct logo
   scaling** (`crates/sysinfo/src/packages.rs`, `src/logo.rs`, `src/display.rs`). Three
   user-reported defects, all found by diffing a `sudo retch --full` run against a plain one
diff --git a/docs/retch.1 b/docs/retch.1
index 452c8d8..376513f 100644
--- a/docs/retch.1
+++ b/docs/retch.1
@@ -1,4 +1,4 @@
-.TH "RETCH" "1" "August 2026" "retch 0.6.18" "System Information Fetcher"
+.TH "RETCH" "1" "August 2026" "retch 0.6.19" "System Information Fetcher"
 
 .SH "NAME"
 .PP