diff --git a/Cargo.lock b/Cargo.lock
index c28c1ed9..78152edc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1127,12 +1127,13 @@ dependencies = [
 
 [[package]]
 name = "deno_core"
-version = "0.394.0"
+version = "0.401.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d5f5f106a5d7e7e8b0309b61c211cf2690f00267d39d774930be54696fc387d"
+checksum = "88a6d2c044b4d8d34a582c1993eaf620fbeed63a6cf2f129407fd00ba7398c50"
 dependencies = [
  "anyhow",
  "az",
+ "base64 0.22.1",
  "bincode",
  "bit-set 0.8.0",
  "bit-vec 0.8.0",
@@ -1140,7 +1141,6 @@ dependencies = [
  "bytes",
  "capacity_builder",
  "cooked-waker",
- "deno_core_icudata",
  "deno_error",
  "deno_ops",
  "deno_path_util",
@@ -1149,6 +1149,7 @@ dependencies = [
  "indexmap 2.13.0",
  "inventory",
  "libc",
+ "num-bigint",
  "parking_lot",
  "percent-encoding",
  "pin-project",
@@ -1158,19 +1159,15 @@ dependencies = [
  "smallvec",
  "sourcemap",
  "static_assertions",
+ "sys_traits",
  "thiserror 2.0.18",
  "tokio",
  "url",
  "v8",
  "wasm_dep_analyzer",
+ "windows-sys 0.59.0",
 ]
 
-[[package]]
-name = "deno_core_icudata"
-version = "0.77.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9efff8990a82c1ae664292507e1a5c6749ddd2312898cdf9cd7cb1fd4bc64c6"
-
 [[package]]
 name = "deno_error"
 version = "0.7.1"
@@ -1198,9 +1195,9 @@ dependencies = [
 
 [[package]]
 name = "deno_ops"
-version = "0.270.0"
+version = "0.277.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77a98351620a3f591a4afae060324d00661831e415e86eac3a8b714b794b7872"
+checksum = "444a16d56d43657f2d134c6a1f287f749edeabce0198c8747d4ca1a596b78299"
 dependencies = [
  "indexmap 2.13.0",
  "proc-macro2",
@@ -4261,9 +4258,9 @@ dependencies = [
 
 [[package]]
 name = "serde_v8"
-version = "0.303.0"
+version = "0.310.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d3769bc27c92c9c4845883865dcb00222e56e86c4e48602e90cefc0626833df"
+checksum = "07e711906fc66842095f5a3137b11f4738a481def8906b756b1366cf467a3aee"
 dependencies = [
  "deno_error",
  "num-bigint",
@@ -4711,9 +4708,9 @@ dependencies = [
 
 [[package]]
 name = "sys_traits"
-version = "0.1.19"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1495a604cd38eeb30c408724966cd31ca1b68b5a97e3afc474c0d719bfeec5a"
+checksum = "c7a35f11f9773f11930a7d1e6276766f1577400ee2530b7f0cf3844c2dcbf12b"
 dependencies = [
  "sys_traits_macros",
 ]
@@ -5393,9 +5390,9 @@ dependencies = [
 
 [[package]]
 name = "v8"
-version = "147.4.0"
+version = "149.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2df8fffd507fb18ed000673a83d937f58e60fb07f3306b2274284125b15137cd"
+checksum = "ebfd8d6919bfb4b627ca778a67f85ca45e5fb442d352947ba093798bdf9b07e0"
 dependencies = [
  "bindgen",
  "bitflags",
diff --git a/crates/static-analysis-kernel/Cargo.toml b/crates/static-analysis-kernel/Cargo.toml
index 39358153..ad92c4de 100644
--- a/crates/static-analysis-kernel/Cargo.toml
+++ b/crates/static-analysis-kernel/Cargo.toml
@@ -18,7 +18,7 @@ thiserror = { workspace = true }
 tree-sitter = { workspace = true }
 
 # other
-deno_core = "0.394.0"
+deno_core = "0.401.0"
 globset = "0.4.16"
 graphviz-rust = "0.9.6"
 sequence_trie = "0.3.6"
diff --git a/crates/static-analysis-kernel/src/analysis/ddsa_lib/extension.rs b/crates/static-analysis-kernel/src/analysis/ddsa_lib/extension.rs
index badd025f..3de04f33 100644
--- a/crates/static-analysis-kernel/src/analysis/ddsa_lib/extension.rs
+++ b/crates/static-analysis-kernel/src/analysis/ddsa_lib/extension.rs
@@ -3,6 +3,40 @@
 // Copyright 2024 Datadog, Inc.
 
 use crate::analysis::ddsa_lib::ops;
+use std::borrow::Cow;
+
+macro_rules! embedded_esm {
+    ($(($specifier:literal, $file:literal)),* $(,)?) => {
+        &[$(deno_core::ExtensionFileSource::new(
+            $specifier,
+            deno_core::ascii_str_include!(concat!("js/", $file)),
+        )),*]
+    };
+}
+
+/// The ES modules that make up `ddsa_lib`.
+const DDSA_LIB_ESM: &[deno_core::ExtensionFileSource] = embedded_esm![
+    ("ext:ddsa_lib/__bootstrap.js", "__bootstrap.js"),
+    ("ext:ddsa_lib/context_file", "context_file.js"),
+    ("ext:ddsa_lib/context_file_go", "context_file_go.js"),
+    ("ext:ddsa_lib/context_file_js", "context_file_js.js"),
+    ("ext:ddsa_lib/context_file_tf", "context_file_tf.js"),
+    ("ext:ddsa_lib/context_root", "context_root.js"),
+    ("ext:ddsa_lib/context_rule", "context_rule.js"),
+    ("ext:ddsa_lib/context_ts_lang", "context_ts_lang.js"),
+    ("ext:ddsa_lib/ddsa", "ddsa.js"),
+    ("ext:ddsa_lib/edit", "edit.js"),
+    ("ext:ddsa_lib/fix", "fix.js"),
+    ("ext:ddsa_lib/flow/graph", "flow/graph.js"),
+    ("ext:ddsa_lib/flow/java", "flow/java.js"),
+    ("ext:ddsa_lib/query_match", "query_match.js"),
+    ("ext:ddsa_lib/query_match_compat", "query_match_compat.js"),
+    ("ext:ddsa_lib/region", "region.js"),
+    ("ext:ddsa_lib/stella_compat", "stella_compat.js"),
+    ("ext:ddsa_lib/utility", "utility.js"),
+    ("ext:ddsa_lib/ts_node", "ts_node.js"),
+    ("ext:ddsa_lib/violation", "violation.js"),
+];
 
 deno_core::extension!(
     ddsa_lib,
@@ -18,37 +52,20 @@ deno_core::extension!(
         ops::op_digraph_adjacency_list_to_dot,
     ],
     esm_entry_point = "ext:ddsa_lib/__bootstrap.js",
-    esm = [
-        dir "src/analysis/ddsa_lib/js",
-        "__bootstrap.js",
-        "ext:ddsa_lib/context_file" = "context_file.js",
-        "ext:ddsa_lib/context_file_go" = "context_file_go.js",
-        "ext:ddsa_lib/context_file_js" = "context_file_js.js",
-        "ext:ddsa_lib/context_file_tf" = "context_file_tf.js",
-        "ext:ddsa_lib/context_root" = "context_root.js",
-        "ext:ddsa_lib/context_rule" = "context_rule.js",
-        "ext:ddsa_lib/context_ts_lang" = "context_ts_lang.js",
-        "ext:ddsa_lib/ddsa" = "ddsa.js",
-        "ext:ddsa_lib/edit" = "edit.js",
-        "ext:ddsa_lib/fix" = "fix.js",
-        "ext:ddsa_lib/flow/graph" = "flow/graph.js",
-        "ext:ddsa_lib/flow/java" = "flow/java.js",
-        "ext:ddsa_lib/query_match" = "query_match.js",
-        "ext:ddsa_lib/query_match_compat" = "query_match_compat.js",
-        "ext:ddsa_lib/region" = "region.js",
-        "ext:ddsa_lib/stella_compat" = "stella_compat.js",
-        "ext:ddsa_lib/utility" = "utility.js",
-        "ext:ddsa_lib/ts_node" = "ts_node.js",
-        "ext:ddsa_lib/violation" = "violation.js",
-    ],
+    customizer = |ext: &mut deno_core::Extension| {
+        ext.esm_files = Cow::Borrowed(DDSA_LIB_ESM);
+    },
 );
 
+#[cfg(test)]
+const DDSA_LIB_CFG_TEST_ESM: &[deno_core::ExtensionFileSource] =
+    embedded_esm![("ext:ddsa_lib_cfg_test/helpers", "test_helpers.js")];
+
 #[cfg(test)]
 deno_core::extension!(
     ddsa_lib_cfg_test,
     ops = [ops::cfg_test_op_rust_option],
-    esm = [
-        dir "src/analysis/ddsa_lib/js",
-        "ext:ddsa_lib_cfg_test/helpers" = "test_helpers.js",
-    ]
+    customizer = |ext: &mut deno_core::Extension| {
+        ext.esm_files = Cow::Borrowed(DDSA_LIB_CFG_TEST_ESM);
+    },
 );
diff --git a/crates/static-analysis-kernel/src/analysis/ddsa_lib/v8_platform.rs b/crates/static-analysis-kernel/src/analysis/ddsa_lib/v8_platform.rs
index 009983b1..92f830a1 100644
--- a/crates/static-analysis-kernel/src/analysis/ddsa_lib/v8_platform.rs
+++ b/crates/static-analysis-kernel/src/analysis/ddsa_lib/v8_platform.rs
@@ -27,7 +27,7 @@ const BASE_FLAGS: &str = concat!(
     // and so it's possible for changes in their default flags to contradict ours. Until `deno_core`
     // allows the creation of a JsRuntime without forcing v8 flags, we use the following flag
     // to crash the process if there is a contradiction. This serves as a canary to investigate further.
-    " --abort-on-contradictory-flags",
+    " --flag-processing-mode=abort-on-error",
     // Performance: compile JavaScript eagerly
     " --no-lazy",
     " --no-lazy-streaming",
@@ -155,11 +155,11 @@ mod tests {
         assert!(result.is_err());
     }
 
-    /// v8 is initialized with `--abort-on-contradictory-flags`.
+    /// v8 is initialized with `--flag-processing-mode=abort-on-error` (which will abort on contradictory flags).
     /// (This is important -- see documentation in [`BASE_FLAGS`] -- hence it has an explicit test).
     #[test]
-    fn v8_contradictory_flags_abort() {
-        assert!(BASE_FLAGS.contains("--abort-on-contradictory-flags"));
+    fn v8_flag_processing_mode() {
+        assert!(BASE_FLAGS.contains("--flag-processing-mode=abort-on-error"));
     }
 
     /// v8 is initialized without the ability to run `eval`-like functions.