diff --git a/go.mod b/go.mod
index 7a5d20304..4e15c06dd 100644
--- a/go.mod
+++ b/go.mod
@@ -49,7 +49,7 @@ require (
 	github.com/superseriousbusiness/activity v1.6.0-gts
 	github.com/superseriousbusiness/httpsig v1.2.0-SSB
 	github.com/superseriousbusiness/oauth2/v4 v4.3.2-SSB.0.20230227143000-f4900831d6c8
-	github.com/tdewolff/minify/v2 v2.20.14
+	github.com/tdewolff/minify/v2 v2.20.16
 	github.com/technologize/otel-go-contrib v1.1.0
 	github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80
 	github.com/ulule/limiter/v3 v3.11.2
@@ -163,7 +163,7 @@ require (
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/superseriousbusiness/go-jpeg-image-structure/v2 v2.0.0-20220321154430-d89a106fdabe // indirect
 	github.com/superseriousbusiness/go-png-image-structure/v2 v2.0.1-SSB // indirect
-	github.com/tdewolff/parse/v2 v2.7.8 // indirect
+	github.com/tdewolff/parse/v2 v2.7.11 // indirect
 	github.com/tmthrgd/go-hex v0.0.0-20190904060850-447a3041c3bc // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.11 // indirect
diff --git a/go.sum b/go.sum
index 7f091bc79..79c417209 100644
--- a/go.sum
+++ b/go.sum
@@ -493,10 +493,10 @@ github.com/superseriousbusiness/httpsig v1.2.0-SSB h1:BinBGKbf2LSuVT5+MuH0XynHN9
 github.com/superseriousbusiness/httpsig v1.2.0-SSB/go.mod h1:+rxfATjFaDoDIVaJOTSP0gj6UrbicaYPEptvCLC9F28=
 github.com/superseriousbusiness/oauth2/v4 v4.3.2-SSB.0.20230227143000-f4900831d6c8 h1:nTIhuP157oOFcscuoK1kCme1xTeGIzztSw70lX9NrDQ=
 github.com/superseriousbusiness/oauth2/v4 v4.3.2-SSB.0.20230227143000-f4900831d6c8/go.mod h1:uYC/W92oVRJ49Vh1GcvTqpeFqHi+Ovrl2sMllQWRAEo=
-github.com/tdewolff/minify/v2 v2.20.14 h1:sktSuVixRwk0ryQjqvKBu/uYS+MWmkwEFMEWtFZ+TdE=
-github.com/tdewolff/minify/v2 v2.20.14/go.mod h1:qnIJbnG2dSzk7LIa/UUwgN2OjS8ir6RRlqc0T/1q2xY=
-github.com/tdewolff/parse/v2 v2.7.8 h1:1cnVqa8L63xFkc2vfRsZTM6Qy35nJpTvQ2Uvdv3vbvs=
-github.com/tdewolff/parse/v2 v2.7.8/go.mod h1:3FbJWZp3XT9OWVN3Hmfp0p/a08v4h8J9W1aghka0soA=
+github.com/tdewolff/minify/v2 v2.20.16 h1:/C8dtRkxLTIyUlKlBz46gDiktCrE8a6+c1gTrnPFz+U=
+github.com/tdewolff/minify/v2 v2.20.16/go.mod h1:/FvxV9KaTrFu35J9I2FhRvWSBxcHj8sDSdwBFh5voxM=
+github.com/tdewolff/parse/v2 v2.7.11 h1:v+W45LnzmjndVlfqPCT5gGjAAZKd1GJGOPJveTIkBY8=
+github.com/tdewolff/parse/v2 v2.7.11/go.mod h1:3FbJWZp3XT9OWVN3Hmfp0p/a08v4h8J9W1aghka0soA=
 github.com/tdewolff/test v1.0.11-0.20231101010635-f1265d231d52/go.mod h1:6DAvZliBAAnD7rhVgwaM7DE5/d9NMOAJ09SqYqeK4QE=
 github.com/tdewolff/test v1.0.11-0.20240106005702-7de5f7df4739 h1:IkjBCtQOOjIn03u/dMQK9g+Iw9ewps4mCl1nB8Sscbo=
 github.com/tdewolff/test v1.0.11-0.20240106005702-7de5f7df4739/go.mod h1:XPuWBzvdUzhCuxWO1ojpXsyzsA5bFoS3tO/Q3kFuTG8=
diff --git a/vendor/github.com/tdewolff/minify/v2/minify.go b/vendor/github.com/tdewolff/minify/v2/minify.go
index 8e2e3fdb0..0e9a2e113 100644
--- a/vendor/github.com/tdewolff/minify/v2/minify.go
+++ b/vendor/github.com/tdewolff/minify/v2/minify.go
@@ -29,7 +29,7 @@ var Warning = log.New(os.Stderr, "WARNING: ", 0)
 var ErrNotExist = errors.New("minifier does not exist for mimetype")
 
 // ErrClosedWriter is returned when writing to a closed writer.
-var ErrClosedWriter = errors.New("write on closed writer")
+var ErrClosedWriter = errors.New("write on closed writer") // TODO: DEPRECATED, remove
 
 ////////////////////////////////////////////////////////////////
 
@@ -253,32 +253,24 @@ func (m *M) Reader(mediatype string, r io.Reader) io.Reader {
 
 // writer makes sure that errors from the minifier are passed down through Close (can be blocking).
 type writer struct {
-	pw     *io.PipeWriter
+	io.WriteCloser
 	wg     sync.WaitGroup
-	err    error
 	closed bool
-}
-
-// Write intercepts any writes to the writer.
-func (w *writer) Write(b []byte) (int, error) {
-	if w.closed {
-		return 0, ErrClosedWriter
-	}
-	n, err := w.pw.Write(b)
-	if w.err != nil {
-		err = w.err
-	}
-	return n, err
+	err    error
 }
 
 // Close must be called when writing has finished. It returns the error from the minifier.
-func (w *writer) Close() error {
-	if !w.closed {
-		w.pw.Close()
-		w.wg.Wait()
-		w.closed = true
+func (z *writer) Close() error {
+	if z.closed {
+		return nil
 	}
-	return w.err
+	z.closed = true
+	err := z.WriteCloser.Close()
+	z.wg.Wait()
+	if z.err == nil {
+		return err
+	}
+	return z.err
 }
 
 // Writer wraps a Writer interface and minifies the stream.
@@ -286,17 +278,16 @@ func (w *writer) Close() error {
 // The writer must be closed explicitly.
 func (m *M) Writer(mediatype string, w io.Writer) io.WriteCloser {
 	pr, pw := io.Pipe()
-	mw := &writer{pw, sync.WaitGroup{}, nil, false}
-	mw.wg.Add(1)
+	z := &writer{pw, sync.WaitGroup{}, false, nil}
+	z.wg.Add(1)
 	go func() {
-		defer mw.wg.Done()
-
+		defer z.wg.Done()
+		defer pr.Close()
 		if err := m.Minify(mediatype, w, pr); err != nil {
-			mw.err = err
+			z.err = err
 		}
-		pr.Close()
 	}()
-	return mw
+	return z
 }
 
 // responseWriter wraps an http.ResponseWriter and makes sure that errors from the minifier are passed down through Close (can be blocking).
@@ -305,7 +296,7 @@ func (m *M) Writer(mediatype string, w io.Writer) io.WriteCloser {
 type responseWriter struct {
 	http.ResponseWriter
 
-	writer    *writer
+	z         io.Writer
 	m         *M
 	mediatype string
 }
@@ -319,20 +310,34 @@ func (w *responseWriter) WriteHeader(status int) {
 // Write intercepts any writes to the response writer.
 // The first write will extract the Content-Type as the mediatype. Otherwise it falls back to the RequestURI extension.
 func (w *responseWriter) Write(b []byte) (int, error) {
-	if w.writer == nil {
+	if w.z == nil {
 		// first write
 		if mediatype := w.ResponseWriter.Header().Get("Content-Type"); mediatype != "" {
 			w.mediatype = mediatype
 		}
-		w.writer = w.m.Writer(w.mediatype, w.ResponseWriter).(*writer)
+		if _, params, minifier := w.m.Match(w.mediatype); minifier != nil {
+			pr, pw := io.Pipe()
+			z := &writer{pw, sync.WaitGroup{}, false, nil}
+			z.wg.Add(1)
+			go func() {
+				defer z.wg.Done()
+				defer pr.Close()
+				if err := minifier(w.m, w.ResponseWriter, pr, params); err != nil {
+					z.err = err
+				}
+			}()
+			w.z = z
+		} else {
+			w.z = w.ResponseWriter
+		}
 	}
-	return w.writer.Write(b)
+	return w.z.Write(b)
 }
 
 // Close must be called when writing has finished. It returns the error from the minifier.
 func (w *responseWriter) Close() error {
-	if w.writer != nil {
-		return w.writer.Close()
+	if closer, ok := w.z.(interface{ Close() error }); ok {
+		return closer.Close()
 	}
 	return nil
 }
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 140b57ae7..262bffba7 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -689,11 +689,11 @@ github.com/superseriousbusiness/oauth2/v4/generates
 github.com/superseriousbusiness/oauth2/v4/manage
 github.com/superseriousbusiness/oauth2/v4/models
 github.com/superseriousbusiness/oauth2/v4/server
-# github.com/tdewolff/minify/v2 v2.20.14
+# github.com/tdewolff/minify/v2 v2.20.16
 ## explicit; go 1.18
 github.com/tdewolff/minify/v2
 github.com/tdewolff/minify/v2/html
-# github.com/tdewolff/parse/v2 v2.7.8
+# github.com/tdewolff/parse/v2 v2.7.11
 ## explicit; go 1.13
 github.com/tdewolff/parse/v2
 github.com/tdewolff/parse/v2/buffer