diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3ce9c05..2f4ce37 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,263 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+# Vix.cpp v2.7.2
+
+Vix.cpp v2.7.2 is a focused module-dependency release that completes the next step of Vix App Modules: registry packages can now be declared inside a specific module while the application keeps one global dependency resolution and one root `vix.lock`.
+
+This release also improves the quality of the existing codebase. Several build warnings were removed across Vix, and Vix Note now handles unsafe C++ cell execution more safely when user code produces too much output or does not terminate.
+
+The core identity of v2.7.2 is:
+
+- Module-level registry dependencies
+- `vix add --module`
+- Global lockfile generation from enabled modules
+- Module-specific CMake links
+- Safer Vix Note C++ cell execution
+- Cleaner warning-free builds
+- Better integration between `vix.module`, `vix.lock`, `vix install`, and `vix build`
+
+## Added
+
+### Module registry dependencies
+
+Added `[deps]` support in generated `vix.module` files.
+
+A module can now declare registry packages directly inside its own manifest:
+
+```ini
+[deps]
+registry = [
+  "rix/rix@^0.9.1",
+]
+
+links = [
+  "rix::rix",
+]
+```
+
+This makes it possible to declare registry packages at the module level without creating a separate `vix.json` or `vix.lock` inside the module.
+
+Enabled module registry dependencies are now resolved through the root application, and the required packages are kept in the root `vix.lock`.
+
+### `vix add --module`
+
+Added support for adding a registry package to a specific module:
+
+```bash
+vix add rix/rix --module auth
+```
+
+Added short module syntax:
+
+```bash
+vix add rix/rix -m auth
+```
+
+Added assignment-style module syntax:
+
+```bash
+vix add rix/rix --module=auth
+```
+
+Added explicit CMake target linking support:
+
+```bash
+vix add rix/rix --module auth --link rix::rix
+```
+
+Added automatic default CMake link target inference:
+
+```text
+rix/rix -> rix::rix
+```
+
+When a package is added to a module, Vix inserts the dependency into:
+
+```text
+modules/<module>/vix.module
+```
+
+The root lockfile is refreshed after `vix add --module`, so module dependencies immediately update the root `vix.lock`.
+
+### Module CMake integration
+
+Added generated CMake variables for module-specific links:
+
+```cmake
+set(VIX_MODULE_auth_LINKS
+  rix::rix
+)
+```
+
+Added module target linking from `vix.module` dependencies.
+
+Registry packages can now be linked directly to the module target that needs them instead of being linked globally to the main application.
+
+Generated CMake now includes `.vix/vix_deps.cmake` when enabled modules declare registry dependencies.
+
+The dependency loading order was updated so registry package targets are available before enabled modules are loaded.
+
+### Module checks
+
+Added validation for module registry dependency declarations.
+
+Added checks for modules that declare registry dependencies without matching links.
+
+Added checks for modules that declare links without matching registry dependencies.
+
+Added safer validation around `vix.module` dependency metadata.
+
+### Vix Note execution guards
+
+Added timeout protection for C++ cells in Vix Note.
+
+C++ cells can now stop safely when user code does not terminate, such as an accidental infinite loop.
+
+Added output capture limits for C++ cells. This prevents the notebook UI from freezing when a program writes a very large amount of output.
+
+For example, this kind of code can produce an unexpectedly large output because `v.size() - 1` underflows when the vector is empty:
+
+```cpp
+#include <iostream>
+#include <vector>
+
+int main()
+{
+  std::vector<int> v;
+
+  for (int i = 0; i < v.size() - 1; i++)
+  {
+    std::cout << i << "\n";
+  }
+
+  return 0;
+}
+```
+
+Vix Note now guards against this by stopping the execution when the captured output becomes too large.
+
+## Changed
+
+Updated `vix add` so it now supports both project-level and module-level dependency workflows.
+
+The existing project-level behavior is preserved:
+
+```bash
+vix add <package>
+```
+
+This still adds a dependency to the root project.
+
+The module-level workflow now writes into the target module manifest instead:
+
+```bash
+vix add <package> --module <name>
+```
+
+Updated the dependency resolution flow so enabled module dependencies are merged into the effective application dependency set.
+
+Updated lockfile generation so the root `vix.lock` includes dependencies required by enabled modules.
+
+Updated generated app CMake so registry dependencies declared by enabled modules can trigger `.vix/vix_deps.cmake` loading.
+
+Updated module CMake generation so registry package targets are linked to the module that needs them.
+
+Updated the module workflow so disabled modules do not force their registry dependencies into the active build.
+
+Updated Vix Note C++ cell execution so long-running or noisy programs are handled with stronger runtime guards.
+
+Updated the codebase to remove remaining compiler warnings and keep the build output cleaner across supported platforms.
+
+## Fixed
+
+Fixed `vix add --module` creating or updating `vix.module` without generating a root `vix.lock`.
+
+Fixed `vix install` failing after module-only dependencies because `vix.lock` was missing.
+
+Fixed module registry dependencies being installed correctly but not loaded during `vix build`.
+
+Fixed unresolved CMake targets such as:
+
+```text
+missing: rix::rix
+```
+
+Fixed generated CMake ordering so `.vix/vix_deps.cmake` is loaded before module targets are added.
+
+Fixed module dependency links so package targets declared in `vix.module` are available before `target_link_libraries()` is evaluated.
+
+Fixed the gap between `vix add --module`, `vix install`, and `vix build`.
+
+Fixed Vix Note blocking when a C++ cell entered an infinite loop.
+
+Fixed Vix Note freezing when a C++ cell produced too much output.
+
+Fixed unsafe output capture behavior in Vix Note by adding an output limit before the browser receives a very large result.
+
+Fixed sign-conversion warnings in Vix Note runtime and web route code.
+
+Fixed socket length conversion warnings in the Vix Note web server.
+
+Fixed remaining compiler warnings across Vix so the project now builds with a cleaner output.
+
+## Notes
+
+Vix.cpp v2.7.2 completes an important part of the module architecture introduced in v2.7.1.
+
+A module can now own its dependency declaration without becoming a separate project. For example, an `auth` module can declare the registry package it needs:
+
+```ini
+name = "auth"
+kind = "service"
+
+[routes]
+prefix = "/api/auth"
+
+[deps]
+registry = [
+  "rix/rix@^0.9.1",
+]
+
+links = [
+  "rix::rix",
+]
+
+[tests]
+enabled = true
+```
+
+Then the command:
+
+```bash
+vix add rix/rix --module auth
+```
+
+updates the module manifest, refreshes the root `vix.lock`, and keeps the application dependency graph reproducible from one place.
+
+The workflow becomes:
+
+```bash
+vix modules add auth
+vix add rix/rix --module auth
+vix install
+vix build
+```
+
+The separation is intentional:
+
+- `vix.app` decides which modules are enabled.
+- `vix.module` describes what a module needs.
+- `vix.lock` remains global.
+- `vix install` installs the effective dependency graph.
+- `vix build` loads registry package targets before compiling modules.
+
+Vix Note also becomes safer in this release. In v2.7.1, a C++ cell could block the notebook when user code entered an infinite loop or produced a very large output. In v2.7.2, C++ cell execution now has runtime guards for timeout and captured output size, so the notebook can recover instead of being locked by a bad run.
+
+This release also removes the remaining warnings that were visible in the build logs. The result is a cleaner codebase, a quieter CI output, and a more reliable release foundation for the next Vix.cpp iterations.
+
+This gives Vix modules a stronger backend-oriented workflow while keeping the project structure simple and predictable.
+
 # Vix.cpp v2.7.1
 
 Vix.cpp v2.7.1 is a focused patch release that strengthens the new Vix application workflow with a Go-like internal module system for C++ application and backend projects, improves SDK lifecycle handling, fixes dev-mode manifest watching, and gives `vix uninstall` a cleaner command experience.
diff --git a/modules/agent b/modules/agent
index c3d05d3..7092623 160000
--- a/modules/agent
+++ b/modules/agent
@@ -1 +1 @@
-Subproject commit c3d05d32ecf8f8f9b476fec6631b2c06ba8a6c55
+Subproject commit 70926232fca4c35b2a8deec04ae765f15c38bcc9
diff --git a/modules/async b/modules/async
index 995a44c..b260623 160000
--- a/modules/async
+++ b/modules/async
@@ -1 +1 @@
-Subproject commit 995a44c2de239450c312f18881e309f354837e65
+Subproject commit b260623ab0a7d48c2e2714d9f8a6eef11dbb4270
diff --git a/modules/cli b/modules/cli
index 6a6ec78..60507b4 160000
--- a/modules/cli
+++ b/modules/cli
@@ -1 +1 @@
-Subproject commit 6a6ec7824399368a586eaba57fb6c62859890ef9
+Subproject commit 60507b4201cd583c4b3e036b376bad53550eb911
diff --git a/modules/core b/modules/core
index b8607e4..e0ec5bb 160000
--- a/modules/core
+++ b/modules/core
@@ -1 +1 @@
-Subproject commit b8607e46e832dc66f52bb4f8cd30ebad2d08d3de
+Subproject commit e0ec5bbda3a4770a703a41c7b5880434c5aba617
diff --git a/modules/game b/modules/game
index 4e8d718..723f5a5 160000
--- a/modules/game
+++ b/modules/game
@@ -1 +1 @@
-Subproject commit 4e8d71812e9e815beaec1427bbcf16231f960d47
+Subproject commit 723f5a5e2adc508ab2708923b0905eccf2d30df7
diff --git a/modules/io b/modules/io
index 32b6e8d..a35a308 160000
--- a/modules/io
+++ b/modules/io
@@ -1 +1 @@
-Subproject commit 32b6e8dedc20f5a664df899a5b77b3d54b30e7a3
+Subproject commit a35a3089493847adf53fc282074dee180a99b73f
diff --git a/modules/kv b/modules/kv
index e39f8d2..c47384c 160000
--- a/modules/kv
+++ b/modules/kv
@@ -1 +1 @@
-Subproject commit e39f8d2d9a77113ccee0cff5172e49e33a1fdc48
+Subproject commit c47384c405267d9917eaf737b4ed62a696fd3fd4
diff --git a/modules/middleware b/modules/middleware
index eba27bb..33542d0 160000
--- a/modules/middleware
+++ b/modules/middleware
@@ -1 +1 @@
-Subproject commit eba27bb39144e45693007efe0b7fb0754fe0445a
+Subproject commit 33542d0732cf1f68816c859facf57bb73bfa9265
diff --git a/modules/note b/modules/note
index 8fa1b28..acbc268 160000
--- a/modules/note
+++ b/modules/note
@@ -1 +1 @@
-Subproject commit 8fa1b28a4f47da524e13748dc41f0fb198f5f1d8
+Subproject commit acbc268ac14ad9c0ad8d025a14825c384e7fb425
diff --git a/modules/p2p b/modules/p2p
index 7635815..767c96f 160000
--- a/modules/p2p
+++ b/modules/p2p
@@ -1 +1 @@
-Subproject commit 76358159f054b4fb063c800a4e6b1d447e81df41
+Subproject commit 767c96f44a220507d9f8086fe14c4475274724f5
diff --git a/modules/p2p_http b/modules/p2p_http
index 6eb0742..4f4f6cb 160000
--- a/modules/p2p_http
+++ b/modules/p2p_http
@@ -1 +1 @@
-Subproject commit 6eb07426410c2f0791e91e4b3cd539819a4e911e
+Subproject commit 4f4f6cbcd33ff93e8c439686d49ed02be470170e
diff --git a/modules/process b/modules/process
index f3f2bc3..e3787d7 160000
--- a/modules/process
+++ b/modules/process
@@ -1 +1 @@
-Subproject commit f3f2bc3d7b48a586e00d2b7d69a65f2eb4a4a627
+Subproject commit e3787d7131e63590866ee237e3616adfd365edd4
diff --git a/modules/reply b/modules/reply
index c55f8cb..160b723 160000
--- a/modules/reply
+++ b/modules/reply
@@ -1 +1 @@
-Subproject commit c55f8cb90aaa3a3e7db73f6634722b3ab0b8d4d5
+Subproject commit 160b723c0681dabdd392c3f46018989b35fa863d
diff --git a/modules/requests b/modules/requests
index 9d7f125..f899440 160000
--- a/modules/requests
+++ b/modules/requests
@@ -1 +1 @@
-Subproject commit 9d7f1252cb75bd5d0c14ffd0bedea325fa022454
+Subproject commit f8994400f7ed1a6ef4dae3028a62957dae5e0925
diff --git a/modules/template b/modules/template
index f87ce3e..98642b7 160000
--- a/modules/template
+++ b/modules/template
@@ -1 +1 @@
-Subproject commit f87ce3e65edb30819be88b10d418c87df4883a2a
+Subproject commit 98642b7a36a3e0c6d8aa729f9fb27dc91192c682
diff --git a/modules/threadpool b/modules/threadpool
index 3ef0b6a..112bcb2 160000
--- a/modules/threadpool
+++ b/modules/threadpool
@@ -1 +1 @@
-Subproject commit 3ef0b6a138b822de1e0c7a15ead516a7147c8125
+Subproject commit 112bcb2f1522a82ae35aa19b4c772ee02a4f366f
diff --git a/modules/ui b/modules/ui
index fc176ad..ecf43e9 160000
--- a/modules/ui
+++ b/modules/ui
@@ -1 +1 @@
-Subproject commit fc176adc2af300f19b06c15f599e060a115f219d
+Subproject commit ecf43e9c026967853a8fff47bca33e8a08626ff6
diff --git a/modules/utils b/modules/utils
index 5246e9a..ba404c5 160000
--- a/modules/utils
+++ b/modules/utils
@@ -1 +1 @@
-Subproject commit 5246e9af8998dd7e3314bccdf34469b622d38b7a
+Subproject commit ba404c55c1a52fa3075b5e0277f502590402910e