diff --git a/backend/requirements-dev.txt b/backend/requirements-dev.txt
index 65ebce1..9752340 100644
--- a/backend/requirements-dev.txt
+++ b/backend/requirements-dev.txt
@@ -13,8 +13,8 @@
 # 8.3.2 is reported by pip-audit under PYSEC-2026-1845 / GHSA-6w46-j5rx-g56g
 # (fixed in 9.0.3), which is why the runner moved to 9 together with the
 # pytest-asyncio 1.x line it requires.
-pytest==9.0.3
-pytest-asyncio==1.3.0
+pytest==9.1.1
+pytest-asyncio==1.4.0
 # pytest-httpx used to sit here and is deliberately gone: no test used it (the
 # suite mocks HTTP through httpx.MockTransport and ASGITransport directly), and
 # every release that supports pytest 9 also demands httpx==0.28.* — a runtime
@@ -22,9 +22,9 @@ pytest-asyncio==1.3.0
 pytest-cov==7.1.0
 # 4.6.2.post1 is affected by GHSA-82r6-8w77-94w6 (critical, TLS hostname
 # spoofing via IDNA 2003) and GHSA-5p39-cfhj-2xmp; both fixed in 4.14.2.
-anyio==4.14.2
-aiosqlite==0.20.0
+anyio==4.15.1
+aiosqlite==0.22.1
 
 # --- Static analysis ---------------------------------------------------------
-ruff==0.6.5
-mypy==1.11.2
+ruff==0.16.10
+mypy==1.20.2
diff --git a/backend/requirements.txt b/backend/requirements.txt
index 7204f93..dd5fa1a 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -14,9 +14,9 @@
 # before 1.3.1 carries fourteen advisories (PYSEC-2026-1941/1943/161/2280/2281/
 # 248/249) that the security job flags on every push. Both are pinned exactly:
 # Starlette is a shipped runtime dependency even though it arrives transitively.
-fastapi==0.141.1
-starlette==1.6.0
-uvicorn[standard]==0.30.6
+fastapi==0.142.2
+starlette==1.7.0
+uvicorn[standard]==0.54.0
 # 0.0.9 is affected by CVE-2024-53981 (DoS) and by the 2026 path-traversal and
 # header-parsing issues fixed in 0.0.22. Reachable: the login endpoint parses
 # form data through this library.
@@ -24,58 +24,58 @@ python-multipart==0.0.32
 gunicorn==23.0.0
 
 # --- Database ----------------------------------------------------------------
-sqlalchemy==2.0.35
-asyncpg==0.29.0
-psycopg2-binary==2.9.9
-alembic==1.13.2
+sqlalchemy==2.1.1
+asyncpg==0.31.0
+psycopg2-binary==2.9.13
+alembic==1.20.0
 
 # --- Data Validation ---------------------------------------------------------
-pydantic==2.9.2
-pydantic-settings==2.5.2
-email-validator==2.2.0
+pydantic==2.13.5
+pydantic-settings==2.15.0
+email-validator==2.3.0
 
 # --- Security & Auth ---------------------------------------------------------
 # PyJWT replaced python-jose: 3.3.0 carries CVE-2024-33663 (algorithm confusion)
 # and CVE-2024-33664 (JWE decompression DoS), and a September 2026 advisory still
 # covers releases up to 3.5.0. passlib was dropped as well — it is unmaintained
 # and required a monkeypatch of a private hook to work with current bcrypt.
-PyJWT[crypto]==2.14.0
+PyJWT[crypto]==2.15.1
 bcrypt==5.0.0
-cryptography==50.0.1
+cryptography==50.0.2
 qrcode==8.2
 
 # --- HTTP Clients (async) ----------------------------------------------------
-httpx==0.27.2
-aiodns==3.2.0
+httpx==0.28.1
+aiodns==3.6.1
 # 4.5.0 is affected by CVE-2025-48945.
-pycares==4.9.0
+pycares==4.11.0
 
 # --- Task Queue --------------------------------------------------------------
-celery[redis]==5.4.0
-redis==5.0.8
+celery[redis]==5.6.3
+redis==5.3.1
 # msgpack is used by Kombu's serializer and must include the fix for
 # GHSA-6v7p-g79w-8964 (fixed in 1.2.1).
-msgpack==1.2.1
+msgpack==1.2.3
 
 # --- Templates & Rendering ---------------------------------------------------
 # 3.1.4 is affected by CVE-2024-56201 and CVE-2024-56326 (sandbox escape).
 jinja2==3.1.6
 
 # --- PDF Generation ----------------------------------------------------------
-fpdf2==2.8.1
+fpdf2==2.8.9
 
 # --- Threat Intelligence -----------------------------------------------------
 mmh3==4.1.0
-python-whois==0.9.4
-dnspython==2.6.1
+python-whois==0.9.6
+dnspython==2.8.0
 
 # --- CLI & Configuration -----------------------------------------------------
-typer==0.12.5
+typer==0.27.2
 # 1.0.1 is affected by PYSEC-2026-2270.
-python-dotenv==1.2.2
+python-dotenv==1.2.4
 
 # --- Resilience --------------------------------------------------------------
-tenacity==9.0.0
+tenacity==9.1.4
 
 # --- Structured Logging ------------------------------------------------------
 structlog==24.4.0