diff --git a/requirements.txt b/requirements.txt
index 0568d69a0..615e713fa 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -4,7 +4,7 @@
 fastapi==0.143.0
 starlette==1.7.0
 python-multipart==0.0.32
-sqlalchemy==2.1.1
+sqlalchemy==2.1.4
 werkzeug==3.1.9
 # Flask previously supplied this indirectly; FastAPI signs compatible session,
 # CSRF and token payloads directly, so keep it explicit in the native runtime.
@@ -15,7 +15,7 @@ alembic==1.20.0
 # Declarative JSON request validation (wave A2.4). @validate_body models live in
 # oneirodex/schemas/. Not pulled in transitively today -- pinned like the rest so
 # a rebuilt image resolves the same pydantic-core wheel.
-pydantic==2.13.5
+pydantic==2.14.1
 # pydantic 2.13.5 requires exactly this core; another package on the shared
 # interpreter has twice pulled it to 2.49.0, and pydantic then refuses to import
 # (create_app() SystemError). Pinning it here lets `pip install -r` reassert it.
@@ -26,9 +26,9 @@ pillow==12.3.0
 WTForms_SQLAlchemy==0.4.2
 requests==2.34.2
 psycopg2_binary==2.9.13
-python_dotenv==1.2.3
+python_dotenv==1.2.4
 psutil==7.2.2
-tenacity==9.1.4
+tenacity==9.2.1
 email_validator==2.3.0
 uvicorn[standard]==0.54.0
 aiofiles==25.1.0
@@ -36,6 +36,6 @@ zipstream_new==1.1.8
 howlongtobeatpy==1.0.24
 authlib==1.8.0
 cryptography==50.0.2
-py7zr==1.1.3
+py7zr==1.1.4
 rarfile==4.5
 watchdog==6.0.0