diff --git a/requirements.txt b/requirements.txt
index 0568d69a0..ee3c56e17 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,10 +1,10 @@
 # Core ASGI/ORM runtime dependencies. A self-hosted image is rebuilt on user
 # hardware on the user's schedule; pinning prevents builds from resolving
 # incompatible framework/ORM minors. Legacy Flask adapters are development-only.
-fastapi==0.143.0
-starlette==1.7.0
+fastapi==0.143.1
+starlette==1.8.0
 python-multipart==0.0.32
-sqlalchemy==2.1.1
+sqlalchemy==2.1.4
 werkzeug==3.1.9
 # Flask previously supplied this indirectly; FastAPI signs compatible session,
 # CSRF and token payloads directly, so keep it explicit in the native runtime.
@@ -15,7 +15,7 @@ alembic==1.20.0
 # Declarative JSON request validation (wave A2.4). @validate_body models live in
 # oneirodex/schemas/. Not pulled in transitively today -- pinned like the rest so
 # a rebuilt image resolves the same pydantic-core wheel.
-pydantic==2.13.5
+pydantic==2.14.1
 # pydantic 2.13.5 requires exactly this core; another package on the shared
 # interpreter has twice pulled it to 2.49.0, and pydantic then refuses to import
 # (create_app() SystemError). Pinning it here lets `pip install -r` reassert it.
@@ -26,16 +26,16 @@ pillow==12.3.0
 WTForms_SQLAlchemy==0.4.2
 requests==2.34.2
 psycopg2_binary==2.9.13
-python_dotenv==1.2.3
+python_dotenv==1.2.4
 psutil==7.2.2
-tenacity==9.1.4
+tenacity==9.2.1
 email_validator==2.3.0
 uvicorn[standard]==0.54.0
 aiofiles==25.1.0
 zipstream_new==1.1.8
 howlongtobeatpy==1.0.24
-authlib==1.8.0
+authlib==1.9.1
 cryptography==50.0.2
-py7zr==1.1.3
+py7zr==1.1.4
 rarfile==4.5
 watchdog==6.0.0