diff --git a/pyproject.toml b/pyproject.toml
index 026c999..7ca1b45 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -27,19 +27,19 @@ classifiers = [
 ]
 dynamic = ["version"]
 dependencies = [
-    "PyMuPDF>=1.24.0",
-    "pytesseract>=0.3.10",
+    "PyMuPDF>=1.28.0",
+    "pytesseract>=0.3.13",
     # Security floor: 12.2.0 carries 9 known CVEs (PYSEC-2026-2255/3451-3454,
     # CVE-2026-54058/59198/59200/59204), all fixed in 12.3.0. pip-audit is a hard
     # CI gate (T-013), so the floor is pinned here rather than left to the resolver.
     "Pillow>=12.3.0",
-    "openai>=1.40.0",
-    "python-dotenv>=1.0.0",
-    "PyYAML>=6.0",
-    "rich>=13.0.0",
+    "openai>=2.47.0",
+    "python-dotenv>=1.2.2",
+    "PyYAML>=6.0.3",
+    "rich>=15.0.0",
     # PDF/UA structure-tree tagging (T-004). Wheels bundle qpdf — no apt package
     # needed, so the air-gapped image stays self-contained.
-    "pikepdf>=9.0",
+    "pikepdf>=10.10.0",
 ]
 
 [project.urls]
@@ -55,27 +55,27 @@ figmark-server = "figmark.api:main"
 # The HTTP service. Kept optional so the CLI/PyPI install stays lean; the
 # container image installs ".[server]".
 server = [
-    "fastapi>=0.119,<1.0",
+    "fastapi>=0.139.2,<1.0",
     # Pin Starlette's floor directly — FastAPI's own floor (>=0.46.0) has left
     # known CVEs unpatched twice (CVE-2025-62727, then CVE-2026-48710/BadHost,
     # fixed in 1.0.1). See docs/tickets/T-009.
-    "starlette>=1.0.1,<2.0",
-    "uvicorn[standard]>=0.32,<1.0",
-    "python-multipart>=0.0.9,<0.1",
+    "starlette>=1.3.1,<2.0",
+    "uvicorn[standard]>=0.51.0,<1.0",
+    "python-multipart>=0.0.32,<0.1",
 ]
 dev = [
-    "pytest>=8.0.0",
-    "pytest-cov>=5.0",
-    "mypy>=1.11",
-    "ruff>=0.6.0",
-    "httpx>=0.27",
-    "fastapi>=0.119,<1.0",
+    "pytest>=9.1.1",
+    "pytest-cov>=7.1.0",
+    "mypy>=2.3.0",
+    "ruff>=0.15.22",
+    "httpx>=0.28.1",
+    "fastapi>=0.139.2,<1.0",
     # Pin Starlette's floor directly — FastAPI's own floor (>=0.46.0) has left
     # known CVEs unpatched twice (CVE-2025-62727, then CVE-2026-48710/BadHost,
     # fixed in 1.0.1). See docs/tickets/T-009.
-    "starlette>=1.0.1,<2.0",
-    "uvicorn[standard]>=0.32,<1.0",
-    "python-multipart>=0.0.9,<0.1",
+    "starlette>=1.3.1,<2.0",
+    "uvicorn[standard]>=0.51.0,<1.0",
+    "python-multipart>=0.0.32,<0.1",
 ]
 
 [tool.hatch.version]