diff --git a/backend/requirements.txt b/backend/requirements.txt
index 02433cf5..22835561 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -1,39 +1,39 @@
 # Core FastAPI and web framework dependencies
-annotated-types==0.7.0
-anyio==4.13.0
-click==8.4.0
-fastapi==0.136.1
+annotated-types==0.8.0
+anyio==4.14.2
+click==8.4.2
+fastapi==0.140.6
 h11==0.16.0
-idna==3.15
+idna==3.18
 pydantic==2.13.3
 pydantic[email]
-pydantic-settings==2.14.1
+pydantic-settings==2.14.2
 python-dotenv==1.2.2
 python-json-logger==4.1.0
 sniffio==1.3.1
-starlette==1.0.0
+starlette==1.3.1
 typing-inspection==0.4.2
-typing_extensions==4.15.0
-uvicorn==0.47.0
+typing_extensions==4.16.0
+uvicorn==0.51.0
 
 # Database dependencies
-sqlalchemy==2.0.49
+sqlalchemy==2.0.51
 psycopg2-binary==2.9.12
-alembic==1.18.4
+alembic==1.18.5
 uuid6==2025.0.1
 
 # Authentication and security
 # PyJWT — primary JWT library (AUTH-04, Phase 5 D-06).
-PyJWT==2.12.1
+PyJWT==2.13.0
 bcrypt==5.0.0
-python-multipart==0.0.28
-pyotp==2.9.0
+python-multipart==0.0.32
+pyotp==2.10.0
 qrcode[pil]==8.2
 webauthn==2.7.1
-google-auth==2.53.0
+google-auth==2.56.2
 
 requests==2.34.2
-beautifulsoup4==4.14.3
+beautifulsoup4==4.15.0
 defusedxml==0.7.1
 # Circuit breaker for crawler rate-limit protection (CRAWL-04). Pinned exact
 # version; see threat model T-03-02-02 for supply-chain posture.
@@ -47,9 +47,9 @@ pybreaker==1.4.1
 curl_cffi==0.15.0
 
 # Image storage and processing
-boto3==1.43.9
-boto3-stubs[s3,sesv2]==1.43.9  # Type stubs for boto3 S3 and SES clients
-Pillow==12.2.0
+boto3==1.43.56
+boto3-stubs[s3,sesv2]==1.43.56  # Type stubs for boto3 S3 and SES clients
+Pillow==12.3.0
 
 # Observability (Phase 2 / OBS-01 + OBS-02)
 sentry-sdk>=2.60.0,<3
@@ -61,20 +61,20 @@ sentry-sdk>=2.60.0,<3
 aws-embedded-metrics>=3.5.0,<4
 
 # Testing: in-memory S3 mock (used with pytest fixtures; never runs in production)
-moto[s3]==5.2.1
+moto[s3]==5.2.2
 
 # Testing dependencies
-pytest==9.0.3
-pytest-asyncio==1.3.0
+pytest==9.1.1
+pytest-asyncio==1.4.0
 pytest-xdist==3.8.0
 pytest-cov==7.1.0
 pytest-recording==0.13.4
 httpx==0.28.1
 
 # Development tools
-black==26.5.0
+black==26.5.1
 isort==8.0.1
-mypy==2.1.0
+mypy==2.3.0
 watchdog==6.0.0
 
 # Perf-gate load testing (M002/S05/T05). Pure-Python load runner; the gate