diff --git a/apps/api/requirements-mcp.txt b/apps/api/requirements-mcp.txt
index ef952f7..d896eca 100644
--- a/apps/api/requirements-mcp.txt
+++ b/apps/api/requirements-mcp.txt
@@ -1,3 +1,3 @@
 # Servidor MCP local (mcp_server.py); no forma parte del servicio web.
 -r requirements.txt
-mcp>=1.30
+mcp>=2.3.0
diff --git a/apps/api/requirements.txt b/apps/api/requirements.txt
index d1f67d0..e67f05c 100644
--- a/apps/api/requirements.txt
+++ b/apps/api/requirements.txt
@@ -1,27 +1,27 @@
 # API web (Render). Versiones revisadas con OSV-Scanner (oct-2026); el CI instala
 # este archivo y ejecuta apps/api/tests para validar cada actualización.
-fastapi==0.161.1
-starlette>=1.3.1
+fastapi==0.162.0
+starlette>=1.10.0
 uvicorn==0.54.0
 python-multipart==0.0.32
-pydantic>=2.11,<3
+pydantic>=2.14.2,<3
 psycopg2-binary==2.9.13
 sqlalchemy==2.1.6
 python-dotenv==1.2.4
 geopandas==1.2.0
 shapely==2.2.0
 pyogrio==0.13.0
-duckdb>=1.1.0,<2
-polars>=1.20,<2
-pandas==3.0.6
-pyarrow>=18
+duckdb>=2.0.0,<3
+polars>=2.1.0,<3
+pandas==3.1.0
+pyarrow>=26.0.0
 openpyxl==3.1.5
-brotli-asgi==1.6.0
+brotli-asgi==1.7.0
 sentry-sdk[fastapi]==2.73.0
-upstash-redis>=1.4,<2
+upstash-redis>=1.8.0,<2
 httpx==0.28.1
 
 # Mínimos de dependencias transitivas con vulnerabilidades corregidas
-anyio>=4.14.2
-certifi>=2026.10.19
-idna>=3.15
+anyio>=4.15.1
+certifi>=2026.10.23
+idna>=3.20