diff --git a/backend/pyproject.toml b/backend/pyproject.toml
index 72dedf3..eed72b6 100644
--- a/backend/pyproject.toml
+++ b/backend/pyproject.toml
@@ -6,13 +6,13 @@ description = "Resource allocation engine: equipment engineers to tool-downs and
 requires-python = ">=3.11"
 readme = "../README.md"
 dependencies = [
-    "fastapi==0.142.2",
+    "fastapi==0.146.0",
     "uvicorn[standard]==0.54.0",
-    "pydantic==2.13.5",
-    "pydantic-settings==2.15.0",
+    "pydantic==2.14.1",
+    "pydantic-settings==2.16.0",
     "numpy>=2.3,<3",
     "scipy>=1.16,<2",
-    "pyvrp==0.14.0",
+    "pyvrp==0.14.1",
     "qdrant-client==1.19.1",
     "pyjwt[crypto]==2.15.1",
     "psycopg[binary]==3.3.6",
diff --git a/backend/requirements-dev.txt b/backend/requirements-dev.txt
index a9b9774..b1e5750 100644
--- a/backend/requirements-dev.txt
+++ b/backend/requirements-dev.txt
@@ -2,7 +2,7 @@
 pytest==9.1.1
 pytest-cov==7.1.0
 httpx==0.28.1
-ruff==0.16.9
+ruff==0.17.1
 pip-audit==2.10.1
 pyyaml==6.0.3            # docs-site consistency test reads mkdocs.yml
 scikit-learn==1.9.1         # quantile model in scripts/duration_study.py; dev only
diff --git a/backend/requirements.txt b/backend/requirements.txt
index e678d12..6f0cd2c 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -1,12 +1,12 @@
 # Runtime dependencies. Everything is free/open-source; nothing needs an API key.
 # Exact pins, except numpy/scipy: ranges so Python 3.11-3.14 each get a matching wheel.
-fastapi==0.142.2
+fastapi==0.146.0
 uvicorn[standard]==0.54.0
-pydantic==2.13.5
-pydantic-settings==2.15.0
+pydantic==2.14.1
+pydantic-settings==2.16.0
 numpy>=2.3,<3              # range, not a pin: 2.5 dropped Python 3.11
 scipy>=1.16,<2            # Hungarian (linear_sum_assignment) and the exact MILP (HiGHS)
-pyvrp==0.14.0            # state-of-the-art VRPTW iterated local search, MIT
+pyvrp==0.14.1            # state-of-the-art VRPTW iterated local search, MIT
 qdrant-client==1.19.1    # repair-history vector search (embedded locally, server in prod)
 pyjwt[crypto]==2.15.1    # verifies Supabase (ES256/RS256 via JWKS) and demo (HS256) tokens
 psycopg[binary]==3.3.6   # Postgres / Supabase in production; unused with the SQLite default