diff --git a/book/requirements.txt b/book/requirements.txt
index fe00f19d..28d3867a 100644
--- a/book/requirements.txt
+++ b/book/requirements.txt
@@ -1,7 +1,7 @@
-Markdown>=3.11,<4
+Markdown>=3.11.1,<4
 Pygments>=2.21.0,<3
 PyYAML>=6,<7
 WeasyPrint>=70.0,<71
-pymdown-extensions>=12.1,<13
+pymdown-extensions>=12.3,<13
 CairoSVG>=2.9.1,<3
-pdfplumber>=0.11.9,<0.12
+pdfplumber>=0.11.10,<0.12
diff --git a/pyproject.toml b/pyproject.toml
index 4dbf4fc3..5d730dcc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -26,7 +26,7 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "pydantic>=2.13.5",
+    "pydantic>=2.14.1",
     "pyyaml>=6.0.3",
 ]
 
@@ -40,12 +40,12 @@ Issues = "https://github.com/fireflyframework/fireflyframework-pyfly/issues"
 templates = ["jinja2>=3.1.6"]
 webapp = ["pyfly[web,templates,security]"]
 web = [
-    "starlette>=1.7.0",
+    "starlette>=1.8.0",
     "uvicorn[standard]>=0.54.0",
     "python-multipart>=0.0.32",
 ]
 data-relational = [
-    # Requires SQLAlchemy >= 2.0.50 (2.0.49 broke pool pre-ping on the MySQL/MariaDB async drivers, C089) and is
+    # Requires SQLAlchemy >= 2.1.5 (2.0.49 broke pool pre-ping on the MySQL/MariaDB async drivers, C089) and is
     # tested on the 2.0 and 2.1 lines: the lock holds the latest release, and CI runs the suite on the newest 2.0
     # release too (test-sqlalchemy-2-0). No upper bound; what differs between the lines is bridged in
     # pyfly.data.relational.sqlalchemy.compat.
@@ -54,7 +54,7 @@ data-relational = [
     "aiosqlite>=0.22.1",
 ]
 testing = [
-    "jsonpath-ng>=1.8.0",
+    "jsonpath-ng>=1.11.0",
 ]
 argon2 = [
     "argon2-cffi>=25.1.0",  # Argon2PasswordEncoder (OWASP-preferred password hashing)
@@ -67,7 +67,7 @@ data-document = [
     "beanie>=2.2.0",
 ]
 postgresql = [
-    "asyncpg>=0.31.0",
+    "asyncpg>=0.32.0",
 ]
 mysql = [
     # MySQL and MariaDB (mysql+asyncmy:// and mariadb+asyncmy://). asyncmy rather than aiomysql: aiomysql
@@ -75,17 +75,17 @@ mysql = [
     # checkout raised TypeError (C089); asyncmy's pre-ping worked there and works on every later 2.0.x.
     # 0.2.11 is the oldest release the MySQL/MariaDB lanes were run on (with SQLAlchemy 2.0.50) and the
     # oldest with wheels for Python 3.12 and 3.13.
-    "asyncmy>=0.2.11",
+    "asyncmy>=0.2.16",
 ]
 eda = [
     "aiokafka>=0.14.0",
-    "aio-pika>=10.0.4",
+    "aio-pika>=10.1.1",
 ]
 fastapi = [
-    "fastapi>=0.141.1",
+    "fastapi>=0.143.3",
 ]
 granian = [
-    "granian>=2.8.3",
+    "granian>=2.8.4",
 ]
 hypercorn = [
     "hypercorn>=0.18.0",
@@ -94,7 +94,7 @@ kafka = [
     "aiokafka>=0.14.0",
 ]
 rabbitmq = [
-    "aio-pika>=10.0.4",
+    "aio-pika>=10.1.1",
 ]
 redis = [
     "redis[hiredis]>=8.1.0",
@@ -109,17 +109,17 @@ client = [
 feature-flags = [
     # OpenFeature SDK + flagd's reference in-process evaluator (FlagdCore, spec D3); httpx serves the http source.
     "openfeature-sdk>=0.10.0",
-    "openfeature-flagd-core>=1.0.0",
+    "openfeature-flagd-core>=2.0.0",
     "httpx>=0.28",
 ]
 config-server-git = [
-    "GitPython>=3.1.62",
+    "GitPython>=3.2.1",
 ]
 grpc = [
     "grpcio>=1.84.0",
 ]
 websocket = [
-    "websockets>=17.1",
+    "websockets>=17.2",
 ]
 idp-azure = [
     "httpx>=0.28.1",
@@ -128,19 +128,19 @@ idp-keycloak = [
     "httpx>=0.28.1",
 ]
 idp-cognito = [
-    "boto3>=1.43.103",
+    "boto3>=1.43.114",
 ]
 ecm-aws = [
-    "boto3>=1.43.103",
+    "boto3>=1.43.114",
 ]
 ecm-azure = [
-    "azure-storage-blob>=12.30.3",
+    "azure-storage-blob>=12.31.0",
 ]
 observability = [
     "prometheus-client>=0.26.0",
-    "opentelemetry-api>=1.45.0",
-    "opentelemetry-sdk>=1.45.0",
-    "opentelemetry-instrumentation-starlette>=0.66b0",
+    "opentelemetry-api>=1.45.1",
+    "opentelemetry-sdk>=1.45.1",
+    "opentelemetry-instrumentation-starlette>=0.66b1",
     "structlog>=26.1.0",
 ]
 scheduling = [
@@ -152,9 +152,9 @@ pii = [
     "presidio-anonymizer @ git+https://github.com/data-privacy-stack/presidio.git@5e2fcea990aa3b99660d2aea9121d0ba74a8940b#subdirectory=presidio-anonymizer",
 ]
 security = [
-    "pyjwt[crypto]>=2.15.0",
+    "pyjwt[crypto]>=2.15.1",
     "bcrypt>=5.0.0",
-    "cryptography>=50.0.1",
+    "cryptography>=50.0.2",
     "pyotp>=2.10.0",
 ]
 notifications = [
@@ -171,33 +171,33 @@ shell = [
 ]
 web-fast = [
     "pyfly[web,granian]",
-    "uvloop>=0.22.1; sys_platform != 'win32'",
+    "uvloop>=0.23.0; sys_platform != 'win32'",
 ]
 web-fastapi = [
     "pyfly[fastapi,granian]",
-    "uvloop>=0.22.1; sys_platform != 'win32'",
+    "uvloop>=0.23.0; sys_platform != 'win32'",
 ]
 full = [
     "pyfly[web,templates,data-relational,data-document,postgresql,mysql,eda,cache,client,grpc,websocket,ecm-aws,ecm-azure,observability,security,scheduling,cli,shell,kafka,rabbitmq,redis,granian,fastapi,hypercorn,idp-azure,idp-keycloak,idp-cognito,notifications,config-server-git,feature-flags]",
 ]
 
 [dependency-groups]
-browser = ["playwright>=1.63.0"]
+browser = ["playwright>=1.64.0"]
 dev = [
     "pytest>=9.1.1",
     "pytest-asyncio>=1.4.0",
     "pytest-cov>=7.1.0",
-    "coverage[toml]>=7.16.1",
-    "mypy>=2.3.1",
-    "ruff>=0.16.9",
-    "jsonpath-ng>=1.8.0",
+    "coverage[toml]>=7.16.2",
+    "mypy>=2.4.0",
+    "ruff>=0.17.1",
+    "jsonpath-ng>=1.11.0",
     "respx>=0.23.1",
     "aiosmtpd>=1.4.6",
     # The OTLP exporter is the DEFAULT tracing exporter (auto_configuration selects it as soon as an
     # endpoint is configured), yet it appears in no extra, so nothing in CI ever imported it and the
     # whole OTLP path — including how the endpoint is built — went unexercised. It is a dev dependency
     # rather than a new runtime one: applications choose their exporter and pay for it deliberately.
-    "opentelemetry-exporter-otlp-proto-http>=1.45.0",
+    "opentelemetry-exporter-otlp-proto-http>=1.45.1",
     # The second MySQL/MariaDB async driver the docs name (mysql+aiomysql://). The integration lanes run
     # pool pre-ping through both drivers, so neither can regress unseen (C089).
     "aiomysql>=0.3.2",