diff --git a/backend/requirements-oracle.txt b/backend/requirements-oracle.txt
index b43383f..e03c29e 100644
--- a/backend/requirements-oracle.txt
+++ b/backend/requirements-oracle.txt
@@ -9,4 +9,4 @@
 # Docker image therefore bundles Instant Client 19.32, which can connect to
 # Oracle Database 11.2 and newer. The high-level API used here (connect,
 # cursor, execute, init_oracle_client, and call_timeout) is stable in 4.x.
-oracledb>=4.0.2,<5
+oracledb>=26.0.0,<27
diff --git a/backend/requirements.txt b/backend/requirements.txt
index 179fac6..f10cba2 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -2,16 +2,16 @@
 # fastapi 0.138.x drops Starlette's upper bound, letting us pull a Starlette
 # release with no open advisories (CVE remediation — see requirements.lock).
 fastapi==0.141.1
-uvicorn[standard]==0.52.3
+uvicorn[standard]==0.53.0
 
 # Configuration
 pydantic-settings==2.15.0
 
 # Database - PostgreSQL
-sqlalchemy==2.0.52
-alembic==1.19.1
+sqlalchemy==2.0.54
+alembic==1.20.0
 asyncpg>=0.31.0
-psycopg2-binary>=2.9.12
+psycopg2-binary>=2.9.13
 
 # Oracle connectivity (optional — install separately; see requirements-oracle.txt)
 # python-oracledb is imported lazily inside ConnectionService.test_connection()
@@ -21,11 +21,11 @@ psycopg2-binary>=2.9.12
 apscheduler==3.11.3
 
 # Auth
-PyJWT==2.13.0
+PyJWT==2.14.0
 bcrypt==5.0.0
 
 # Encryption (credential storage at rest)
-cryptography==50.0.0
+cryptography==50.0.1
 
 # Logging
 structlog==26.1.0
@@ -39,5 +39,5 @@ pytest-asyncio==1.4.0
 pytest-cov==7.1.0
 
 # Linting and type checking
-ruff==0.16.3
-mypy==2.3.0
+ruff==0.16.8
+mypy==2.3.1