diff --git a/requirements-dev.txt b/requirements-dev.txt
index d085065..49c8386 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -4,7 +4,7 @@
 #   mypy refigure
 #   pytest --cov --cov-report=term-missing
 -r requirements.txt
-ruff==0.16.6
+ruff==0.16.7
 mypy==2.3.1
 pytest==9.1.1
 pytest-cov==7.1.0
@@ -14,11 +14,11 @@ types-openpyxl==3.1.5.20260827
 # in the source pipeline). Installed here so the dev/test environment covers that code path;
 # NOT declared as a hard dependency of any published extra.
 mermaidx==0.9.5
-hypothesis==6.167.1
+hypothesis==6.168.0
 # mcp — pulled in for the dev/test environment same as mermaidx above (not
 # a hard dependency of any extra except [mcp] itself); pins anyio/starlette/
 # uvicorn transitively.
-mcp==2.1.1
+mcp==2.2.0
 # httpx — tests/unit/mcp/test_http.py drives the MCP HTTP transport in-process
 # via httpx.AsyncClient/httpx.ASGITransport. Not a hard dependency of any
 # extra (mcp>=2.0 itself already depends on httpx2, not this) — until
diff --git a/requirements.txt b/requirements.txt
index a497eb3..07f9657 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -2,9 +2,9 @@
 # extras in pyproject.toml — installs everything needed to work on every
 # format path at once). Install: uv pip install -r requirements.txt
 lxml==6.1.3         # core chart engine (chart_data.py/chart_render.py) — always required
-mammoth==1.12.1     # DOCX -> HTML (refigure/docx.py), [docx] extra
+mammoth==1.12.2     # DOCX -> HTML (refigure/docx.py), [docx] extra
 markdownify==1.2.3  # HTML -> Markdown (refigure/docx.py), [docx] extra
 openpyxl==3.1.5     # XLSX read + chart access (refigure/xlsx.py), [xlsx] extra
 pdfplumber==0.11.10  # docx-group soffice-render crop (refigure/vlm.py), [vlm] extra
-openai==3.8.0      # OpenAIClient (refigure/vlm/client.py), [vlm-direct] extra
-anthropic==1.4.0  # AnthropicClient (refigure/vlm/client.py), [vlm-direct] extra
+openai==3.13.0      # OpenAIClient (refigure/vlm/client.py), [vlm-direct] extra
+anthropic==1.5.0  # AnthropicClient (refigure/vlm/client.py), [vlm-direct] extra