dependabot · Oct 31, 2026
diff --git a/apps/api/pyproject.toml b/apps/api/pyproject.toml
@@ -42,7 +42,7 @@ dependencies = [
     "uvicorn[standard]>=0.53.0",
     "pydantic-settings>=2.2",
     "sqlalchemy>=2.0",
-    "cryptography>=43",
+    "cryptography>=50.0.2",
     "httpx>=0.27",
     # Enqueue background MCP index syncs onto the worker's Celery queue (F20).
     "celery>=5.3",

diff --git a/packages/agent-runtime/pyproject.toml b/packages/agent-runtime/pyproject.toml
@@ -9,7 +9,7 @@ authors = [{ name = "The Forge Authors" }]
 dependencies = [
     "forge-contracts",
     "forge-orchestration-policy",
-    "langgraph>=1.2.9,<2",
+    "langgraph>=1.2.18,<2",
     "docker>=7.2.0,<8",
     "forge-policy",
 ]

diff --git a/packages/approval-sdk/pyproject.toml b/packages/approval-sdk/pyproject.toml
@@ -8,7 +8,7 @@ license = { text = "Apache-2.0" }
 authors = [{ name = "The Forge Authors" }]
 dependencies = [
     "forge-contracts",
-    "pydantic>=2.7",
+    "pydantic>=2.14.1",
 ]
 
 [tool.uv.sources]

diff --git a/packages/auth-sdk/pyproject.toml b/packages/auth-sdk/pyproject.toml
@@ -8,7 +8,7 @@ license = { text = "Apache-2.0" }
 authors = [{ name = "The Forge Authors" }]
 dependencies = [
     "forge-contracts",
-    "cryptography>=43",
+    "cryptography>=50.0.2",
 ]
 
 [build-system]

diff --git a/packages/board-core/pyproject.toml b/packages/board-core/pyproject.toml
@@ -12,7 +12,7 @@ dependencies = [
     "forge-policy",
     "forge-skill",
     "forge-workflow",
-    "sqlalchemy>=2.0",
+    "sqlalchemy>=2.1.6",
 ]
 
 [build-system]

diff --git a/packages/contracts/pyproject.toml b/packages/contracts/pyproject.toml
@@ -7,7 +7,7 @@ requires-python = ">=3.14"
 license = { text = "Apache-2.0" }
 authors = [{ name = "The Forge Authors" }]
 dependencies = [
-    "pydantic>=2.7,<3",
+    "pydantic>=2.14.1,<3",
 ]
 
 [build-system]

diff --git a/packages/db/pyproject.toml b/packages/db/pyproject.toml
@@ -8,7 +8,7 @@ license = { text = "Apache-2.0" }
 authors = [{ name = "The Forge Authors" }]
 dependencies = [
     "forge-contracts",
-    "sqlalchemy>=2.0",
+    "sqlalchemy>=2.1.6",
     "alembic>=1.13",
     "pgvector>=0.5.0",
     "psycopg[binary]>=3.3.5",

diff --git a/packages/deploy-core/pyproject.toml b/packages/deploy-core/pyproject.toml
@@ -11,7 +11,7 @@ dependencies = [
     "forge-db",
     "forge-policy",
     "sqlalchemy>=2.0",
-    "pydantic>=2.0",
+    "pydantic>=2.14.1",
     "pyyaml>=6.0",
 ]
 

diff --git a/packages/evaluation/pyproject.toml b/packages/evaluation/pyproject.toml
@@ -19,7 +19,7 @@ dependencies = [
 # The learned local embedder for the honest real-corpus eval (HARD-04). Optional
 # so the base package and default test suite never require torch. uv lock owned
 # by HARD-14.
-eval = ["sentence-transformers>=3.0"]
+eval = ["sentence-transformers>=6.2.0"]
 
 [project.scripts]
 # HARD-12: the automated RELEASE_READINESS meta-gate. Runs/inspects every spec

diff --git a/packages/knowledge-core/pyproject.toml b/packages/knowledge-core/pyproject.toml
@@ -9,7 +9,7 @@ authors = [{ name = "The Forge Authors" }]
 dependencies = [
     "forge-contracts",
     "forge-db",
-    "numpy>=2.5.1",
+    "numpy>=2.5.4",
     "httpx>=0.27",
     # Tree-sitter multi-language code chunking backend (Task H2). The stdlib
     # ``ast`` path remains the Python fallback when these are unavailable.

diff --git a/packages/marketplace-sdk/pyproject.toml b/packages/marketplace-sdk/pyproject.toml
@@ -10,7 +10,7 @@ dependencies = [
     "forge-contracts",
     "forge-skill",
     "cryptography>=43",
-    "pydantic>=2.7",
+    "pydantic>=2.14.1",
     "pyyaml>=6.0",
 ]
 

diff --git a/packages/multi-agent-coordinator/pyproject.toml b/packages/multi-agent-coordinator/pyproject.toml
@@ -13,7 +13,7 @@ dependencies = [
     "forge-skill",
     "forge-db",
     "forge-knowledge",
-    "sqlalchemy>=2.0",
+    "sqlalchemy>=2.1.6",
 ]
 
 [build-system]

diff --git a/packages/observability/pyproject.toml b/packages/observability/pyproject.toml
@@ -10,7 +10,7 @@ dependencies = [
     "forge-contracts",
     "forge-db",
     "forge-auth",
-    "pydantic>=2.7",
+    "pydantic>=2.14.1",
     "sqlalchemy>=2.0",
     # Attested Changesets (F41 slice `dsse-signer`): detached Ed25519 over the
     # DSSE PAE encoding, same crypto dependency forge-auth/forge-marketplace use.

diff --git a/packages/orchestration-policy/pyproject.toml b/packages/orchestration-policy/pyproject.toml
@@ -8,7 +8,7 @@ license = { text = "Apache-2.0" }
 authors = [{ name = "The Forge Authors" }]
 dependencies = [
     "forge-contracts",
-    "pydantic>=2.0",
+    "pydantic>=2.14.1",
 ]
 
 [build-system]

diff --git a/packages/spec-engine/pyproject.toml b/packages/spec-engine/pyproject.toml
@@ -8,7 +8,7 @@ license = { text = "Apache-2.0" }
 authors = [{ name = "The Forge Authors" }]
 dependencies = [
     "forge-contracts",
-    "pydantic>=2.0",
+    "pydantic>=2.14.1",
     "pyyaml>=6.0",
 ]
 

diff --git a/packages/workflow-engine/pyproject.toml b/packages/workflow-engine/pyproject.toml
@@ -15,7 +15,7 @@ dependencies = [
     # Update API + time-skipping WorkflowEnvironment are version-sensitive.
     "temporalio==1.33.0",
     # F25 — RedactingEncryptionCodec AES-GCM encryption of Temporal payloads.
-    "cryptography>=43",
+    "cryptography>=50.0.2",
 ]
 
 [build-system]

diff --git a/pyproject.toml b/pyproject.toml
@@ -34,23 +34,23 @@ dependencies = [
 
 [dependency-groups]
 dev = [
-    "pytest>=8.0",
-    "pytest-asyncio>=0.23",
+    "pytest>=9.2.0",
+    "pytest-asyncio>=1.4.1",
     "pytest-cov>=5.0",
-    "ruff>=0.15.21",
-    "mypy>=2.2.0",
+    "ruff>=0.17.3",
+    "mypy>=2.4.1",
     "httpx>=0.27",
     # Validates the Helm chart values files against deploy/helm/forge/values.schema.json (F24).
     "jsonschema>=4.0",
     "pyyaml>=6.0",
     "bandit>=1.9.4",
     "pip-audit>=2.10.1",
-    "cyclonedx-bom>=7.3.0",
-    "semgrep>=1.169.0",
+    "cyclonedx-bom>=7.6.0",
+    "semgrep>=1.182.1",
     # HARD-12: single-source-of-truth versioning + conventional-commit lint +
     # SemVer bump + CHANGELOG generation. `uv run cz …` works with no global
     # install. Drives `make bump` / `make changelog` / the CI commit-lint step.
-    "commitizen>=3.29",
+    "commitizen>=4.19.3",
 ]
 
 # The workspace root is a virtual project: its dependencies (every member) are