diff --git a/frameworks/javascript/tanstack/app/package-lock.json b/frameworks/javascript/tanstack/app/package-lock.json
index 9bb1cc8..0d31332 100644
--- a/frameworks/javascript/tanstack/app/package-lock.json
+++ b/frameworks/javascript/tanstack/app/package-lock.json
@@ -3499,9 +3499,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz",
-      "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==",
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.2.tgz",
+      "integrity": "sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==",
       "funding": [
         {
           "type": "github",
@@ -4044,9 +4044,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+      "version": "3.3.17",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz",
+      "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==",
       "funding": [
         {
           "type": "github",
@@ -4109,9 +4109,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.15",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
-      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+      "version": "8.5.25",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz",
+      "integrity": "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==",
       "funding": [
         {
           "type": "opencollective",
@@ -4128,7 +4128,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.12",
+        "nanoid": "^3.3.16",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -4590,9 +4590,9 @@
       "license": "MIT"
     },
     "node_modules/undici": {
-      "version": "8.5.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.5.0.tgz",
-      "integrity": "sha512-xamtWoB1EshgjpmlXd7GGm2VfdDtw1+rD8uhry8pSNW3If6S8E0m2T2+orSKeZXEn/aPJMviCpDBA65WJt8zhg==",
+      "version": "8.10.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.10.0.tgz",
+      "integrity": "sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/frameworks/javascript/tanstack/app/package.json b/frameworks/javascript/tanstack/app/package.json
index bdaea3a..42ed098 100644
--- a/frameworks/javascript/tanstack/app/package.json
+++ b/frameworks/javascript/tanstack/app/package.json
@@ -59,11 +59,11 @@
     "@tanstack/router-core": "1.171.6",
     "esbuild": ">=0.28.1",
     "h3": ">=2.0.1-rc.18",
-    "postcss": ">=8.5.10",
+    "postcss": ">=8.5.18",
     "launch-editor": ">=2.14.1",
     "shell-quote": ">=1.9.0",
-    "js-yaml": ">=4.3.0",
-    "undici": ">=7.28.0",
+    "js-yaml": ">=5.2.2",
+    "undici": ">=8.9.0",
     "ws": ">=8.20.1"
   }
 }
diff --git a/frameworks/javascript/tanstack/package-lock.json b/frameworks/javascript/tanstack/package-lock.json
index 42d82ee..5d9f61a 100644
--- a/frameworks/javascript/tanstack/package-lock.json
+++ b/frameworks/javascript/tanstack/package-lock.json
@@ -194,9 +194,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.1.1.tgz",
+      "integrity": "sha512-YPOs1zD5TG2+EZt+r88LwF6mclA7TPkpwMP7ZN3TO2HiHS8TXvq7QA/17iJsV9dubcLo/f8eEYqMBruyQV21hQ==",
       "dev": true,
       "funding": [
         {
diff --git a/frameworks/javascript/tanstack/package.json b/frameworks/javascript/tanstack/package.json
index 49214b3..1488b35 100644
--- a/frameworks/javascript/tanstack/package.json
+++ b/frameworks/javascript/tanstack/package.json
@@ -12,7 +12,7 @@
     "prettier": "3.8.3"
   },
   "overrides": {
-    "fast-uri": ">=3.1.2",
+    "fast-uri": ">=3.1.4",
     "lodash": ">=4.18.0"
   }
 }
diff --git a/mflix/server/python-fastapi/requirements.in b/mflix/server/python-fastapi/requirements.in
index afbf8ec..a4f2c31 100644
--- a/mflix/server/python-fastapi/requirements.in
+++ b/mflix/server/python-fastapi/requirements.in
@@ -62,7 +62,7 @@ rich-toolkit~=0.15.1    # Extensions for the 'rich' library
 # Minimum versions for indirect dependencies.
 # ------------------------------------------------------------------------------
 filelock>=3.20.3        # Transitive dep via huggingface-hub
-aiohttp>=3.14.1         # CVE-2026-54273 / GHSA-4fvr-rgm6-gqmc (pipelined request queue)
+aiohttp>=3.14.3         # CVE-2026-69244 / GHSA-cq5v-8q36-5273 (Dependabot #126-128)
 orjson>=3.11.7          # Transitive dep via langsmith (CVE fix)
 langchain-core>=1.4.0   # Transitive dep via langchain-text-splitters (Dependabot #63)
 langsmith>=0.8.18       # Transitive dep via langchain-core (Dependabot #101, GHSA-f4xh-w4cj-qxq8)
diff --git a/mflix/server/python-fastapi/requirements.txt b/mflix/server/python-fastapi/requirements.txt
index 7cc0f1d..f5f209e 100644
--- a/mflix/server/python-fastapi/requirements.txt
+++ b/mflix/server/python-fastapi/requirements.txt
@@ -5,7 +5,7 @@
 #    pip-compile --no-annotate --output-file=requirements.txt --strip-extras requirements.in
 #
 aiohappyeyeballs==2.6.2
-aiohttp==3.14.1
+aiohttp==3.14.3
 aiolimiter==1.2.1
 aiosignal==1.4.0
 annotated-doc==0.0.4