diff --git a/setup/requirements-finetune.txt b/setup/requirements-finetune.txt
index 2efd0b4..688d733 100644
--- a/setup/requirements-finetune.txt
+++ b/setup/requirements-finetune.txt
@@ -1,4 +1,4 @@
 pyarrow>=25.0.1
 scikit-learn>=1.4
-scipy>=1.18.0
+scipy>=1.18.1
 httpx>=0.28.1
diff --git a/setup/requirements-test.txt b/setup/requirements-test.txt
index 228d9f4..71a9f8b 100644
--- a/setup/requirements-test.txt
+++ b/setup/requirements-test.txt
@@ -30,4 +30,4 @@ jsonschema>=4.26.0
 pandas>=3.0.5,<4.0
 numpy>=2.4.6
 tqdm>=4.67.1
-lxml>=6.1.1
+lxml>=6.1.2
diff --git a/setup/requirements.txt b/setup/requirements.txt
index f337331..42125b4 100644
--- a/setup/requirements.txt
+++ b/setup/requirements.txt
@@ -14,12 +14,12 @@ fasttext>=0.9.3
 # cannot silently become a no-op; the hook then degrades to one loud warning per run.
 # Declared here as well as in requirements-test.txt so the published image has it.
 jsonschema>=4.26.0
-lxml>=6.1.1
+lxml>=6.1.2
 pandas>=3.0.5,<4.0
 pillow>=12.3.0
 torch>=2.1,<3.0
 tqdm>=4.70.0
 transformers>=4.57.6,<5.0
-httpx2>=2.10.0
-bitsandbytes>=0.50.1
+httpx2>=2.12.0
+bitsandbytes>=0.50.2
 accelerate>=1.14.0