diff --git a/requirements-optional.txt b/requirements-optional.txt
index db624f4c9..78b01506f 100644
--- a/requirements-optional.txt
+++ b/requirements-optional.txt
@@ -1,7 +1,7 @@
 # Optional dependencies — install only if you use the corresponding feature.
 # Local OCR for screenshots, scans, labels, and coordinate-grounded text extraction.
 rapidocr==3.9.2
-onnxruntime>=1.20,<2
+onnxruntime>=1.30.0,<2
 # The app handles their absence gracefully (clear error message on first use).
 #
 # Note: chromadb-client + fastembed moved to requirements.txt — RAG, semantic
@@ -46,7 +46,7 @@ PyMuPDF
 # magika (onnxruntime), already a core dep via fastembed. We avoid the
 # [all]/Azure/audio extras (cloud + heavy). Pinned to a release >30 days old per
 # the dependency-age discussion in issue #485.
-markitdown[docx,pptx,xlsx,xls]==0.1.6
+markitdown[docx,pptx,xlsx,xls]==0.1.8
 
 # Photoshop PSD opening / flattened previews / layer inspection.
 psd-tools
diff --git a/requirements.txt b/requirements.txt
index 7fabaae93..4a6ed05df 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -3,9 +3,9 @@ uvicorn
 python-multipart
 python-dotenv
 httpx
-httpcore>=1.0,<2.0
-pydantic>=2.13.4
-pydantic-settings>=2.14.1
+httpcore>=1.0.9,<2.0
+pydantic>=2.13.5
+pydantic-settings>=2.15.0
 SQLAlchemy
 pypdf
 pypdfium2
@@ -46,7 +46,7 @@ bcrypt
 # Built-in servers use the v1 low-level Server decorator API. MCP SDK v2 is a
 # breaking rewrite, so keep fresh installs on the maintained v1 line until the
 # servers are migrated together.
-mcp<2
+mcp<3
 pyotp
 qrcode[pil]
 croniter