diff --git a/frameworks/javascript/tanstack/app/package-lock.json b/frameworks/javascript/tanstack/app/package-lock.json
index 39c328e..9bb1cc8 100644
--- a/frameworks/javascript/tanstack/app/package-lock.json
+++ b/frameworks/javascript/tanstack/app/package-lock.json
@@ -3499,9 +3499,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz",
+      "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==",
       "funding": [
         {
           "type": "github",
@@ -3517,7 +3517,7 @@
         "argparse": "^2.0.1"
       },
       "bin": {
-        "js-yaml": "bin/js-yaml.js"
+        "js-yaml": "bin/js-yaml.mjs"
       }
     },
     "node_modules/jsdom": {
@@ -4350,9 +4350,9 @@
       }
     },
     "node_modules/shell-quote": {
-      "version": "1.8.4",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz",
-      "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==",
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz",
+      "integrity": "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/frameworks/javascript/tanstack/app/package.json b/frameworks/javascript/tanstack/app/package.json
index 78b2538..bdaea3a 100644
--- a/frameworks/javascript/tanstack/app/package.json
+++ b/frameworks/javascript/tanstack/app/package.json
@@ -61,7 +61,8 @@
     "h3": ">=2.0.1-rc.18",
     "postcss": ">=8.5.10",
     "launch-editor": ">=2.14.1",
-    "shell-quote": ">=1.8.4",
+    "shell-quote": ">=1.9.0",
+    "js-yaml": ">=4.3.0",
     "undici": ">=7.28.0",
     "ws": ">=8.20.1"
   }
diff --git a/mflix/server/python-fastapi/requirements.in b/mflix/server/python-fastapi/requirements.in
index 263ba1b..afbf8ec 100644
--- a/mflix/server/python-fastapi/requirements.in
+++ b/mflix/server/python-fastapi/requirements.in
@@ -68,6 +68,6 @@ langchain-core>=1.4.0   # Transitive dep via langchain-text-splitters (Dependabo
 langsmith>=0.8.18       # Transitive dep via langchain-core (Dependabot #101, GHSA-f4xh-w4cj-qxq8)
 langchain-text-splitters>=1.1.2 # Transitive dep via langchain (CVE-2026-41481)
 pygments>=2.20.0        # Transitive dep via rich/pytest (CVE-2026-4539)
-pillow>=12.2.0          # Transitive dep via voyageai (Pillow 12.2.0 security fixes)
+pillow>=12.3.0          # Transitive dep via voyageai (Dependabot #102-116)
 requests>=2.33.0        # Transitive dep via langsmith/voyageai (CVE-2026-25645 fix)
 idna>=3.15              # Transitive dep via httpx/requests (Dependabot #70)
diff --git a/mflix/server/python-fastapi/requirements.txt b/mflix/server/python-fastapi/requirements.txt
index 54f3726..7cc0f1d 100644
--- a/mflix/server/python-fastapi/requirements.txt
+++ b/mflix/server/python-fastapi/requirements.txt
@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with Python 3.13
+# This file is autogenerated by pip-compile with Python 3.12
 # by the following command:
 #
 #    pip-compile --no-annotate --output-file=requirements.txt --strip-extras requirements.in
@@ -46,7 +46,7 @@ multidict==6.7.1
 numpy==2.4.6
 orjson==3.11.9
 packaging==26.2
-pillow==12.2.0
+pillow==12.3.0
 pluggy==1.6.0
 propcache==0.5.2
 pydantic==2.12.5