diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 95d720f..14a2206 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -38,12 +38,12 @@ jobs:
         run: uv sync --all-extras --dev
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 0000000..7957bb4
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,26 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    name: Audit dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v5
+        with:
+          fail-on-severity: high
+          fail-on-scopes: direct
+          license-check: true
+          # Project is GPL-3.0-or-later; flag licenses that would taint it.
+          deny-licenses: AGPL-1.0-only, AGPL-1.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later, SSPL-1.0, BUSL-1.1
+          comment-summary-in-pr: always
diff --git a/requirements.txt b/requirements.txt
index 742196d..ac70dca 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,12 +1,12 @@
-anthropic==0.105.2
+anthropic==0.109.1
 google-genai==2.8.0
 jinja2==3.1.6
-openai==2.41.0
-pre-commit==4.5.0
+openai==2.41.1
+pre-commit==4.6.0
 pyyaml==6.0.3
 questionary==2.1.1
 requests==2.34.2
 rich==15.0.0
-ruff==0.15.16
+ruff==0.15.17
 toml==0.10.2
 typer==0.26.7