diff --git a/tests/requirements.txt b/tests/requirements.txt
index abb83b28..aaf4bed2 100644
--- a/tests/requirements.txt
+++ b/tests/requirements.txt
@@ -1,6 +1,6 @@
 ## Used to run the tests:
 
-pytest>=9.0.3  # CVE-2025-71176 (vulnerable <= 9.0.2)
+pytest>=9.1.1  # CVE-2025-71176 (vulnerable <= 9.0.2)
 pytest-xdist
 pytest-cov
 pytest-timeout
@@ -10,7 +10,7 @@ pytest-retry
 
 importlib_metadata
 psutil
-setuptools>=65.4.1
+setuptools>=84.0.0
 untangle
 
 ## Used in Python code that is run/debugged by the tests:
@@ -19,10 +19,10 @@ django
 flask
 gevent
 numpy
-requests>=2.33.0  # CVE-2026-25645 (vulnerable < 2.33.0)
+requests>=2.34.2  # CVE-2026-25645 (vulnerable < 2.33.0)
 # urllib3 is pulled in transitively by requests; pin a secure floor for
 # CVE-2026-44431 and CVE-2026-44432 (vulnerable 2.6.0 <= x < 2.7.0).
-urllib3>=2.7.0
+urllib3>=2.8.0
 typing_extensions
 
 # Used to build pydevd attach to process binaries: