diff --git a/nlp-service/requirements.txt b/nlp-service/requirements.txt
index fcbc465..c6e49ac 100644
--- a/nlp-service/requirements.txt
+++ b/nlp-service/requirements.txt
@@ -1,10 +1,10 @@
 # Kompl v2 nlp-service — commit 4. Pins per docs/research/2026-04-08-conversion-deps.md
 # and docs/research/2026-04-09-llm-compile.md.
-fastapi==0.136.1
-uvicorn[standard]==0.47.0
+fastapi==0.136.3
+uvicorn[standard]==0.48.0
 pydantic==2.13.4
 httpx==0.28.1
-markitdown[all]==0.1.5
+markitdown[all]==0.1.6
 # Promoted to a direct dep so routers/conversion.py can call
 # youtube-transcript-api WITHOUT going through MarkItDown for YouTube URLs.
 # Reason: MarkItDown's YouTubeConverter silently falls back to scraping the
@@ -13,7 +13,7 @@ markitdown[all]==0.1.5
 # transcript signal explicitly, which only the direct API exposes.
 youtube-transcript-api>=1.0.0,<2.0.0
 # Commit 4: LLM compile. Use google-genai NOT google-generativeai (deprecated 2025-Q1).
-google-genai==2.4.0
+google-genai==2.7.0
 # Commit 4: async token-bucket rate limiter. Single uvicorn worker only —
 # InMemoryBucket is process-local; see research artifact section 3.
 pyrate-limiter==3.7.0
@@ -22,7 +22,7 @@ spacy==3.8.14
 rake-nltk==1.0.6
 yake==0.7.3
 keybert==0.9.0
-sentence-transformers==5.5.0
+sentence-transformers==5.5.1
 # pytextrank: spaCy-native TextRank component (PyPI-available, no git dep).
 pytextrank==3.3.0
 scikit-learn==1.8.0
@@ -35,7 +35,7 @@ rapidfuzz>=3.14.5
 json-repair>=0.59.10
 # Commit 7: Chroma vector store (embedded, no separate server). 0.4.x API:
 # PersistentClient, get_or_create_collection, cosine distance.
-chromadb==0.4.24
+chromadb==0.6.3
 # chromadb 0.4.24 references np.float_ (chromadb/api/types.py:102), which
 # NumPy 2.0 removed. Pin numpy<2 until chromadb is upgraded.
 numpy<2