diff --git a/pyproject.toml b/pyproject.toml
index ab0583f302..5d12f2b606 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -45,14 +45,14 @@ dependencies = [
     "kaitaistruct>=0.10,<=0.11",
     "ldap3>=2.8,<=2.9.1",
     "mitmproxy_rs>=0.12.6,<0.13",  # relaxed upper bound here: we control this
-    "msgpack>=1.0.0,<=1.1.2",
+    "msgpack>=1.0.0,<=1.2.1",
     "pydivert>=2.0.3,<=2.1.0; sys_platform == 'win32'",
     "pyOpenSSL>=24.3,<=27.0.0",
     "pyparsing>=2.4.2,<=3.3.2",
     "pyperclip>=1.9.0,<=1.11.0",
     "ruamel.yaml>=0.18.10,<=0.19.1",
     "sortedcontainers>=2.3,<=2.4.0",
-    "tornado>=6.5.0,<=6.5.5",
+    "tornado>=6.5.0,<=6.5.7",
     "typing-extensions>=4.13.2,<=4.14; python_version < '3.13'",
     "urwid>=2.6.14,<=4.0.0",
     "wsproto>=1.0,<=1.3.2",
diff --git a/uv.lock b/uv.lock
index b8ff15b990..ac4cac4dd3 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1043,7 +1043,7 @@ requires-dist = [
     { name = "kaitaistruct", specifier = ">=0.10,<=0.11" },
     { name = "ldap3", specifier = ">=2.8,<=2.9.1" },
     { name = "mitmproxy-rs", specifier = ">=0.12.6,<0.13" },
-    { name = "msgpack", specifier = ">=1.0.0,<=1.1.2" },
+    { name = "msgpack", specifier = ">=1.0.0,<=1.2.1" },
     { name = "publicsuffix2", specifier = ">=2.20190812,<=2.20191221" },
     { name = "pydivert", marker = "sys_platform == 'win32'", specifier = ">=2.0.3,<=2.1.0" },
     { name = "pyopenssl", specifier = ">=24.3,<=27.0.0" },
@@ -1051,7 +1051,7 @@ requires-dist = [
     { name = "pyperclip", specifier = ">=1.9.0,<=1.11.0" },
     { name = "ruamel-yaml", specifier = ">=0.18.10,<=0.19.1" },
     { name = "sortedcontainers", specifier = ">=2.3,<=2.4.0" },
-    { name = "tornado", specifier = ">=6.5.0,<=6.5.5" },
+    { name = "tornado", specifier = ">=6.5.0,<=6.5.7" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'", specifier = ">=4.13.2,<=4.14" },
     { name = "urwid", specifier = ">=2.6.14,<=4.0.0" },
     { name = "wsproto", specifier = ">=1.0,<=1.3.2" },