diff --git a/requirements/base.txt b/requirements/base.txt
index 731b211c0ad..7dd8c8e1601 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -17,7 +17,7 @@ croniter!=0.3.22,>=6.2.2; sys_platform != 'win32'
 # last 46.x release for Python 3.9 so uv pip compile can still resolve.
 # Furthermore, pyOpenSSL 26.2 dropped X509Extension and add_extensions()
 # which breaks salt/modules/tls.py. pyOpenSSL < 26.2 requires cryptography < 48.0.0.
-cryptography>=46.0.7,<48.0.0
+cryptography>=49.0.0,<50.0.0
 distro>=1.9.0
 frozenlist>=1.8.0; python_version < '3.11'
 frozenlist>=1.5.0; python_version >= '3.11'
@@ -39,15 +39,15 @@ msgpack>=1.1.2
 # `/` parameter syntax which is a SyntaxError on Python <3.8. Keep at
 # 24.0 to preserve salt-ssh compatibility against legacy target
 # Pythons; salt 3006.x still promises this matrix.
-packaging==24.0
+packaging==26.2
 psutil<6.0.0; python_version <= '3.9'
 psutil>=5.0.0; python_version >= '3.10'
 # pymssql 2.3.12+ dropped win32 (32-bit Windows) wheels; salt 3006.x
 # still builds a Windows x86 onedir, so pin to the last release that
 # ships cp3X-win32 wheels.
-pymssql==2.3.11; sys_platform == 'win32'
+pymssql==2.3.13; sys_platform == 'win32'
 pymysql>=1.2.0; sys_platform == 'win32'
-pyopenssl>=26.0.0,<26.2.0
+pyopenssl>=26.3.0,<26.4.0
 python-dateutil>=2.9.0.post0
 python-gnupg>=0.5.6
 pythonnet>=3.0.5; sys_platform == 'win32'
@@ -63,9 +63,9 @@ setproctitle>=1.3.7
 # requires urllib3 < 2 and Salt 3006.x still builds a py3.9 onedir.
 # The Python 3.10+ floor carries the urllib3 2.6.3 CVE backports
 # (CVE-2025-66418, CVE-2026-21441).
-urllib3>=1.26.20,<2.0.0; python_version < '3.10'
+urllib3>=2.6.3,<3.0.0; python_version < '3.10'
 urllib3>=2.7.0; python_version >= '3.10'
-virtualenv>=21.4.2
+virtualenv>=21.5.0
 # Transitive of virtualenv; some uv resolver caches pin a stale 3.25
 # version that conflicts with the CI floor of 3.29.1 on Python 3.10+.
 filelock>=3.29.1; python_version >= '3.10'
diff --git a/requirements/static/ci/common.txt b/requirements/static/ci/common.txt
index c93548d4259..1b4597f1557 100644
--- a/requirements/static/ci/common.txt
+++ b/requirements/static/ci/common.txt
@@ -14,16 +14,16 @@ bcrypt
 # our urllib3 floor is 2.6.3 so we skip the boto3 cloud module tests on
 # 3.9 by not pinning it here. The bare `boto3` package is still
 # available transitively for any tool that needs it.
-boto3>=1.43.24; python_version >= '3.10'
+boto3>=1.43.29; python_version >= '3.10'
 boto>=2.49.0
-cryptography>=46.0.7,<48.0.0
+cryptography>=49.0.0,<50.0.0
 cffi>=2.0.0
 cherrypy>=18.10.0
 clustershell
 dnspython
 etcd3-py==0.1.6
 filelock>=3.19.1 ; python_version < '3.10'
-filelock>=3.29.1 ; python_version >= '3.10'
+filelock>=3.29.4 ; python_version >= '3.10'
 gitpython>=3.1.50
 google-auth==2.35.0; python_version == '3.9'
 jmespath>=1.1.0
@@ -47,7 +47,7 @@ napalm; sys_platform != 'win32' and python_version < '3.10'
 paramiko>=5.0.0; sys_platform != 'win32' and sys_platform != 'darwin'
 passlib>=1.7.4
 pycryptodomex
-pynacl>=1.5.0
+pynacl>=1.6.2
 pyinotify>=0.9.6; sys_platform != 'win32' and sys_platform != 'darwin' and platform_system != "openbsd"
 python-etcd>=0.4.5
 pyvmomi
@@ -58,13 +58,13 @@ textfsm
 toml
 # vcert 0.18.x adds hard pins on cryptography, pynacl, and six that
 # conflict with every other CI requirement; stay on 0.9.x.
-vcert~=0.9.0; sys_platform != 'win32'
-virtualenv>=21.4.2
+vcert~=0.18.1; sys_platform != 'win32'
+virtualenv>=21.5.0
 watchdog>=6.0.0
 websocket-client>=1.9.0
 # werkzeug is a dependency of moto
 werkzeug>=3.1.8
-xmldiff>=2.7.0
+xmldiff>=3.0
 # Available template libraries that can be used
 genshi>=0.7.11
 cheetah3>=3.2.6.post1
diff --git a/requirements/static/ci/darwin.txt b/requirements/static/ci/darwin.txt
index 753818ff84e..fac4d295f8a 100644
--- a/requirements/static/ci/darwin.txt
+++ b/requirements/static/ci/darwin.txt
@@ -1,5 +1,5 @@
 pygit2>=1.13.1,<1.18.0; python_version < '3.11'
-pygit2>=1.19.2; python_version >= '3.11'
+pygit2>=1.19.3; python_version >= '3.11'
 yamllint
 mercurial>=7.2.2
 hglib
diff --git a/requirements/static/ci/lint.txt b/requirements/static/ci/lint.txt
index 7d4448fd435..69b6236b563 100644
--- a/requirements/static/ci/lint.txt
+++ b/requirements/static/ci/lint.txt
@@ -6,6 +6,6 @@ docker < 7.1.0; python_version < '3.8'
 # Salt 3006.x codebase has not been audited for; the lint job logs are
 # full of pre-existing possibly-used-before-assignment warnings now
 # turning into errors. Stay on the 3.1.x line for 3006.x.
-pylint~=3.1.0
+pylint~=4.0.5
 SaltPyLint>=2024.2.5
 toml
diff --git a/requirements/static/ci/linux.txt b/requirements/static/ci/linux.txt
index 80265218062..66108ec1872 100644
--- a/requirements/static/ci/linux.txt
+++ b/requirements/static/ci/linux.txt
@@ -1,7 +1,7 @@
 # Linux static CI requirements
 pyiface
 pygit2>=1.13.1,<1.18.0; python_version < '3.11'
-pygit2>=1.19.2; python_version >= '3.11'
+pygit2>=1.19.3; python_version >= '3.11'
 pymysql>=1.2.0
 # ansible release lines support different Python versions:
 #   ansible-core / ansible 10.x — Python 3.10+
@@ -12,7 +12,7 @@ ansible>=12.3.0,<13.0.0; python_version >= '3.11' and python_version < '3.12'
 ansible>=14.0.0; python_version >= '3.12'
 twilio>=9.10.9
 python-telegram-bot>=20.3,<22.0; python_version < '3.10'
-python-telegram-bot>=22.7; python_version >= '3.10'
+python-telegram-bot>=22.8; python_version >= '3.10'
 yamllint
 mercurial>=7.2.2
 hglib
diff --git a/requirements/static/ci/windows.txt b/requirements/static/ci/windows.txt
index 0febcd008fd..388561a5a77 100644
--- a/requirements/static/ci/windows.txt
+++ b/requirements/static/ci/windows.txt
@@ -1,7 +1,7 @@
 dmidecode
 patch
 pygit2>=1.13.1,<1.18.0; python_version < '3.11'
-pygit2>=1.19.2; python_version >= '3.11'
+pygit2>=1.19.3; python_version >= '3.11'
 sed
 pywinrm>=0.5.0
 yamllint
diff --git a/requirements/static/pkg/freebsd.txt b/requirements/static/pkg/freebsd.txt
index e6546184e85..b623cca4706 100644
--- a/requirements/static/pkg/freebsd.txt
+++ b/requirements/static/pkg/freebsd.txt
@@ -2,10 +2,10 @@
 # Any non hard dependencies of Salt for FreeBSD can go here
 # If they are freebsd specific, place "; sys_platform == 'freebsd'" in front of the requirement.
 cherrypy>=18.10.0
-cryptography>=46.0.7,<48.0.0
+cryptography>=49.0.0,<50.0.0
 pycparser>=2.23; python_version < '3.10'
 pycparser>=3.0; python_version >= '3.10'
-pyopenssl>=26.0.0,<26.2.0
+pyopenssl>=26.3.0,<26.4.0
 python-dateutil>=2.9.0.post0
 python-gnupg>=0.5.6
 setproctitle>=1.3.7
diff --git a/requirements/static/pkg/linux.txt b/requirements/static/pkg/linux.txt
index 031ce9caf05..0c64df40bdd 100644
--- a/requirements/static/pkg/linux.txt
+++ b/requirements/static/pkg/linux.txt
@@ -7,7 +7,7 @@ cherrypy>=18.10.0
 cheroot>=11.1.2
 pycparser>=2.23; python_version < '3.10'
 pycparser>=3.0; python_version >= '3.10'
-pyopenssl>=26.0.0,<26.2.0
+pyopenssl>=26.3.0,<26.4.0
 python-dateutil>=2.9.0.post0
 python-gnupg>=0.5.6
 rpm-vercmp
@@ -16,7 +16,7 @@ timelib>=0.2.5; python_version < '3.11'
 timelib>=0.3.0; python_version >= '3.11'
 importlib-metadata>=8.7.0,<9.0.0; python_version < '3.10'
 importlib-metadata>=9.0.0; python_version >= '3.10'
-cryptography>=46.0.7,<48.0.0
+cryptography>=49.0.0,<50.0.0
 linode-python>=1.1.1
 more-itertools>=10.8.0,<11.0.0; python_version < '3.10'
 more-itertools>=11.1.0; python_version >= '3.10'