diff --git a/Tests/Dependencies/test_repository_policy.py b/Tests/Dependencies/test_repository_policy.py
index 39a3a15..a38b383 100644
--- a/Tests/Dependencies/test_repository_policy.py
+++ b/Tests/Dependencies/test_repository_policy.py
@@ -47,11 +47,24 @@ def test_optional_dependency_sets_are_exact_and_kotak_uses_official_tag():
     # regression and a live session. Move it together with requirements.txt, and
     # only once a PAPER session has confirmed the feed still ticks on the new
     # version -- CI never opens a real socket, so a green build proves nothing
-    # about the transport. Note this is a MAJOR (16 -> 17): dhanhq.marketfeed
-    # hard-imports websockets at package import time, so an incompatible API
-    # would surface as the RUNNER FAILING TO START, not merely a quiet feed.
-    assert "websockets==17.0" in core
-    assert "claude-agent-sdk==0.2.128" in ai
+    # about the transport.
+    #
+    # 17.0 -> 17.0.1 (2026-08-11, PR #119). The upstream tag-to-tag diff looks
+    # alarming -- it removes `Server.wrap()` and reworks the asyncio server --
+    # but every one of those is SERVER-side and marketfeed is a client. Its
+    # entire surface is three names, all confirmed present in 17.0.1:
+    # `websockets.connect`, `websockets.ConnectionClosed`, and
+    # `websockets.protocol.State.CLOSED`. That rules out the import-time
+    # "runner fails to start" failure this pin exists to prevent; it does NOT
+    # prove the transport behaves, which only a session on the real socket can.
+    # Operator decision: validate on the next run rather than ahead of the
+    # merge, because MARKET_DATA_SOURCE=WEBSOCKET is active but every strategy
+    # is PAPER (LIVE_TRADING_ENABLED=false), so a bad feed costs a session and
+    # not money. If the feed does not tick, revert this pin first.
+    assert "websockets==17.0.1" in core
+    # Same reasoning for the agent transport: SL_HUNTING_ENABLED=true, so this
+    # is an active path, but paper-only until the next session confirms it.
+    assert "claude-agent-sdk==0.2.132" in ai
     assert "pydantic==2.13.4" in ai
     assert all("==" in line for line in ai)
     # The independent CPR agent is an optional, subscription-authenticated
diff --git a/requirements-ai.txt b/requirements-ai.txt
index ab5f511..c36b30f 100644
--- a/requirements-ai.txt
+++ b/requirements-ai.txt
@@ -3,7 +3,7 @@
 # These versions are the Python 3.12/3.13 set validated by the MAT safety stack.
 # The first three packages are the Claude Agent SDK's direct runtime dependencies;
 # pinning them prevents a fresh install from silently changing the agent transport.
-claude-agent-sdk==0.2.128
+claude-agent-sdk==0.2.132
 anyio==4.14.2
 mcp==1.29.0
 sniffio==1.3.1
diff --git a/requirements-dev.txt b/requirements-dev.txt
index da48319..7e7333e 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -1,11 +1,11 @@
 # Development / CI quality-gate tools (runtime deps live in requirements.txt).
 # Versions mirror the Streamlit Scanner App's verified set where shared.
 pytest==9.1.1
-ruff==0.16.1
+ruff==0.16.2
 mypy==1.20.2
 bandit==1.9.4
 pre-commit==4.6.1
-coverage==7.15.2
+coverage==7.15.4
 pytest-cov==7.1.0
 pip-audit==2.10.1
 # Type stubs for typed third-party usage in the mypy scope. pandas-stubs is
diff --git a/requirements.txt b/requirements.txt
index 5bf8063..1f70f48 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -27,7 +27,7 @@ websocket-client==1.8.0
 # `websockets` library at package import time. It already arrives transitively
 # with dhanhq, but per DEPS-001 the exact version the live runner was verified
 # with must be pinned here rather than left to transitive resolution.
-websockets==17.0
+websockets==17.0.1
 TA-Lib==0.6.8
 
 # ---- Exact optional dependency sets -----------------------------------------