diff --git a/.github/workflows/sphinx-books-tests.js.yml b/.github/workflows/sphinx-books-tests.js.yml
index 88a005983..61f92005f 100644
--- a/.github/workflows/sphinx-books-tests.js.yml
+++ b/.github/workflows/sphinx-books-tests.js.yml
@@ -24,7 +24,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
         # Pinned like the packages it installs; the action applies it as an
         # exact `pip==` requirement.
-        pip-version: '26.2.1'
+        pip-version: '26.2.2'
         cache: 'pip'
         # Named explicitly: the default pattern matches `requirements.txt`,
         # which is not the file the workflow installs, so the key would not
diff --git a/.github/workflows/sphinx-content-tests.js.yml b/.github/workflows/sphinx-content-tests.js.yml
index cce7da736..2a9a731ee 100644
--- a/.github/workflows/sphinx-content-tests.js.yml
+++ b/.github/workflows/sphinx-content-tests.js.yml
@@ -24,7 +24,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
         # Pinned like the packages it installs; the action applies it as an
         # exact `pip==` requirement.
-        pip-version: '26.2.1'
+        pip-version: '26.2.2'
         cache: 'pip'
         # Named explicitly: the default pattern matches `requirements.txt`,
         # which is not the file the workflow installs, so the key would not
diff --git a/.github/workflows/sphinx-plugin-tests.js.yml b/.github/workflows/sphinx-plugin-tests.js.yml
index d6b5a6d65..0c0230f17 100644
--- a/.github/workflows/sphinx-plugin-tests.js.yml
+++ b/.github/workflows/sphinx-plugin-tests.js.yml
@@ -30,7 +30,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
         # Pinned like the packages it installs; the action applies it as an
         # exact `pip==` requirement.
-        pip-version: '26.2.1'
+        pip-version: '26.2.2'
         cache: 'pip'
         # Named explicitly: the default pattern matches `requirements.txt`,
         # which is not the file the workflow installs, so the key would not
diff --git a/.github/workflows/typescript-tests.js.yml b/.github/workflows/typescript-tests.js.yml
index 987e51912..41141f885 100644
--- a/.github/workflows/typescript-tests.js.yml
+++ b/.github/workflows/typescript-tests.js.yml
@@ -31,7 +31,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
         # Pinned like the packages it installs; the action applies it as an
         # exact `pip==` requirement.
-        pip-version: '26.2.1'
+        pip-version: '26.2.2'
         cache: 'pip'
         # Named explicitly: the default pattern matches `requirements.txt`,
         # which is not the file the workflow installs, so the key would not
diff --git a/Vagrantfile b/Vagrantfile
index 662eccf18..d45916b77 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -110,7 +110,7 @@ $frontend = <<-SHELL
   source /vagrant/venv/bin/activate
   # Pinned like CI's setup-python pip-version input: pip itself is the one
   # tool that resolves the pinned packages below, so it needs a pin too.
-  pip3 install --upgrade pip==26.2.1
+  pip3 install --upgrade pip==26.2.2
   pip3 install -r /vagrant/frontend/requirements_frozen.txt
   pip3 install -e /vagrant/frontend/python/rst_code_example_pipeline
 
@@ -280,7 +280,7 @@ $epub = <<-SHELL
   source /vagrant/venv/bin/activate
   # Pinned like CI's setup-python pip-version input: pip itself is the one
   # tool that resolves the pinned packages below, so it needs a pin too.
-  pip3 install --upgrade pip==26.2.1
+  pip3 install --upgrade pip==26.2.2
   pip3 install -r /vagrant/frontend/requirements_frozen.txt
   pip3 install -e /vagrant/frontend/python/rst_code_example_pipeline
 
diff --git a/frontend/requirements.txt b/frontend/requirements.txt
index 9e41eeed6..4176a9043 100644
--- a/frontend/requirements.txt
+++ b/frontend/requirements.txt
@@ -1,16 +1,16 @@
-coverage==7.15.2
-docutils==0.22.4
+coverage==7.17.0
+docutils==0.23
 furo==2025.12.19
 graphviz==0.21
-ipython==9.15.0
+ipython==9.18.0
 pdf2image==1.17.0
-pillow==12.3.0
+pillow==13.0.0
 pydot-ng==2.0.0
-Pygments==2.20.0
-pyparsing==3.3.2
-pyright==1.1.411
-Sphinx==9.1.0
+Pygments==2.21.0
+pyparsing==3.3.3
+pyright==1.1.414
+Sphinx==9.2.0
 sphinx-reredirects==1.1.0
 sphinxcontrib-bibtex==2.7.0
 sphinxcontrib-plantuml==0.31
-websocket-client==1.9.0
+websocket-client==1.9.2
diff --git a/frontend/requirements_frozen.txt b/frontend/requirements_frozen.txt
index f271169d0..37404a67b 100644
--- a/frontend/requirements_frozen.txt
+++ b/frontend/requirements_frozen.txt
@@ -3,58 +3,57 @@ alabaster==1.0.0
 asttokens==3.0.2
 babel==2.18.0
 beautifulsoup4==4.15.0
-certifi==2026.7.22
-charset-normalizer==3.4.9
-coverage==7.15.2
-decorator==5.3.1
-docutils==0.22.4
-executing==2.2.1
+certifi==2026.10.23
+charset-normalizer==3.5.2
+coverage==7.17.0
+docutils==0.23
+executing==2.3.0
 furo==2025.12.19
 graphviz==0.21
-idna==3.18
-imagesize==2.0.0
-ipython==9.15.0
+idna==3.20
+imagesize==2.0.1
+ipython==9.18.0
 ipython_pygments_lexers==1.1.1
-jedi==0.20.0
+jedi==0.20.1
 Jinja2==3.1.6
 latexcodec==3.0.1
-MarkupSafe==3.0.3
+MarkupSafe==3.0.4
 matplotlib-inline==0.2.2
-nodeenv==1.10.0
-packaging==26.2
+nodeenv==1.11.1
+packaging==26.3
 parso==0.8.7
 pdf2image==1.17.0
 pexpect==4.9.0
-pillow==12.3.0
-prompt_toolkit==3.0.52
+pillow==13.0.0
+prompt_toolkit==3.0.53
 psutil==7.2.2
 ptyprocess==0.7.0
-pure_eval==0.2.3
+pure_eval==0.2.4
 pybtex==0.26.1
 pybtex-docutils==1.0.3
 pydot-ng==2.0.0
-Pygments==2.20.0
-pyparsing==3.3.2
-pyright==1.1.411
+Pygments==2.21.0
+pyparsing==3.3.3
+pyright==1.1.414
 PyYAML==6.0.3
 requests==2.34.2
 roman-numerals==4.1.0
 snowballstemmer==3.1.1
-soupsieve==2.9.1
-Sphinx==9.1.0
+soupsieve==3.0.4
+Sphinx==9.2.0
 sphinx-basic-ng==1.0.0b2
 sphinx-reredirects==1.1.0
 sphinxcontrib-applehelp==2.0.0
 sphinxcontrib-bibtex==2.7.0
 sphinxcontrib-devhelp==2.0.0
 sphinxcontrib-htmlhelp==2.1.0
-sphinxcontrib-jsmath==1.0.1
+sphinxcontrib-jsmath==2.0.0
 sphinxcontrib-plantuml==0.31
 sphinxcontrib-qthelp==2.0.0
 sphinxcontrib-serializinghtml==2.0.0
 stack-data==0.6.3
-traitlets==5.15.1
+traitlets==5.16.1
 typing_extensions==4.16.0
-urllib3==2.7.0
-wcwidth==0.8.2
-websocket-client==1.9.0
+urllib3==2.8.0
+wcwidth==0.9.4
+websocket-client==1.9.2