diff --git a/mlflow/server/js/package.json b/mlflow/server/js/package.json
index 10b58997255de..4cd044c83c0f2 100644
--- a/mlflow/server/js/package.json
+++ b/mlflow/server/js/package.json
@@ -57,7 +57,7 @@
     "http-proxy-middleware": "^1.0.3",
     "immutable": "3.8.1",
     "invariant": "^2.2.4",
-    "js-yaml": "^4.3.0",
+    "js-yaml": "^4.3.2",
     "json-bigint": "patch:json-bigint@npm%3A1.0.0#yarn/patches/json-bigint-npm-1.0.0-mlflow.patch",
     "leaflet": "^1.5.1",
     "lodash": "^4.17.21",
@@ -223,11 +223,11 @@
     "axios@npm:^1.12.0": "npm:1.15.2",
     "d3-transition": "3.0.1",
     "fsevents@^1.2.7": "1.2.13",
-    "js-yaml@npm:^3.13.1": "npm:4.3.0",
-    "js-yaml@npm:^3.14.0": "npm:4.3.0",
-    "js-yaml@npm:^4.0.0": "npm:4.3.0",
-    "js-yaml@npm:^4.1.0": "npm:4.3.0",
-    "js-yaml@npm:^4.2.0": "npm:4.3.0",
+    "js-yaml@npm:^3.13.1": "npm:4.3.2",
+    "js-yaml@npm:^3.14.0": "npm:4.3.2",
+    "js-yaml@npm:^4.0.0": "npm:4.3.2",
+    "js-yaml@npm:^4.1.0": "npm:4.3.2",
+    "js-yaml@npm:^4.2.0": "npm:4.3.2",
     "react-dev-utils/fork-ts-checker-webpack-plugin": "6.5.3",
     "postcss-preset-env/autoprefixer": "10.4.5",
     "rc-virtual-list@^3.2.0": "patch:rc-virtual-list@npm%3A3.2.0#yarn/patches/rc-virtual-list-npm-3.2.0-5efaefc12e.patch",
diff --git a/mlflow/server/js/yarn.lock b/mlflow/server/js/yarn.lock
index f5e32078e7f4b..98ab67fcab96f 100644
--- a/mlflow/server/js/yarn.lock
+++ b/mlflow/server/js/yarn.lock
@@ -4891,7 +4891,7 @@ __metadata:
     invariant: "npm:^2.2.4"
     jest-canvas-mock: "npm:^2.2.0"
     jest-localstorage-mock: "npm:^2.3.0"
-    js-yaml: "npm:^4.3.0"
+    js-yaml: "npm:^4.3.2"
     json-bigint: "patch:json-bigint@npm%3A1.0.0#yarn/patches/json-bigint-npm-1.0.0-mlflow.patch"
     knip: "npm:^5.30.2"
     leaflet: "npm:^1.5.1"
@@ -23311,14 +23311,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"js-yaml@npm:4.3.0, js-yaml@npm:^4.3.0":
-  version: 4.3.0
-  resolution: "js-yaml@npm:4.3.0"
+"js-yaml@npm:4.3.2, js-yaml@npm:^4.3.2":
+  version: 4.3.2
+  resolution: "js-yaml@npm:4.3.2"
   dependencies:
     argparse: "npm:^2.0.1"
   bin:
     js-yaml: bin/js-yaml.js
-  checksum: 10c0/058b30473d6915ca5b4feb11e2f7d4d97242f98d00a798ed48dd90b46b7c640398afe9128c5db22c5300f8c6528fe2a174b9a93f351a70ebc28c6203938d8bff
+  checksum: 10c0/dedd34c2e8fef1d504687f1bc94ed0ee1311a1f78770fa2800352c6d59c635ccf555009d74e9afe529ae62199da2b1ccef30e53dc84dcd8d2d8187c22574bc97
   languageName: node
   linkType: hard
 
diff --git a/requirements/konflux-aipcc-requirements.txt b/requirements/konflux-aipcc-requirements.txt
index 91e31730939df..7db06675c4289 100644
--- a/requirements/konflux-aipcc-requirements.txt
+++ b/requirements/konflux-aipcc-requirements.txt
@@ -89,8 +89,8 @@ fsspec==2026.4.0 \
     --hash=sha256:57e9e37e877e67c0bdeaa7024c6c70ec149b2c540896b180e765d5301d1459be
 gitdb==4.0.12 \
     --hash=sha256:be784ee25c084b5e2d0fc901e07f0f2329b33e88ede8a865f0241c14dbfaa810
-gitpython==3.1.57 \
-    --hash=sha256:3b60fc5129efd15e21738a92841ef4bdc3dca2ca24b9b5cf519d582d3cf5c9b4
+gitpython==3.1.62 \
+    --hash=sha256:8b118ccf6444fc05ca44308ef8861ba7a1c18c00c778723717eda25d56c4370a
 google-auth==2.53.0 \
     --hash=sha256:a580fd6784815095e84187a6dec1920835fa3e464ad30071c5396f889f51a21d
 graphene==3.4.3 \
@@ -307,8 +307,8 @@ sqlalchemy==2.0.49 \
     --hash=sha256:2ae54c222fe9b0076e6c33ad0fd102b73001618408045f56ea6ca9ec4eb3709b \
     --hash=sha256:77bbdc3a1021c44465c1f67326c66af6a07c1ed791b29aa42a1fd23e775e6ec2 \
     --hash=sha256:908a4752106dc407a89e906d257f9a7891ac4f0c0b67dca986207178571c1ea5
-sqlparse==0.5.5 \
-    --hash=sha256:e14e47d6edcac7eaf3e6a1cf85c236e9c71f06e269b16928da76ad47683d4a8f
+sqlparse==0.6.0 \
+    --hash=sha256:4727e0a13e075ef8043e086e4f05fe349fe59bd710c7d88e57f03e27b1e33e56
 threadpoolctl==3.6.0 \
     --hash=sha256:b65c2b90252c3ac0074bab96dc50655115fc10e3b659b0c4e708cf59226ce1d0
 tiktoken==0.12.0 \
diff --git a/requirements/konflux-aipcc.in b/requirements/konflux-aipcc.in
index 41fbdcfa52e94..a0b9a3eb449a4 100644
--- a/requirements/konflux-aipcc.in
+++ b/requirements/konflux-aipcc.in
@@ -39,5 +39,8 @@ pillow>=12.3.0
 # pyasn1 0.6.4+ fixes CVE-2026-59884 (DoS via crafted BER/CER/DER long-form tag IDs).
 pyasn1>=0.6.4
 
-# GitPython 3.1.54+ fixes CVE-2026-73625 (Remote Code Execution via kwarg value smuggling)
-gitpython>=3.1.54
+# Security constraints for shipped runtime dependencies.
+# GitPython 3.1.60+ validates git directory locations before repository operations.
+gitpython>=3.1.60
+# sqlparse 0.6.0+ bounds work while lexing and grouping adversarial SQL.
+sqlparse>=0.6.0