Merge pull request #652 from kagenti/dependabot/uv/a2a/weather_service/minor-and-patch-bf7f187e71

chore(deps): Bump the minor-and-patch group across 1 directory with 14 updates

Author: pdettori

a2a/weather_service/pyproject.toml

@@ -10,37 +10,37 @@ license = { text = "Apache" }
 requires-python = ">=3.11"
 dependencies = [
     "a2a-sdk>=1.1.0,<2",
-    "langgraph>=1.2.2",
+    "langgraph>=1.2.7",
     "langchain-core>=1.4.0",
     "langchain-community>=0.4.2",
     "langchain-ollama>=1.1.0",
-    "langchain-openai>=1.2.2",
+    "langchain-openai>=1.3.3",
     "mlflow[langchain,kubernetes]>=3.13.0,<4",
-    "pydantic-settings>=2.14.1",
-    "langchain-mcp-adapters>=0.2.2",
+    "pydantic-settings>=2.14.2",
+    "langchain-mcp-adapters>=0.3.0",
     "python-keycloak>=7.1.1",
-    "opentelemetry-exporter-otlp>=1.42.1",
+    "opentelemetry-exporter-otlp>=1.43.0",
     # Auto-instrument httpx so outgoing MCP tool calls propagate traceparent
     "opentelemetry-instrumentation-httpx>=0.49b0",
     # OpenTelemetry GenAI semantic convention instrumentation
     # Emits spans with gen_ai.* attributes for MLflow compatibility
-    "opentelemetry-instrumentation-openai>=0.61.0",
+    "opentelemetry-instrumentation-openai>=0.62.1",
     # OpenInference for LangChain instrumentation and AGENT span semantics
     "openinference-semantic-conventions>=0.1.30",
-    "openinference-instrumentation-langchain>=0.1.66",
+    "openinference-instrumentation-langchain>=0.1.67",
     "urllib3>=2.7.0",   # Indirect; prevents CVE-2025-66418
     "python-multipart>=0.0.32", # Indirect; prevents CVE-2026-24486
     "cryptography>=48.0.0,<49", # Indirect; prevents CVE-2026-26007
     "langgraph-checkpoint>=4.1.1", # Indirect; prevents CVE-2025-64439
-    "mcp>=1.27.2",              # Indirect; prevents CVE-2025-66416
+    "mcp>=1.28.1",              # Indirect; prevents CVE-2025-66416
     "protobuf>=6.33.5",         # Indirect; prevents CVE-2026-0994
-    "starlette>=1.2.1",        # Indirect; prevents CVE-2025-62727
+    "starlette>=1.3.1",        # Indirect; prevents CVE-2025-62727
     "pyasn1>=0.6.3",            # Indirect; prevents CVE-2026-30922
-    "aiohttp>=3.14.0",          # Indirect; prevents CVE-2025-69223
+    "aiohttp>=3.14.1",          # Indirect; prevents CVE-2025-69223
     "gitpython>=3.1.47",        # Indirect; prevents CVE-2026-42215, CVE-2026-42284
     "langchain-text-splitters>=1.1.2", # Indirect; prevents CVE-2026-41481
-    "langsmith>=0.8.9",        # Indirect; prevents CVE-2026-41182
-    "langchain-classic>=1.0.7", # Indirect; prevents CVE-2026-45134
+    "langsmith>=0.9.5",        # Indirect; prevents CVE-2026-41182
+    "langchain-classic>=1.0.8", # Indirect; prevents CVE-2026-45134
     "mako>=1.3.12",             # Indirect; prevents CVE-2026-41205
     "marshmallow>=4.3.0",      # Indirect; prevents CVE-2025-68480
     "python-dotenv>=1.2.2",     # Indirect; prevents CVE-2026-28684