Merge remote-tracking branch 'upstream/main' into pr663-resolve

Signed-off-by: Paolo Dettori <dettori@us.ibm.com>

# Conflicts:
#	a2a/file_organizer/pyproject.toml
#	a2a/file_organizer/uv.lock
#	a2a/image_service/pyproject.toml
#	a2a/image_service/uv.lock

Author: pdettori

.github/workflows/build.yaml

@@ -75,7 +75,7 @@ jobs:
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4
 
       - name: Log in to ghcr.io
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4  # v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/ci.yaml

@@ -48,7 +48,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8
       - name: Install expect
         run: sudo apt-get update && sudo apt-get install -y expect
       - name: Verify agents start

.github/workflows/scorecard.yaml

@@ -30,6 +30,6 @@ jobs:
           name: scorecard-results
           path: results.sarif
           retention-days: 30
-      - uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4
+      - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4
         with:
           sarif_file: results.sarif

.github/workflows/security-scans.yaml

@@ -36,7 +36,7 @@ jobs:
           exit-code: 0  # Informational — upstream dependency CVEs in community examples
           format: sarif
           output: trivy-results.sarif
-      - uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4
+      - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4
         if: always()
         with:
           sarif_file: trivy-results.sarif
@@ -49,11 +49,11 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-      - uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4
+      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4
         with:
           languages: python
           queries: security-extended
-      - uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4
+      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4
 
   hadolint:
     runs-on: ubuntu-latest

a2a/a2a_contact_extractor/pyproject.toml

@@ -11,10 +11,10 @@ dependencies = [
     "python-multipart>=0.0.32", # Indirect; prevents CVE-2026-24486
     "starlette>=1.3.1",        # Indirect; prevents CVE-2025-62727
     "mcp>=1.28.1",              # Indirect; prevents CVE-2025-66416
-    "pyasn1>=0.6.3",            # Indirect; prevents CVE-2026-30922
+    "pyasn1>=0.6.4",            # Indirect; prevents CVE-2026-30922
     "pydantic-ai>=1.106.0",      # Indirect; prevents CVE-2026-25580
-    "filelock>=3.29.5",         # Indirect; prevents CVE-2025-68146
-    "fastmcp>=3.4.2",           # Indirect; prevents CVE-2026-32871 (critical), CVE-2026-27124 (high)
+    "filelock>=3.29.7",         # Indirect; prevents CVE-2025-68146
+    "fastmcp>=3.4.4",           # Indirect; prevents CVE-2026-32871 (critical), CVE-2026-27124 (high)
     "anthropic>=0.116.0",        # Indirect; prevents CVE-2026-34452, CVE-2026-34450
     "aiohttp>=3.14.1",          # Indirect; prevents CVE-2026-34525, CVE-2026-34516, CVE-2026-34515, CVE-2026-22815
     "mako>=1.3.12",             # Indirect; prevents CVE-2026-41205 (CVE-2026-44307 has no fix yet)
@@ -33,5 +33,5 @@ extend-select = ["I", "UP"]
 py-modules = ["agent", "agent_executor", "server", "__main__"]
 
 [build-system]
-requires = ["setuptools>=82.0.1"]
+requires = ["setuptools>=83.0.0"]
 build-backend = "setuptools.build_meta"

a2a/a2a_contact_extractor/uv.lock

@@ -8,24 +8,24 @@ dependencies = [
     "a2a-sdk[http-server]>=1.1.0,<2",
     "click>=8.4.2",
     "httpx>=0.28.1",
-    "langchain-google-genai>=4.2.6",
-    "langgraph>=1.2.7",
+    "langchain-google-genai>=4.2.7",
+    "langgraph>=1.2.9",
     "pydantic>=2.13.4",
     "python-dotenv>=1.2.2",
-    "uvicorn>=0.49.0",
-    "langchain-openai>=1.3.3",
+    "uvicorn>=0.51.0",
+    "langchain-openai>=1.3.4",
     "pydantic-settings>=2.14.2",
     "openinference-instrumentation-langchain>=0.1.67",
     "opentelemetry-exporter-otlp>=1.43.0",
     # The following are to avoid CVEs reported by Trivy and checked by our CI
     "urllib3>=2.7.0",
     "starlette>=1.3.1",
-    "pyasn1>=0.6.3",            # Indirect; prevents CVE-2026-30922
+    "pyasn1>=0.6.4",            # Indirect; prevents CVE-2026-30922
     "protobuf>=6.33.5",         # prevents CVE-2026-0994
     "langgraph-checkpoint>=4.1.1",
     "langchain-core>=1.4.0",   # Indirect; prevents CVE-2026-34070
     "orjson>=3.11.6",          # Indirect; prevents CVE-2025-67221
-    "langsmith>=0.9.7",        # Indirect; prevents CVE-2026-45134
+    "langsmith>=0.10.1",        # Indirect; prevents CVE-2026-45134
 ]
 
 [tool.hatch.build.targets.wheel]