Merge pull request #201 from esnible/upgrade-dep-version

Chore: Upgrade library versions to avoid CVEs.  This PR also introduces some new `make` targets to avoid problems in Docker builds.

Author: esnible

.gitignore

@@ -221,3 +221,6 @@ secrets.*
 
 # Orchestration working directory
 .repos/
+
+# Bogus lock files created by running uv in home directory.
+uv.lock

CONTRIBUTING.md

@@ -16,6 +16,8 @@ Please follow our [Developer's Guide](https://github.com/kagenti/kagenti/blob/ma
 
 Please note that the section concerning pre-commit does not apply to this repository.
 
+Please run `make test` before pushing PRs.
+
 ## Claiming an Issue
 
 Comment `/claim` on an issue to have it automatically assigned to you. Issues labeled `blocked` or `in-progress` cannot be claimed this way. If you need to release an issue, comment `/unassign` or ask a maintainer.

Makefile

@@ -1,8 +1,50 @@
-.PHONY: lint fmt
+.PHONY: lint fmt test-docker test-a2a test-mcp sync-all-uv sync-a2a sync-mcp
 
 lint:
 	pre-commit run --all-files
 
 fmt:
 	ruff format .
 	ruff check --fix .
+
+# This builds all of the A2A and MCP example Docker images to verify they can be built successfully.
+test-docker: test-a2a test-mcp
+
+# Verify all of the A2A example Docker images can be built
+# (Optional KAGENTI_DOCKER_FLAGS for docker build, e.g. --no-cache or --load)
+test-a2a:
+	@for f in $(shell find a2a -mindepth 1 -maxdepth 1 -type d); do \
+		pushd $${f} || exit; \
+		echo "Building Docker image for $${f}..."; \
+		docker build ${KAGENTI_DOCKER_FLAGS} --tag $${f##*/} . || exit; \
+		popd; \
+	done
+
+# Verify all of the MCP example Docker images can be built
+# (Optional KAGENTI_DOCKER_FLAGS for docker build, e.g. --no-cache or --load)
+test-mcp:
+	@for f in $(shell find mcp -mindepth 1 -maxdepth 1 -type d); do \
+		pushd $${f} || exit; \
+		echo "Building Docker image for $${f}..."; \
+		docker build ${KAGENTI_DOCKER_FLAGS} --tag $${f##*/} . || exit; \
+		popd; \
+	done
+
+# After changing pyproject.toml, run this to sync dependencies for all examples
+sync-all-uv: sync-a2a sync-mcp
+
+sync-a2a:
+	@for f in $(shell find a2a -mindepth 1 -maxdepth 1 -type d); do \
+		pushd $${f} || exit; \
+		echo "Syncing dependencies for $${f}..."; \
+		uv sync --no-dev || exit; \
+		popd; \
+	done
+
+sync-mcp:
+	@for f in $(shell find mcp -mindepth 1 -maxdepth 1 -type d); do \
+		pushd $${f} || exit; \
+		echo "Syncing dependencies for $${f}..."; \
+		uv sync --no-dev || exit; \
+		popd; \
+	done

README.md

@@ -1,4 +1,4 @@
 # agent-examples
 
 This repo collects several examples of community agents and MCP tools written in different
-frameworks and exposed with agent-to-agent protocols and tools protocols such as A2A and MCP. 
+frameworks and exposed with agent-to-agent protocols and tools protocols such as A2A and MCP.

a2a/a2a_contact_extractor/pyproject.toml

@@ -6,7 +6,14 @@ readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
     "marvin>=3.0.0", 
-    "a2a-sdk>=0.2.5,<0.4.0"
+    "a2a-sdk>=0.2.5,<0.4.0",
+    "urllib3>=2.6.3",   # Indirect; prevents CVE-2025-66418
+    "python-multipart>=0.0.22", # Indirect; prevents CVE-2026-24486
+    "starlette>=0.49.1",        # Indirect; prevents CVE-2025-62727
+    "mcp>=1.23.0",              # Indirect; prevents CVE-2025-66416
+    "pyasn1>=0.6.3",            # Indirect; prevents CVE-2026-30922
+    "pydantic-ai>=1.56.0",      # Indirect; prevents CVE-2026-25580
+    "filelock>=3.20.1",         # Indirect; prevents CVE-2025-68146
 ]
 
 [tool.uv.sources]

a2a/a2a_contact_extractor/uv.lock

@@ -20,7 +20,7 @@ dependencies = [
     # The following are to avoid CVEs reported by Trivy and checked by our CI
     "urllib3>=2.6.0",
     "starlette>=0.49.1",
-    "pyasn1>=0.6.2",
+    "pyasn1>=0.6.3",            # Indirect; prevents CVE-2026-30922
     "protobuf>=5.29.6",
     "langgraph-checkpoint>=3.0.0",
     "langchain-core>=0.3.81"

a2a/a2a_currency_converter/pyproject.toml

@@ -11,14 +11,17 @@ requires-python = ">=3.11"
 dependencies = [
     "a2a-sdk>=0.2.16",
     "langgraph>=0.2.55",
-    "langchain-community>=0.3.9",
+    "langchain-core>=1.2.11",
+    "langchain-community>=0.3.27",
     "langchain-ollama>=0.2.1",
     "langchain-openai>=0.3.7",
     "openinference-instrumentation-langchain>=0.1.36",
     "pydantic-settings>=2.8.1",
     "langchain-mcp-adapters>=0.1.0",
     "python-keycloak>=5.5.1",
     "opentelemetry-exporter-otlp",
+    "urllib3>=2.6.3",   # Indirect; prevents CVE-2025-66418
+    "python-multipart>=0.0.22", # Indirect; prevents CVE-2026-24486
 ]
 
 [project.scripts]