Merge pull request #283 from kagenti/build/bundle-weather-service-deps

build(deps): bundle weather_service dependency updates

Author: pdettori

a2a/weather_service/pyproject.toml

@@ -24,19 +24,26 @@ dependencies = [
     "opentelemetry-instrumentation-httpx>=0.49b0",
     # OpenTelemetry GenAI semantic convention instrumentation
     # Emits spans with gen_ai.* attributes for MLflow compatibility
-    "opentelemetry-instrumentation-openai>=0.34b0",
+    "opentelemetry-instrumentation-openai>=0.60.0",
     # OpenInference for LangChain instrumentation and AGENT span semantics
     "openinference-semantic-conventions>=0.1.12",
-    "openinference-instrumentation-langchain>=0.1.27",
+    "openinference-instrumentation-langchain>=0.1.63",
     "urllib3>=2.6.3",   # Indirect; prevents CVE-2025-66418
-    "python-multipart>=0.0.22", # Indirect; prevents CVE-2026-24486
-    "cryptography>=46.0.5",     # Indirect; prevents CVE-2026-26007
+    "python-multipart>=0.0.26", # Indirect; prevents CVE-2026-24486
+    "cryptography>=46.0.7",     # Indirect; prevents CVE-2026-26007
     "langgraph-checkpoint>=3.0.0", # Indirect; prevents CVE-2025-64439
     "mcp>=1.23.0",              # Indirect; prevents CVE-2025-66416
     "protobuf>=6.33.5",         # Indirect; prevents CVE-2026-0994
     "starlette>=0.49.1",        # Indirect; prevents CVE-2025-62727
     "pyasn1>=0.6.3",            # Indirect; prevents CVE-2026-30922
-    "aiohttp>=3.13.3",          # Indirect; prevents CVE-2025-69223
+    "aiohttp>=3.13.5",          # Indirect; prevents CVE-2025-69223
+    "gitpython>=3.1.47",        # Indirect; prevents CVE-2026-42215, CVE-2026-42284
+    "langchain-text-splitters>=1.1.2", # Indirect; prevents CVE-2026-41481
+    "langsmith>=0.7.31",        # Indirect; prevents CVE-2026-41182
+    "mako>=1.3.11",             # Indirect; prevents CVE-2026-41205
+    "marshmallow>=3.26.2",      # Indirect; prevents CVE-2025-68480
+    "python-dotenv>=1.2.2",     # Indirect; prevents CVE-2026-28684
+    "requests>=2.33.0",         # Indirect; prevents CVE-2026-25645
 ]
 
 [project.scripts]