fix(deps): address Trivy security scan findings and dependency conflicts

Security updates:
- starlette: 0.48.0 → 0.50.0 (fixes CVE-2025-62727 Range header DoS)
- langchain-core: 0.2.1 → 1.1.0 (security fixes)
- pydantic-ai: 0.0.13 → 1.22.0 (resolves dependency conflicts)

Dependency resolution:
- Resolved pydantic-evals/pydantic-ai-slim version mismatch
- Resolved cohere/httpx-sse version conflict
- All pydantic-ai packages now consistent at 1.22.0

Go client cleanup:
- Removed unused golang.org/x/net and golang.org/x/text dependencies
- Cleaned via go mod tidy

Notes:
- urllib3 remains at <2.4.0 due to kubernetes client constraint
- CVE-2025-50181, CVE-2025-50182 fixes pending kubernetes-client/python#2439

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: vishnu2kmohan

clients/go/go.mod

@@ -1,6 +1,11 @@
 module github.com/GIT_USER_ID/GIT_REPO_ID
 
-go 1.23
+go 1.23.0
+
+require github.com/stretchr/testify v1.11.1
 
 require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

clients/go/go.sum

@@ -1,11 +1,10 @@
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e h1:bRhVy7zSSasaqNksaRZiA5EEI+Ei4I1nO5Jh72wfHlg=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4 h1:YUO/7uOKsKeq9UokNS62b8FYywz3ker1l1vDZRCRefw=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-google.golang.org/appengine v1.4.0 h1:/wp5JvzpHIxhs/dumFmF7BXTf3Z+dd4uXta4kVyO508=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

pyproject.toml

@@ -28,7 +28,7 @@ keywords = ["mcp", "model-context-protocol", "langgraph", "llm", "agent", "anthr
 dependencies = [
     "langgraph>=1.0.3",
     "langgraph-checkpoint-redis>=0.1.2",  # Redis checkpointer for distributed conversation state
-    "langchain-core>=1.0.4",
+    "langchain-core>=1.1.0",  # Updated from 1.0.4 for security fixes
     "langsmith>=0.4.37",
     "litellm>=1.80.0",  # Latest stable with Gemini 3 Pro support (gemini-3-pro-preview)
     "mcp>=1.18.0",
@@ -46,10 +46,13 @@ dependencies = [
     "python-dotenv>=1.1.1",
     "pydantic>=2.12.3",
     "pydantic-settings>=2.11.0",
-    "pydantic-ai>=0.0.13",  # Type-safe AI agent framework for structured routing
+    "pydantic-ai>=1.22.0",  # Type-safe AI agent framework for structured routing (updated for dependency consistency)
     "httpx>=0.28.1",
+    # NOTE: urllib3 capped at <2.4.0 by kubernetes client (34.1.0)
+    # CVE-2025-50181, CVE-2025-50182 fixes in 2.5.0 pending kubernetes-client/python#2439
+    # https://github.com/kubernetes-client/python/issues/2458 tracks the blocker
     "fastapi>=0.120.3",
-    "starlette>=0.48.0",  # Explicitly listed (also transitively via FastAPI) for direct imports
+    "starlette>=0.50.0",  # Updated from 0.48.0, fixes CVE-2025-62727 (Range header DoS)
     "uvicorn[standard]>=0.38.0",
     "python-keycloak>=5.8.1",
     "authlib>=1.6.5",