fix: update vulnerable agentex dependencies

agentex/pyproject.toml

@@ -7,8 +7,8 @@ requires-python = ">=3.12,<3.13"
 readme = "README.md"
 dependencies = [
     "fastapi>=0.115.0",
-    "litellm>=1.48.2,<2",
-    "python-dotenv>=1.0.1,<2",
+    "litellm>=1.83.7,<2",
+    "python-dotenv>=1.2.2,<2",
     "temporalio>=1.18.0,<2",
     "uvicorn[standard]>=0.35.0,<0.36",
     "redis>=5.1.0,<6",
@@ -17,7 +17,7 @@ dependencies = [
     "alembic>=1.13.3,<2",
     "psycopg2-binary>=2.9.9,<3",
     "docker>=7.1.0,<8",
-    "python-multipart>=0.0.22",
+    "python-multipart>=0.0.26",
     "aiodocker>=0.23.0,<0.24",
     "kubernetes-asyncio>=31.1.0,<32",
     "aiohttp>=3.10.9,<4",
@@ -47,7 +47,7 @@ test = [
     "pytest-asyncio>=1.0.0,<2",
     "pytest-cov>=5.0.0,<6",
     "testcontainers>=4.0.0,<5",
-    "httpx[http2]>=0.27.0,<0.28", # for test client
+    "httpx[http2]>=0.27.0,<0.29", # for test client
     "factory-boy>=3.3.0,<4", # for test data factories
     "greenlet>=3.2.3",
     "asyncpg>=0.29.0",

agentex/tests/integration/api/agent_api_keys/test_agent_api_keys_api.py

@@ -542,10 +542,14 @@ async def test_forwarding_post_request(
         )
 
         # When - Forward a request to the agent
+        payload_body = b'{"key": "value"}'
         forward_response = await isolated_client.post(
             "/agents/forward/name/test-agent/some/path",
-            json={"key": "value"},
-            headers={"x-agent-api-key": "test-api-key-value"},
+            content=payload_body,
+            headers={
+                "content-type": "application/json",
+                "x-agent-api-key": "test-api-key-value",
+            },
         )
         assert forward_response.status_code == 200
         assert forward_response.json() == mock_response
@@ -557,7 +561,7 @@ async def test_forwarding_post_request(
         assert (
             call_args[0][1] == "http://test-acp:8000/some/path"
         )  # URL should match agent's ACP URL
-        assert call_args[1]["content"] == b'{"key": "value"}'  # Body should match
+        assert call_args[1]["content"] == payload_body  # Body should match
 
         isolated_api_key_http_client.send.assert_called_once()
         call_args = isolated_api_key_http_client.send.call_args
@@ -814,8 +818,9 @@ async def test_forwarding_request_with_slack(
         )
         forward_response = await isolated_client.post(
             "/agents/forward/name/test-agent/some/path",
-            json={"api_app_id": test_agent_api_key_slack.name},
+            content=payload_body,
             headers={
+                "content-type": "application/json",
                 "x-slack-signature": "v0=" + hash_object.hexdigest(),
                 "x-slack-request-timestamp": str(request_timestamp),
             },

pyproject.toml

@@ -30,6 +30,7 @@ environments = [
 override-dependencies = [
     "fastapi>=0.135.0",
     "starlette>=0.52.0",
+    "httpx[http2]>=0.28.1,<0.29",
 ]
 
 [tool.uv.workspace]