Repository navigation
Security: Bump Google ADK (and others) to resolve CVEs - #188
Merged
krisztianfekete merged 6 commits intoAug 26, 2026
Merged
krisztianfekete merged 6 commits into
krisztianfekete merged 6 commits into
Conversation
Signed-off-by: Fabian Gonzalez <[email protected]>
…lvd CVEs Signed-off-by: Fabian Gonzalez <[email protected]>
inFocus7
marked this pull request as ready for review
August 25, 2026 20:00
Signed-off-by: Fabian Gonzalez <[email protected]>
krisztianfekete
left a comment
krisztianfekete
left a comment
Member
There was a problem hiding this comment.
Thanks, added a comment!
Comment on lines
+12
to
+13
| # Cap: ADK ships breaking changes in minor releases (e.g. 2.2, 2.5, 2.7), so <3 is not a safe guardrail. | ||
| "google-adk[eval]>=2.5.0,<2.8", |
Member
There was a problem hiding this comment.
ADK ships a minor every ~14 days, so <2.8 goes stale in ~2w we have the problem I wanted to fix in #183. Our own CI can't regress from a new ADK release anyway because uv.lock pins it and we gate the lock, so the cap only really for PyPI users. What do you think about something like >=2.5.0,<3?
Signed-off-by: Fabian Gonzalez <[email protected]>
Signed-off-by: Fabian Gonzalez <[email protected]>
krisztianfekete
left a comment
krisztianfekete
left a comment
Member
There was a problem hiding this comment.
Awesome, thanks! Two minor things, if you have time to add!
Comment on lines
+115
to
+136
| - package-ecosystem: "docker" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "weekly" | ||
| day: "monday" | ||
| open-pull-requests-limit: 3 | ||
| labels: | ||
| - "dependencies" | ||
| commit-message: | ||
| prefix: "chore(deps):" | ||
| ignore: | ||
| - dependency-name: "*" | ||
| update-types: | ||
| - "version-update:semver-major" | ||
| groups: | ||
| docker-base-images: | ||
| applies-to: version-updates | ||
| patterns: | ||
| - "*" | ||
| update-types: | ||
| - "minor" | ||
| - "patch" |
Comment on lines
+4
to
+26
| - package-ecosystem: "github-actions" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "weekly" | ||
| day: "monday" | ||
| open-pull-requests-limit: 3 | ||
| labels: | ||
| - "dependencies" | ||
| - "CI" | ||
| commit-message: | ||
| prefix: "chore(deps):" | ||
| groups: | ||
| github-actions: | ||
| applies-to: version-updates | ||
| patterns: | ||
| - "*" | ||
| update-types: | ||
| - "minor" | ||
| - "patch" | ||
| github-actions-security: | ||
| applies-to: security-updates | ||
| patterns: | ||
| - "*" |
Member
There was a problem hiding this comment.
Can we add cooldown here as well?
Signed-off-by: Fabian Gonzalez <[email protected]>
krisztianfekete
approved these changes
Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Dependency bumps to resolve CVEs. Add
dependabot.ymlfor dependencies, set to run on Mondays, weekly.Note: Looking at scans below, I left
lang*dependencies as-is in the meantime to avoid possible breaking changes (AI-related projects tend to break here and there, so it would need a bit more investigation). I focused on quicker wins.Resolves #183
Resolves #185
What Changed
google-adk[eval] >= 2.5.0 < 2.8< 2.8because 2.x minor releases have breaking changes, so we want to avoid unknowingly breaking agentevals in future updates.click >= 8.3.3pygments >= 2.20.0pytest >= 9.0.3Additional Notes
Bump Safety
Between
google-adk2.2.0 - 2.7.1, these were the breaking changes (based on release notes):v2.2.0affect: None. We don't construct an
LlmAgentaffect: None. We don't use
convert_contents_to_turnsorinteractions_utilsin general.v2.5.0affect: None. No skill-registry, agentregistry, or skill-toolset usage anywhere.
v2.7.0affect: None. We don't request
[gcp], only[eval].Scans
Scanned by running the following on
mainand this branch:Before (branch:
main)https://osv.dev/GHSA-gr75-jv2w-4656
https://osv.dev/GHSA-pjwx-r37v-7724
https://osv.dev/GHSA-r7w7-9xr2-qq2r
https://osv.dev/GHSA-fjqc-hq36-qh5p
https://osv.dev/GHSA-w39p-vh2g-g8g5
https://osv.dev/GHSA-3644-q5cj-c5c7
https://osv.dev/GHSA-5239-wwwm-4pmq
https://osv.dev/GHSA-6w46-j5rx-g56g
https://osv.dev/GHSA-86qp-5c8j-p5mr
https://osv.dev/GHSA-x746-7m8f-x49c
https://osv.dev/GHSA-wqp7-x3pw-xc5r
https://osv.dev/GHSA-jp82-jpqv-5vv3
https://osv.dev/GHSA-82w8-qh3p-5jfq
After (branch:
security/bump-google-adk-to-resolve-starlette-cves)https://osv.dev/GHSA-gr75-jv2w-4656
https://osv.dev/GHSA-pjwx-r37v-7724
https://osv.dev/GHSA-r7w7-9xr2-qq2r
https://osv.dev/GHSA-fjqc-hq36-qh5p
https://osv.dev/GHSA-w39p-vh2g-g8g5
https://osv.dev/GHSA-3644-q5cj-c5c7