Security: Bump Google ADK (and others) to resolve CVEs

[inFocus7]

Context

Dependency bumps to resolve CVEs.

Note: Looking at scans below, I left lang* dependencies as-is in the meantime to avoid possible breaking changes (AI-related projects tend to break here and there, so it would need a bit more investigation). I focused on quicker wins.

Resolves #183

What Changed

• Bump google-adk[eval] >= 2.5.0 < 2.8
  • Required test updates due to changed underlying routing.
  • < 2.8 because 2.x minor releases have breaking changes, so we want to avoid unknowingly breaking agentevals in future updates.
• Bump click >= 8.3.3
• Bump pygments >= 2.20.0
• Bump pytest >= 9.0.3

Additional Notes

Bump Safety

Between google-adk 2.2.0 - 2.7.1, these were the breaking changes (based on release notes):

v2.2.0

agents: LlmAgent default model changed from gemini-2.5-flash to gemini-3-flash-preview (a preview model), ahead of the 2026-10-16 gemini-2.5-flash shutdown. Agents without an explicit model= now run on the new preview default; set model="gemini-2.5-flash" to retain prior behavior. DEFAULT_LIVE_MODEL is unchanged. (ad8b6c7)

affect: None. We don't construct an LlmAgent

interactions: GenAI SDK v2.0.0 support renames the turn-based helpers in interactions_utils.py (e.g. convert_contents_to_turns → convert_contents_to_steps) and moves from "turns" to "steps" terminology. Update any direct callers. (da1d8f1)

affect: None. We don't use convert_contents_to_turns or interactions_utils in general.

v2.5.0

Update GCP Skill Registry to use agentregistry/skill endpoint (fa884e3): Existing users of GCP Skill Registry should note that the underlying endpoint is now AgentRegistry, so users will need to migrate their data and enable the Agent Registry API if not yet enabled.

affect: None. No skill-registry, agentregistry, or skill-toolset usage anywhere.

v2.7.0

deps: move pyarrow out of the gcp extra

affect: None. We don't request [gcp], only [eval].

Scans

Scanned by running the following on main and this branch:

docker run --rm -v "$PWD:/src:ro" ghcr.io/google/osv-scanner:latest \
  scan source --lockfile=/src/uv.lock --format markdown

Before (branch: main)

OSV URL	CVSS	Ecosystem	Package	Version	Fixed Version	Source
https://osv.dev/PYSEC-2026-2132	7.2	PyPI	click	8.3.1	8.3.3	src/uv.lock
https://osv.dev/PYSEC-2026-2192 https://osv.dev/GHSA-gr75-jv2w-4656	5.5	PyPI	langchain	1.2.15	1.3.9	src/uv.lock
https://osv.dev/PYSEC-2026-2564 https://osv.dev/GHSA-pjwx-r37v-7724	8.2	PyPI	langchain-core	1.2.29	1.3.3	src/uv.lock
https://osv.dev/PYSEC-2026-76 https://osv.dev/GHSA-r7w7-9xr2-qq2r	3.1	PyPI	langchain-openai	1.1.13	1.1.14	src/uv.lock
https://osv.dev/PYSEC-2026-2573 https://osv.dev/GHSA-fjqc-hq36-qh5p	6.8	PyPI	langgraph-checkpoint	4.0.1	4.1.1	src/uv.lock
https://osv.dev/PYSEC-2026-2575 https://osv.dev/GHSA-w39p-vh2g-g8g5	4.2	PyPI	langgraph-sdk	0.3.13	0.3.15	src/uv.lock
https://osv.dev/PYSEC-2026-2582 https://osv.dev/GHSA-3644-q5cj-c5c7	7.1	PyPI	langsmith	0.7.31	0.8.0	src/uv.lock
https://osv.dev/GHSA-f4xh-w4cj-qxq8	7.7	PyPI	langsmith	0.7.31	0.8.18	src/uv.lock
https://osv.dev/PYSEC-2026-2987 https://osv.dev/GHSA-5239-wwwm-4pmq	3.3	PyPI	pygments	2.19.2	2.20.0	src/uv.lock
https://osv.dev/PYSEC-2026-1845 https://osv.dev/GHSA-6w46-j5rx-g56g	6.8	PyPI	pytest	9.0.2	9.0.3	src/uv.lock
https://osv.dev/PYSEC-2026-161 https://osv.dev/GHSA-86qp-5c8j-p5mr	6.5	PyPI	starlette	0.52.1	1.0.1	src/uv.lock
https://osv.dev/PYSEC-2026-2280 https://osv.dev/GHSA-x746-7m8f-x49c	5.3	PyPI	starlette	0.52.1	1.1.0	src/uv.lock
https://osv.dev/PYSEC-2026-2281 https://osv.dev/GHSA-wqp7-x3pw-xc5r	7.5	PyPI	starlette	0.52.1	1.1.0	src/uv.lock
https://osv.dev/PYSEC-2026-248 https://osv.dev/GHSA-jp82-jpqv-5vv3	5.3	PyPI	starlette	0.52.1	1.3.0	src/uv.lock
https://osv.dev/PYSEC-2026-249 https://osv.dev/GHSA-82w8-qh3p-5jfq	7.5	PyPI	starlette	0.52.1	1.3.1	src/uv.lock

After (branch: security/bump-google-adk-to-resolve-starlette-cves)

OSV URL	CVSS	Ecosystem	Package	Version	Fixed Version	Source
https://osv.dev/PYSEC-2026-2192 https://osv.dev/GHSA-gr75-jv2w-4656	5.5	PyPI	langchain	1.2.15	1.3.9	src/uv.lock
https://osv.dev/PYSEC-2026-2564 https://osv.dev/GHSA-pjwx-r37v-7724	8.2	PyPI	langchain-core	1.2.29	1.3.3	src/uv.lock
https://osv.dev/PYSEC-2026-76 https://osv.dev/GHSA-r7w7-9xr2-qq2r	3.1	PyPI	langchain-openai	1.1.13	1.1.14	src/uv.lock
https://osv.dev/PYSEC-2026-2573 https://osv.dev/GHSA-fjqc-hq36-qh5p	6.8	PyPI	langgraph-checkpoint	4.0.1	4.1.1	src/uv.lock
https://osv.dev/PYSEC-2026-2575 https://osv.dev/GHSA-w39p-vh2g-g8g5	4.2	PyPI	langgraph-sdk	0.3.13	0.3.15	src/uv.lock
https://osv.dev/PYSEC-2026-2582 https://osv.dev/GHSA-3644-q5cj-c5c7	7.1	PyPI	langsmith	0.7.31	0.8.0	src/uv.lock
https://osv.dev/GHSA-f4xh-w4cj-qxq8	7.7	PyPI	langsmith	0.7.31	0.8.18	src/uv.lock