Fix CVE-2026-4810: bump google-adk constraint to >=1.28.1,<2.0.0 - #269
Conversation
Bumps the centralized google-adk constraint in root pyproject.toml from >=1.0.0 to >=1.28.1,<2.0.0 (pinned within the 1.x line to avoid the breaking 2.x major), which resolves the previously-locked vulnerable google-adk 1.14.1 up to the patched 1.39.1.
|
dbezic (@dbezic) Rick Brighenti (@rbrighenti) Krishnadheeraj (@DheerajPannala) could one of you review/approve? (submitted from a fork so I can't formally request review — flagging directly instead.) |
There was a problem hiding this comment.
🟡 Changes recommended
The current < 2.0.0 bound still permits 2.0.0 pre-releases (e.g., 2.0.0a2), so the constraint does not strictly enforce “1.x only” as intended.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR updates the repository’s centralized dependency constraints to remediate CVE-2026-4810 by raising the minimum required google-adk version and adding an upper bound to avoid unintended adoption of a breaking major release.
Changes:
- Bump
google-adkconstraint minimum to>=1.28.1to pick up the upstream security fix. - Add an upper bound to keep resolution within the 1.x line (with an explanatory security remediation comment).
File summaries
| File | Description |
|---|---|
| pyproject.toml | Updates the root constraint-dependencies entry for google-adk to a patched minimum version with an upper bound and remediation context. |
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
🟡 Changes recommended
The constraint upper bound in pyproject.toml (<2.0.0a0) does not match the PR’s stated <2.0.0 bound and should be aligned to avoid confusion.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
|
@microsoft-github-policy-service agree company="Microsoft" |
c871549 to
133001a
Compare
|
Clarified in a comment: the current <2.0.0 bound (no explicit pre-release marker) already excludes 2.0.0 pre-releases like 2.0.0a2 under the resolver's default pre-release exclusion behavior, so no functional change was needed - updated the inline comment to make that explicit for future readers. |
|
Flagging for reviewers: if this repo's CI also runs integration/secret-dependent tests, the same fork-secrets limitation may apply here too - pull_request workflows from forks don't receive repository secrets. If a check fails for that reason (not from the dependency bump itself), the fix is to get these commits onto a same-repo branch (not a fork) so a PR from that branch gets full secrets access. |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟡 Changes recommended
The PR description’s stated upper bound (<2.0.0a0) does not match the implemented constraint (<2.0.0), which should be aligned to avoid ambiguity in the security remediation record.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
Summary
Fixes a known vulnerability in the google-adk dependency by bumping the centralized constraint in root pyproject.toml's [tool.uv] constraint-dependencies from >=1.0.0 to >=1.28.1,<2.0.0a0 (pinned within the 1.x line to avoid the breaking 2.x major).
CVE fixed
CVE-2026-4810: Code Injection and Missing Authentication in Google Agent Development Kit (ADK), allowing an unauthenticated remote attacker to execute arbitrary code. Patched upstream in 1.28.1 / 2.0.0a2. Resolves the previously-locked vulnerable google-adk 1.14.1 up to the patched 1.39.1.
Local verification
Reviewers
Requested review from dbezic, rbrighenti, DheerajPannala.
This PR description was drafted with AI assistance. Please review carefully before merging.