build(deps): bump the backend-dependencies group across 1 directory with 2 updates

[dependabot]

Updates the requirements on google-adk and a2a-sdk to permit the latest version.
Updates google-adk to 2.5.0

Release notes

Sourced from google-adk's releases.

v2.5.0

2.5.0 (2026-07-16)

Breaking Changes

• Update GCP Skill Registry to use agentregistry/skill endpoint (fa884e3): Existing users of GCP Skill Registry should note that the underlying endpoint is now AgentRegistry, so users will need to migrate their data and enable the Agent Registry API if not yet enabled.

Features

• add Cloud Run sandbox option in code executors (5b1088a)
• Add search agents and search MCP severs to agent registry (ed579c1)
• add skill to verify markdown code snippets (c0fa51b)
• Add strict input schema validation for LlmAgent workflow nodes (6f66814)
• add to_mcp_server to serve an ADK agent over MCP (50ff37f)
• agents: add single_turn mode field to ManagedAgent (da50578)
• agents: bridge node_input to user_content for ManagedAgent nodes (a680cea)
• agents: support remote MCP servers for ManagedAgent with runtime header callbacks (2e2ec09)
• agents: wrap single_turn non-LlmAgent sub-agents as inline tools (fc98549)
• bigquery: log tool descriptions and parameter schemas in LLM_REQUEST (ecef5f8)
• enable a2a-sdk 1.x by widening the dependency constraint (b46dd13)
• live: allow Voice activity detection (VAD) events to be returned (820a910)
• live: Run non-blocking tools in a background task (5620d8f)
• plugins: add on_agent_error_callback and on_run_error_callback (7d0ae63)
• Support HITL resumption for standalone nodes and NodeTool (00760f8)
• Support LoadArtifacts parsing for binary text documents (e.g., DOCX) (ccbedd8)
• Validate that no old orchestrators are used inside Workflow graphs (7e245c4)
• Validate that no old orchestrators are used inside Workflow graphs (eaffb0e)
• workflow: Support state-based resumption for task-mode agent workflow nodes (9d306f5)

Bug Fixes

• Add mTLS support for for API registry (41693dc)
• Add mtls support for gcp_utils (3fa993b)
• Add support for list_artifact_versions and get_artifact_version to ForwardingArtifactService (61ba59a)
• avoid crash on first turn with empty user content (c9bacd4)
• Avoid shell execution in ReadFileTool ranged reads (1ac6875)
• block posix, nt, _posixsubprocess, and _socket modules in agent config validation (faa1744)
• cli: Block special internal agents in ApiServer mode (3f6eb1f)
• confine docs-agent file tools to the managed repos directory (f00fc5a)
• decode shell skill output as UTF-8 (b7ad76a)
• environment: add integer validation in ReadFileTool (3c0fb65)
• exclude LiteLlm llm_client from JSON serialization (ecbefd9), closes #6164
• exclude rewound invocations from event compaction (0d4d378)
• explicitly preserve language and tools during event compaction (b44d2c9), closes #6273
• Fix InputTokensDetails validation in OpenAI responses test and formatting in a2a_agent_executor (99ea228)
• Fix sub-branch event routing for nested sub-agents and tools in InvocationContext (3cdc102)
• GitHub CI for the verify-snippets skill (ccc8ab4)
• grow eligible Gemini cache prefixes (98fc036)
• guard decode_model against non-dict session values (8c60d99), closes #6348
• handle sqlite float timestamps in PreciseTimestamp (2da09e6), closes #6352

... (truncated)

Changelog

Sourced from google-adk's changelog.

2.5.0 (2026-07-16)

Features

• add Cloud Run sandbox option in code executors (5b1088a)
• Add search agents and search MCP severs to agent registry (ed579c1)
• add skill to verify markdown code snippets (c0fa51b)
• Add strict input schema validation for LlmAgent workflow nodes (6f66814)
• add to_mcp_server to serve an ADK agent over MCP (50ff37f)
• agents: add single_turn mode field to ManagedAgent (da50578)
• agents: bridge node_input to user_content for ManagedAgent nodes (a680cea)
• agents: support remote MCP servers for ManagedAgent with runtime header callbacks (2e2ec09)
• agents: wrap single_turn non-LlmAgent sub-agents as inline tools (fc98549)
• bigquery: log tool descriptions and parameter schemas in LLM_REQUEST (ecef5f8)
• enable a2a-sdk 1.x by widening the dependency constraint (b46dd13)
• live: allow Voice activity detection (VAD) events to be returned (820a910)
• live: Run non-blocking tools in a background task (5620d8f)
• plugins: add on_agent_error_callback and on_run_error_callback (7d0ae63)
• Support HITL resumption for standalone nodes and NodeTool (00760f8)
• Support LoadArtifacts parsing for binary text documents (e.g., DOCX) (ccbedd8)
• Validate that no old orchestrators are used inside Workflow graphs (7e245c4)
• Validate that no old orchestrators are used inside Workflow graphs (eaffb0e)
• workflow: Support state-based resumption for task-mode agent workflow nodes (9d306f5)

Bug Fixes

• Add mTLS support for for API registry (41693dc)
• Add mtls support for gcp_utils (3fa993b)
• Add support for list_artifact_versions and get_artifact_version to ForwardingArtifactService (61ba59a)
• avoid crash on first turn with empty user content (c9bacd4)
• Avoid shell execution in ReadFileTool ranged reads (1ac6875)
• block posix, nt, _posixsubprocess, and _socket modules in agent config validation (faa1744)
• cli: Block special internal agents in ApiServer mode (3f6eb1f)
• confine docs-agent file tools to the managed repos directory (f00fc5a)
• decode shell skill output as UTF-8 (b7ad76a)
• environment: add integer validation in ReadFileTool (3c0fb65)
• exclude LiteLlm llm_client from JSON serialization (ecbefd9), closes #6164
• exclude rewound invocations from event compaction (0d4d378)
• explicitly preserve language and tools during event compaction (b44d2c9), closes #6273
• Fix InputTokensDetails validation in OpenAI responses test and formatting in a2a_agent_executor (99ea228)
• Fix sub-branch event routing for nested sub-agents and tools in InvocationContext (3cdc102)
• GitHub CI for the verify-snippets skill (ccc8ab4)
• grow eligible Gemini cache prefixes (98fc036)
• guard decode_model against non-dict session values (8c60d99), closes #6348
• handle sqlite float timestamps in PreciseTimestamp (2da09e6), closes #6352
• honor server-reported Gemini cache expiry (4fdc94c)
• litellm: preserve reasoning replay and optionally share agent thoughts (6290aec)
• litellm: preserve signature-only blocks for Anthropic streaming thinking aggregation (78d1957)

... (truncated)

Commits

• 1e93d82 chore: update last-release-sha for next main release
• 5e3b6f1 chore(release/candidate): release 2.5.0 (#6411)
• c9bacd4 fix: avoid crash on first turn with empty user content
• c03f333 fix: Prevent continuation forgery in tool confirmation
• 2da09e6 fix: handle sqlite float timestamps in PreciseTimestamp
• 065234e fix: preserve non-image file MIME type in LiteLlm content conversion
• ecbefd9 fix: exclude LiteLlm llm_client from JSON serialization
• 98fc036 fix: grow eligible Gemini cache prefixes
• 221bad9 fix: require starlette>=1.3.1 to clear known CVEs
• 8eb8348 test: re-enable finish_reason unknown-maps-to-other litellm test
• Additional commits viewable in compare view

Updates a2a-sdk to 1.1.2

Release notes

Sourced from a2a-sdk's releases.

v1.1.2

1.1.2 (2026-07-20)

Features

• server: add aclose() to drain ActiveTask background tasks (#1101) (#1105) (9801f46)

Bug Fixes

• agent_execution: resolve ActiveTask 'destroyed but pending' warning during teardown (#1122) (d19c4d2)
• persist early producer failure as FAILED with originating message (#1106) (4e3d724)

Changelog

Sourced from a2a-sdk's changelog.

1.1.2 (2026-07-20)

Features

• server: add aclose() to drain ActiveTask background tasks (#1101) (#1105) (9801f46)

Bug Fixes

• agent_execution: resolve ActiveTask 'destroyed but pending' warning during teardown (#1122) (d19c4d2)
• persist early producer failure as FAILED with originating message (#1106) (4e3d724)

1.1.1 (2026-07-15)

Bug Fixes

• server: improve Swagger /docs example annotations for A2A routes (#1092) (46b292b)

Miscellaneous Chores

• grpc: eliminate third-party grpcio-status dependency (#1130) (723880e)
• http: eliminate httpx-sse dependency (#1132) (0d82ab9)

1.1.0 (2026-05-29)

Features

• server: restore FastAPI /docs visibility for A2A routes (#1024) (1122d4e)

Bug Fixes

• compat: remove ListTasks from v0.3 REST adapter (#1043) (#1068) (5c88793)
• properly convert metadata to dict in RequestContext.metadata (#1081) (d2f2e18)
• raise on append=True for unknown artifact_id (#1038) (#1077) (fe1f24b)
• release reference count on non-terminal exit to prevent stale registry entries (#1079) (501255c)
• server: preserve non-ASCII characters in streaming JSON responses (#1080) (d46c6f9)
• telemetry: don't mark QueueShutDown as an error span (#1075) (54a485c)

Documentation

• clarify EventQueue usage (#1066) (11dd68a)

Miscellaneous Chores

... (truncated)

Commits

• 3e6fa6a chore(main): release 1.1.2 (#1139)
• 9801f46 feat(server): add aclose() to drain ActiveTask background tasks (#1101) (#1105)
• d19c4d2 fix(agent_execution): resolve ActiveTask 'destroyed but pending' warning duri...
• 4e3d724 fix: persist early producer failure as FAILED with originating message (#1106)
• 86c6b0d chore(main): release 1.1.1 (#1103)
• 0d82ab9 refactor(http): eliminate third-party httpx-sse dependency (#1132)
• 723880e refactor(grpc): remove grpcio-status dependency (#1130)
• 343373b test: expand itk scenarios with ts java and rust agents (#1129)
• e7eafe3 chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#1109)
• 46b292b fix(server): improve Swagger /docs example annotations for A2A routes (#1092)
• Additional commits viewable in compare view