build(deps): bump the backend-dependencies group across 1 directory with 2 updates

[dependabot]

Updates the requirements on google-adk and a2a-sdk to permit the latest version.
Updates google-adk to 2.5.0

Release notes

Sourced from google-adk's releases.

v2.5.0

2.5.0 (2026-07-16)

Features

• add Cloud Run sandbox option in code executors (5b1088a)
• Add search agents and search MCP severs to agent registry (ed579c1)
• add skill to verify markdown code snippets (c0fa51b)
• Add strict input schema validation for LlmAgent workflow nodes (6f66814)
• add to_mcp_server to serve an ADK agent over MCP (50ff37f)
• agents: add single_turn mode field to ManagedAgent (da50578)
• agents: bridge node_input to user_content for ManagedAgent nodes (a680cea)
• agents: support remote MCP servers for ManagedAgent with runtime header callbacks (2e2ec09)
• agents: wrap single_turn non-LlmAgent sub-agents as inline tools (fc98549)
• bigquery: log tool descriptions and parameter schemas in LLM_REQUEST (ecef5f8)
• enable a2a-sdk 1.x by widening the dependency constraint (b46dd13)
• live: allow Voice activity detection (VAD) events to be returned (820a910)
• live: Run non-blocking tools in a background task (5620d8f)
• plugins: add on_agent_error_callback and on_run_error_callback (7d0ae63)
• Support HITL resumption for standalone nodes and NodeTool (00760f8)
• Support LoadArtifacts parsing for binary text documents (e.g., DOCX) (ccbedd8)
• Validate that no old orchestrators are used inside Workflow graphs (7e245c4)
• Validate that no old orchestrators are used inside Workflow graphs (eaffb0e)
• workflow: Support state-based resumption for task-mode agent workflow nodes (9d306f5)

Bug Fixes

• Add mTLS support for for API registry (41693dc)
• Add mtls support for gcp_utils (3fa993b)
• Add support for list_artifact_versions and get_artifact_version to ForwardingArtifactService (61ba59a)
• avoid crash on first turn with empty user content (c9bacd4)
• Avoid shell execution in ReadFileTool ranged reads (1ac6875)
• block posix, nt, _posixsubprocess, and _socket modules in agent config validation (faa1744)
• cli: Block special internal agents in ApiServer mode (3f6eb1f)
• confine docs-agent file tools to the managed repos directory (f00fc5a)
• decode shell skill output as UTF-8 (b7ad76a)
• environment: add integer validation in ReadFileTool (3c0fb65)
• exclude LiteLlm llm_client from JSON serialization (ecbefd9), closes #6164
• exclude rewound invocations from event compaction (0d4d378)
• explicitly preserve language and tools during event compaction (b44d2c9), closes #6273
• Fix InputTokensDetails validation in OpenAI responses test and formatting in a2a_agent_executor (99ea228)
• Fix sub-branch event routing for nested sub-agents and tools in InvocationContext (3cdc102)
• GitHub CI for the verify-snippets skill (ccc8ab4)
• grow eligible Gemini cache prefixes (98fc036)
• guard decode_model against non-dict session values (8c60d99), closes #6348
• handle sqlite float timestamps in PreciseTimestamp (2da09e6), closes #6352
• honor server-reported Gemini cache expiry (4fdc94c)
• litellm: preserve reasoning replay and optionally share agent thoughts (6290aec)

... (truncated)

Changelog

Sourced from google-adk's changelog.

2.5.0 (2026-07-16)

Features

• add Cloud Run sandbox option in code executors (5b1088a)
• Add search agents and search MCP severs to agent registry (ed579c1)
• add skill to verify markdown code snippets (c0fa51b)
• Add strict input schema validation for LlmAgent workflow nodes (6f66814)
• add to_mcp_server to serve an ADK agent over MCP (50ff37f)
• agents: add single_turn mode field to ManagedAgent (da50578)
• agents: bridge node_input to user_content for ManagedAgent nodes (a680cea)
• agents: support remote MCP servers for ManagedAgent with runtime header callbacks (2e2ec09)
• agents: wrap single_turn non-LlmAgent sub-agents as inline tools (fc98549)
• bigquery: log tool descriptions and parameter schemas in LLM_REQUEST (ecef5f8)
• enable a2a-sdk 1.x by widening the dependency constraint (b46dd13)
• live: allow Voice activity detection (VAD) events to be returned (820a910)
• live: Run non-blocking tools in a background task (5620d8f)
• plugins: add on_agent_error_callback and on_run_error_callback (7d0ae63)
• Support HITL resumption for standalone nodes and NodeTool (00760f8)
• Support LoadArtifacts parsing for binary text documents (e.g., DOCX) (ccbedd8)
• Validate that no old orchestrators are used inside Workflow graphs (7e245c4)
• Validate that no old orchestrators are used inside Workflow graphs (eaffb0e)
• workflow: Support state-based resumption for task-mode agent workflow nodes (9d306f5)

Bug Fixes

• Add mTLS support for for API registry (41693dc)
• Add mtls support for gcp_utils (3fa993b)
• Add support for list_artifact_versions and get_artifact_version to ForwardingArtifactService (61ba59a)
• avoid crash on first turn with empty user content (c9bacd4)
• Avoid shell execution in ReadFileTool ranged reads (1ac6875)
• block posix, nt, _posixsubprocess, and _socket modules in agent config validation (faa1744)
• cli: Block special internal agents in ApiServer mode (3f6eb1f)
• confine docs-agent file tools to the managed repos directory (f00fc5a)
• decode shell skill output as UTF-8 (b7ad76a)
• environment: add integer validation in ReadFileTool (3c0fb65)
• exclude LiteLlm llm_client from JSON serialization (ecbefd9), closes #6164
• exclude rewound invocations from event compaction (0d4d378)
• explicitly preserve language and tools during event compaction (b44d2c9), closes #6273
• Fix InputTokensDetails validation in OpenAI responses test and formatting in a2a_agent_executor (99ea228)
• Fix sub-branch event routing for nested sub-agents and tools in InvocationContext (3cdc102)
• GitHub CI for the verify-snippets skill (ccc8ab4)
• grow eligible Gemini cache prefixes (98fc036)
• guard decode_model against non-dict session values (8c60d99), closes #6348
• handle sqlite float timestamps in PreciseTimestamp (2da09e6), closes #6352
• honor server-reported Gemini cache expiry (4fdc94c)
• litellm: preserve reasoning replay and optionally share agent thoughts (6290aec)
• litellm: preserve signature-only blocks for Anthropic streaming thinking aggregation (78d1957)

... (truncated)

Commits

• 1e93d82 chore: update last-release-sha for next main release
• 5e3b6f1 chore(release/candidate): release 2.5.0 (#6411)
• c9bacd4 fix: avoid crash on first turn with empty user content
• c03f333 fix: Prevent continuation forgery in tool confirmation
• 2da09e6 fix: handle sqlite float timestamps in PreciseTimestamp
• 065234e fix: preserve non-image file MIME type in LiteLlm content conversion
• ecbefd9 fix: exclude LiteLlm llm_client from JSON serialization
• 98fc036 fix: grow eligible Gemini cache prefixes
• 221bad9 fix: require starlette>=1.3.1 to clear known CVEs
• 8eb8348 test: re-enable finish_reason unknown-maps-to-other litellm test
• Additional commits viewable in compare view

Updates a2a-sdk to 1.1.2

Release notes

Sourced from a2a-sdk's releases.

v1.1.2

1.1.2 (2026-07-20)

Features

• server: add aclose() to drain ActiveTask background tasks (#1101) (#1105) (9801f46)

Bug Fixes

• agent_execution: resolve ActiveTask 'destroyed but pending' warning during teardown (#1122) (d19c4d2)
• persist early producer failure as FAILED with originating message (#1106) (4e3d724)

Changelog

Sourced from a2a-sdk's changelog.

1.1.2 (2026-07-20)

Features

• server: add aclose() to drain ActiveTask background tasks (#1101) (#1105) (9801f46)

Bug Fixes

• agent_execution: resolve ActiveTask 'destroyed but pending' warning during teardown (#1122) (d19c4d2)
• persist early producer failure as FAILED with originating message (#1106) (4e3d724)

1.1.1 (2026-07-15)

Bug Fixes

• server: improve Swagger /docs example annotations for A2A routes (#1092) (46b292b)

Miscellaneous Chores

• grpc: eliminate third-party grpcio-status dependency (#1130) (723880e)
• http: eliminate httpx-sse dependency (#1132) (0d82ab9)

1.1.0 (2026-05-29)

Features

• server: restore FastAPI /docs visibility for A2A routes (#1024) (1122d4e)

Bug Fixes

• compat: remove ListTasks from v0.3 REST adapter (#1043) (#1068) (5c88793)
• properly convert metadata to dict in RequestContext.metadata (#1081) (d2f2e18)
• raise on append=True for unknown artifact_id (#1038) (#1077) (fe1f24b)
• release reference count on non-terminal exit to prevent stale registry entries (#1079) (501255c)
• server: preserve non-ASCII characters in streaming JSON responses (#1080) (d46c6f9)
• telemetry: don't mark QueueShutDown as an error span (#1075) (54a485c)

Documentation

• clarify EventQueue usage (#1066) (11dd68a)

Miscellaneous Chores

... (truncated)

Commits

• 3e6fa6a chore(main): release 1.1.2 (#1139)
• 9801f46 feat(server): add aclose() to drain ActiveTask background tasks (#1101) (#1105)
• d19c4d2 fix(agent_execution): resolve ActiveTask 'destroyed but pending' warning duri...
• 4e3d724 fix: persist early producer failure as FAILED with originating message (#1106)
• 86c6b0d chore(main): release 1.1.1 (#1103)
• 0d82ab9 refactor(http): eliminate third-party httpx-sse dependency (#1132)
• 723880e refactor(grpc): remove grpcio-status dependency (#1130)
• 343373b test: expand itk scenarios with ts java and rust agents (#1129)
• e7eafe3 chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#1109)
• 46b292b fix(server): improve Swagger /docs example annotations for A2A routes (#1092)
• Additional commits viewable in compare view