fix: relaxes dependency constraints to improve compatibility with FastAPI …

[qfennessy]

Summary

This PR relaxes dependency constraints to improve compatibility with FastAPI and other common packages, addressing issue #2657 from the upstream repository.

Problem

The current google-adk v1.12.0 has overly restrictive dependency requirements that prevent it from being installed alongside commonly used packages like FastAPI,
causing ResolutionImpossible errors during pip installation.

Changes

• google-genai: Relaxed lower bound from >=1.21.1 to >=1.0.0
  • Allows compatibility with google-cloud-aiplatform which requires google-genai>=1.0.0
• requests: Relaxed lower bound from >=2.32.4 to >=2.25.1
  • Provides broader compatibility while avoiding known security vulnerabilities (CVE-2018-18074)
  • Version 2.25.1 is the minimum required by starlette
• starlette: Updated constraints from >=0.46.2, <1.0.0 to >=0.40.0, <0.47.0
  • Compatible with FastAPI >=0.115.0 which requires starlette<0.47.0,>=0.40.0
  • Addresses the specific conflict where FastAPI 0.115.5 requires starlette<0.42.0,>=0.40.0

Testing

• ✅ Verified unit tests pass with relaxed dependencies
• ✅ Confirmed FastAPI can now be installed alongside google-adk
• ✅ No breaking changes introduced (only relaxed lower bounds and tightened upper bound for starlette to match FastAPI)

Security Considerations

• The requests lower bound was set to >=2.25.1 instead of >=2.13.0 to avoid known security vulnerabilities in earlier versions
• All changes maintain upper bounds to prevent unexpected breaking changes from major version updates

Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• ✨ Improves compatibility with other packages

Related Issues

Fixes #2657

Additional Context

This change allows google-adk to be used in projects that require FastAPI or other packages with less restrictive dependency requirements, while maintaining security
and stability through appropriate version constraints.

#non-breaking

[gemini-code-assist]

Summary of Changes

Hello @qfennessy, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses critical dependency conflicts within the "google-adk" package, specifically resolving "ResolutionImpossible" errors that occurred when attempting to install it alongside common libraries like FastAPI. The core change involves relaxing overly restrictive version constraints for key dependencies such as "google-genai", "requests", and "starlette" in the "pyproject.toml" file. This adjustment significantly improves the package's interoperability with other Python ecosystems, enabling broader adoption without compromising security or stability. The changes are non-breaking and have been verified to maintain existing functionality while enhancing compatibility.

Highlights

• Relaxed google-genai dependency: The lower bound for "google-genai" was relaxed from ">=1.21.1" to ">=1.0.0" to ensure compatibility with "google-cloud-aiplatform".
• Relaxed requests dependency: The lower bound for "requests" was relaxed from ">=2.32.4" to ">=2.25.1". This provides broader compatibility while specifically avoiding known security vulnerabilities and meeting the minimum requirement of "starlette".
• Updated starlette dependency constraints: The "starlette" dependency constraints were updated from ">=0.46.2, <1.0.0" to "<0.47.0,>=0.40.0". This change ensures compatibility with "FastAPI >=0.115.0", which has specific requirements for "starlette" versions.
• Confirmed compatibility and stability: The changes were thoroughly tested, confirming that unit tests pass and that FastAPI can now be successfully installed alongside "google-adk" without "ResolutionImpossible" errors.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request effectively addresses dependency conflicts with FastAPI by relaxing constraints for google-genai, requests, and starlette. The changes are well-justified in the description, considering both compatibility and security. I have one suggestion to improve the consistency of the version specifiers for better readability.