Repository navigation
Remove version constraint for starlette #5381
Description
🔴 Required Information
Is your feature request related to a specific problem?
adk-python currently pins starlette to a specific version range "starlette>=0.49.1, <1.0.0"
Preventing end-users from updating to starlette 1.0
Describe the Solution You'd Like
Use starlette v1.0 in adk-python v2.0
Impact on your work
Updating to starlette v1.0 came up as an issue for my project (NVIDIA/NeMo-Agent-Toolkit#1882) which depends on adk-python.
Willingness to contribute
No
🟡 Recommended Information
Describe Alternatives You've Considered
adk-python is an optional dependency for NeMo Agent Toolkit, so in theory we could support both starlette < 1.0, and starlette 1.0.
Proposed API / Implementation
N/A
Additional Context
N/A
Activity
llalitkumarrr commentedon Apr 20, 2026
Hello @dagardner-nv ,
Thank you for raising this request. We will review it and take the necessary steps.
dagardner-nv commentedon Apr 20, 2026
@llalitkumarrr thanks, for what it's worth on my side I was able to switch to using API compatible code that works with both 0.52 and 1.0, so this removes some (but not all) of the need for this issue.
ct-claude-agent commentedon May 27, 2026
+1 — this constraint became actively painful with CVE-2026-48710 (Starlette BadHost), disclosed 2026-05-26 by OSTIF. The patched Starlette is 1.0.1, but
adk-pythonstill pinsstarlette<1.0.0across all releases including 2.1.0, so projects depending ongoogle-adk[a2a]cannot upgrade.For my project (Newsleopard A2A agent on Cloud Run) I ended up shipping an application-layer mitigation: an outermost ASGI middleware that rejects HTTP requests whose
Hostheader contains/,?,#,@, whitespace, or control bytes — neutralising the BadHost attack vector regardless of Starlette version. Happy to share the code if useful.That said, the long-term fix is what this issue asks for. Some context that might help prioritisation: a quick scan of ADK's source against the Starlette 0.52 → 1.0 changelog shows the main breaking change is the removal of deprecated
BaseHTTPMiddlewarebehaviour; most consumers (including ADK'sto_a2a) should be unaffected. Is there a specific blocker on the ADK side, or is this just waiting for someone to do the bump + CI run? If the latter, I can take a look at a PR.ftnext commentedon May 30, 2026
merged #5894
adk-python/pyproject.toml
Line 54 in 4006fe4
DeanChensj commentedon Jun 26, 2026
Hi @dagardner-nv, thank you for the feedback! This issue is already resolved. We have relaxed the Starlette version constraint to "starlette>=1.0.1,<2" in
pyproject.toml, which resolves the version conflicts with newer Starlette releases. We are closing this issue, but please let us know if you run into any further problems. Thanks!