Bump starlette in v1 to fix multiple CVEs (including HIGH-classified CVEs) #6567

🔴 Required Information

Currently, ADK v1 requires starlette prior to version 1, which contains the vulnerability reported in GHSA-86qp-5c8j-p5mr. It was already fixed in v2 (#5894) but not in v1.

Describe the Bug:
ADK v1 depends on an outdated version of starlette that needs to be bumped to address:

1. CVE-2026-48710
2. CVE-2026-54283
3. CVE-2026-48818
4. CVE-2026-48817
5. CVE-2026-54282

Related to: #6038, which was prematurely closed.
Current pyproject.toml in the v1 branch has:

starlette>=0.49.1,<1

Steps to Reproduce:
N/A

Expected Behavior:
N/A

Observed Behavior:
N/A

Environment Details:

• ADK Library Version: 1.36.1
• Desktop OS: macOS
• Python Version: 3.13.2

Model Information:
N/A

How often has this issue occurred?:

• Always (100%)