pyproject.toml

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "kagent-adk"
version = "0.3.0"
description = "kagent-adk is an sdk for integrating adk agents with kagent"
readme = "README.md"
requires-python = ">=3.10"
dependencies = [
  "agentsts-adk>=0.1.0",
  "agentsts-core>=0.1.0",
  "kagent-core>=0.1.0",
  "kagent-skills>=0.1.0",
  "aiofiles>=24.1.0",
  "anyio>=4.9.0",
  "typer>=0.15.0",
  "uvicorn>=0.34.0",
  "openai>=1.72.0",
  "mcp>=1.25.0",
  "protobuf>=6.33.5",  # CVE-2026-0994: Denial of Service due to recursion depth bypass
  "anthropic[vertex]>=0.49.0",
  "fastapi>=0.115.1",
  "google-adk>=1.25.0",
  "google-genai>=1.21.1",
  "google-auth>=2.40.2",
  "httpx>=0.25.0",
  "pydantic>=2.5.0",
  "typing-extensions>=4.8.0",
  "jsonref>=1.1.0",
  "a2a-sdk>=0.3.23",
  # Security: pin minimum versions for CVE fixes in transitive dependencies
  "urllib3>=2.6.3",  # CVE-2025-66418, CVE-2025-66471, CVE-2026-21441: unbounded decompression DoS
  "filelock>=3.20.3",  # CVE-2025-68146, CVE-2026-22701: TOCTOU symlink race condition
  "python-multipart>=0.0.22",  # CVE-2026-24486: Arbitrary file write via path traversal
  "httpx-sse>=0.4.3",  # U+2028/U+2029 SSE line terminator fix (0.4.2) + performance regression fix (0.4.3)
  "boto3>=1.28.57",
  "ollama >=0.3.6",  # Ollama SDK
  "numpy>=2.2.6",
]

[tool.uv.sources]
kagent-core = {workspace = true}
kagent-skills = {workspace = true}
agentsts-adk = {workspace = true}
agentsts-core = {workspace = true}

[project.scripts]
kagent-adk = "kagent.adk.cli:run_cli"

[project.optional-dependencies]
test = [
  "pytest>=8.3.5",
  "pytest-asyncio>=0.25.3",
]
memory = [
  "psutil>=6.1.0",  # For memory monitoring
]

[tool.hatch.build.targets.wheel]
packages = ["src/kagent"]

[tool.ruff]
extend = "../../pyproject.toml"

[tool.pytest.ini_options]
testpaths = ["tests"]
asyncio_default_fixture_loop_scope = "function"
asyncio_mode = "auto"