Update google-adk[mcp] requirement from <2.8,>=2.6 to >=2.6,<2.9

[dependabot]

Updates the requirements on google-adk[mcp] to permit the latest version.

Release notes

Sourced from google-adk[mcp]'s releases.

v2.8.0

2.8.0 (2026-08-25)

Features

• a2a: add native task mode support to RemoteA2aAgent (72f3ff5)
• add ADK_MAX_LLM_CALLS environment variable to configure max LLM calls limit (75679db)
• add create_data_agent tool to data_agent toolset (5cd38a0)
• add delete_data_agent tool to data_agent toolset (9b451fc)
• add location parameter to list_accessible_data_agents in data_agent toolset (393ec08)
• add Model Armor guardrail plugin (11efc3f)
• add nvidia nim integration sample (c6bba8d)
• add sample for skill state injection via adk_inject_state (9384127)
• add spreadsheet mime types to load_artifact_tool (370027a)
• add update_data_agent tool to data_agent toolset (92d00aa)
• allow configuring Vertex AI API version (ede87c2), closes #3246
• allow streaming tools to set response scheduling per yield (bf2efd7)
• antigravity: capture client-side tool outcomes for a function_response (4599a52)
• cli: Support Cloud Build worker pools for Agent Engine deploy (e577c30)
• eval: support custom metrics in AgentEvaluator (babb11c)
• guard against SQL injection vulnerabilities in BigQuery tools (d6290a0)
• live: Add VIDEO to the allowed modalities in the ADK API server (dd998a7)
• live: let a live streaming tool send messages to the user directly (98896eb)
• live: run before and after model callbacks in live mode (ef2d680)
• live: surface live interaction_status on LlmResponse and Event (b858904)
• live: use RunConfig.session_resumption.handle when opening a live session (eac32c3)
• mcp: report MCP HTTP exchanges as OpenTelemetry log records (85a6fa1)
• parallelize LLM-as-judge evaluation using asyncio.gather() (0dbb88c)
• preserve field descriptions in set_model_response schema (a30858b), closes #6707
• record context cache state on the LLM call span (c0614d6)
• resolve auth for RemoteA2aAgent in AgentRegistry (d695494)
• support auth_scheme and auth_credential in RemoteA2aAgent (d42c634)
• support injecting custom LLM clients into Gemini and AnthropicLlm (a01d516), closes #5027
• support memory_id and allowed_topics in Vertex Memory Bank (bf73360)
• support opt-in session retention in MultimodalToolResultsPlugin (775c1bd), closes #6695
• support sub-agent escalation event in ParallelAgent (0fd681e), closes #5104

Telemetry

• telemetry: add per-invocation token spend metrics for invoke_agent (dc00db5)
• telemetry: add per-workflow inference and tool call counts (6e6c4a5)
• telemetry: add per-workflow token spend metrics (dd8797e)
• telemetry: Expand telemetry for load_skill_resource span (6e0facf)
• telemetry: honor RunConfig.telemetry at the runner's invocation span (00fc6eb)

Note: new experimental telemetry feature for token usage per agent invocation and per workflow, inference and tool call counts per workflow, and expanded load_skill attributes. Off by default, opt in with ADK_EXPERIMENTAL_TELEMETRY=true or RunConfig.telemetry.adk_experimental_telemetry_opt_in=True.

Bug Fixes

... (truncated)

Changelog

Sourced from google-adk[mcp]'s changelog.

2.8.0 (2026-08-25)

Features

• a2a: add native task mode support to RemoteA2aAgent (72f3ff5)
• add ADK_MAX_LLM_CALLS environment variable to configure max LLM calls limit (75679db)
• add create_data_agent tool to data_agent toolset (5cd38a0)
• add delete_data_agent tool to data_agent toolset (9b451fc)
• add location parameter to list_accessible_data_agents in data_agent toolset (393ec08)
• add Model Armor guardrail plugin (11efc3f)
• add nvidia nim integration sample (c6bba8d)
• add sample for skill state injection via adk_inject_state (9384127)
• add spreadsheet mime types to load_artifact_tool (370027a)
• add update_data_agent tool to data_agent toolset (92d00aa)
• allow configuring Vertex AI API version (ede87c2), closes #3246
• allow streaming tools to set response scheduling per yield (bf2efd7)
• antigravity: capture client-side tool outcomes for a function_response (4599a52)
• cli: Support Cloud Build worker pools for Agent Engine deploy (e577c30)
• eval: support custom metrics in AgentEvaluator (babb11c)
• guard against SQL injection vulnerabilities in BigQuery tools (d6290a0)
• live: Add VIDEO to the allowed modalities in the ADK API server (dd998a7)
• live: let a live streaming tool send messages to the user directly (98896eb)
• live: run before and after model callbacks in live mode (ef2d680)
• live: surface live interaction_status on LlmResponse and Event (b858904)
• live: use RunConfig.session_resumption.handle when opening a live session (eac32c3)
• mcp: report MCP HTTP exchanges as OpenTelemetry log records (85a6fa1)
• parallelize LLM-as-judge evaluation using asyncio.gather() (0dbb88c)
• preserve field descriptions in set_model_response schema (a30858b), closes #6707
• record context cache state on the LLM call span (c0614d6)
• resolve auth for RemoteA2aAgent in AgentRegistry (d695494)
• support auth_scheme and auth_credential in RemoteA2aAgent (d42c634)
• support injecting custom LLM clients into Gemini and AnthropicLlm (a01d516), closes #5027
• support memory_id and allowed_topics in Vertex Memory Bank (bf73360)
• support opt-in session retention in MultimodalToolResultsPlugin (775c1bd), closes #6695
• support sub-agent escalation event in ParallelAgent (0fd681e), closes #5104
• telemetry: add per-invocation token spend metrics for invoke_agent (dc00db5)
• telemetry: add per-workflow inference and tool call counts (6e6c4a5)
• telemetry: add per-workflow token spend metrics (dd8797e)
• telemetry: Expand telemetry for load_skill_resource span (6e0facf)
• telemetry: honor RunConfig.telemetry at the runner's invocation span (00fc6eb)

Bug Fixes

• a2a: keep file payloads out of the debug log line (ef158d3)
• agents: report which toolset an agent lost when one fails to load (66930e6)
• artifacts: Publish file artifact versions atomically (94475c9)
• auth: take the auth scheme from the request, not the client's response (8989aea)
• avoid O(n^2) deep event comparison during rehydration (b8dd086), closes #6657

... (truncated)

Commits

• 76a96e6 chore: update last-release-sha for next main release
• 2174b84 chore(release/candidate): release 2.8.0 (#6900)
• 0880bbe fix: end a ParallelAgent early only when a direct sub-agent escalates (cherry...
• 401cd6d fix: keep transport options and scoped state keys out of the debug log
• 1bc001e fix(sessions): admit the stdlib data types legacy session state holds
• 2956083 fix: remove an internal link from a shipped comment and guard against more
• 94cefbb fix: lazy-load evaluation dependencies in AgentEvaluator
• 4d0d63c fix: prefer the function response's own invocation over a caller-supplied id ...
• 67ca98c fix: Fix crashes and cross-invocation leaks from copying RunConfig.http_options
• a86bd25 fix: redact credentials from DebugLoggingPlugin output file
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[haruotsu]

This one is worth more than a glance, since it widens the range and pulls google-adk 2.7.1 -> 2.8.0 and google-genai 2.18.1 -> 2.22.0 with it.

The 2.8.0 notes carry no breaking-changes section. Of what did change, these land on surfaces this repository actually touches, and all in the direction we want:

• mcp: idle sessions are evicted from the MCP session pool, and tool errors are detected under either field spelling — both under runtime/mcp.py's McpToolset.
• percent-encode path parameter values in RestApiTool — runtime/openapi.py builds tools through the OpenAPI spec parser, so this is a fix we inherit.
• prevent duplicate OAuth prompts and fix tool resumption, and auth: take the auth scheme from the request, not the client's response — the area runtime/reauthorization.py wraps.

Verified locally on the branch rather than trusting the checks alone: uv sync --frozen --all-extras, uv lock --check, ruff check and format, mypy in strict mode, and the full suite (875 tests, including the MCP e2e test) all pass on 2.8.0.

The <2.9 ceiling keeps the "pin to a tested minor" arrangement the comment above the dependency describes. LGTM.