fix: resolve main image scan failures (kagent-dev#1742)

## Summary
- fix the image-scan workflow so the `golang-adk-full` job scans the
image name and tag that `make build-golang-adk-full` actually publishes
- patch the pinned sandbox-runtime install in the app and full Go images
to replace the vulnerable locked `lodash-es` version without repinning
the whole external runtime
- raise the runtime `google-adk` floor to a fixed 1.x release, refresh
`python/uv.lock`, and update the ADK Python template pin

## Verification
- `make lint`
- `uv run pytest
packages/kagent-adk/tests/unittests/converters/test_consts_sync.py`

---------

Signed-off-by: Jaison Paul <paul.jaison@gmail.com>

Author: jsonmp-k8

.github/workflows/image-scan.yaml

@@ -25,13 +25,25 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        image:
-          - controller
-          - ui
-          - app
-          - skills-init
-          - golang-adk
-          - golang-adk-full
+        include:
+          - build_target: controller
+            image_name: controller
+            tag_suffix: ""
+          - build_target: ui
+            image_name: ui
+            tag_suffix: ""
+          - build_target: app
+            image_name: app
+            tag_suffix: ""
+          - build_target: skills-init
+            image_name: skills-init
+            tag_suffix: ""
+          - build_target: golang-adk
+            image_name: golang-adk
+            tag_suffix: ""
+          - build_target: golang-adk-full
+            image_name: golang-adk
+            tag_suffix: "-full"
     runs-on: ubuntu-latest
     services:
       registry:
@@ -67,15 +79,12 @@ jobs:
             --push
         run: |
           export VERSION=${{ steps.vars.outputs.version }}
-          make build-${{ matrix.image }}
+          make build-${{ matrix.build_target }}
         working-directory: ./
-      - name: Load image versions
-        id: image-versions
-        run: make build-img-versions
       - name: Image vulnerability scanner
         uses: aquasecurity/trivy-action@0.35.0
         with:
-          image-ref: localhost:5001/kagent-dev/kagent/${{ matrix.image }}:${{ steps.vars.outputs.version }}
+          image-ref: localhost:5001/kagent-dev/kagent/${{ matrix.image_name }}:${{ steps.vars.outputs.version }}${{ matrix.tag_suffix }}
           severity: 'CRITICAL,HIGH'
           ignore-unfixed: true
           exit-code: '1'

go/Dockerfile.full

@@ -29,12 +29,13 @@ RUN --mount=type=cache,target=/var/cache/apk,rw \
     apk add --no-cache \
     bash git ca-certificates nodejs npm node-gyp bubblewrap python-${TOOLS_PYTHON_VERSION} libstdc++
 
+# Keep the pinned sandbox-runtime revision, but replace its vulnerable locked lodash-es version.
 RUN --mount=type=cache,target=/root/.npm \
     mkdir -p /opt && \
     cd /opt && \
     git clone --depth 1 --revision=ef4afdef4d711ba21a507d7f7369e305f7d3dbfa https://github.com/anthropic-experimental/sandbox-runtime.git && \
     cd sandbox-runtime && \
-    npm install && \
+    npm install --save-exact lodash-es@4.18.1 @types/lodash-es@4.17.12 && \
     npm run build && \
     npm prune --omit=dev
 

go/core/cli/internal/agent/frameworks/adk/python/templates/pyproject.toml.tmpl

@@ -4,7 +4,7 @@ version = "0.1"
 description = "{{.Name}} agent"
 readme = "README.md"
 dependencies = [
-  "google-adk==1.25.1",
+  "google-adk==1.28.1",
 ]
 
-requires-python = ">=3.13"
+requires-python = ">=3.13"

python/Dockerfile

@@ -67,12 +67,13 @@ RUN --mount=type=cache,target=/var/cache/apk,rw \
 # Install sandbox runtime from a specific commit of the GitHub repo without using global prefix
 # This avoids scope-related rename issues in global node_modules
 # Using BuildKit cache for npm to speed up rebuilds
+# Keep the pinned sandbox-runtime revision, but replace its vulnerable locked lodash-es version.
 RUN --mount=type=cache,target=/root/.npm \
     mkdir -p /opt && \
-    cd opt && \
+    cd /opt && \
     git clone --depth 1 --revision=ef4afdef4d711ba21a507d7f7369e305f7d3dbfa https://github.com/anthropic-experimental/sandbox-runtime.git && \
     cd sandbox-runtime && \
-    npm install && \
+    npm install --save-exact lodash-es@4.18.1 @types/lodash-es@4.17.12 && \
     npm run build && \
     # CVE-2026-26996: all minimatch instances (3.1.2, 9.0.5) are transitive dev
     # deps (eslint, typescript-eslint). Prune dev deps after build to remove them.

python/packages/agentsts-adk/pyproject.toml

@@ -9,7 +9,7 @@ description = "Framework-specific integration points with agentsts-core"
 requires-python = ">=3.10"
 dependencies = [
   "agentsts-core>=0.1.0",
-  "google-adk>=1.18.0",
+  "google-adk>=1.28.1,<2",
   "google-genai>=1.21.1",
   "google-auth>=2.40.2",
   "httpx>=0.25.0",

python/packages/kagent-adk/pyproject.toml

@@ -22,7 +22,7 @@ dependencies = [
   "protobuf>=6.33.5",  # CVE-2026-0994: Denial of Service due to recursion depth bypass
   "anthropic[vertex]>=0.49.0",
   "fastapi>=0.115.1",
-  "google-adk>=1.25.0",
+  "google-adk>=1.28.1,<2",
   "google-genai>=1.21.1",
   "google-auth>=2.40.2",
   "httpx>=0.25.0",