github google/adk-go v2.5.0
on GitHub

3 hours ago

What's Changed

  • fix(internal/utils): skip nil Parts in the Parts accessors by @dhakad22klx in #1556
  • fix(sequentialagent): recurse task_completed injection and rebind Agent in Run and RunLive by @somuai in #1510
  • fix(remoteagent): respect isolation scope by @Soundcreates in #1259
  • fix(remoteagent): render unmatched function responses as text by @leilei3167 in #1494
  • test(session): add concurrent regression test for State.All() by @nuthalapativarun in #725
  • fix(telemetry): include tool-use prompt tokens in input_tokens by @peterkarabinovic in #1525
  • chore(deps): bump the go-minor-patch group with 6 updates by @dependabot[bot] in #1592
  • fix(session/inmemory): strip temp: keys from the canonical event record by @jordigilh in #1356
  • fix(launcher/api): serve run_live through the API mount again by @jjsasha63 in #1533
  • fix(session/vertexai): strip temp: keys before AppendEvent persist by @leilei3167 in #1514
  • fix(model/openaimodel): pin function tools to non-strict validation by @hanorik in #1389
  • fix(cmd/launcher/web): defer telemetry shutdown and adjust startup logging (#1469) by @chill-czar in #1470
  • fix(model/openaimodel): source the streamed function name from output_item.added by @dependabot[bot] in #1616
  • fix(adkrest): refuse DNS-rebinding hosts and cross-origin browsers by @jjsasha63 in #1615
  • fix(web): bind web server to loopback by default by @AARUSHGAUR in #1456
  • fix: map response finish reasons to semantic conventions by @mikemikimike in #1474
  • fix(model/openaimodel): give property-less objects the strict-schema keys by @wojtas000 in #1614
  • fix(launcher): declare the web bind address to the REST server by @jjsasha63 in #1623
  • fix(llminternal): bound RunLive's reconnect loop by @jjsasha63 in #1621
  • fix(tool): apply WithConfirmation to streaming tools by @jjsasha63 in #1596
  • fix(adkgo/deploy): use a long timeout for Agent Engine op.Wait by @nuthalapativarun in #1590
  • fix(functiontool): wrap non-map results only when they can be marshaled by @Trainingcqy in #1586
  • fix(agent): keep the invocation when WithICDelta returns nil by @wolo-lab in #1521
  • ci: require a linked issue, and document stale pull request takeover by @jjsasha63 in #1593
  • fix(model/openaimodel): stop replaying prior-turn reasoning to the API by @hanorik in #1395
  • feat(agent): recover the invocation identity from a plain context by @wolo-lab in #1522
  • fix(exampletool): skip example injection when the invocation has no user content by @rishabhsai in #1573
  • fix(workflow): stop yielding after consumer exits by @cruvie in #1550
  • fix(adkrest): declare UTF-8 charset on the SSE content type by @baptmont in #1629
  • test(launcher/web): bind the exact server address in bind-failure tests by @Vivek1106-04 in #1638
  • feat(authn): add a Google OIDC authenticator by @herdiyana256 in #1636
  • test(authn): pin the audience a Google OIDC authenticator enforces by @wolo-lab in #1646
  • fix(loadartifactstool): stop double-wrapping the artifact load error by @rishabhsai in #1574
  • fix(llminternal): build arrays when assembling streamed function call arguments by @ashrodan in #1630
  • feat(auth/gcp): add GCP credential provider by @wolo-lab in #1173
  • chore(deps): bump the go-minor-patch group with 4 updates by @dependabot[bot] in #1653
  • fix(launcher): pin the webui-before-api order, and clarify the adk-web pin by @jjsasha63 in #1536
  • fix(adkrest): gate the agent graph routes behind IncludeDebugAPI by @jjsasha63 in #1534
  • fix: skip nil responses in generateContent by @koriyoshi2041 in #630
  • fix(adkrest,web): limit request body size to mitigate memory-exhaustion DoS by @AARUSHGAUR in #1457
  • feat(auth): add CredentialStore and cache GCP credentials by @wolo-lab in #1174
  • fix: preserve orphan response content during rearrangement by @ktsoator in #1564
  • test(auth): make arm() force a sweep on a coarse clock by @harshitwandhare in #1668
  • fix(llminternal): drop unanswered function calls from request contents by @QuentinBisson in #1669
  • docs(session/database): document that AutoMigrate must run on every startup by @wolo-lab in #1670
  • fix(agenttool): share artifacts with parent agents by @ktsoator in #1654
  • refactor(llmagent): give State.IncludeContents an internal type by @jjsasha63 in #1462
  • fix(auth/gcp): pin the default builder's context, and correct its comments by @wolo-lab in #1647
  • fix(adkrest): limit /run_live WebSocket message size by @prasanna8585 in #1664
  • feat(artifact): guarantee artifact version metadata by @yiaany in #1440
  • docs(session): clarify that state prefixes do not compose by @indurireddy-TF in #1674
  • fix(session/database): persist input and output transcriptions by @Vivek1106-04 in #1662
  • feat(openaimodel): support the Chat Completions API by @wojtas000 in #1642
  • refactor(openaimodel): split Chat Completions and Responses endpoints into sub-packages by @wojtas000 in #1643
  • test: keep model registry and llminternal logging tests repeatable by @Vivek1106-04 in #1657
  • chore(version): bump the tagged version constant to 2.5.0 by @wolo-lab in #1677
  • fix(agentengine): base64-encode []byte fields instead of failing thei… by @rizukijr in #1387
  • feat: Add daily time partitioning to BigQuery event logging table by @vasilyl in #1377

Breaking changes

  • Session tables gain two columns (#1662): session/database now stores live-audio input and output transcriptions, in two new nullable columns on the events table. DatabaseSessionService never creates or alters tables on its own, so call database.AutoMigrate on every startup. A database that is not migrated fails to write events once this release is deployed. If you manage the schema by hand, add input_transcription and output_transcription before you deploy. See Sessions: DatabaseSessionService.
  • adk web listens on loopback by default (#1456): the web launcher binds 127.0.0.1 instead of every interface. Pass -host 0.0.0.0 to restore the old behavior. You need that flag inside a container and whenever another machine must reach the server. Dockerfiles generated by adkgo deploy already pass it. A Dockerfile you wrote yourself needs it added.
  • Cross-origin browser requests are refused (#1615, #1623): the REST server and the /run_live WebSocket now answer 403 to a browser whose Origin is neither the server's own nor the one given in -webui_address. On a loopback bind they also answer 403 to a request whose Host is not a loopback name, which blocks DNS-rebinding attacks. Non-browser clients and same-origin pages are unaffected. If you serve the UI from another origin, set -webui_address to it. If you embed adkrest.NewServer behind a reverse proxy on the same machine, add the proxy's origin to the new ServerConfig.AllowedOrigins. '*' turns the checks off.
  • Request size limits (#1457, #1664): the REST server and every route behind the web launcher, including the Pub/Sub and Eventarc triggers, reject request bodies over 10 MiB with HTTP 400. Raise the limit with -max_request_body_size, launcher.Config.MaxPayloadSize or adkrest.ServerConfig.MaxPayloadSize. /run_live closes the connection on any single WebSocket message over 16 MiB. That limit is not configurable.
  • Agent graph routes require the debug API (#1534): build_graph and build_graph_image return the agent tree and every tool it can call, so they are now registered only when IncludeDebugAPI is set. Pass -include_debug_api to the api sublauncher if you use the agent graph view in ADK Web.
  • gcp.Client.RetrieveCredential returns *gcp.Retrieval (#1174): it used to return auth.Credential. The new struct carries the credential together with its expiry. Read .Credential for the old value. Code that only uses gcp.NewProvider is unaffected.
  • artifact.SaveRequest is no longer comparable (#1440): the new CustomMetadata map[string]any field means SaveRequest values can no longer be compared with ==, used as map keys, or passed where a comparable type parameter is required.

A few changes alter what agents send or report without affecting most setups:

  • Telemetry values: gen_ai.usage.input_tokens now includes tool-use prompt tokens, so calls that use Google Search, Maps or code execution report higher input counts, matching what Gemini bills (#1525). gen_ai.response.finish_reasons carries semantic-convention values such as stop and length instead of STOP and MAX_TOKENS (#1474).
  • Request history: a function call with an ID and no function response is no longer sent to the model (#1669). Long-running tool calls are kept.
  • openaimodel tools: function tools are always sent with strict: false. Tools whose schema used to qualify for strict validation now get best-effort validation instead (#1389).
  • Stored events: stored events no longer keep temp: state keys in the in-memory and Vertex AI session services (#1356, #1514). This restores the documented behavior.

New Contributors

Full Changelog: v2.4.0...v2.5.0

Check out latest releases or
releases around google/adk-go v2.5.0

Don't miss a new adk-go release

NewReleases is sending notifications on new releases.

Get notifications