1.39.1 (2026-08-27)
Bug Fixes
- a2a: Port event action allowlist, agent card description source and resume flattening to v1 (#6801) (1f898a6)
- artifacts: Port app-scoped file artifact storage and layout-derived payload paths to v1 (#6795) (0ae2bff)
- artifacts: Port artifact reference scoping and path-segment validation to v1 (#6794) (efc5bb8)
- cli: check the Host header on every local API server request (v1) (#6789) (15bf230)
- cli: Port deploy ignore-file handling to v1 (#6793) (8467bf0)
- close the residual gaps from the v1 backport review (#6890) (218061e)
- integrations: send api registry credentials only to google api endpoints (v1) (#6889) (1e9e117)
- mcp: Port config stdio opt-in and reserved tool name checks to v1 (#6796) (28b32b4)
- models: Port Gemini context cache fingerprint scoping to v1 (#6804) (f2f8456)
- plugins: sanitize BigQuery analytics rows and build GCS paths per call (v1) (#6808) (80e56de)
- Port A2A agent card RPC target origin validation to v1 (#6800) (ccb4812)
- Port agent loader and file path resolution fixes to v1 (#6788) (8bc927f)
- Port agent-config code-reference and config_path validation to v1 (#6790) (15ae713)
- Port branch-scoped auth responses and OAuth2 nonce forwarding to v1 (#6803) (5817d30)
- Port code executor container and pod isolation defaults to v1 (#6807) (1b4da44)
- Port credential and inline-data field exclusions in logs, reprs and spans to v1 (#6797) (7c2075c)
- Port eval identifier validation and persona template rendering to v1 (#6806) (0a4a5c6)
- Port migration unpickle allowlist and database URL redaction to v1 (#6791) (6deda28)
- Port session id validation, thread id scoping and Vertex RAG cleanup fixes to v1 (#6809) (3fec8c5)
- Port skill resource path and skill name validation fixes to v1 (#6805) (1353e8d)
- Port URL validation, client timeout and credential scoping fixes to v1 (#6802) (7b6547f)
- Route thread-pool and live-mode tool dispatch through run_async (v1) (#6799) (48c56c3)
- Scope custom eval metrics per registry and resolve their function path from the eval config (v1) (#6792) (9886410)
- sessions: accept a full session resource name again on v1 (#6888) (ef4f1e0)
- Validate user message parts and agent transfer targets (v1) (#6798) (d830355)