Update dependency google-adk to v1.28.1 [SECURITY]

[renovate-bot]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
google-adk (changelog)	==1.16.0 → ==1.28.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability

CVE-2026-4810 / GHSA-rg7c-g689-fr3x

More information

Details

A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Python (OSS), Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance.

This vulnerability was patched in versions 1.28.1 and 2.0.0a2.

Customers need to redeploy the upgraded ADK to their production environments. In addition, if they are running ADK Web locally, they also need to upgrade their local instance.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/U:Amber

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-4810
• https://github.com/google/adk-python/blob/main/CHANGELOG.md#1274-2026-03-26
• https://github.com/advisories/GHSA-rg7c-g689-fr3x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

google/adk-python (google-adk)

v1.28.1

Compare Source

Features

• Add an option to prevent the SaveFilesAsArtifactsPlugin from attaching reference file parts to the message (987c809)
• add credentials parameter to BigQueryAgentAnalyticsPlugin (34713fb)
• Add express mode onboarding support to adk deploy cli (2b04996)
• add native OpenTelemetry agentic metrics (6942aac)
• Add OpenTelemetry tracing for event compaction (c65dd55)
• Add sample agent demonstrating 2LO, 3LO, and API Key auth via GcpAuthProvider (909a8c2)
• Add support for Anthropic's thinking blocks (16952bd)
• Add support for excluding predefined functions in ComputerUseToolset (d760037)
• Add support for refusal messages in ApigeeLlm (d6594a1)
• Added indication of user message in history event list (662354a)
• Allow user to define credential_key for McpToolset (282db87), closes #​5103
• analytics: add support for logging LLM cache metadata to BigQuery (02deeb9)
• eval: add evaluate_full_response option to rubric-based evaluation (#​5316) (7623ff1)
• live: Add save_live_blob query parameter to /run_live endpoint (36ab8f1)
• mcp: gracefully handle tool execution errors and transport crashes (7744cfe)

Bug Fixes

• accumulate list values when merging parallel tool call state_delta (b0b8b31), closes #​5190
• Add support for overriding the API version in GoogleLLM (1cdd1e7)
• auth: isolate resolved credentials in context to prevent race conditions and data leakage (5578772)
• avoid double-execution of sync FunctionTools returning None (78a8851), closes #​5284
• block RCE vulnerability via nested YAML configurations in ADK (74f235b)
• bump Vertex SDK version (6380f6a)
• cancel siblings in parallel function calling on failure (49985c9)
• Capture and include LLM usage metadata in summarized events (5ce33b9), closes #​4014
• catch ValueError in safe-JSON serializers for circular refs (70a7add), closes #​5412
• deps: bump litellm cap to >=1.83.7 to admit CVE patches (6d2ada8)
• Disable bound token for mcp_tool (4c0c6db)
• fix dataset location handling in BigQueryAgentAnalyticsPlugin (c263426)
• Fix exception handling and argument order in ReflectRetryToolPlugin (1deab6d)
• Fix GcpAuthProvider to return capitalized Bearer scheme (ad937fe)
• fix lifecycle issues with credentials in BigQuery Agent Analytics Plugin (a69f861)
• Fix malformated skill.md (9a0d2f7)
• Fix misplaced pytest decorator on helper dataclass in 2LO integration tests (2343973)
• Fix RecursionError in ADK framework by adding circular reference detection to schema resolution (7de5bc5)
• fix rewind to preserve initial session state (af1b00a), closes #​4933
• Fix SSRF and local-file access in load_web_page (0447e93)
• handle None state values in skill_toolset after session rewind (a977aa3)
• litellm: emit input_audio for audio inline_data parts (4073238), closes #​5406
• live: mark all agents' Event as from other agents (48b7a64)
• live: treat input transcription as user message (ae1f2e6)
• optimization: handle None metric scores in LocalEvalSampler (#​5415) (684a6e7)
• otel: change gen_ai.tool_definitions to gen_ai.tool.definitions (029b87d)
• preserve cache fingerprint stability on creation failure (4d5438c)
• preserve empty-string text parts in A2A converter (2d61cb6)
• preserve function call IDs for Anthropic models (f0c787f)
• Prevent LoopAgent from resetting sub-agent state on pause (8846be5)
• Quote user_id literals in VertexAiSessionService list filters (bdece00)
• read_file/write_file path type mismatch in BaseEnvironment and LocalEnvironment (782796f)
• relax EventActions.state_delta value type to Any (dbec8e9)
• remove exclude_unset=True to correctly serialize pydantic types (f95ac48)
• samples: Upgrade google-adk to 1.28.1 to fix vulnerability (b848390)
• Sanitize user_id derived from PubSub subscription and Eventarc source (0c4f157), closes #​5324
• Scope Vertex RAG memory display names (784350d)
• Use correct camelCase functionCallId (c87ee1e)
• web oauth flow and trace view (87cd310)
• yield tool_call_parts immediately in live mode to unblock Gemini 3.1 tool calls (f57b05d)

Performance Improvements

• lazy-load optional providers and auth chain to cut cold start ~25% (66bfedc)

Code Refactoring

• move exception handling from metric emission into instrumentation handlers (62d7ee0)
• tests: Refactor tests to explicitly handle JSON_SCHEMA_FOR_FUNC_DECL feature flag (b580891)
• Use artifact_service.load_artifact during rewind (c3d50db), closes #​4932

Documentation

• gemini: show subclass pattern for custom Client config (34c7505), closes #​3628
• update output_schema docstring to reflect support for tools and output_schema together (e1e652d)
• Update README with instructions for installing ADK extensions (f2a1179)
• use sphinx-click to generate docs for google.adk.cli (f455974)

v1.28.0

Compare Source

Features

• a2a: add lifespan parameter to to_a2a() (0f4c807), closes #​4701
• Add a new extension for the new version of ADK-A2A integration (6f0dcb3)
• Add ability to run individual unit tests to unittests.sh (b3fcd8a)
• Add database_role property to SpannerToolSettings and use it in execute_sql to support fine grained access controls (360e0f7)
• Add index to events table and update dependencies (3153e6d), closes #​4827
• Add MultiTurn Task success metric (9a75c06)
• Add MultiTurn Task trajectory and tool trajectory metrics (38bfb44)
• Add slack integration to ADK (6909a16)
• Add Spanner Admin Toolset (28618a8)
• Add SSE streaming support to conformance tests (c910961)
• Add support for Anthropic's thinking_blocks format in LiteLLM integration (fc45fa6), closes #​4801
• Add support for timeout to UnsafeLocalCodeExecutor (71d26ef)
• auth: Integrate GCP IAM Connectors (Noop implementation) (78e5a90)
• bigquery: Migrate 1P BQ Toolset (08be442) (7aa1f52) (d112131) (166ff99)
• enable suppressing A2A experimental warnings (fdc2b43)
• Enhance AgentEngineSandboxCodeExecutor sample to automatically provision an Agent Engine if neither agent_engine_resource_name nor sandbox_resource_name is provided (6c34694)
• Extract and merge EventActions from A2A metadata (4b677e7), closes #​3968
• mcp: add sampling callback support for MCP sessions (8f82697)
• Optional GCP project and credential for GCS access (2f90c1a)
• Support new embedding model in files retrieval (faafac9)

Bug Fixes

• add agent name validation to prevent arbitrary module imports (116f75d)
• add protection for arbitrary module imports (995cd1c), closes #​4947
• Add read-only session support in DatabaseSessionService (f6ea58b), closes #​4771
• Allow snake case for skill name (b157276)
• bigquery: use valid dataplex OAuth scope (4010716)
• Default to ClusterIP so GKE deployment isn't publicly exposed by default (f7359e3)
• deps: bump google-genai minimum to >=1.64.0 for gemini-embedding-2-preview (f8270c8)
• enforce allowed file extensions for GET requests in the builder API (96e845e)
• error when event does not contain long_running_tool_ids (1f9f0fe)
• Exclude compromised LiteLLM versions from dependencies pin to 1.82.6 (77f1c41)
• Fix IDE hangs by moving test venv and cache to /tmp (6f6fd95)
• Fix imports for environment simulation files (dcccfca)
• gate builder endpoints behind web flag (6c24ccc)
• Handle concurrent creation of app/user state rows in DatabaseSessionService (d78422a), closes #​4954
• live: convert response_modalities to Modality enum before assigning to LiveConnectConfig (47aaf66), closes #​4869
• models: handle arbitrary dict responses in part_to_message_block (c26d359)
• models: update 429 docs link for Gemini (a231c72)
• populate required for Pydantic BaseModel parameters in FunctionTool (c5d809e), closes #​4777
• Prevent compaction of events with pending function calls (991c411), closes #​4740
• Prevent uv.lock modifications in unittests.sh (e6476c9)
• Refactor blocking subprocess call to use asyncio in bash_tool (58c4536)
• Refactor LiteLlm check to avoid ImportError (7b94a76)
• Reject appends to stale sessions in DatabaseSessionService (b8e7647), closes #​4751
• Remove redundant client_id from fetch_token call (50d6f35), closes #​4782
• returns '<No stdout/stderr captured>' instead of empty strings for clearer agent feedback and correct typing (3e00e95)
• Store and retrieve usage_metadata in Vertex AI custom_metadata (b318eee)
• Support resolving string annotations for find_context_parameter (22fc332)
• telemetry: Rolling back change to fix issue affecting LlmAgent creation due to missing version field (0e18f81)
• tools: disable default httpx 5s timeout in OpenAPI tool _request (4c9c01f), closes #​4431
• tools: support regional Discovery Engine endpoints (30b904e)
• tools: support structured datastores in DiscoveryEngineSearchTool (f35c3a6), closes #​3406
• Update Agent Registry to use the full agent card if available (031f581)
• Update eval extras to Vertex SDK package version with constrained LiteLLM upperbound (27cc98d)
• Update import and version for k8s-agent-sandbox (1ee0623), closes #​4883
• Update list_agents to only list directories, not validate agent definitions (5020954)

Code Refactoring

• rename agent simulator to environment simulation. Also add tracing into environment simulation (99a31bf)

Documentation

• Feat/Issue Monitoring Agent (780093f)
• Use a dedicated API key for docs agents (51c19cb)

v1.27.5

Compare Source

Bug Fixes

• Update eval extras to Vertex SDK package version with constrained LiteLLM upperbound (77928a8)

v1.27.4

Compare Source

Bug Fixes

• Exclude compromised LiteLLM versions from dependencies pin to 1.82.6 (fa5e707)
• gate builder endpoints behind web flag (44b3f72)

v1.27.3

Compare Source

Bug Fixes

• add protection for arbitrary module imports (276adfb)

v1.27.2

Compare Source

Bug Fixes

• Use valid dataplex OAuth scope for BigQueryToolset (4010716)
• Store and retrieve usage_metadata in Vertex AI custom_metadata (b318eee)

v1.27.1

Compare Source

Bug Fixes

• Rolling back change to fix issue affecting LlmAgent creation due to missing version field (0e18f81)

v1.27.0

Compare Source

Features

• [Core]

  • Introduce A2A request interceptors in RemoteA2aAgent (6f772d2)
  • Add UiWidget to EventActions for supporting new experimental UI Widgets feature (530ff06)
  • auth: Add pluggable support for auth integrations using AuthProviderRegistry within CredentialManager (d004074)
  • Support all types.SchemaUnion as output_schema in LLM Agent (63f450e)
  • durable runtime support (07fdd23)
  • runners: pass GetSessionConfig through Runner to session service (eff724a)

• [Models]

  • Add support for PDF documents in Anthropic LLM (4c8ba74)
  • Add streaming support for Anthropic models (5770cd3), closes #​3250
  • Enable output schema with tools for LiteLlm models (89df5fc), closes #​3969
  • Preserve thought_signature in LiteLLM tool calls (ae565be), closes #​4650

• [Web]

  • Updated human in the loop: developers now can respond to long running functions directly in chat
  • Render artifacts when resuming
  • Fix some light mode styles
  • Fix token level streaming not working properly (22799c0)

• [Observability]

  • telemetry: add new gen_ai.agent.version span attribute (ffe97ec)
  • otel: add gen_ai.tool.definitions to experimental semconv (4dd4d5e)
  • otel: add experimental semantic convention and emit gen_ai.client.inference.operation.details event (19718e9)
  • add missing token usage span attributes during model usage (77bf325)
  • capture tool execution error code in OpenTelemetry spans (e0a6c6d)

• [Tools]

  • Warn when accessing DEFAULT_SKILL_SYSTEM_INSTRUCTION (35366f4)
  • add preserve_property_names option to OpenAPIToolset (078b516)
  • Add gcs filesystem support for Skills. It supports skills in text and pdf format, also has some sample agents (6edcb97)
  • Add list_skills_in_dir to skills utils (327b3af)
  • Add support for MCP App UI widgets in MCPTool (86db35c)
  • add Dataplex Catalog search tool to BigQuery ADK (82c2eef)
  • Add RunSkillScriptTool to SkillToolset (636f68f)
  • Add support for ADK tools in SkillToolset (44a5e6b)
  • limit number of user-provided BigQuery job labels and reserve internal prefixes (8c4ff74)
  • Add param support to Bigtable execute_sql (5702a4b)
  • bigtable: add Bigtable cluster metadata tools (34c560e)
  • execute-type param addition in GkeCodeExecutor (9c45166)
  • skill: Add BashTool (8a31612)
  • Add support for toolsets to additional_tools field of SkillToolset (066fcec)

• [Optimization]

  • Add adk optimize command (b18d7a1)
  • Add interface between optimization infra and LocalEvalService (7b7ddda)
  • Add GEPA root agent prompt optimizer (4e3e2cb)

• [Integrations]

  • Enhance BigQuery plugin schema upgrades and error reporting (bcf38fa)
  • Enhance BQ plugin with fork safety, auto views, and trace continuity (80c5a24)
  • Handle Conflict Errors in BigQuery Agent Analytics Plugin (372c76b)
  • Added tracking headers for ADK CLI command to Agent Engine (3117446)

• [A2A]

  • New implementation of A2aAgentExecutor and A2A-ADK conversion (87ffc55)
  • New implementation of RemoteA2aAgent and A2A-ADK conversion (6770e41)

Bug Fixes

• Allow artifact services to accept dictionary representations of types.Part (b004da5), closes #​2886
• Decode image data from ComputerUse tool response into image blobs (d7cfd8f)
• Expand LiteLLM reasoning extraction to include 'reasoning' field (9468487), closes #​3694
• Filter non-agent directories from list_agents() (3b5937f)
• Fix Type Error by initializing user_content as a Content object (2addf6b)
• Handle length finish reason in LiteLLM responses (4c6096b), closes #​4482
• In SaveFilesAsArtifactsPlugin, write the artifact delta to state then event actions so that the plugin works with ADK Web UI's artifacts panel (d6f31be)
• Make invocation_context optional in convert_event_to_a2a_message (8e79a12)
• Optimize row-level locking in append_event (d61846f), closes #​4655
• Preserve thought_signature in FunctionCall conversions between GenAI and A2A (f9c104f)
• Prevent splitting of SSE events with artifactDelta for function resume requests (6a929af), closes #​4487
• Propagate file names during A2A to/from Genai Part conversion (f324fa2)
• Propagate thought from A2A TextPart metadata to GenAI Part (e59929e)
• Re-export DEFAULT_SKILL_SYSTEM_INSTRUCTION to skills and skill/prompt.py to avoid breaking current users (de4dee8)
• Refactor type string update in Anthropic tool param conversion (ab4b736)
• simulation: handle NoneType generated_content (9d15517)
• Store and retrieve EventCompaction via custom_metadata in Vertex AISessionService (2e434ca), closes #​3465
• Support before_tool_callback and after_tool_callback in Live mode (c36a708), closes #​4704
• temp-scoped state now visible to subsequent agents in same invocation (2780ae2)
• tools: Handle JSON Schema boolean schemas in Gemini schema conversion (3256a67)
• typo in A2A EXPERIMENTAL warning (eb55eb7)
• Update agent_engine_sandbox_code_executor in ADK (dff4c44)
• update Bigtable query tools to async functions (72f3e7e)
• Update expected UsageMetadataChunk in LiteLLM tests (dd0851a), closes #​4680
• update toolbox server and SDK package versions (2e370ea)
• Validate session before streaming instead of eagerly advancing the runner generator (ebbc114)

Code Refactoring

• extract reusable functions from hitl and auth preprocessor (c59afc2)
• Rename base classes and TypeVars in optimization data types (9154ef5)

v1.26.0

Compare Source

Features

• [Core]

  • Add intra-invocation compaction and token compaction pre-request (485fcb8)
  • Use --memory_service_uri in ADK CLI run command (a7b5097)

• [Models]

  • Add /chat/completions integration to ApigeeLlm (9c4c445)
  • Add /chat/completions streaming support to Apigee LLM (121d277)
  • Expand LiteLlm supported models and add registry tests (d5332f4)

• [Tools]

  • Add load_skill_from_dir() method (9f7d5b3)
  • Agent Skills spec compliance — validation, aliases, scripts, and auto-injection (223d9a7)
  • BigQuery ADK support for search catalog tool (bef3f11)
  • Make skill instruction optimizable and can adapt to user tasks (21be6ad)
  • Pass trace context in MCP tool call's _meta field with OpenTelemetry propagator (bcbfeba)

• [Evals]

  • Introduce User Personas to the ADK evaluation framework (6a808c6)

• [Services]

  • Add generate/create modes for Vertex AI Memory Bank writes (811e50a)
  • Add support for memory consolidation via Vertex AI Memory Bank (4a88804)

• [A2A]

  • Add interceptor framework to A2aAgentExecutor (87fcd77)

• [Auth]

  • Add native support for id_token in OAuth2 credentials (33f7d11)
  • Support ID token exchange in ServiceAccountCredentialExchanger (7be90db), closes #​4458

• [Integrations]

  • Agent Registry in ADK (abaa929)
  • Add schema auto-upgrade, tool provenance, HITL tracing, and span hierarchy fix to BigQuery Agent Analytics plugin (4260ef0)
  • Change default BigQuery table ID and update docstring (7557a92)
  • Update Agent Registry to create AgentCard from info in get agents endpoint (c33d614)

• [Web]

  • Enable dependency injection for agent loader in FastAPI app gen (34da2d5)

Bug Fixes

• Add OpenAI strict JSON schema enforcement in LiteLLM (2dbd1f2), closes #​4573
• Add push notification config store to agent_to_a2a (4ca904f), closes #​4126
• Add support for injecting a custom google.genai.Client into Gemini models (48105b4), closes #​2560
• Add support for injecting a custom google.genai.Client into Gemini models (c615757), closes #​2560
• Check both input_stream parameter name and its annotation to decide whether it's a streaming tool that accept input stream (d56cb41)
• deps: Increase pydantic lower version to 2.7.0 (dbd6420)
• edit copybara and BUILD config for new adk/integrations folder (added with Agent Registry) (37d52b4)
• Expand add_memory to accept MemoryEntry (f27a9cf)
• Fix pickling lock errors in McpSessionManager (4e2d615)
• fix typo in PlanReActPlanner instruction (6d53d80)
• handle UnicodeDecodeError when loading skills in ADK (3fbc27f)
• Improve BigQuery Agent Analytics plugin reliability and code quality (ea03487)
• Include list of skills in every message and remove list_skills tool from system instruction (4285f85)
• Invoke on_tool_error_callback for missing tools in live mode (e6b601a)
• Keep query params embedded in OpenAPI paths when using httpx (ffbcc0a), closes #​4555
• Only relay the LiveRequest after tools is invoked (b53bc55)
• Parallelize tool resolution in LlmAgent.canonical_tools() (7478bda)
• race condition in table creation for DatabaseSessionService (fbe9ecc)
• Re-export DEFAULT_SKILL_SYSTEM_INSTRUCTION to skills and skill/prompt.py to avoid breaking current users (40ec134)
• Refactor LiteLLM streaming response parsing for compatibility with LiteLLM 1.81+ (e8019b1), closes #​4225
• remove duplicate session GET when using API server, unbreak auto_session_create when using API server (445dc18)
• Remove experimental decorators from user persona data models (eccdf6d)
• Replace the global DEFAULT_USER_PERSONA_REGISTRY with a function call to get_default_persona_registry (2703613)
• skill: coloate default skill SI with skilltoolset (fc1f1db)
• Update agent_engine_sandbox_code_executor in ADK (ee8d956)
• Update agent_engine_sandbox_code_executor in ADK (dab80e4)
• Update sample skills agent to use weather-skill instead of weather_skill (8f54281)
• update Spanner query tools to async functions (1dbcecc)
• use correct msg_out/msg_err keys for Agent Engine sandbox output (b1e33a9)
• Validate session before streaming instead of eagerly advancing the runner generator (ab32f33)
• web: allow session resume without new message (30b2ed3)

Code Refactoring

• Extract reusable function for building agent transfer instructions (e1e0d63)
• Extract reusable private methods (976a238)
• Extract reusable private methods (42eeaef)
• Extract reusable private methods (706f9fe)

Documentation

• add thinking_config in generate_content_config in example agent (c6b1c74)

v1.25.1

Compare Source

Bug Fixes

• Fix pickling lock errors in McpSessionManager (4e2d615)

v1.25.0

Compare Source

Features

• [Core]

  • Add a demo for the simple prompt optimizer for the optimization interface (0abf4cd)
  • Add --auto_create_session flag to adk api_server CLI (40c15d0)
  • Add add_events_to_memory facade for event-delta (59e8897)
  • Add post-invocation token-threshold compaction with event retention (a88e864)
  • Add report generation to adk conformance test command (43c437e)

• [Models]

  • Add base_url option to Gemini LLM class (781f605)

• [Tools]

  • Enhance google credentials config to support externally passed access token (3cf43e3)
  • Update agent simulator by improving prompts and add environment data (7af1858)
  • Add a load MCP resource tool (e25227d)
  • Add SkillToolset to adk (8d02792)

• [Web]

  • Add /health and /version endpoints to ADK web server (25ec2c6)

Bug Fixes

• Use async iteration for VertexAiSessionService.list_sessions pagination (758d337)
• Fix event loop closed bug in McpSessionManager (4aa4751)
• Preserve thought_signature in function call conversions for interactions API integration (2010569)
• Propagate grounding and citation metadata in streaming responses (e6da417)
• Add endpoints to get/list artifact version metadata (e0b9712)
• Support escaped curly braces in instruction templates (7c7d25a)
• Strip timezone for PostgreSQL timestamps in DatabaseSessionService (19b6076)
• Prompt token may be None in streaming mode (32ee07d)
• Pass invocation_id from /run endpoint to Runner.run_async (d2dba27)
• Conditionally preserve function call IDs in LLM requests (663cb75)
• Migrate VertexAiMemoryBankService to use the async Vertex AI client (64a44c2)
• Handle list values in Gemini schema sanitization (fd8a9e3)
• Used logger to log instead of print in MCP (6bc70a6)

Improvements

• Replace check of instance for LlmAgent with hasAttribute check (7110336)
• Log exception details before re-raising in MCP session execution ([de79bf1](https://redirect.github.com/google/adk-python/commit/de79bf12b564a4eefc7e6a2568dbe0f0

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.