Skip to content

chore: sync main -> v2#4915

Open
Jacksunwei wants to merge 300 commits intov2from
main
Open

chore: sync main -> v2#4915
Jacksunwei wants to merge 300 commits intov2from
main

Conversation

@Jacksunwei
Copy link
Copy Markdown
Collaborator

Automated sync of v1 changes from main into v2. The oncall is responsible for reviewing and merging this PR. Resolve conflicts in favor of the v2 implementation.

wuliang229 and others added 10 commits March 18, 2026 16:16
Renames the imported module from `agentic_sandbox` to `k8s_agent_sandbox` in `gke_code_executor.py` and updates the required version in `pyproject.toml` to `>=0.1.1.post3`.

Closes #4883

Co-authored-by: Liang Wu <wuliang@google.com>
PiperOrigin-RevId: 885840142
- Introduced a new `AuthScheme` named `GcpIamConnectorAuth` in `google.adk.integrations.iam_connector` package.
- The feature is currently disabled through the newly added `GCP_IAM_CONNECTOR_AUTH`experimentation flag.
- The newly added `GcpAuthProvider` class in `adk/integrations/iam_connector/gcp_auth_provider.py` is for internal ADK use and developer should not depend on it.

PiperOrigin-RevId: 886070137
PiperOrigin-RevId: 886119834
The ADK experimental warnings can already be disabled with an environment
variable, enable the same behavior for A2A to avoid log spam.

Co-authored-by: Tim Niemueller <timdn@google.com>
PiperOrigin-RevId: 886233489
This change introduces a separate async session factory for Spanner connections configured with `read_only=True`

Close #4771

Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 886267104
Modified compaction logic to exclude events containing function calls for which no corresponding function response has been recorded in the session. Added helper functions to identify pending function call IDs and check if an event contains such IDs. Applied this exclusion to both sliding window and token threshold-based compaction strategies

Close #4740

Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 886268526
Kebab-case is the standard for skill names/directories given by the Skill spec. However, to enable support for importing within skill scripts (python does not allow imports with kebab-case, only snake case), allow snake case for the skill name.

Co-authored-by: Kathy Wu <wukathy@google.com>
PiperOrigin-RevId: 886351132
DiscoveryEngineSearchTool hardcoded search_result_mode to CHUNKS, which
fails with a 400 error for structured datastores (e.g. Jira Cloud
connectors) that require DOCUMENTS mode. This broke VertexAiSearchTool
with bypass_multi_tools_limit=True for structured data.

Add auto-detection: default mode is now None, which tries CHUNKS first
and automatically falls back to DOCUMENTS when the API returns the
structured-datastore error. Users can also explicitly set the mode via
the new SearchResultMode enum to skip auto-detection.

Fixes #3406

Co-authored-by: Xiang (Sean) Zhou <seanzhougoogle@google.com>
PiperOrigin-RevId: 886354417
Co-authored-by: Xuan Yang <xygoogle@google.com>
PiperOrigin-RevId: 886446298
@google-cla
Copy link
Copy Markdown

google-cla Bot commented Mar 20, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

google-genai-bot and others added 19 commits March 20, 2026 10:11
Support Starlette lifespan protocol in to_a2a() so users can run
async startup/shutdown logic (e.g. initializing DB connections,
loading prompt registries) without resorting to module-level globals.

The lifespan parameter accepts a standard Starlette async context
manager. Internally, a composed lifespan runs the A2A route setup
first, then delegates to the user's lifespan if provided. This also
replaces the deprecated add_event_handler("startup", ...) pattern
with the modern Starlette(lifespan=...) constructor.

Closes #4701

Co-authored-by: Xiang (Sean) Zhou <seanzhougoogle@google.com>
PiperOrigin-RevId: 886892363
This change enables the conversion of ADK EventActions, serialized within A2A object metadata, back into ADK Event objects. It includes logic to parse JSON-encoded metadata values and to merge EventActions from multiple sources within an A2A Task

Close #3968

Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 886927688
The log message when instantiating DatabaseSessionService is updated from "Falling back to..." to "Using..." for clarity.

Close #4890

Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 888160397
Close #4947

Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 888296476
Merge #4720
Close #4697

Co-authored-by: Xuan Yang <xygoogle@google.com>
COPYBARA_INTEGRATE_REVIEW=#4720 from kaligautier:fix/global-and-regional-region ed0b18d
PiperOrigin-RevId: 888728543
…82.6

Versions 1.82.7 and 1.82.8 of LiteLLM were affected by a supply chain attack and are now explicitly excluded from the dependency constraints for both project and dev dependencies.

Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 888818704
Co-authored-by: Sasha Sobran <asobran@google.com>
PiperOrigin-RevId: 888850792
Introduces a new index `idx_events_app_user_session_ts` on the `events` table in both V0 and V1 database schemas. This index covers `app_name`, `user_id`, `session_id`, and `timestamp` (descending) to improve query performance.

Modifies `DatabaseSessionService` to automatically create any missing indexes defined in the SQLAlchemy metadata when preparing the database tables.

Close #4827

Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 888877174
…tionTool`

Merge #4778

Closes: #4777

Co-authored-by: Xuan Yang <xygoogle@google.com>
COPYBARA_INTEGRATE_REVIEW=#4778 from gautamvarmadatla:fix/pydantic-basemodel-required-fields 45db622
PiperOrigin-RevId: 888905953
Merge #4990

Syncs version bump and CHANGELOG from release v1.27.4 to main.

COPYBARA_INTEGRATE_REVIEW=#4990 from google:release/v1.27.4 71982f2
PiperOrigin-RevId: 888928449
Update the `model_config` for `Event` to set `extra='ignore'`. This allows the `Event` model to be initialized with fields not explicitly defined in the model, preventing errors when deserializing data that may contain additional, unneeded fields. This allows the session service to accept 2.0 events.

Co-authored-by: Shangjie Chen <deanchen@google.com>
PiperOrigin-RevId: 889327445
…sionService

Introduces a new helper function, `_get_or_create_state`, which uses a nested transaction (SAVEPOINT) to safely attempt creating a state row. If a concurrent transaction has already inserted the row, the inner insert will fail with an IntegrityError, which is caught, and the already-existing row is then fetched

Close #4954

Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 889441684
…d LiteLLM upperbound

Co-authored-by: Sasha Sobran <asobran@google.com>
PiperOrigin-RevId: 889449878
…or clearer agent feedback and correct typing

PiperOrigin-RevId: 889521009
- Migrate `tools/bigquery` to `integrations/bigquery` to match standard ADK layout.
- Update unit tests to fully assert integration migration.

Co-authored-by: Haiyuan Cao <haiyuan@google.com>
PiperOrigin-RevId: 889634966
- Migrate `tools/bigquery` to `integrations/bigquery` to match standard ADK layout.
- Update unit tests to fully assert integration migration.

PiperOrigin-RevId: 889796517
google-genai-bot and others added 30 commits April 24, 2026 19:00
The rewind logic is updated to ensure that state keys set during session creation are not nullified when rewinding. Previously, any key not present in the state at the rewind point was removed. Now, only keys that have appeared in any event's state delta are considered for nullification during a rewind, preventing the removal of initial session state

Close #4933

PiperOrigin-RevId: 905322038
Co-authored-by: Shangjie Chen <deanchen@google.com>
PiperOrigin-RevId: 905354260
Merge #5295

## Summary

Fixes #5294.

This PR tightens `VertexAiRagMemoryService` memory scoping by replacing the ambiguous dot-delimited RAG `display_name` format with an encoded v1 format for new uploads. Search results are now parsed into exact `app_name`, `user_id`, and `session_id` components before being accepted.

The change also keeps compatibility for old unambiguous legacy display names in the exact `app.user.session` form, while ignoring ambiguous legacy names that contain extra dot-delimited components.

## Why

The previous client-side filter used:

```python
context.source_display_name.startswith(f"{app_name}.{user_id}.")
```

That can collide for IDs such as `alice` and `alice.smith`, allowing memory stored under `demo.alice.smith.*` to pass a lookup for `demo` / `alice`.

## Tests

```text
PYTHONPATH=src python -m pytest tests/unittests/memory -q
42 passed, 2 warnings

python -m isort --check-only src/google/adk/memory/vertex_ai_rag_memory_service.py tests/unittests/memory/test_vertex_ai_rag_memory_service.py
passed

python -m pyink --check --config pyproject.toml src/google/adk/memory/vertex_ai_rag_memory_service.py tests/unittests/memory/test_vertex_ai_rag_memory_service.py
passed

git diff --check -- src/google/adk/memory/vertex_ai_rag_memory_service.py tests/unittests/memory/test_vertex_ai_rag_memory_service.py
passed
```

## Checklist

- [x] I have read the CONTRIBUTING.md document.
- [x] I have performed a self-review of my own code.
- [x] I have added tests that prove my fix is effective.
- [x] New and existing unit tests pass locally with my changes.

COPYBARA_INTEGRATE_REVIEW=#5295 from petrmarinec:fix/vertex-rag-memory-scope 64a8f5a
PiperOrigin-RevId: 905365796
Merge #5343

## Summary

Fixes #5341 — `convert_genai_part_to_a2a_part()` drops `Part(text='')`  because the truthiness check `if part.text:` treats empty strings as falsy.

## Root Cause

`Part(text='')`  is valid and is produced in at least two places in the ADK:

1. **`code_executors/code_execution_utils.py`** — when code execution completes with `None` output
2. **`models/interactions_utils.py`** — when the Interactions API returns `None` text content

Gemini 2.5 Flash (thinking mode) also emits empty text parts.

When the converter drops all parts the A2A message ends up with zero parts and the client sees "broken thinking" with no content.

## Fix

Change line 182 from `if part.text:` to `if part.text is not None:` so that empty strings are correctly wrapped as `TextPart` while `None` is still skipped.

## Test

Added `test_convert_empty_text_part` — verifies that `Part(text='')`  produces a valid `TextPart(text='')`  instead of returning `None`.

COPYBARA_INTEGRATE_REVIEW=#5343 from voidborne-d:fix/part-converter-empty-text dbb2f20
PiperOrigin-RevId: 905370961
… detection to schema resolution

PiperOrigin-RevId: 905576545
PiperOrigin-RevId: 906139925
Use sphinx-click to automatically generate documentation for the CLI commands in the google.adk.cli module. Closes #4500

Co-authored-by: Sasha Sobran <asobran@google.com>
PiperOrigin-RevId: 906328549
Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 906466855
Co-authored-by: Xuan Yang <xygoogle@google.com>
PiperOrigin-RevId: 906753501
Merge #5489

Closes #5488

## Summary

Bumps the `litellm` constraint from `<=1.82.6` to `>=1.83.7,<=1.83.14`
in both the base project dependencies and the `[test]` extras.

The current cap was added in
[`77f1c41`](77f1c41) to
exclude the March 2026 supply-chain compromise of litellm 1.82.7
and 1.82.8. Since then, **five CVEs have been disclosed against
litellm `<=1.82.6`** (2 critical, 3 high), with patches in 1.83.0
and 1.83.7. The new lower bound (1.83.7) is strictly above the
originally compromised versions, so the original concern is still
respected.

The upper bound is pinned to the current latest release on PyPI
(1.83.14) per reviewer request, mirroring the project's prior
exact-version cap pattern. New litellm releases will require an
explicit ADK PR to admit, the same way `<=1.82.6` did.

Full CVE list and rationale in the linked issue (#5488).

## Diff

Two identical edits, one in project deps (line 126) and one in
`[test]` extras (line 145):

```diff
- "litellm>=1.75.5,<=1.82.6",                                        # ... supply chain attack ...
+ "litellm>=1.83.7,<=1.83.14",                                       # For LiteLlm class. Lower bound: 5 CVE patches (2026-04). Upper bound pinned to current latest; bump deliberately. See #5488.
```

## Testing plan

1. Re-installed `google-adk` (editable) against the updated
   constraint; pip resolved litellm to 1.83.13 (latest stable
   compatible with the rest of the lockfile, inside the new
   `[1.83.7, 1.83.14]` window).
2. Ran `tests/unittests/models/test_litellm.py` and
   `tests/unittests/models/test_litellm_import.py`; **all 259
   tests pass**. Output below.
3. Verified `pyproject.toml` is parseable as TOML.

### Upstream litellm test output

```
collected 259 items

tests/unittests/models/test_litellm.py ................................. [ 12%]
........................................................................ [ 40%]
........................................................................ [ 68%]
........................................................................ [ 96%]
.......                                                                  [ 98%]
tests/unittests/models/test_litellm_import.py ...                        [100%]

============================= 259 passed in 6.57s ==============================
```

## Heads up: litellm hard-pins python-dotenv

While verifying, we discovered that **litellm 1.83.7 (and every
subsequent version through 1.83.14) hard-pins
`python-dotenv==1.0.1`** as an unconditional core dependency. By
contrast, litellm 1.82.6 declared `python-dotenv>=0.2.0` (loose).

This does **not** affect adk-python itself -- ADK declares
`python-dotenv>=1,<2`, which admits `1.0.1` cleanly. But any
downstream project that has tightened `python-dotenv` (e.g.
`>=1.2.x`) will hit a resolver conflict after this bump and may
need to either relax its python-dotenv constraint or apply a
package-manager override. This is a litellm anti-pattern, not an
ADK problem; included here so reviewers know to expect downstream
issues of that shape.

## Out of scope

`langgraph` has a similar dep cap (`<0.4.8`) and one
medium-severity CVE
([GHSA-g48c-2wqr-h844](GHSA-g48c-2wqr-h844)),
but bumping past 0.4.x requires porting ADK's use of the removed
`graph.graph` API (per
[#1687](#1687)). That is
real engineering work, not a dep cap bump, and is left as a
separate effort.

COPYBARA_INTEGRATE_REVIEW=#5489 from cwest:topic/bump-litellm-cap 559f0c2
PiperOrigin-RevId: 906979886
Co-authored-by: Kathy Wu <wukathy@google.com>
PiperOrigin-RevId: 907023117
Co-authored-by: Wiktoria Walczak <wwalczak@google.com>
PiperOrigin-RevId: 907418898
`gemini-1.*` and `gemini-2.0*` models are respectively deprecated and scheduled for shutdown on June 1, 2026. `gemini-2.5*` models are their successors.
No regressions in unit tests:
```
========================================================================================== 5583 passed, 2237 warnings in 84.91s (0:01:24) ===========================================================================================
```

PiperOrigin-RevId: 907663315
… and `output_schema` together

PiperOrigin-RevId: 907857917
Previously it was just in adk create, now add it to adk deploy in case users create an agent on their own and need to deploy with api key. Moved the shared logic into a utils/onboarding.py file

Co-authored-by: Kathy Wu <wukathy@google.com>
PiperOrigin-RevId: 908191494
Close #5103

Co-authored-by: Kathy Wu <wukathy@google.com>
PiperOrigin-RevId: 908196458
Co-authored-by: Sasha Sobran <asobran@google.com>
PiperOrigin-RevId: 908322085
… 3.1 tool calls

Fixes #5407

END_PUBLIC

Merge #5408

## Summary

- Tool call parts received via `LiveServerToolCall` in `GeminiLlmConnection.receive()` are now yielded immediately instead of being deferred until `turn_complete`
- This unblocks function/tool calling for Gemini 3.1 Flash Live models which do not emit `turn_complete` until they receive the tool response

## Problem

Gemini 3.1 Flash Live models send tool calls via `LiveServerToolCall` and wait for the tool response before sending `turn_complete`. The current code accumulates `tool_call_parts` and only yields them on `turn_complete` or loop exit, creating a deadlock where tools are never executed.

## Fix

Yield `tool_call_parts` immediately after receiving `message.tool_call`. This is backward-compatible — earlier models that send `turn_complete` after tool calls will still work because the existing yield paths become no-ops when `tool_call_parts` is already empty.

## Test plan

- [x] Tested with `gemini-3.1-flash-live-preview` in live mode — tool calls now execute on the first message and the model responds with audio after receiving tool results
- [x] Verified no regression with the existing `turn_complete`-based flow

Co-authored-by: Sasha Sobran <asobran@google.com>
COPYBARA_INTEGRATE_REVIEW=#5408 from sandeshveerani4:fix/live-tool-call-yield ca0e760
PiperOrigin-RevId: 908326192
…onal` for conversation_scenario support

Close #5214

Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 908347275
Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 908397117
Co-authored-by: Kathy Wu <wukathy@google.com>
PiperOrigin-RevId: 908414335
Merge #5563

Syncs version bump and CHANGELOG from release v1.32.0 to main.

COPYBARA_INTEGRATE_REVIEW=#5563 from google:release/v1.32.0 1551268
PiperOrigin-RevId: 908475510
Co-authored-by: Yifan Wang <wanyif@google.com>
PiperOrigin-RevId: 908496612
Co-authored-by: Yifan Wang <wanyif@google.com>
PiperOrigin-RevId: 908883116
…mResponse

Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 908900779
This fixes an issue where AgentEngineSandboxCodeExecutor catches the wrong exception class when attempting to recover from externally-deleted sandboxes.

Fixes #5480

Co-authored-by: Amaad Martin <amaadmartin@google.com>
PiperOrigin-RevId: 908965545
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.