# What changed in @a2a-js/sdk

> 24 changes in @a2a-js/sdk 1 from its official release notes, upgrade guides and advisories: 1 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@a2a-js/sdk/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @a2a-js/sdk 1

### Security

- The client caches the extended Agent Card only after signature verification. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)

### New APIs and options

- Adds database-backed stores for tasks and push notifications. (1.3.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.3.0)
- Introduces the server SettleByTaskId method. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)

### Fixes and other changes

- JSON-RPC dispatch now uses A2A-Version. (1.2.1) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.1)
- JSON-RPC errors are returned with HTTP 200. (1.2.1) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.1)
- JSON-RPC response versions are now validated. (1.2.1) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.1)
- The server adds optional media type validation against the agent's defaultInputModes. (1.2.1) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.1)
- Status or artifact event metadata now propagates to the task. (1.2.1) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.1)
- When creating push notification configs through REST, taskId is now correctly set from path parameters. (1.2.1) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.1)
- Avoids mutating the caller's message configuration. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)
- Guards terminal state transitions and makes cancelTask atomic. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)
- Rejects empty task IDs with RequestMalformedError. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)
- Scopes the manager by tenant and owner to match TaskStore. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)
- Accepts JSON-RPC calls with omitted params. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)
- Rejects empty task IDs with RequestMalformedError. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)
- Preserves HeadersInit in authenticating fetch. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)
- Preserves historyLength=0 rather than treating it as absent. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)
- Preserves call context for tenant requests. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)
- Rejects invalid REST listTasks pageSize values. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)
- Rejects invalid status filters with RequestMalformedError. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)
- Missing push notification configs now return 404/-32001. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)
- Rejects whitespace-only taskId values. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)
- Stamps the resolved taskId onto sendMessage push configs. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)
- Rejects missing required extensions before mutating task history. (1.2.0) — [release notes](https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0)