pypi / google-adk
google-adk
What changed in google-adk 1 to 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
19 breaking7 security1 deprecations41 new APIs and options3 performance12 behavior and defaults5 tooling20 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initgoogle-adk 2107 changes
Breaking changes 19
Restrict mutating /dev and agent builder endpoints to local clients by default, and only enable built-in agents when bound to loopback.
Parallel agent_states are now isolated by node_path.
Initial routing now uses card descriptions.
Require an OIDC audience when trigger endpoints are enabled.
Nodes marked rerun_on_resume are rerun after interrupts are resolved, waiting for all direct interrupts before rerunning.
Single-turn workflow node events and contents are now isolated by node path.
Tool nodes pause for user approval instead of passing an error downstream.
Path parameters containing '.' or '..' segments are now rejected.
The endpoint now cancels the run when the client disconnects.
VIDEO live sessions now default to a pre-built avatar.
Raises ValueError when no evaluation cases are evaluated instead of passing.
Keeps its BigQuery session in process memory rather than session state, so temporary tables do not survive restarts or carry over to another replica.
Runs a non-SELECT statement only when its dry run places it in the session's anonymous dataset; statements with no destination are rejected.
Raises ValueError when no evaluation cases are evaluated instead of passing.
Leaves ${var} and backslash-escaped \{var} patterns unchanged instead of filling them from state.
Dynamic run_node calls isolate peer task-mode agents.
A streamed model call is traced once instead of once per chunk.
OpenAIResponsesLlm ignores thinking_config settings and warns; use OpenAIGenerateContentConfig.effort instead.
OpenAILlm now honors tool_config mode and all tool declarations.
Security 6
Encrypt Google credentials stored in sessions.
Prevent OAuth2 secrets from leaking through run, websocket, dev server, and session endpoints.
Require human confirmation before executing workflow nodes; confirmed tools run once per approval.
Instructions are rendered in a sandbox and given a read-only state mapping.
The proxy path now applies load_web_page SSRF checks.
Attaches application default credentials only over HTTPS.
Deprecations 1
Use this module instead of the legacy live-audio modules under google.adk.flows.llm_flows, which now emit DeprecationWarning on import.
New APIs and options 41
Intercept and filter tool outputs before they are returned to the model.
Add skill-level security support when building agent cards.
Add schema error and schema ready callback hooks to BigQueryLoggerConfig.
Deploy agents to Agent Engine using dedicated custom service accounts.
Resume Gemini generations that were paused with a continuation token.
retry_config is now supported for dynamic node failures in NodeRunner.
Persist outputs from skill scripts as artifacts.
Add a state-file option to
adk run.Pass abort_signal to Runner, Workflow, and nodes to stop a run gracefully.
Server commands now accept avatar configuration.
The data agent toolset function now supports pagination.
Server commands now support setting a maximum number of LLM calls.
An opt-in path allows connections to MCP servers over the modern protocol.
Lets an agent consult another model mid-task, with per-turn and per-session budgets.
Selects the built-in SQLite memory service for keeping agent memory in a local SQLite database.
Adds an optional plugin for tool-call integrity.
Opts in to validation and coercion of function tool argument types when set to 1.
Enables experimental skill lifecycle management, including lifecycle modes, active-skill limits, and unloading skills.
Exposes session options through the REST endpoint.
Adds name-based request processor helpers.
Adds a field to control Live non-blocking function calls.
Adds default_project_id and default_dataset_id fields to BigQueryToolConfig.
Adds abort signal primitives; the Runner and workflows do not act on an abort yet.
Adds an evaluation metric for tracking duration.
Adds an experimental skill lifecycle that lasts one turn.
Adds an OpenAI integration extra for installing the OpenAI-related dependencies.
OpenAI models move to this module; google.adk.labs.openai continues to re-export them.
Adds token-consumption and model-call-count metrics to evaluation.
Adds abort signal primitives; the Runner and workflows do not act on an abort yet.
Adds MongoDB tools for vector and hybrid search within agent flows.
Adds an on_error handler to skill listing functions.
Adds OpenAI generation configuration, including per-model reasoning effort; use its effort setting instead of thinking_config with OpenAIResponsesLlm.
Adds api_key and base_url configuration with per-request key resolution, adapts parameters for reasoning models, and reports reasoning tokens on Chat Completions.
Supports OpenAPI basic authentication.
Adds an optional context_builder.
Exposes the serving tier through RunConfig and sends deferred service tier on interactions API requests.
Controls how the skill catalog is disclosed.
Adds programmatic skill activation, lifecycle modes, an active-skill cap, and an opt-in unload_skill tool; lifecycle features are experimental and off by default.
State supports key iteration.
OpenAILlm surfaces streaming usage and finish reason.
Allows experimental telemetry to be enabled per feature.
Performance 3
Unused providers are no longer imported on the first LLM request.
Time to first model request is cut by 40% in long sessions.
Time to the first model request in long sessions is reduced by 40%.
Behavior and default changes 12
Synchronous FunctionNode tools run their callable on the tool thread pool.
Allow OIDC token exchange without a client secret.
ADK can now be installed and run on Python 3.15.
The system now warns when session state is dropped.
Automatically box scalar inputs for ToolNode.
BigQuery tools can now run where CMEK is required.
The Vertex project now defaults from GCP metadata.
Stamps the Agent Registry URN as gen_ai.main_agent.id.
Content inputs are unwrapped for parallel workers after START.
Can now fan out to several workflow nodes.
Model adapters stream partial function-call arguments.
Resolved interrupts can resume without requiring rerun_on_resume.
Tooling 5
The dev server now warns when it binds a non-loopback address.
Eval scenarios are now generated using the project backend.
Config-based project creation now skips __init__.py.
Adds gemini-3.8-flash to the model options offered by the command.
The CLI automatically configures session and memory services on Agent Runtime.
Fixes and other changes 20
Vertex AI sessions now update last_update_time when append_event is called.
Resolving the effective mode no longer mutates LlmAgent.mode.
ParallelWorker now waits for in-flight workers when a HITL interrupt occurs.
Bindings are now resolved for the deployed agent at runtime.
url_prefix is now propagated to FastAPI root_path.
NodeTool failures are surfaced to on_tool_error, and dict validation errors are returned.
An inbound new_message is now treated as a user turn.
The configuration is now honored for sync tools outside live mode.
Importing Agent no longer loads authlib.
Validates the target data subquery for detect_anomalies.
Adds opt-in validation and coercion of function tool argument types, enabled with ADK_ENABLE_FUNCTION_TOOL_ARG_VALIDATION=1.
Can be imported on OpenTelemetry 1.39; google.adk.telemetry.google_cloud still requires a newer OpenTelemetry.
Rejects num_samples=0 at construction time.
Rejects parallelism below 1 instead of hanging.
Widens the MCP version bound to admit MCP 2.x.
Rebuilds a session when the server reports it no longer holds it.
RestApiTool handles HTTP 401 and recovers stale OAuth2 credentials.
Adds support for basic authentication in OpenAPI tools.
Interrupted agent transfers can resume in static workflows.
Integral floats in list[int] tool parameters are coerced to integers.
google-adk 11 changes
Security 1
Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability