# What changed in google-adk

> 108 changes in google-adk 1 to 2 from its official release notes, upgrade guides and advisories: 19 breaking, 1 deprecations, 7 security, 41 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/pypi/google-adk/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## google-adk 2

### Breaking changes

- Restrict mutating /dev and agent builder endpoints to local clients by default, and only enable built-in agents when bound to loopback. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Parallel agent_states are now isolated by node_path. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Initial routing now uses card descriptions. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Require an OIDC audience when trigger endpoints are enabled. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Nodes marked rerun_on_resume are rerun after interrupts are resolved, waiting for all direct interrupts before rerunning. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Single-turn workflow node events and contents are now isolated by node path. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Tool nodes pause for user approval instead of passing an error downstream. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- Path parameters containing '.' or '..' segments are now rejected. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- The endpoint now cancels the run when the client disconnects. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- VIDEO live sessions now default to a pre-built avatar. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- Raises ValueError when no evaluation cases are evaluated instead of passing. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Keeps its BigQuery session in process memory rather than session state, so temporary tables do not survive restarts or carry over to another replica. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Runs a non-SELECT statement only when its dry run places it in the session's anonymous dataset; statements with no destination are rejected. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Raises ValueError when no evaluation cases are evaluated instead of passing. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Leaves ${var} and backslash-escaped \{var} patterns unchanged instead of filling them from state. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Dynamic run_node calls isolate peer task-mode agents. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- A streamed model call is traced once instead of once per chunk. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- OpenAIResponsesLlm ignores thinking_config settings and warns; use OpenAIGenerateContentConfig.effort instead. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- OpenAILlm now honors tool_config mode and all tool declarations. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)

### Security

- Encrypt Google credentials stored in sessions. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Prevent OAuth2 secrets from leaking through run, websocket, dev server, and session endpoints. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Require human confirmation before executing workflow nodes; confirmed tools run once per approval. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Instructions are rendered in a sandbox and given a read-only state mapping. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- The proxy path now applies load_web_page SSRF checks. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- Attaches application default credentials only over HTTPS. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)

### Deprecations

- Use this module instead of the legacy live-audio modules under google.adk.flows.llm_flows, which now emit DeprecationWarning on import. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)

### New APIs and options

- Intercept and filter tool outputs before they are returned to the model. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Add skill-level security support when building agent cards. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Add schema error and schema ready callback hooks to BigQueryLoggerConfig. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Deploy agents to Agent Engine using dedicated custom service accounts. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Resume Gemini generations that were paused with a continuation token. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- retry_config is now supported for dynamic node failures in NodeRunner. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Persist outputs from skill scripts as artifacts. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Add a state-file option to `adk run`. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Pass abort_signal to Runner, Workflow, and nodes to stop a run gracefully. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- Server commands now accept avatar configuration. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- The data agent toolset function now supports pagination. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- Server commands now support setting a maximum number of LLM calls. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- An opt-in path allows connections to MCP servers over the modern protocol. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- Lets an agent consult another model mid-task, with per-turn and per-session budgets. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- Selects the built-in SQLite memory service for keeping agent memory in a local SQLite database. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- Adds an optional plugin for tool-call integrity. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- Opts in to validation and coercion of function tool argument types when set to 1. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Enables experimental skill lifecycle management, including lifecycle modes, active-skill limits, and unloading skills. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Exposes session options through the REST endpoint. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds name-based request processor helpers. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds a field to control Live non-blocking function calls. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds default_project_id and default_dataset_id fields to BigQueryToolConfig. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds abort signal primitives; the Runner and workflows do not act on an abort yet. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds an evaluation metric for tracking duration. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds an experimental skill lifecycle that lasts one turn. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds an OpenAI integration extra for installing the OpenAI-related dependencies. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- OpenAI models move to this module; google.adk.labs.openai continues to re-export them. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds token-consumption and model-call-count metrics to evaluation. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds abort signal primitives; the Runner and workflows do not act on an abort yet. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds MongoDB tools for vector and hybrid search within agent flows. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds an on_error handler to skill listing functions. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds OpenAI generation configuration, including per-model reasoning effort; use its effort setting instead of thinking_config with OpenAIResponsesLlm. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds api_key and base_url configuration with per-request key resolution, adapts parameters for reasoning models, and reports reasoning tokens on Chat Completions. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Supports OpenAPI basic authentication. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds an optional context_builder. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Exposes the serving tier through RunConfig and sends deferred service tier on interactions API requests. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Controls how the skill catalog is disclosed. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds programmatic skill activation, lifecycle modes, an active-skill cap, and an opt-in unload_skill tool; lifecycle features are experimental and off by default. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- State supports key iteration. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- OpenAILlm surfaces streaming usage and finish reason. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Allows experimental telemetry to be enabled per feature. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)

### Performance

- Unused providers are no longer imported on the first LLM request. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Time to first model request is cut by 40% in long sessions. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Time to the first model request in long sessions is reduced by 40%. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)

### Behavior and default changes

- Synchronous FunctionNode tools run their callable on the tool thread pool. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Allow OIDC token exchange without a client secret. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- ADK can now be installed and run on Python 3.15. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- The system now warns when session state is dropped. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Automatically box scalar inputs for ToolNode. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- BigQuery tools can now run where CMEK is required. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- The Vertex project now defaults from GCP metadata. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- Stamps the Agent Registry URN as gen_ai.main_agent.id. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Content inputs are unwrapped for parallel workers after START. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Can now fan out to several workflow nodes. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Model adapters stream partial function-call arguments. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Resolved interrupts can resume without requiring rerun_on_resume. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)

### Tooling

- The dev server now warns when it binds a non-loopback address. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Eval scenarios are now generated using the project backend. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Config-based project creation now skips __init__.py. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- Adds gemini-3.8-flash to the model options offered by the command. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- The CLI automatically configures session and memory services on Agent Runtime. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)

### Fixes and other changes

- Vertex AI sessions now update last_update_time when append_event is called. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Resolving the effective mode no longer mutates LlmAgent.mode. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- ParallelWorker now waits for in-flight workers when a HITL interrupt occurs. (2.12.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.12.0)
- Bindings are now resolved for the deployed agent at runtime. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- url_prefix is now propagated to FastAPI root_path. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- NodeTool failures are surfaced to on_tool_error, and dict validation errors are returned. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- An inbound new_message is now treated as a user turn. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- The configuration is now honored for sync tools outside live mode. (2.11.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.11.0)
- Importing Agent no longer loads authlib. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Validates the target data subquery for detect_anomalies. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds opt-in validation and coercion of function tool argument types, enabled with ADK_ENABLE_FUNCTION_TOOL_ARG_VALIDATION=1. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Can be imported on OpenTelemetry 1.39; google.adk.telemetry.google_cloud still requires a newer OpenTelemetry. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Rejects num_samples=0 at construction time. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Rejects parallelism below 1 instead of hanging. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Widens the MCP version bound to admit MCP 2.x. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Rebuilds a session when the server reports it no longer holds it. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- RestApiTool handles HTTP 401 and recovers stale OAuth2 credentials. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Adds support for basic authentication in OpenAPI tools. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Interrupted agent transfers can resume in static workflows. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)
- Integral floats in list[int] tool parameters are coerced to integers. (2.10.0) — [release notes](https://github.com/google/adk-python/releases/tag/v2.10.0)

## google-adk 1

### Security

- Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability (1.28.1) — [security advisory](https://github.com/advisories/GHSA-RG7C-G689-FR3X)