Release: v1.6.0

[kalenkevich]

Automated Release PR

adk: 1.6.0

1.6.0 (2026-08-04)

Features

• Add bearerTokenUserBuilder for A2A authentication (Part 1/2) (#562) (f077722)
• CLI-level A2A authenticator for the dev server and Cloud Run deploy (Part 2/2) (#559) (0c0bba2)
• Support ttl and expireTime session-expiration options in VertexAiSessionService.createSession (#561) (b390217)
• tools: add getUserChoiceTool and requestInputTool for parity with adk-python (#506) (03abf76)
• Validate tool callback response types and prevent state event pollution (#505) (b99f21b)

Bug Fixes

• a2a: stop restoring event branch from A2A peer metadata (#606) (0000925)
• accept the derived allowedTools alias in skill frontmatter validation (#560) (fcfd043)
• artifacts: isolate in-memory composite keys (#576) (693a1d7)
• core: fall back to node:crypto so randomUUID cannot throw on Node (#599) (3dc1b20)
• core: use a cryptographically secure source for randomUUID (#577) (81bcc8d)
• detect PowerShell 7+ (pwsh) in the UnsafeLocalCodeExecutor SHELL branch (#568) (ce0e474)
• fail fast when a Vertex AI Express Mode API key cannot be used (#563) (e1112c6)
• gate the set_model_response workaround on canUseOutputSchemaWithTools (adk-python parity) (#580) (5b65ee1)
• parse JSON bodies only in the toA2a server (drop express.urlencoded) (#558) (605b469)
• pass -NoProfile to spawned PowerShell and /D to cmd.exe in UnsafeLocalCodeExecutor (#566) (b56761b)
• reject zip-slip entries and non-bare skill names when loading zipped skills (adk-python parity) (#584) (4fe80b0)
• runner: persist events returned by onEventCallback (#575) (c4c5582)
• surface root-cause MCP session errors instead of swallowing them (#527) (13d7304)
• treat @google/genai ApiError 404 as session not found in VertexAiSessionService (#567) (5331c77)
• utils: fix sibling-directory escape in materializeFiles path check (#603) (868ca1f)

devtools: 1.6.0

1.6.0 (2026-08-04)

Features

• CLI-level A2A authenticator for the dev server and Cloud Run deploy (Part 2/2) (#559) (0c0bba2)

Bug Fixes

• cli: check isCancel before coercing the project prompt in adk create (#570) (c6f8b2f)
• create dev-package temp directories atomically with mkdtemp (no predictable parent) (#615) (81c1422)
• deploy: reject unsafe appName/project/region in generated Dockerfile (#604) (dadce1a)
• make streaming and stateDelta optional on RunAgentRequest (#585) (1df47e9)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @google/adk bumped from ^1.5.0 to ^1.6.0

integrations: 1.6.0

1.6.0 (2026-08-04)

Miscellaneous Chores

• integrations: Synchronize adk versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @google/adk bumped from ^1.5.0 to ^1.6.0

main: 1.6.0

1.6.0 (2026-08-04)

Features

• Add bearerTokenUserBuilder for A2A authentication (Part 1/2) (#562) (f077722)
• CLI-level A2A authenticator for the dev server and Cloud Run deploy (Part 2/2) (#559) (0c0bba2)
• Support ttl and expireTime session-expiration options in VertexAiSessionService.createSession (#561) (b390217)
• tools: add getUserChoiceTool and requestInputTool for parity with adk-python (#506) (03abf76)
• Validate tool callback response types and prevent state event pollution (#505) (b99f21b)

Bug Fixes

• a2a: stop restoring event branch from A2A peer metadata (#606) (0000925)
• accept the derived allowedTools alias in skill frontmatter validation (#560) (fcfd043)
• add explicit per-test timeout to real-PowerShell skill-script integration test (#550) (e4d3bea)
• artifacts: isolate in-memory composite keys (#576) (693a1d7)
• cli: check isCancel before coercing the project prompt in adk create (#570) (c6f8b2f)
• core: fall back to node:crypto so randomUUID cannot throw on Node (#599) (3dc1b20)
• core: use a cryptographically secure source for randomUUID (#577) (81bcc8d)
• create dev-package temp directories atomically with mkdtemp (no predictable parent) (#615) (81c1422)
• deploy: reject unsafe appName/project/region in generated Dockerfile (#604) (dadce1a)
• deps: hoist @google/genai 2.x to the workspace root (#564) (00f3775)
• detect PowerShell 7+ (pwsh) in the UnsafeLocalCodeExecutor SHELL branch (#568) (ce0e474)
• fail fast when a Vertex AI Express Mode API key cannot be used (#563) (e1112c6)
• gate the set_model_response workaround on canUseOutputSchemaWithTools (adk-python parity) (#580) (5b65ee1)
• give build_setup integration hooks an explicit timeout to stop CI flakiness (#549) (64e80ad)
• make streaming and stateDelta optional on RunAgentRequest (#585) (1df47e9)
• parse JSON bodies only in the toA2a server (drop express.urlencoded) (#558) (605b469)
• pass -NoProfile to spawned PowerShell and /D to cmd.exe in UnsafeLocalCodeExecutor (#566) (b56761b)
• reject zip-slip entries and non-bare skill names when loading zipped skills (adk-python parity) (#584) (4fe80b0)
• runner: persist events returned by onEventCallback (#575) (c4c5582)
• surface root-cause MCP session errors instead of swallowing them (#527) (13d7304)
• test: set integration hook/test timeouts in vitest.config.ts (#548) (3b3be2f)
• treat @google/genai ApiError 404 as session not found in VertexAiSessionService (#567) (5331c77)
• utils: fix sibling-directory escape in materializeFiles path check (#603) (868ca1f)

---

This PR was generated with Release Please. See documentation.