[dependabot]

Updates the requirements on a2a-sdk to permit the latest version.

Release notes

Sourced from a2a-sdk's releases.

v1.3.0

1.3.0 (2026-10-27)

Features

• server: release parked interrupted tasks after a configurable timeout (#1338) (b22a68d)

Bug Fixes

• client: Create separate httpx per client when none configured (#1358) (d316d0e)
• client: raise A2A errors for malformed JSON-RPC responses (#1375) (7e55413)
• client: rejections from unrecognized fields (#1354) (91929cd)
• compat: keep an unset v0.3 status message and provider as None (#1362) (cdb4799), closes #1361
• compat: return A2A error codes from the v0.3 JSON-RPC adapter (#1369) (8e32d53)
• compat: set last_updated when storing a task in v0.3 format (#1372) (30b6d50), closes #1371
• core: restore structured repr on A2A exceptions (#1348) (79a6f45)
• server: allow recovery after status event validation fails (#1365) (ca3ef0d)
• server: apply history_length to legacy streaming sends (#1364) (261c074)
• server: include legacy task states in database list filters (#1337) (e12d494)
• server: record executor failures through the event consumer (#1366) (ad85806)
• server: reject boolean JSON-RPC request IDs (#1350) (05392b3)
• skip malformed agent card signature headers (#1335) (b21a144)

Documentation

• helpers: note that whole numbers in a data Part come back as floats (#1373) (654774f)

Miscellaneous Chores

• release 1.3.0 (#1389) (fb6373f)

Changelog

Sourced from a2a-sdk's changelog.

1.3.0 (2026-10-27)

Features

• server: release parked interrupted tasks after a configurable timeout (#1338) (b22a68d)

Bug Fixes

• client: Create separate httpx per client when none configured (#1358) (d316d0e)
• client: raise A2A errors for malformed JSON-RPC responses (#1375) (7e55413)
• client: rejections from unrecognized fields (#1354) (91929cd)
• compat: keep an unset v0.3 status message and provider as None (#1362) (cdb4799), closes #1361
• compat: return A2A error codes from the v0.3 JSON-RPC adapter (#1369) (8e32d53)
• compat: set last_updated when storing a task in v0.3 format (#1372) (30b6d50), closes #1371
• core: restore structured repr on A2A exceptions (#1348) (79a6f45)
• server: allow recovery after status event validation fails (#1365) (ca3ef0d)
• server: apply history_length to legacy streaming sends (#1364) (261c074)
• server: include legacy task states in database list filters (#1337) (e12d494)
• server: record executor failures through the event consumer (#1366) (ad85806)
• server: reject boolean JSON-RPC request IDs (#1350) (05392b3)
• skip malformed agent card signature headers (#1335) (b21a144)

Documentation

• helpers: note that whole numbers in a data Part come back as floats (#1373) (654774f)

Miscellaneous Chores

• release 1.3.0 (#1389) (fb6373f)

1.2.3 (2026-10-17)

Bug Fixes

• client: ignore the patch version when preferring a 1.0 interface (#1304) (cbb2d84)
• client: normalize malformed agent card parsing errors (#1307) (486f0f6)
• compat: block on a v0.3 gRPC and REST send without configuration (#1334) (8160310), closes #1321
• compat: treat a v0.3 history_length of 0 as unlimited in JSON-RPC and REST (#1312) (e86695c)
• jcs: count open containers for the nesting bound, so an empty container leaf is refused (#1294) (5653daf)
• server: isolate push notification failures from the task lifecycle (#1329) (0ee47d7)
• server: mark internal lifecycle events done so a cancelled stream frees its producer (#1336) (a4c4fc9)
• server: reject push URLs in shared address space (#1326) (01da00b)
• server: release the ActiveTask after a direct Message response (#1297) (49ebce6)
• server: run follow-up messages in the sender's contextvars (#1317) (a016002)
• server: warn when an AgentCard is missing required fields (#1279) (4f4101c)

... (truncated)

Commits

• 0d9dafb chore(main): release 1.3.0 (#1359)
• 3d185ad test: extend selected scenarios to REST (#1370)
• fb6373f chore: release 1.3.0 (#1389)
• 7e55413 fix(client): raise A2A errors for malformed JSON-RPC responses (#1375)
• b21a144 fix: skip malformed agent card signature headers (#1335)
• ca3ef0d fix(server): allow recovery after status event validation fails (#1365)
• c70403a chore(deps): bump opentelemetry-api from 1.42.1 to 1.45.1 (#1387)
• c666b5f chore(deps): bump certifi from 2026.2.25 to 2026.10.19 (#1386)
• 8e32d53 fix(compat): return A2A error codes from the v0.3 JSON-RPC adapter (#1369)
• b22a68d feat(server): release parked interrupted tasks after a configurable timeout (...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)