kagent v0.10.0
security+++++~~~~~~~~*****!
Changes
- Patch CRITICAL/HIGH CVEs in golang-adk-full and app imagessecurity
- Scope task get, create, and delete to the ownersecurity
- Resolve CVE-2026-84304 (bump grpc)security
- Update claude db migration skill reference with additional constraintschanged
- Switch default declarative agent runtime to gochanged
- Add ACP shim for communication with agents in substratechanged
- Add Charlesthebird as CODEOWNER for ui directorychanged
- Add query-contraction check against the previous releasechanged
- Feat(sso) expired token session redirectchanged
- Allow configuration of A2A client timeoutchanged
- Add check for schema-agnostic sqlchanged
- Stop false stale-send guard after tool-call turnschanged
108 more lines
- Trigger CI workflows on all release/ brancheschanged
- Add database upgrade and rollback compatibility testschanged
- Switch migrator to orchestrator and manage downstream migrationschanged
- Remove cr.kagent.dev alias usagechanged
- Add kagent db migrate CLI for out-of-band migrationschanged
- Add SKIP_MIGRATIONS to run migrations out-of-bandchanged
- Gate SandboxAgent actor readiness on the app serving trafficchanged
- Feat(MCP UI) chat widgetschanged
- Fixes empty secretkeyref in azureopenaichanged
- Add 'none' as an option for reasoning effort, update models acrosschanged
- Feat (UI): improve UX by grouping tool calls in the chatchanged
- Mark agent as ready when at least one replica is availablechanged
- Fix droping an MCP toolset when the MCP server isn't reachable at startupchanged
- Clean up and move the agent creation functions into a single filechanged
- Reference declarative agents by tag; digests only for sandbox agentschanged
- Bump minimum python version to 3.11changed
- Reduce redundant fetching and optimize rendering (ui)changed
- (otel)(fix): don't double-instrument OpenAI on the agents runtimechanged
- Add substrate badge to agent cardschanged
- Helm: add annotations support to controller and UI ServiceAccountschanged
- Add xhigh as a valid reasoning effort for openai modelschanged
- Honor event timestamp filters when loading sessionschanged
- Force-flush trace spans before the A2A response completes for substratechanged
- Batch checkpoint writes to remove N+1 querychanged
- Bump deps for CVE fixeschanged
- Backport 2361 and 2367changed
- Backport 2153 to 0.10.x releasechanged
- Backport 2369 to 0.10.x release branchchanged
- Backport 2365 to 0.10.x release branchchanged
- Backport 2387 to 0.10.x release branchchanged
- Backport 2091 to 0.10.x release branchchanged
- Backport #2394 CVE fixes to release/v0.10.xchanged
- Backport 2400 to 0.10.x release branchchanged
- Backport 2392 to 0.10.x release branchchanged
- Backport #2479 CVE fix to release/v0.10.xchanged
- Backport #2423 CVE fixes to release/v0.10.xchanged
- Honor LOG_LEVEL in bundled agents and expose agent env config in helmchanged
- Backport #2539 (remove bundled doc2vec) to release/v0.10.xchanged
- Bump Google ADK to address Starlette CVEschanged
- Bump go to v1.26.7 + x/mod v0.40.0changed
- Backport #2637 (bump postgres to 18.6-alpine3.23) to release/v0.10.xchanged
- Configurable nginx, controller, and UI inactivity ti…added
- Add controller service annotationsadded
- Enable sharing of chat sessionsadded
- Substrate support for BYO and python runtimes for SandboxAgent CRadded
- Bump agent substrate to 0.0.7added
- Bump agent substrate to 0.0.8added
- Support deployment annotationsadded
- Add nodeSelector support to agent helm chartsadded
- Expose icon, provider, documentation URL and version on agent A2A cardadded
- Add claude ACP sandbox targetadded
- Store session state in durableDir volume for declarative sandbox agentsadded
- Add UI HTTPRouteadded
- Bump bundled oauth2-proxy subchart to ~10.7.0added
- Default nodeSelector for agent deployments (--default-agent-node-selector)added
- Add podLabels for controller and UI pod templatesadded
- Add extraObjects for arbitrary manifestsadded
- Playwright ui tests foundation stage 0added
- Allow read-only shares to read A2A tasksadded
- Make Go (ADK) runtime agent image independently configurableadded
- Allow custom annotations on the default ModelConfigadded
- Playwright UI E2E suite — helpers + feature flows (stage 2)added
- Serve A2A ListTasks from the task storeadded
- Add maxCompletionTokens for OpenAIadded
- Wire maxOutputTokens for native Gemini and Vertexadded
- Add envFrom support to agent deployment specadded
- Add native AWS Bedrock Guardrails support to ModelConfigadded
- Configurable Bedrock read/connect timeoutadded
- Add deploymentAnnotations to agent deployment specadded
- Allow disabling default modelconfigadded
- Send RFC 8707 resource and audience on token exchangeadded
- Send RFC 8707 resource and audience on token exchange (Python)added
- Backport of 2407 (pg connection) to 0.10.x releaseadded
- Backport 2409 (db session cleanup) to 0.10.x releaseadded
- Backport of 2408 (s3 skills) to 0.10.x releaseadded
- Configurable refresh interval for tool server controllersadded
- Support file upload in agent chatadded
- Chat interface overflows viewport causing input to be hidden below foldfixed
- Avoid false stale chat send guardfixed
- Extract system prompt from genai.GenerateContentConfig in Ollama and Bedrock model providersfixed
- Support omitting image.registry in grafana-mcp chartfixed
- Support omitting image.registry in querydoc chartfixed
- Openai embeddings generationfixed
- Omit empty repository segment in bundled image pathfixed
- Intermittent Postgres deadlock for concurrent memory searchesfixed
- Fix typos in part_converter commentsfixed
- Annotate serialize_metadata_value as str | dictfixed
- Fix model name editing on the model config formfixed
- Correct package comment in v1alpha2 groupversion_infofixed
- Unwrap Part before DataPart check so structured inputs are usedfixed
- Expose nodeSelector and tolerations for kagent-tools subchartfixed
- Make the cluster DNS domain configurablefixed
- Parse migration filenames the same way golang-migrate doesfixed
- Build sandbox runtime outside QEMU emulationfixed
- Set kgateway.dev/a2a as appProtoco for BYO agentsfixed
- Normalize agent name in memory vector searchfixed
- Coerce nil tool-call args to empty objectfixed
- Correct webhook typo in CLI help textfixed
- Use AZURE_OPENAI_API_KEY env var name consistentlyfixed
- Keep token refresh loop alive after a failed readfixed
- Drain child stdout during terminate to avoid teardown deadlockfixed
- Keep full session state when num_recent_events is setfixed
- Wire up SessionSharesHandler in NewHandlersfixed
- Ensure API key passthrough works for OpenAI embedding modelsfixed
- Validate ask_user questionsfixed
- Backport fix(golang-adk): resolve user identity from A2A call context to 0.10.xfixed
- Serve exact task reads from the persistent storefixed
- Preserve post-login redirect target through oauth2-proxy sign-infixed
67 maintenance lines (dependency bumps, CI, tests, docs)
- Bump google-adk to 1.32.0 for Anthropic thinking blocksmaintenance
- Fix duplicate descriptions and broken link in READMEmaintenance
- Fix typos and errors in component READMEsmaintenance
- Fix typos and list formatting in contributor docsmaintenance
- Replace outdated AutoGen reference in SECURITY.mdmaintenance
- Fix kagent-langgraph README import to kagent.langgraphmaintenance
- Fix KAgentSession import path in kagent-openai READMEmaintenance
- Fix stale references and wordingmaintenance
- List bash in get_skill_tools Returns docstringmaintenance
- Fix broken file linksmaintenance
- Point prompt template integration link to compilermaintenance
- Add STYLE.md with Go style guidemaintenance
- Fix stale architecture referencesmaintenance
- Fix currency LangGraph sample README to match OpenAI implementationmaintenance
- Assert real tls_insecure_skip_verify tag in omitempty testmaintenance
- Bump the go-minor-patch group in /go with 8 updatesmaintenance
- Bump the npm-minor-patch group in /ui with 28 updatesmaintenance
- Bump the python-minor-patch group in /python with 10 updatesmaintenance
- Bump black from 25.1.0 to 26.5.1 in /pythonmaintenance
- Bump cryptography from 48.0.0 to 49.0.0 in /pythonmaintenance
- Bump the python-minor-patch group in /python with 9 updatesmaintenance
- Bump the go-minor-patch group in /go with 3 updatesmaintenance
- Update anthropic[vertex] requirement from >=0.49.0 to >=0.112.0 in /pythonmaintenance
- Bump azure/setup-helm from 5.0.0 to 5.0.1 in the actions groupmaintenance
- Update byo sample base images to work with substratemaintenance
- Bump the go-minor-patch group in /go with 8 updatesmaintenance
- Bump debian from 12-slim to 13-slim in /pythonmaintenance
- Bump the python-minor-patch group in /python with 3 updatesmaintenance
- Update setuptools requirement from >=61.0 to >=83.0.0 in /pythonmaintenance
- Pin actions/checkout to v6 in release workflowmaintenance
- Bump node from 20-bookworm-slim to 26-bookworm-slim in /pythonmaintenance
- Update langsmith[otel] requirement from >=0.4.30 to >=0.9.8 in /pythonmaintenance
- Update wheel requirement from >=0.46.2 to >=0.47.0 in /pythonmaintenance
- Update anthropic[vertex] requirement from >=0.49.0 to >=0.116.0 in /pythonmaintenance
- Bump the npm-minor-patch group across 1 directory with 39 updatesmaintenance
- Update langsmith[otel] requirement from >=0.9.8 to >=0.10.2 in /pythonmaintenance
- Bump the python-minor-patch group in /python with 4 updatesmaintenance
- Bump distroless/cc-debian12 from b0ae8e9 to ce0d66b in /pythonmaintenance
- Bump node from b16ca7b to e999d08 in /pythonmaintenance
- Upgrade google.golang.org/adk to v2.0.0maintenance
- Add @Charlesthebird as CODEOWNER for .github/maintenance
- Read go version from go.mod in sqlc checkmaintenance
- Bump the go-minor-patch group across 1 directory with 7 updatesmaintenance
- Bump substrate to v0.0.9 and remove collapsing of image env into actor envmaintenance
- Pin packageManager to [email protected]maintenance
- Bump the go-minor-patch group in /go with 6 updatesmaintenance
- Bump actions/upload-artifact from 4 to 7maintenance
- Improve build caching and cancel stale runsmaintenance
- Bump actions/setup-go from 6 to 7maintenance
- Bump actions/setup-node from 6 to 7maintenance
- Update langsmith[otel] requirement from >=0.10.2 to >=0.10.6 in /pythonmaintenance
- Bump debian from 28de087 to 020c0d2 in /pythonmaintenance
- Bump distroless/cc-debian12 from ce0d66b to 66aa873 in /pythonmaintenance
- Bump node from e999d08 to 2d49d87 in /pythonmaintenance
- Bump the python-minor-patch group in /python with 4 updatesmaintenance
- Update anthropic[vertex] requirement from >=0.116.0 to >=0.117.0 in /pythonmaintenance
- Bump the npm-minor-patch group in /ui with 27 updatesmaintenance
- Helm template and sample metadata cleanupsmaintenance
- Update anthropic[vertex] requirement from >=0.117.0 to >=0.120.0 in /pythonmaintenance
- Update langsmith[otel] requirement from >=0.10.6 to >=0.10.10 in /pythonmaintenance
- Update a2a-sdk[http-server] requirement from >=0.3.23 to >=0.3.26 in /pythonmaintenance
- Fix stale node version comments in python full imagemaintenance
- Bump distroless/cc-debian12 from 66aa873 to fccdbb0 in /pythonmaintenance
- Hide pgx errors behind database.ErrNotFoundmaintenance
- Bump the npm-minor-patch group in /ui with 37 updatesmaintenance
- Bump actions/labeler from 6 to 7maintenance
- Bump the go-minor-patch group in /go with 14 updatesmaintenance
187 lines3 security36 added50 changed31 fixed67 maintenancetyped from the source notes