chore(release/candidate): release 2.5.0

[adk-bot]

🤖 I have created a release beep boop

2.5.0 (2026-07-16)

Features

• add Cloud Run sandbox option in code executors (5b1088a)
• Add search agents and search MCP severs to agent registry (ed579c1)
• add skill to verify markdown code snippets (c0fa51b)
• Add strict input schema validation for LlmAgent workflow nodes (6f66814)
• add to_mcp_server to serve an ADK agent over MCP (50ff37f)
• agents: add single_turn mode field to ManagedAgent (da50578)
• agents: bridge node_input to user_content for ManagedAgent nodes (a680cea)
• agents: support remote MCP servers for ManagedAgent with runtime header callbacks (2e2ec09)
• agents: wrap single_turn non-LlmAgent sub-agents as inline tools (fc98549)
• bigquery: log tool descriptions and parameter schemas in LLM_REQUEST (ecef5f8)
• enable a2a-sdk 1.x by widening the dependency constraint (b46dd13)
• live: allow Voice activity detection (VAD) events to be returned (820a910)
• live: Run non-blocking tools in a background task (5620d8f)
• plugins: add on_agent_error_callback and on_run_error_callback (7d0ae63)
• Support HITL resumption for standalone nodes and NodeTool (00760f8)
• Support LoadArtifacts parsing for binary text documents (e.g., DOCX) (ccbedd8)
• Validate that no old orchestrators are used inside Workflow graphs (7e245c4)
• Validate that no old orchestrators are used inside Workflow graphs (eaffb0e)
• workflow: Support state-based resumption for task-mode agent workflow nodes (9d306f5)

Bug Fixes

• Add mTLS support for for API registry (41693dc)
• Add mtls support for gcp_utils (3fa993b)
• Add support for list_artifact_versions and get_artifact_version to ForwardingArtifactService (61ba59a)
• avoid crash on first turn with empty user content (c9bacd4)
• Avoid shell execution in ReadFileTool ranged reads (1ac6875)
• block posix, nt, _posixsubprocess, and _socket modules in agent config validation (faa1744)
• cli: Block special internal agents in ApiServer mode (3f6eb1f)
• confine docs-agent file tools to the managed repos directory (f00fc5a)
• decode shell skill output as UTF-8 (b7ad76a)
• environment: add integer validation in ReadFileTool (3c0fb65)
• exclude LiteLlm llm_client from JSON serialization (ecbefd9), closes #6164
• exclude rewound invocations from event compaction (0d4d378)
• explicitly preserve language and tools during event compaction (b44d2c9), closes #6273
• Fix InputTokensDetails validation in OpenAI responses test and formatting in a2a_agent_executor (99ea228)
• Fix sub-branch event routing for nested sub-agents and tools in InvocationContext (3cdc102)
• GitHub CI for the verify-snippets skill (ccc8ab4)
• grow eligible Gemini cache prefixes (98fc036)
• guard decode_model against non-dict session values (8c60d99), closes #6348
• handle sqlite float timestamps in PreciseTimestamp (2da09e6), closes #6352
• honor server-reported Gemini cache expiry (4fdc94c)
• litellm: preserve reasoning replay and optionally share agent thoughts (6290aec)
• litellm: preserve signature-only blocks for Anthropic streaming thinking aggregation (78d1957)
• make agent and run error callbacks best-effort so they never mask the original error (2f48ad3)
• make discussion answering model configurable (de4ac2d)
• match HF-style gemma-4 model names for tool_responses role (4930155), closes #6334
• models: Allow context caches with empty content prefixes (ee7174d)
• models: forward request headers on google_llm interactions path (b5a3e34)
• preserve non-ASCII characters in agent input (7006e33), closes #6279 #6282
• preserve non-image file MIME type in LiteLlm content conversion (065234e), closes #4174
• Prevent continuation forgery in tool confirmation (c03f333)
• prevent model bypass in resumable mode by rejecting user-authored function calls (283e92e)
• prevent synchronous code executors from blocking the event loop (585809c), closes #6353
• recover a compacted sibling's latest response, not its placeholder (0bd7ea0)
• recover compacted function calls during prompt assembly (0c517e7), closes #5602
• remove OpenTelemetry event logger setup since the Events API/SDK has been deprecated and is soon being removed entirely (bb3b2a4)
• repair two broken contributing samples (ee3a381)
• require starlette>=1.3.1 to clear known CVEs (221bad9), closes #6038
• Resolve scheduler leakage and make scheduler instantiation explicit (ce2e4ca)
• Resolve scheduler leakage and make scheduler instantiation explicit (d4f0772)
• Retain user input across transfer_to_agent when include_contents='none' (ad5445a), closes #3535
• Return 404 instead of 500 when app_name does not match any agent (f4decf6), closes #5374
• return MCP tools in stable sorted order for cache stability (2aba05c)
• reuse current-step tool resolution (3164504)
• reuse fetched session and honor get_session_config on chat path (81306bb)
• rollback of path segment validation in InMemoryArtifactService and GcsArtifactService (961f3e8)
• samples: Fix monitor_video_stream in live bidi streaming sample (7c11f58)
• scope Gemini cache identity (8de4237)
• sessions: prevent PydanticSerializationError when session state contains non-serializable objects (757ef22)
• shield toolset cleanup from cancellation (a69ba4f)
• snapshot events under lock in InMemoryMemoryService.search_memory (aeccd3b), closes #6167
• Support passing credentials to GCPSkillRegistry (c441ab2)
• support unencrypted workload certificates for mTLS in GoogleApiToolset (d831ee6)
• telemetry: add 0 bucket boundary to per-invocation call count histograms (c291821)
• test: correct polling timeout unit test in IAM Connector credentials provider (4448117)
• Update GCP Skill Registry to use agentregistry/skill endpoint (fa884e3)
• Update VertexAiRagMemoryService methods to use latest RAG module (96d2914)
• Validate path segments in GcsArtifactService and InMemoryArtifactService to prevent cross-user artifact access (45a77dc)
• Validate path segments in GcsArtifactService and InMemoryArtifactService to prevent cross-user artifact access (8718aef), closes #6115 #6116
• workflow: Process all completed tasks in batch before exiting on error (8db2ace)
• workflow: treat RetryConfig(max_attempts=0) as no retries (3b3f127)

Performance Improvements

• lazy-load ManagedAgent to keep the interactions API off startup (995628c)
• litellm: track brace depth incrementally for streaming tool-call args (e5fdb51)
• Optimize workflow rehydration performance with indexing (64a7448)
• skip disabled request-log formatting (cba2827)
• skip non-recording LLM trace work (0c63a89), closes #4233

Documentation

• add to_mcp_server unit guide (534e8d5)
• Fix token exceeded error on ADK release analyzer's final summary agent (989af4d)
• guides: Add ManagedAgent unit guide (ab839d5)
• guides: note single_turn works for non-LlmAgent agents (26ed6fe)
• samples: add ManagedAgent remote MCP (Maps Grounding Lite) sample (cc444b6)
• samples: Add ManagedAgent single-turn sub-agent sample (57e1ba6)
• samples: Link ManagedAgent sample READMEs to the guide (3834c0b)
• samples: Remove NOT WORKING YET comments from workflow samples (f3f602f)
• simplify sample graph guidance in adk-sample-creator skill (27edb1a)
• skills: Add coding conventions and state lifecycle rules to style and architecture guides (367ab9a)
• tools: encourage using mode='single_turn' in AgentTool and document manual artifacts configuration (a9b4276)
• tools: recommend mode='single_turn' in AgentTool docstring (f4072a4)
• Update models owner for ADK PR triaging agent (b8a1dab)

---

This PR was generated with Release Please. See documentation.