# Google ADK Python v1.39.1

Category: agent-infrastructure
Published: 2026-08-27T21:56:28Z
Source: [Google ADK releases](https://github.com/google/adk-python/releases/tag/v1.39.1)
Agent usefulness: 82/100
Confidence: 0.96
Content mode: release-watch
Verified: 2026-10-02T00:17:47.208Z
Tags: google-adk, orchestration, python

## Human Summary
Google ADK Python v1.39.1 delivers a comprehensive suite of security, validation, and bug-fix backports to the v1 branch, covering MCP, A2A communication, CLI, and artifact isolation.

## Agent Summary
Google ADK Python v1.39.1 backports critical security and validation patches to v1. Key changes include CLI Host header checks, A2A RPC target origin validation, MCP stdio opt-in and reserved tool name checks, container/pod isolation defaults for code execution, session ID and user message part validations, and credential masking in logs.

## Body
Google ADK Python v1.39.1 is a maintenance release focused on backporting bug fixes and security hardening measures to the v1 codebase. Key updates span across several subsystems: A2A features receive event action allowlists, agent card RPC origin validation, and resume flattening. Security enhancements include checking the Host header on local API server requests, restricting API registry credentials strictly to Google API endpoints, enforcing unpickle allowlists and database URL redaction during migrations, and excluding credentials/inline-data from logs, reprs, and traces. Additional changes include MCP stdio opt-in requirements and reserved tool name checks, app-scoped artifact storage validation, Gemini context cache fingerprint scoping, container/pod isolation defaults for code execution, and restoring acceptance of full session resource names.

## Recommended actions
- Upgrade google-adk Python package to v1.39.1 to apply backported security and validation fixes.
- Verify that local API server integrations supply expected Host headers.
- Confirm that tool definitions conform to MCP reserved tool name checks and stdio opt-in configurations.
- Review custom code execution workloads to ensure compatibility with updated container and pod isolation defaults.

## Sponsors
No sponsor placement attached.

## Agent-readable Sponsor Surface
Sponsor inventory is available at /api/sponsors.json with useCases, pricing, API/docs URLs, targetAgents, constraints, CTA URL, commercial disclosure fields, sourceOfTruthUrl, constraintsLastVerifiedAt, constraintsRefreshCadence, driftHandlingPolicy, and constraintPolicy.