A2A SDK for Go 2.5.0

Apply the Go 1.27 baseline first. These rules cover github.com/a2aproject/a2a-go/v2 at v2.5.0, implementing A2A Protocol 1.0. The SDK requires Go 1.25.0 or newer.

Discovery and transport selection

• Allow only approved HTTPS card locations before calling agentcard.Resolver.Resolve. Reject untrusted file: locations: 2.5.0 reads them directly from disk, bypassing Resolver.Client and its network controls. Confine any intentionally supported local cards to trusted deployment files.
• Supply a restricted Resolver.Client and enforce a response-byte limit before parsing, with an error on overflow. The default resolver has a 30-second timeout but reads the whole response with io.ReadAll; a size check in CardParser is too late to bound that allocation.
• Validate card structure and approved identity before creating a client or calling Client.UpdateCard; DefaultCardParser only unmarshals JSON. Where signed discovery is required, verify JWS signatures with the protocol's canonicalization rules and trusted provider keys; constrain key-discovery URLs as outbound requests.
• Filter every AgentCard.SupportedInterfaces endpoint, protocol version, and binding against local policy. Use a2aclient.WithDefaultsDisabled() and register only approved transports; Config.PreferredTransports sorts candidates but does not exclude other registered transports. Defaults register JSON-RPC and REST, and connection setup can try multiple candidates.
• Pass protected HTTP clients through WithJSONRPCTransport and WithRESTTransport, and configure TLS and destination controls