A2A SDK for Java 1.3

Last reviewed Oct 28, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 25113 lines · 2.8K tokens
  2. A2A SDK for Java 1.369 lines · 4K tokens
Total182 lines · 6.9K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 93
  • 95
  • 117
  • 190
  • 201
  • 203
  • 208
  • 209
  • 214
  • 294
  • 295
  • 297
  • 306
  • 319
  • 323
  • 327
  • 338
  • 347
  • 362
  • 367
  • 378
  • 427
  • 470
  • 471
  • 494
  • 502
  • 532
  • 611
  • 639
  • 653
  • 681
  • 732
  • 770
  • 772
  • 776
  • 789
  • 807
  • 841
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1333

Prompt Preview

Apply the Java 25 prompt first. These rules cover the A2A Java SDK 1.3 line, checked against 1.3.0.Final, on Java 25, A2A Protocol 1.0, and explicitly enabled v0.3 compatibility modules. The SDK targets Java 17 or later; its release CI includes Java 17, 21, and 25.

Release and deployment

  • Align core, transport, reference, and extras artifacts with the appropriate a2a-java-sdk-bom, a2a-java-sdk-reference-bom, or a2a-java-sdk-extras-bom. Review the resolved dependency graph and apply security patches; do not treat the dependencies originally bundled with 1.3.0.Final as permanent safe pins.
  • Make every credential-bearing POST refuse redirects. The JSON-RPC and REST transports call createPost() without followRedirects(false), so give them an A2AHttpClient wrapper whose createPost() returns a builder already set to followRedirects(false), and test that a cross-origin 302 comes back to your code instead of being followed. A custom A2AHttpClient must override PostBuilder.followRedirects, because the interface's default ignores the argument.
  • On a2a-java-sdk-http-client-android 1.3.0.Final through 1.3.1.Final, which predate the 1.3.2.Final fix for GHSA-4fpj-g9jf-9rgg, synchronous POST follows redirects despite the documented client default, and a cross-authority redirect keeps the X-API-Key, API-Key, X-Auth-Token, and X-Authentication headers. Keep that client out of credential-bearing use unless the POST wrapper above is in place.
  • Install only the required reference transports and compatibility modules. Multiversion JSON-RPC and REST