Google ADK for Python 1.39

Apply the Python 3 baseline first. These rules cover ADK Python 1.39 and its v1 APIs.

Release line and dependency scope

• Review v1 release notes alongside advisories and dependency scans: published v1 releases include security-related ports without dedicated advisories. Keep the exact deployed dependency set in the lockfile and verify which controls its release provides; a clean scan cannot establish that every upstream fix is present.
• Update every place that runs ADK, including developer machines that run adk web or adk api_server locally, not only deployed services; a local server runs agent code and can be reached from the developer's browser and network.
• Choose a security-supported CPython minor compatible with every deployed integration. Python 3.10 is end of life. This line declares requires-python = ">=3.10" without an upper bound; its classifiers name 3.10 through 3.13, the v1.39.1 CI also tests 3.14, and current 1.x installation guidance says 3.10 or later. Use the maintained 3.11 through 3.14 candidates only after checking the deployed integrations; verify newer minors separately.
• Track both branches when you assess a fix, and verify that it is present in the exact v1 release you deploy instead of assuming every 2.x security change is backported. No published v1 support window or backport commitment was found. When a relevant fix has no v1 release, document and test a mitigation for that specific flaw; if none works, disable the affected feature or complete migration to a release containing the fix before continued exposure.

Development