feat: Move from Jackson to Gson serialization

[kabir]

• Replacing Jackson with Gson for json (de)serialization
• Update workflows + Kafka version
• Various fixes for the TCK
• fixes discovered reviewing the code relating to security hardening, JSON serialization correctness, and spec compliance. (a lot of this happened in temporary PR feat: Move from Jackson to Gson serialization #808)

[gemini-code-assist]

Code Review

This pull request migrates the A2A Java SDK from Jackson to Gson, introducing a centralized JsonUtil and custom exceptions to decouple the SDK from specific JSON implementations. Feedback identifies a critical security vulnerability in JsonUtil related to unsafe class instantiation from untrusted input (CWE-470). The reviewer also recommends aligning the gRPC utility configuration with the central JsonUtil to ensure consistency, using long integers for IDs to prevent data truncation, and fixing serialization logic for complex error data. Additionally, suggestions are provided to clean up misplaced dependency exclusions in the POM and rename the OBJECT_MAPPER constant to a more library-agnostic term.

[kabir]

/gemini review

[gemini-code-assist]

Code Review

This pull request migrates the SDK from Jackson to a custom JSON abstraction layer using Gson, removing Jackson annotations from specification classes to ensure library independence. The changes include the introduction of JsonUtil for centralized serialization and JSONRPCUtils for JSON-RPC to Protocol Buffer conversion. Feedback indicates that the new caching logic in the Client class is redundant and potentially breaks authenticated extended card resolution. Furthermore, multiple locations in the JSON-RPC handling logic were identified where numeric IDs could be truncated, and several polymorphic deserialization paths were missing the AUTHENTICATED_EXTENDED_CARD_NOT_CONFIGURED_ERROR_CODE case.

[gemini-code-assist]

The caching logic introduced here prevents the client from ever receiving an updated or upgraded agent card (e.g., transitioning from a public card to an authenticated extended card). Since the underlying transport implementations (like JSONRPCTransport) already implement their own caching and handle the extended card resolution logic, this additional layer of caching in the Client class is redundant and breaks the authenticated extended card feature. It should be reverted to delegate directly to the transport.

        agentCard = clientTransport.getAgentCard(context);
        return agentCard;

[gemini-code-assist]

The current logic for extracting the requestId will truncate fractional numbers (e.g., 1.5 becomes 1L). While the JSON-RPC 2.0 specification discourages fractional numbers for IDs, it does not forbid them. Using JsonUtil.OBJECT_MAPPER.fromJson(idElement, Object.class) would be safer as it uses the pre-configured number policy to preserve precision for both integers and floating-point numbers.

            if (idElement != null && !idElement.isJsonNull() && idElement.isJsonPrimitive()) {
                requestId = JsonUtil.OBJECT_MAPPER.fromJson(idElement, Object.class);
            }

[kabir]

The ID precision issues are theoretical - the spec discourages fractional IDs and the code has worked this way since inception.

[gemini-code-assist]

The switch statement is missing a case for AUTHENTICATED_EXTENDED_CARD_NOT_CONFIGURED_ERROR_CODE. This will cause such errors to be deserialized as a base JSONRPCError instead of the specific AuthenticatedExtendedCardNotConfiguredError subclass. Ensure the constant is used to maintain consistency across modules.

            switch (code) {
                case JSON_PARSE_ERROR_CODE:
                    return new JSONParseError(code, message, data);
                case INVALID_REQUEST_ERROR_CODE:
                    return new InvalidRequestError(code, message, data);
                case METHOD_NOT_FOUND_ERROR_CODE:
                    return new MethodNotFoundError(code, message, data);
                case INVALID_PARAMS_ERROR_CODE:
                    return new InvalidParamsError(code, message, data);
                case INTERNAL_ERROR_CODE:
                    return new io.a2a.spec.InternalError(code, message, data);
                case PUSH_NOTIFICATION_NOT_SUPPORTED_ERROR_CODE:
                    return new PushNotificationNotSupportedError(code, message, data);
                case UNSUPPORTED_OPERATION_ERROR_CODE:
                    return new UnsupportedOperationError(code, message, data);
                case CONTENT_TYPE_NOT_SUPPORTED_ERROR_CODE:
                    return new ContentTypeNotSupportedError(code, message, data);
                case INVALID_AGENT_RESPONSE_ERROR_CODE:
                    return new InvalidAgentResponseError(code, message, data);
                case TASK_NOT_CANCELABLE_ERROR_CODE:
                    return new TaskNotCancelableError(code, message, data);
                case TASK_NOT_FOUND_ERROR_CODE:
                    return new TaskNotFoundError(code, message, data);
                case AUTHENTICATED_EXTENDED_CARD_NOT_CONFIGURED_ERROR_CODE:
                    return new AuthenticatedExtendedCardNotConfiguredError(code, message, data);
                default:
                    return new JSONRPCError(code, message, data);
            }

References

1. Constants that are used across multiple modules or components should be moved to a shared location to avoid duplication and ensure consistency.

[gemini-code-assist]

Using getAsLong() to extract the JSON-RPC ID will truncate fractional numbers. It is better to use JsonUtil.OBJECT_MAPPER.fromJson(idElement, Object.class) to correctly handle both string and numeric IDs while preserving precision for non-integer numbers.

Suggested change

	} else if (idElement.isJsonPrimitive()) {
	try {
	id = idElement.getAsLong();
	} catch (UnsupportedOperationException | NumberFormatException | IllegalStateException e) {
	id = idElement.getAsString();
	id = JsonUtil.OBJECT_MAPPER.fromJson(idElement, Object.class);

[kabir]

The ID precision issues are theoretical - the spec discourages fractional IDs and the code has worked this way since inception.

[gemini-code-assist]

The switch statement in the JSONRPCError type adapter is missing the case for AUTHENTICATED_EXTENDED_CARD_NOT_CONFIGURED_ERROR_CODE. This prevents proper polymorphic deserialization of this specific error type. Ensure the constant is used to maintain consistency across modules.

                    return switch (code) {
                        case JSON_PARSE_ERROR_CODE ->
                            new JSONParseError(code, message, data);
                        case INVALID_REQUEST_ERROR_CODE ->
                            new InvalidRequestError(code, message, data);
                        case METHOD_NOT_FOUND_ERROR_CODE ->
                            new MethodNotFoundError(code, message, data);
                        case INVALID_PARAMS_ERROR_CODE ->
                            new InvalidParamsError(code, message, data);
                        case INTERNAL_ERROR_CODE ->
                            new io.a2a.spec.InternalError(code, message, data);
                        case TASK_NOT_FOUND_ERROR_CODE ->
                            new TaskNotFoundError(code, message, data);
                        case TASK_NOT_CANCELABLE_ERROR_CODE ->
                            new TaskNotCancelableError(code, message, data);
                        case PUSH_NOTIFICATION_NOT_SUPPORTED_ERROR_CODE ->
                            new PushNotificationNotSupportedError(code, message, data);
                        case UNSUPPORTED_OPERATION_ERROR_CODE ->
                            new UnsupportedOperationError(code, message, data);
                        case CONTENT_TYPE_NOT_SUPPORTED_ERROR_CODE ->
                            new ContentTypeNotSupportedError(code, message, data);
                        case INVALID_AGENT_RESPONSE_ERROR_CODE ->
                            new InvalidAgentResponseError(code, message, data);
                        case AUTHENTICATED_EXTENDED_CARD_NOT_CONFIGURED_ERROR_CODE ->
                            new AuthenticatedExtendedCardNotConfiguredError(code, message, data);
                        default ->
                            new JSONRPCError(code, message, data);
                    };

References

1. Constants that are used across multiple modules or components should be moved to a shared location to avoid duplication and ensure consistency.