v0.10.0

What's Changed

Features

• feat(streaming): configurable nginx, controller, and UI inactivity ti… by @yanivmn in #1973
• feat(helm): add controller service annotations by @anthonyhaussman in #2088
• feat: enable sharing of chat sessions by @onematchfox in #1935
• feat: substrate support for BYO and python runtimes for SandboxAgent CR by @jmhbh in #2043
• feat(substrate): bump agent substrate to 0.0.7 by @supreme-gg-gg in #2109
• feat(substrate): bump agent substrate to 0.0.8 by @jjamroga in #2140
• feat(helm/kagent): support deployment annotations by @anthonyhaussman in #2143
• feat: add nodeSelector support to agent helm charts by @the-mentor in #2145
• feat: expose icon, provider, documentation URL and version on agent A2A card by @QuentinBisson in #2188
• feat: add claude ACP sandbox target by @the-mentor in #2189
• feat(sandbox-agents): Store session state in durableDir volume for declarative sandbox agents by @jmhbh in #2171
• feat(helm): add UI HTTPRoute by @younsl in #2165
• feat(helm): bump bundled oauth2-proxy subchart to ~10.7.0 by @elihai-risk in #2254
• feat: default nodeSelector for agent deployments (--default-agent-node-selector) by @elihai-risk in #2259
• feat(helm): add podLabels for controller and UI pod templates by @elihai-risk in #2237
• feat(helm): add extraObjects for arbitrary manifests by @younsl in #2174
• feat(ui-test): Playwright ui tests foundation stage 0 by @cjlg-soloio in #2262
• feat: allow read-only shares to read A2A tasks by @QuentinBisson in #2191
• feat(controller): make Go (ADK) runtime agent image independently configurable by @QuentinBisson in #2021
• feat(helm): allow custom annotations on the default ModelConfig by @marians in #2201
• feat(ui-test): Playwright UI E2E suite — helpers + feature flows (stage 2) by @cjlg-soloio in #2264
• feat: serve A2A ListTasks from the task store by @QuentinBisson in #2187
• feat(models): add maxCompletionTokens for OpenAI by @anthonytwh in #2175
• feat(models): wire maxOutputTokens for native Gemini and Vertex by @anthonytwh in #2147
• feat: add envFrom support to agent deployment spec by @uncycler in #2321
• feat: add native AWS Bedrock Guardrails support to ModelConfig by @sanskar-singh-2403 in #2323
• feat(bedrock): configurable Bedrock read/connect timeout by @go-faustino in #2223
• feat: add deploymentAnnotations to agent deployment spec by @anthonyhaussman in #2359
• feat(helm/kagent): allow disabling default modelconfig by @anthonyhaussman in #2142
• feat(sts): send RFC 8707 resource and audience on token exchange by @QuentinBisson in #2106
• feat(sts): send RFC 8707 resource and audience on token exchange (Python) by @QuentinBisson in #2107
• Backport of 2407 (pg connection) to 0.10.x release by @supreme-gg-gg in #2399
• Backport 2409 (db session cleanup) to 0.10.x release by @supreme-gg-gg in #2403
• Backport of 2408 (s3 skills) to 0.10.x release by @supreme-gg-gg in #2405
• feat: configurable refresh interval for tool server controllers by @supreme-gg-gg in #2480
• feat: support file upload in agent chat by @supreme-gg-gg in #2429

Bug Fixes

• fix(ui): chat interface overflows viewport causing input to be hidden below fold by @onematchfox in #2081
• fix(ui): avoid false stale chat send guard by @erauner12 in #2034
• fix(go-adk): extract system prompt from genai.GenerateContentConfig in Ollama and Bedrock model providers by @supreme-gg-gg in #2118
• fix(helm): support omitting image.registry in grafana-mcp chart by @michaelspinks in #2125
• fix(helm): support omitting image.registry in querydoc chart by @michaelspinks in #2124
• fix(security): patch CRITICAL/HIGH CVEs in golang-adk-full and app images by @jsonmp-k8 in #2133
• fix(go-adk): openai embeddings generation by @supreme-gg-gg in #2132
• fix(helm): omit empty repository segment in bundled image path by @michaelspinks in #2120
• fix: intermittent Postgres deadlock for concurrent memory searches by @supreme-gg-gg in #2146
• fix(deps): bump google-adk to 1.32.0 for Anthropic thinking blocks by @anxkhn in #2172
• fix: fix typos in part_converter comments by @mesutoezdil in #2195
• fix(adk): annotate serialize_metadata_value as str | dict by @anxkhn in #2173
• fix(ui): fix model name editing on the model config form by @Valyrian-Code in #1979
• fix: correct package comment in v1alpha2 groupversion_info by @mesutoezdil in #2183
• fix(crewai): unwrap Part before DataPart check so structured inputs are used by @anxkhn in #2231
• fix(helm): expose nodeSelector and tolerations for kagent-tools subchart by @the-mentor in #2213
• fix(helm): make the cluster DNS domain configurable by @shekhargit1912 in #2209
• fix: parse migration filenames the same way golang-migrate does by @mesutoezdil in #2194
• fix: build sandbox runtime outside QEMU emulation by @peterj in #2299
• fix: set kgateway.dev/a2a as appProtoco for BYO agents by @supreme-gg-gg in #2305
• fix(db): normalize agent name in memory vector search by @mesutoezdil in #2307
• fix(adk/bedrock): coerce nil tool-call args to empty object by @go-faustino in #2222
• fix: correct webhook typo in CLI help text by @tziyon31 in #2203
• fix(build): use AZURE_OPENAI_API_KEY env var name consistently by @mesutoezdil in #2310
• fix(security): scope task get, create, and delete to the owner by @mesutoezdil in #2265
• fix(adk): keep token refresh loop alive after a failed read by @mesutoezdil in #2330
• fix(acp-shim): drain child stdout during terminate to avoid teardown deadlock by @tomsen02 in #2338
• fix(adk): keep full session state when num_recent_events is set by @mesutoezdil in #2329
• fix(controller): wire up SessionSharesHandler in NewHandlers (#2363) by @onematchfox in #2420
• fix: ensure API key passthrough works for OpenAI embedding models by @onematchfox in #2494
• fix(adk): validate ask_user questions by @erauner12 in #2486
• Backport fix(golang-adk): resolve user identity from A2A call context to 0.10.x by @buravc in #2507
• fix(a2a): serve exact task reads from the persistent store by @erauner12 in #2484
• fix(ui): preserve post-login redirect target through oauth2-proxy sign-in by @onematchfox in #2532

Documentation

• docs: fix duplicate descriptions and broken link in README by @mesutoezdil in #2068
• docs: fix typos and errors in component READMEs by @mesutoezdil in #2070
• docs: fix typos and list formatting in contributor docs by @mesutoezdil in #2069
• docs: replace outdated AutoGen reference in SECURITY.md by @mesutoezdil in #2110
• docs(python): fix kagent-langgraph README import to kagent.langgraph by @anxkhn in #2167
• docs(python): fix KAgentSession import path in kagent-openai README by @anxkhn in #2163
• docs: fix stale references and wording by @mesutoezdil in #2184
• docs: list bash in get_skill_tools Returns docstring by @anxkhn in #2198
• docs: fix broken file links by @mesutoezdil in #2221
• docs: point prompt template integration link to compiler by @anxkhn in #2228
• docs: add STYLE.md with Go style guide by @EItanya in #2186
• docs: fix stale architecture references by @mesutoezdil in #2308
• docs: fix currency LangGraph sample README to match OpenAI implementation by @shreyasskasetty in #2356

Testing

• test(adk): assert real tls_insecure_skip_verify tag in omitempty test by @anxkhn in #2199

Other Changes

• chore(deps): bump the go-minor-patch group in /go with 8 updates by @dependabot[bot] in #2058
• chore(deps): bump the npm-minor-patch group in /ui with 28 updates by @dependabot[bot] in #2059
• Update claude db migration skill reference with additional constraints by @iplay88keys in #2050
• chore(deps): bump the python-minor-patch group in /python with 10 updates by @dependabot[bot] in #2060
• chore(deps): bump black from 25.1.0 to 26.5.1 in /python by @dependabot[bot] in #2062
• chore(deps): bump cryptography from 48.0.0 to 49.0.0 in /python by @dependabot[bot] in #2063
• Switch default declarative agent runtime to go by @supreme-gg-gg in #2083
• add ACP shim for communication with agents in substrate by @peterj in #2049
• Add Charlesthebird as CODEOWNER for ui directory by @peterj in #2093
• Add query-contraction check against the previous release by @iplay88keys in #2085
• chore(deps): bump the python-minor-patch group in /python with 9 updates by @dependabot[bot] in #2101
• chore(deps): bump the go-minor-patch group in /go with 3 updates by @dependabot[bot] in #2099
• chore(deps): update anthropic[vertex] requirement from >=0.49.0 to >=0.112.0 in /python by @dependabot[bot] in #2103
• chore(deps): bump azure/setup-helm from 5.0.0 to 5.0.1 in the actions group by @dependabot[bot] in #2098
• feat(sso) expired token session redirect by @dimetron in #2051
• Allow configuration of A2A client timeout by @Daniel-Vaz in #2113
• Add check for schema-agnostic sql by @iplay88keys in #2067
• Stop false stale-send guard after tool-call turns by @iplay88keys in #2115
• Trigger CI workflows on all release/** branches by @iplay88keys in #2117
• refactor: update byo sample base images to work with substrate by @jmhbh in #2121
• Add database upgrade and rollback compatibility tests by @iplay88keys in #2084
• chore(deps): bump the go-minor-patch group in /go with 8 updates by @dependabot[bot] in #2157
• chore(deps): bump debian from 12-slim to 13-slim in /python by @dependabot[bot] in #2155
• chore(deps): bump the python-minor-patch group in /python with 3 updates by @dependabot[bot] in #2158
• chore(deps): update setuptools requirement from >=61.0 to >=83.0.0 in /python by @dependabot[bot] in #2162
• ci: pin actions/checkout to v6 in release workflow by @anxkhn in #2164
• chore(deps): bump node from 20-bookworm-slim to 26-bookworm-slim in /python by @dependabot[bot] in #2154
• chore(deps): update langsmith[otel] requirement from >=0.4.30 to >=0.9.8 in /python by @dependabot[bot] in #2159
• Switch migrator to orchestrator and manage downstream migrations by @iplay88keys in #2094
• Remove cr.kagent.dev alias usage by @EItanya in #2177
• chore(deps): update wheel requirement from >=0.46.2 to >=0.47.0 in /python by @dependabot[bot] in #2161
• Add kagent db migrate CLI for out-of-band migrations by @iplay88keys in #2168
• chore(deps): update anthropic[vertex] requirement from >=0.49.0 to >=0.116.0 in /python by @dependabot[bot] in #2160
• Add SKIP_MIGRATIONS to run migrations out-of-band by @iplay88keys in #2170
• Gate SandboxAgent actor readiness on the app serving traffic by @iplay88keys in #2205
• feat(MCP UI) chat widgets by @dimetron in #2052
• chore(deps): bump the npm-minor-patch group across 1 directory with 39 updates by @dependabot[bot] in #2217
• chore(deps): update langsmith[otel] requirement from >=0.9.8 to >=0.10.2 in /python by @dependabot[bot] in #2220
• chore(deps): bump the python-minor-patch group in /python with 4 updates by @dependabot[bot] in #2219
• chore(deps): bump distroless/cc-debian12 from b0ae8e9 to ce0d66b in /python by @dependabot[bot] in #2216
• chore(deps): bump node from b16ca7b to e999d08 in /python by @dependabot[bot] in #2215
• chore: upgrade google.golang.org/adk to v2.0.0 by @yanivmn in #2152
• fixes empty secretkeyref in azureopenai by @peterj in #2225
• add 'none' as an option for reasoning effort, update models across by @peterj in #2227
• chore: add @Charlesthebird as CODEOWNER for .github/ by @Charlesthebird in #2243
• ci: read go version from go.mod in sqlc check by @mesutoezdil in #2235
• feat (UI): improve UX by grouping tool calls in the chat by @peterj in #2224
• mark agent as ready when at least one replica is available by @peterj in #2263
• fix droping an MCP toolset when the MCP server isn't reachable at startup by @peterj in #2256
• chore(deps): bump the go-minor-patch group across 1 directory with 7 updates by @dependabot[bot] in #2218
• clean up and move the agent creation functions into a single file by @peterj in #2252
• Reference declarative agents by tag; digests only for sandbox agents by @iplay88keys in #2242
• chore(substrate): Bump substrate to v0.0.9 and remove collapsing of image env into actor env by @jmhbh in #2208
• chore(ui): pin packageManager to npm@11.6.2 by @cjlg-soloio in #2271
• chore(deps): bump the go-minor-patch group in /go with 6 updates by @dependabot[bot] in #2291
• chore(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2290
• ci: improve build caching and cancel stale runs by @peterj in #2301
• chore(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #2289
• chore(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in #2292
• chore(deps): update langsmith[otel] requirement from >=0.10.2 to >=0.10.6 in /python by @dependabot[bot] in #2296
• chore(deps): bump debian from 28de087 to 020c0d2 in /python by @dependabot[bot] in #2288
• chore(deps): bump distroless/cc-debian12 from ce0d66b to 66aa873 in /python by @dependabot[bot] in #2287
• chore(deps): bump node from e999d08 to 2d49d87 in /python by @dependabot[bot] in #2286
• chore(deps): bump the python-minor-patch group in /python with 4 updates by @dependabot[bot] in #2294
• chore(deps): update anthropic[vertex] requirement from >=0.116.0 to >=0.117.0 in /python by @dependabot[bot] in #2295
• Bump minimum python version to 3.11 by @iplay88keys in #2275
• chore(deps): bump the npm-minor-patch group in /ui with 27 updates by @dependabot[bot] in #2293
• reduce redundant fetching and optimize rendering (ui) by @peterj in #2285
• chore: helm template and sample metadata cleanups by @mesutoezdil in #2309
• (otel)(fix): don't double-instrument OpenAI on the agents runtime by @krisztianfekete in #2313
• Add substrate badge to agent cards by @iplay88keys in #2316
• helm: add annotations support to controller and UI ServiceAccounts by @jon-waggoner in #2319
• chore(deps): update anthropic[vertex] requirement from >=0.117.0 to >=0.120.0 in /python by @dependabot[bot] in #2344
• add xhigh as a valid reasoning effort for openai models by @peterj in #2345
• chore(deps): update langsmith[otel] requirement from >=0.10.6 to >=0.10.10 in /python by @dependabot[bot] in #2342
• chore(deps): update a2a-sdk[http-server] requirement from >=0.3.23 to >=0.3.26 in /python by @dependabot[bot] in #2343
• honor event timestamp filters when loading sessions by @peterj in #2346
• Force-flush trace spans before the A2A response completes for substrate by @iplay88keys in #2176
• chore(build): fix stale node version comments in python full image by @mesutoezdil in #2236
• perf(database): batch checkpoint writes to remove N+1 query by @anxkhn in #2248
• chore(deps): bump distroless/cc-debian12 from 66aa873 to fccdbb0 in /python by @dependabot[bot] in #2336
• refactor: hide pgx errors behind database.ErrNotFound by @QuentinBisson in #2274
• chore(deps): bump the npm-minor-patch group in /ui with 37 updates by @dependabot[bot] in #2340
• chore(deps): bump actions/labeler from 6 to 7 by @dependabot[bot] in #2337
• chore(deps): bump the go-minor-patch group in /go with 14 updates by @dependabot[bot] in #2339
• Bump deps for CVE fixes by @iplay88keys in #2360
• Backport 2361 and 2367 by @iplay88keys in #2368
• Backport 2153 to 0.10.x release by @supreme-gg-gg in #2373
• Backport 2369 to 0.10.x release branch by @supreme-gg-gg in #2375
• Backport 2365 to 0.10.x release branch by @anthonyhaussman in #2378
• Backport 2387 to 0.10.x release branch by @Charlesthebird in #2388
• Backport 2091 to 0.10.x release branch by @EItanya in #2391
• Backport #2394 CVE fixes to release/v0.10.x by @iplay88keys in #2395
• Backport 2400 to 0.10.x release branch by @krisztianfekete in #2417
• Backport 2392 to 0.10.x release branch by @anthonyhaussman in #2430
• Backport #2479 CVE fix to release/v0.10.x by @iplay88keys in #2481
• Backport #2423 CVE fixes to release/v0.10.x by @inFocus7 in #2487
• Honor LOG_LEVEL in bundled agents and expose agent env config in helm by @iplay88keys in #2502
• Backport #2539 (remove bundled doc2vec) to release/v0.10.x by @inFocus7 in #2547
• Bump Google ADK to address Starlette CVEs by @iplay88keys in #2558
• bump go to v1.26.7 + x/mod v0.40.0 by @inFocus7 in #2557
• Backport #2637 (bump postgres to 18.6-alpine3.23) to release/v0.10.x by @inFocus7 in #2650
• Resolve CVE-2026-84304 (bump grpc) by @inFocus7 in #2687

New Contributors

• @erauner12 made their first contribution in #2034
• @michaelspinks made their first contribution in #2125
• @anxkhn made their first contribution in #2164
• @the-mentor made their first contribution in #2145
• @younsl made their first contribution in #2165
• @Valyrian-Code made their first contribution in #1979
• @elihai-risk made their first contribution in #2254
• @shekhargit1912 made their first contribution in #2209
• @cjlg-soloio made their first contribution in #2271
• @tziyon31 made their first contribution in #2203
• @anthonytwh made their first contribution in #2175
• @jon-waggoner made their first contribution in #2319
• @uncycler made their first contribution in #2321
• @sanskar-singh-2403 made their first contribution in #2323
• @tomsen02 made their first contribution in #2338
• @buravc made their first contribution in #2507

Full Changelog: v0.9.10...v0.10.0