v0.10.0-rc4

What's Changed

Bug Fixes

• fix: ensure API key passthrough works for OpenAI embedding models by @onematchfox in #2494
• fix(adk): validate ask_user questions by @erauner12 in #2486
• Backport fix(golang-adk): resolve user identity from A2A call context to 0.10.x by @buravc in #2507
• fix(a2a): serve exact task reads from the persistent store by @erauner12 in #2484

Other Changes

• Backport #2423 CVE fixes to release/v0.10.x by @inFocus7 in #2487
• Honor LOG_LEVEL in bundled agents and expose agent env config in helm by @iplay88keys in #2502
• Backport #2539 (remove bundled doc2vec) to release/v0.10.x by @inFocus7 in #2547
• Bump Google ADK to address Starlette CVEs by @iplay88keys in #2558
• bump go to v1.26.7 + x/mod v0.40.0 by @inFocus7 in #2557

New Contributors

• @buravc made their first contribution in #2507

Full Changelog: v0.10.0-rc3...v0.10.0-rc4