Repository navigation
[Bug]: A2A-Version validation ignores minor versions and the query parameter #1204
Description
What happened?
The specification says:
“Agents MUST process requests using the semantics of the requested
A2A-Version(matchingMajor.Minor).”
and
“Clients MAY provide the
A2A-Versionas a request parameter instead of a header.”
The implementation seems to miss both points.
- The code compares only
major:
return actual_v.major == expected_v.major- The query parameter is ignored.
actual_version = headers.get(
constants.VERSION_HEADER
) or headers.get(constants.VERSION_HEADER.lower())
if not actual_version:
return constants.PROTOCOL_VERSION_0_3
return str(actual_version)A similar issue existed: #856 but it was not fully fixed.
Code of Conduct
- I agree to follow this project's Code of Conduct
Activity
rohityan commentedon Aug 28, 2026
Hi @lkk7 , Thank you for reporting this. This is a bug and diverges from the formal A2A protocol specification.
The spec requires agents to match on both
MajorandMinorversions. The current check ina2a.utils.version_validator.validate_versiononly evaluatesactual_v.major == expected_v.major, which incorrectly permits minor version mismatches .Query Parameter Fallback : The spec allows
A2A-Versionto be passed as a request query parameter. Currently,_get_actual_versiononly inspects HTTP request headers before falling back toDEFAULT_A2A_VERSION, ignoring URL query parameters.If you would like to contribute open a PR with the fix and test coverage for both cases, we would gladly review it. The fix should update
validate_versionto enforce (actual_v.major == expected_v.major and actual_v.minor == expected_v.minor).Update request extraction middleware to check headers first, then URL query parameters, before applying the fallback default.
github-actions commentedon Sep 11, 2026
Marking this issue as stale since it has been open for 14 days with no activity. This issue will be closed if no further activity occurs.
github-actions commentedon Sep 24, 2026
This issue was closed because it has been inactive for 27 days. Please post a new issue if you need further assistance. Thanks!
A2A-Versionsent as a request parameter is ignored (spec §3.6.1), so a v1.0 request is treated as 0.3 #1344 as a duplicate of this issue