Industry story
Google ADK Python v1.38.0: Security and Live-Agent Bug Fixes
agent-framework reliability security tool-use
A maintenance release with no new features isn't usually worth a second look, but the security fix in Google's ADK Python v1.38.0 is. Removing shell execution from ReadFileTool's ranged-read path closes a command injection vector that was hiding inside what looked like a routine file operation. The live multi-agent handoff bug fix matters too: if function-response ordering could silently break agent transfers, any multi-agent system running in production was less reliable than its builders thought.
Full analysis
Google released v1.38.0 of its Agent Development Kit (ADK) for Python, a framework for building agentic systems. The release is primarily a bug-fix update with no new features listed. Key fixes include a security patch that removes shell execution from the ReadFileTool's ranged-read path (preventing potential command injection via file-read operations), ports tool-confirmation security re-validation fixes from a prior branch, and resolves an ordering bug in live multi-agent handoffs where transfer to a target agent could fail depending on function-response order. A dependency exclusion for a broken NLTK version that corrupted virtual environments is also included.
Comments