--- title: A2A Java SDK 1.2.0.Final released | daily.dev description: The A2A Java SDK 1.2.0.Final has shipped with hardened authorization, a new task stream lifecycle hook SPI, deep immutability for spec records, versioned... canonical: https://daily.dev/posts/a2a-java-sdk-1-2-0-final-released-z0xygbtwk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A2A Java SDK 1.2.0.Final released | daily.dev og:description: The A2A Java SDK 1.2.0.Final has shipped with hardened authorization, a new task stream lifecycle hook SPI, deep immutability for spec records, versioned... og:url: https://daily.dev/posts/a2a-java-sdk-1-2-0-final-released-z0xygbtwk og:image: https://api.daily.dev/og/posts/Z0xYgBTwK.png og:image:alt: A2A Java SDK 1.2.0.Final released og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A2A Java SDK 1.2.0.Final released **[Quarkus](https://daily.dev/sources/quarkus)** · 6 min read · 3 upvotes · 0 comments ## Summary The A2A Java SDK 1.2.0.Final has shipped with hardened authorization, a new task stream lifecycle hook SPI, deep immutability for spec records, versioned documentation, and aggregated Javadoc. The release includes three breaking changes: RequestHandler.validateRequestedTask() is renamed to authorizeTaskAccess() with new parameters, several packages were renamed to resolve split-package issues, and TaskState.UNRECOGNIZED is renamed to TASK_STATE_UNSPECIFIED with its isFinal property changed from true to false. Several bug fixes address task store reconciliation, JSON-RPC serialization, streaming history length handling, and a Vert.x HTTP client race condition. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What breaking changes are in A2A Java SDK 1.2.0.Final and how do I migrate from 1.1.0.Final? Three breaking changes exist: RequestHandler.validateRequestedTask() is renamed to authorizeTaskAccess() with added ServerCallContext and TaskOperation parameters; several packages were renamed to fix split-package issues (e.g. utility classes move from org.a2aproject.sdk.util to org.a2aproject.sdk.spec.util); and DefaultRequestHandler.create() is replaced by a builder pattern. Update the BOM version to 1.2.0.Final and adjust imports accordingly. _Track breaking SDK changes like these on daily.dev before they surprise you mid-upgrade._ ### Why was TaskState.UNRECOGNIZED renamed to TASK_STATE_UNSPECIFIED in A2A Java SDK 1.2.0.Final and what changed in its behavior? TaskState.UNRECOGNIZED was renamed to TaskState.TASK_STATE_UNSPECIFIED to match the A2A specification, and its isFinal property changed from true to false. Code that relied on UNRECOGNIZED being a terminal state needs review, since event queues will no longer auto-close and clients will not stop polling when a task is in this state. _Developers auditing task-state logic can follow spec-alignment fixes like this via daily.dev._ ### How does A2A Java SDK 1.2.0.Final prevent unauthorized callers from probing task existence? The SDK now enforces read authorization on all referenced task lookups reached via referenceTaskIds, closing a gap where an unauthorized caller could probe for task existence through sendStreamingMessage or subscribeToTask. The fix spans all transports (JSON-RPC, gRPC, REST) and decorators, and InMemoryTaskStore now applies fail-closed authorization matching JpaDatabaseTaskStore behavior. _Teams hardening authorization in agent protocols can keep up with fixes like this on daily.dev._ ## Similar posts on daily.dev - [A2A Java SDK 1.0.0.Beta1 Released](https://daily.dev/posts/a2a-java-sdk-1-0-0-beta1-released-ov4xttrfx) · Quarkus · 1 upvotes · 0 comments - [A2A Java SDK 1.0.0.CR1 Released](https://daily.dev/posts/a2a-java-sdk-1-0-0-cr1-released-oztkicigx) · Quarkus · 0 upvotes · 0 comments - [A2A Java SDK 1.0.0.Alpha2 Released](https://daily.dev/posts/a2a-java-sdk-1-0-0-alpha2-released-mdsxo75mr) · Quarkus · 0 upvotes · 0 comments - [Java News Roundup: A2A Java SDK 1.0, Jakarta EE 12, JNoSQL, GraalVM, Micrometer, OpenXava, Gradle](https://daily.dev/posts/java-news-roundup-a2a-java-sdk-1-0-jakarta-ee-12-jnosql-graalvm-micrometer-openxava-gradle-ynfgv9c3p) · InfoQ · 3 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#authorization](https://daily.dev/tags/authorization), [#quarkus](https://daily.dev/tags/quarkus) [View this post on daily.dev](https://daily.dev/posts/a2a-java-sdk-1-2-0-final-released-z0xygbtwk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A2A Java SDK 1.2.0.Final released","url":"https://daily.dev/posts/a2a-java-sdk-1-2-0-final-released-z0xygbtwk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a2a-java-sdk-1-2-0-final-released-z0xygbtwk"},"datePublished":"2026-08-18T13:43:14.768Z","dateModified":"2026-09-14T08:06:51.890Z","description":"The A2A Java SDK 1.2.0.Final has shipped with hardened authorization, a new task stream lifecycle hook SPI, deep immutability for spec records, versioned...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e7ab97eced21a845aaca4e155a5e5171?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e7ab97eced21a845aaca4e155a5e5171?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Quarkus","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Quarkus","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8adf82d719bb4a9492f44a28a27fd396","url":"https://daily.dev/sources/quarkus"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a2a-java-sdk-1-2-0-final-released-z0xygbtwk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"java,authorization,quarkus","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Quarkus","item":"https://daily.dev/sources/quarkus"},{"@type":"ListItem","position":3,"name":"A2A Java SDK 1.2.0.Final released"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a2a-java-sdk-1-2-0-final-released-z0xygbtwk#faq","mainEntity":[{"@type":"Question","name":"What breaking changes are in A2A Java SDK 1.2.0.Final and how do I migrate from 1.1.0.Final?","acceptedAnswer":{"@type":"Answer","text":"Three breaking changes exist: RequestHandler.validateRequestedTask() is renamed to authorizeTaskAccess() with added ServerCallContext and TaskOperation parameters; several packages were renamed to fix split-package issues (e.g. utility classes move from org.a2aproject.sdk.util to org.a2aproject.sdk.spec.util); and DefaultRequestHandler.create() is replaced by a builder pattern. Update the BOM version to 1.2.0.Final and adjust imports accordingly. Track breaking SDK changes like these on daily.dev before they surprise you mid-upgrade."}},{"@type":"Question","name":"Why was TaskState.UNRECOGNIZED renamed to TASK_STATE_UNSPECIFIED in A2A Java SDK 1.2.0.Final and what changed in its behavior?","acceptedAnswer":{"@type":"Answer","text":"TaskState.UNRECOGNIZED was renamed to TaskState.TASK_STATE_UNSPECIFIED to match the A2A specification, and its isFinal property changed from true to false. Code that relied on UNRECOGNIZED being a terminal state needs review, since event queues will no longer auto-close and clients will not stop polling when a task is in this state. Developers auditing task-state logic can follow spec-alignment fixes like this via daily.dev."}},{"@type":"Question","name":"How does A2A Java SDK 1.2.0.Final prevent unauthorized callers from probing task existence?","acceptedAnswer":{"@type":"Answer","text":"The SDK now enforces read authorization on all referenced task lookups reached via referenceTaskIds, closing a gap where an unauthorized caller could probe for task existence through sendStreamingMessage or subscribeToTask. The fix spans all transports (JSON-RPC, gRPC, REST) and decorators, and InMemoryTaskStore now applies fail-closed authorization matching JpaDatabaseTaskStore behavior. Teams hardening authorization in agent protocols can keep up with fixes like this on daily.dev."}}]} ```