--- title: "A2A Java SDK 1.2.0.Final released" url: https://daily.dev/posts/a2a-java-sdk-1-2-0-final-released-z0xygbtwk source_url: https://quarkus.io/blog/a2a-java-sdk-1-2-0-final-released type: article source: "Quarkus" published: 2026-08-18T13:43:14.768Z updated: 2026-08-18T14:47:51.676Z tags: ["java", "authorization", "quarkus"] reading_time: 6 upvotes: 3 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A2A Java SDK 1.2.0.Final released **[Quarkus](https://daily.dev/sources/quarkus)** · 6 min read · 3 upvotes · 0 comments ## Summary The A2A Java SDK 1.2.0.Final has shipped with hardened authorization, a new task stream lifecycle hook SPI, deep immutability for spec records, versioned documentation, and aggregated Javadoc. The release includes three breaking changes: RequestHandler.validateRequestedTask() is renamed to authorizeTaskAccess() with new parameters, several packages were renamed to resolve split-package issues, and TaskState.UNRECOGNIZED is renamed to TASK_STATE_UNSPECIFIED with its isFinal property changed from true to false. Several bug fixes address task store reconciliation, JSON-RPC serialization, streaming history length handling, and a Vert.x HTTP client race condition. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What breaking changes are in A2A Java SDK 1.2.0.Final? Three breaking changes ship in this release: RequestHandler.validateRequestedTask() is renamed to authorizeTaskAccess() and takes additional ServerCallContext and TaskOperation parameters; several packages are renamed so no Java package spans multiple Maven modules, moving classes like CollectionCopies and Utils to org.a2aproject.sdk.spec.util; and TaskState.UNRECOGNIZED is renamed to TASK_STATE_UNSPECIFIED with isFinal() changed from true to false. _Track breaking SDK changes like these on daily.dev before they slow down your next upgrade._ ### How do I migrate DefaultRequestHandler.create() to the new builder pattern in A2A Java SDK 1.2.0? DefaultRequestHandler.create() is replaced by DefaultRequestHandler.builder(), which chains agentExecutor, taskStore, queueManager, pushConfigStore, mainEventBusProcessor, executor, and eventConsumerExecutor, plus two new optional settings: authorizationProvider() and populateReferredTasks(true). SimpleRequestContextBuilder also now requires a third authorizationProvider parameter, which can be passed as null if authorization is unused. _Compare old and new API signatures side by side on daily.dev when planning a migration._ ### Why does A2A Java SDK now enforce read authorization on referenced tasks? Previously, when a request referenced existing tasks via referenceTaskIds, the SDK populated those tasks into the RequestContext without checking read authorization, letting an unauthorized caller probe for task existence through sendStreamingMessage or subscribeToTask. Version 1.2.0.Final closes this gap across all transports (JSON-RPC, gRPC, REST) and makes InMemoryTaskStore fail-closed when authorization is configured but no call context is available. _Follow security-hardening fixes like this on daily.dev to keep authorization logic airtight._ ## Similar posts on daily.dev - [A2A Java SDK 1.0.0.Beta1 Released](https://daily.dev/posts/a2a-java-sdk-1-0-0-beta1-released-ov4xttrfx) · Quarkus · 1 upvotes · 0 comments - [A2A Java SDK 1.0.0.CR1 Released](https://daily.dev/posts/a2a-java-sdk-1-0-0-cr1-released-oztkicigx) · Quarkus · 0 upvotes · 0 comments - [A2A Java SDK 1.0.0.Final Released](https://daily.dev/posts/a2a-java-sdk-1-0-0-final-released-xwapjtptk) · Quarkus · 2 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#authorization](https://daily.dev/tags/authorization), [#quarkus](https://daily.dev/tags/quarkus) [View this post on daily.dev](https://daily.dev/posts/a2a-java-sdk-1-2-0-final-released-z0xygbtwk)