Summary
ADK Go 1.8 binds the web launcher to loopback by default and rejects cross-origin browser requests unless explicitly allowed. It also adds request-size limits, WebSocket protections, session-transcription persistence and fixes for Agent Engine deployment.
Why it matters
The defaults reduce exposure from accidentally public agent endpoints and make production session state more durable.
Related coverage
- Mastra adds default agent error recovery and durable execution fixes
- Next.js 16.4 canary advances bundle-analysis tooling
- Frappe Press patches authentication disclosure and agent-job handling