chore(release/v1-candidate): release 1.39.1

[adk-bot]

🤖 I have created a release beep boop

1.39.1 (2026-08-27)

Bug Fixes

• a2a: Port event action allowlist, agent card description source and resume flattening to v1 (#6801) (1f898a6)
• artifacts: Port app-scoped file artifact storage and layout-derived payload paths to v1 (#6795) (0ae2bff)
• artifacts: Port artifact reference scoping and path-segment validation to v1 (#6794) (efc5bb8)
• cli: check the Host header on every local API server request (v1) (#6789) (15bf230)
• cli: Port deploy ignore-file handling to v1 (#6793) (8467bf0)
• close the residual gaps from the v1 backport review (#6890) (218061e)
• integrations: send api registry credentials only to google api endpoints (v1) (#6889) (1e9e117)
• mcp: Port config stdio opt-in and reserved tool name checks to v1 (#6796) (28b32b4)
• models: Port Gemini context cache fingerprint scoping to v1 (#6804) (f2f8456)
• plugins: sanitize BigQuery analytics rows and build GCS paths per call (v1) (#6808) (80e56de)
• Port A2A agent card RPC target origin validation to v1 (#6800) (ccb4812)
• Port agent loader and file path resolution fixes to v1 (#6788) (8bc927f)
• Port agent-config code-reference and config_path validation to v1 (#6790) (15ae713)
• Port branch-scoped auth responses and OAuth2 nonce forwarding to v1 (#6803) (5817d30)
• Port code executor container and pod isolation defaults to v1 (#6807) (1b4da44)
• Port credential and inline-data field exclusions in logs, reprs and spans to v1 (#6797) (7c2075c)
• Port eval identifier validation and persona template rendering to v1 (#6806) (0a4a5c6)
• Port migration unpickle allowlist and database URL redaction to v1 (#6791) (6deda28)
• Port session id validation, thread id scoping and Vertex RAG cleanup fixes to v1 (#6809) (3fec8c5)
• Port skill resource path and skill name validation fixes to v1 (#6805) (1353e8d)
• Port URL validation, client timeout and credential scoping fixes to v1 (#6802) (7b6547f)
• Route thread-pool and live-mode tool dispatch through run_async (v1) (#6799) (48c56c3)
• Scope custom eval metrics per registry and resolve their function path from the eval config (v1) (#6792) (9886410)
• sessions: accept a full session resource name again on v1 (#6888) (ef4f1e0)
• Validate user message parts and agent transfer targets (v1) (#6798) (d830355)

---

This PR was generated with Release Please. See documentation.