Introduce Bandit to CI checks.

Fixes: #251 🦕

# Description

Replace the following:

```py
params={
    'message': {
        'messageId': 'msg1',
        'role': 'user',
        'parts': [],
    }
}
```

by this:

```py
params=MessageSendParams(
    message=Message(
        messageId='msg1',
        role=Role.user,
        parts=[],
    )
)
```

Fixes #250 🦕

```
Release-As: 0.2.11
```

* Removes push_notifier interface from the SDK and introduces
push_notification_config_store and push_notification_sender for
supporting push notifications. Following is an example for the changes
required with new version:

Previously:
```py
from a2a.server.tasks import InMemoryPushNotifier
...
...
httpx_client = httpx.AsyncClient()
request_handler = DefaultRequestHandler(
    agent_executor=CurrencyAgentExecutor(),
    task_store=InMemoryTaskStore(),
    push_notifier=InMemoryPushNotifier(httpx_client),
)
...
...
```

Now:
```py
from a2a.server.tasks import InMemoryPushNotificationConfigStore, BasePushNotificationSender
...
...
httpx_client = httpx.AsyncClient()
push_notification_config_store = InMemoryPushNotificationConfigStore()
push_notification_sender = BasePushNotificationSender(httpx_client,
                        config_store=push_notification_config_store)
        
request_handler = DefaultRequestHandler(
    agent_executor=CurrencyAgentExecutor(),
    task_store=InMemoryTaskStore(),
    push_config_store=push_notification_config_store,
    push_sender=push_notification_sender
)
...
...
```
* Adds support for more than one push_notification_config per task.
* Adds support for List and Delete push notification configurations

---------

Co-authored-by: Holt Skinner <[email protected]>

`pip show a2a-sdk` was including the whole license file.

Changed to just the license name

```
Release-As: 0.2.11
```

Add support for database backed TaskStore

### Installation

```bash
uv add a2a-sdk[postgresql] #postgres driver
or 
uv add a2a-sdk[mysql] #mysql driver
or
uv add a2a-sdk[sqlite] #sqlite driver
or
uv add a2a-sdk[sql]. #install all three sql drivers
```

### Usage

```py
from a2a.server.tasks import DatabaseTaskStore
from sqlalchemy.ext.asyncio import (
        create_async_engine,
    )
...
...
# Postgres - "postgresql+asyncpg://postgres:postgres@localhost:5432/a2a_test"
# Sqlite - "sqlite+aiosqlite:///file::memory:?cache=shared"
# Mysql - "mysql+aiomysql://admin:saysoyeah@localhost:3306/testDB"
engine = create_async_engine(
    "postgresql+asyncpg://postgres:postgres@localhost:5432/a2a_test", echo=False
)
request_handler = DefaultRequestHandler(
    agent_executor=CurrencyAgentExecutor(),
    task_store=DatabaseTaskStore(engine=engine),
    push_notifier=InMemoryPushNotifier(httpx_client),
)
```

---------

Co-authored-by: Zac <[email protected]>
Co-authored-by: MEUNIER Laurent <[email protected]>
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: Zac <[email protected]>
Co-authored-by: Holt Skinner <[email protected]>
Co-authored-by: Holt Skinner <[email protected]>

Prevents usage of "Magic Strings"

# Description

## Summary

This PR improves the current implementation of `A2AFastAPIApplication`
class that enables serving A2A endpoints using a FastAPI application.
(#104)

### Implementation Details

Refactors the `add_routes_to_app` method in
`src/a2a/server/apps/jsonrpc/fastapi_app.py` to simplify route
definitions by:

* Directly associating handler methods with FastAPI route decorators
* Removing unnecessary nested async function definitions by directly
passing handler methods (`self._handle_requests`,
`self._handle_get_agent_card`, and
`self._handle_get_authenticated_extended_agent_card`) to the FastAPI
decorators (`app.post` and `app.get`)
* Enabling method descriptions to appear in Swagger documentation,
improving developer experience

These changes make the code more readable, maintainable, and better
integrated with FastAPI's documentation features.


### Screenshots

#### Before

![image](https://github.com/user-attachments/assets/6b9487fe-010f-492d-98cf-9f28d0ad194e)

![image](https://github.com/user-attachments/assets/7fd5edd9-5849-427d-aa74-6cb392ad370b)

#### After

![image](https://github.com/user-attachments/assets/00e7265b-8f5f-4841-a76a-8445be8a3ee6)

![image](https://github.com/user-attachments/assets/6ffd81e7-646c-42fb-ab96-13807cbc00bd)

---

Continues #104 🦕

# Description

This PR adds a lock to the `TaskUpdater` to prevent race conditions when
updating tasks that are in a terminal state (e.g., completed, failed).
This ensures updates are handled atomically, making task state
management more robust.

### **File Changes**

* `src/a2a/server/tasks/task_updater.py`
* `tests/server/tasks/test_task_updater.py`

### **Benefits**

* **Robustness**: Prevents race conditions during concurrent task
updates.
* **Stability**: Ensures reliable task execution in production.
* **Test Coverage**: Adds new tests for concurrent scenarios.

Thank you for opening a Pull Request!
Before submitting your PR, there are a few things you can do to make
sure it goes smoothly:

- [x] Follow the [`CONTRIBUTING`
Guide](https://github.com/a2aproject/a2a-python/blob/main/CONTRIBUTING.md).
- [x] Make your Pull Request title in the
<https://www.conventionalcommits.org/> specification.
- Important Prefixes for
[release-please](https://github.com/googleapis/release-please):
- `fix:` which represents bug fixes, and correlates to a
[SemVer](https://semver.org/) patch.
- `feat:` represents a new feature, and correlates to a SemVer minor.
- `feat!:`, or `fix!:`, `refactor!:`, etc., which represent a breaking
change (indicated by the `!`) and will result in a SemVer major.
- [x] Ensure the tests and linter pass (Run `nox -s format` from the
repository root to format)
- [x] Appropriate docs were updated (if necessary)

Fixes #278 🦕

---------

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: pstephengoogle <[email protected]>

🤖 I have created a release *beep* *boop*
---


##
[0.2.11](v0.2.10...v0.2.11)
(2025-07-07)


### ⚠ BREAKING CHANGES

* Removes `push_notifier` interface from the SDK and introduces
`push_notification_config_store` and `push_notification_sender` for
supporting push notifications.

### Features

* Add constants for Well-Known URIs
([#271](#271))
([1c8e12e](1c8e12e))
* Adds support for List and Delete push notification configurations.
([f1b576e](f1b576e))
* Adds support for more than one `push_notification_config` per task.
([f1b576e](f1b576e))
* **server:** Add lock to TaskUpdater to prevent race conditions
([#279](#279))
([1022093](1022093))
* Support for database backend Task Store
([#259](#259))
([7c46e70](7c46e70))


### Code Refactoring

* Removes `push_notifier` interface from the SDK and introduces
`push_notification_config_store` and `push_notification_sender` for
supporting push notifications.
([f1b576e](f1b576e))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>