[Bug]: In-memory push store keeps the caller object so later mutations rewrite stored webhooks

Open Beginner friendly
#1,215 2 comments 0 reactions 1 assignee View on GitHub

@rohityan is already working on this.

Since Aug 28, 2026.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
75/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Domain
backend, databases

Research direction

Look at the InMemoryPushNotificationConfigStore class, specifically the set_info method. Compare with DatabasePushNotificationConfigStore which uses CopyFrom, and InMemoryTaskStore which uses CopyingTaskStoreAdapter. The fix is to deep copy the caller proto before storing it. Write a test similar to the repro code to verify the stored copy remains unchanged after mutation.

Written by the indexing model from the issue text.

Description

component: server status:awaiting response status:stale
What happened?

InMemoryPushNotificationConfigStore.set_info appends the caller proto and get_info / get_info_for_dispatch return those same objects.

After create/get, changing url/token/id on the request or response proto silently changes the stored webhook. The next send_notification POSTs to the mutated URL.

DatabasePushNotificationConfigStore already CopyFroms. InMemoryTaskStore wraps CopyingTaskStoreAdapter for the same reason. The JS SDK had this class of bug and cloned on save.

Repro

cfg = TaskPushNotificationConfig(url="http://a.example/cb")
await store.set_info("t1", cfg, ctx)
cfg.url = "http://evil.example/cb"
got = await store.get_info("t1", ctx)

Observed: got[0].url == "http://evil.example/cb"
Expected: stored copy still "http://a.example/cb"

Relevant log output

n/a.

Code of Conduct
  • I agree to follow this project's Code of Conduct
Dominant language
Python
Stars
2.2k
Forks
496
Avg merge
1d 23h
Merged PRs (30d)
16

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from a2aproject/a2a-python

All issues in a2aproject/a2a-python

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.