[Bug]: `A2A-Version` validation ignores minor versions and the query parameter

[lkk7]

What happened?

The specification says:

“Agents MUST process requests using the semantics of the requested A2A-Version (matching Major.Minor).”

and

“Clients MAY provide the A2A-Version as a request parameter instead of a header.”

The implementation seems to miss both points.

1. The code compares only major:

return actual_v.major == expected_v.major

2. The query parameter is ignored.

            actual_version = headers.get(
                constants.VERSION_HEADER
            ) or headers.get(constants.VERSION_HEADER.lower())

            if not actual_version:
                return constants.PROTOCOL_VERSION_0_3

            return str(actual_version)

A similar issue existed: #856 but it was not fully fixed.

Code of Conduct

• I agree to follow this project's Code of Conduct

[rohityan]

Hi @lkk7 , Thank you for reporting this. This is a bug and diverges from the formal A2A protocol specification.
The spec requires agents to match on both Major and Minor versions. The current check in a2a.utils.version_validator.validate_version only evaluates actual_v.major == expected_v.major, which incorrectly permits minor version mismatches .
Query Parameter Fallback : The spec allows A2A-Version to be passed as a request query parameter. Currently, _get_actual_version only inspects HTTP request headers before falling back to DEFAULT_A2A_VERSION, ignoring URL query parameters.
If you would like to contribute open a PR with the fix and test coverage for both cases, we would gladly review it. The fix should update validate_version to enforce (actual_v.major == expected_v.major and actual_v.minor == expected_v.minor).
Update request extraction middleware to check headers first, then URL query parameters, before applying the fallback default.