fix: enforce upper bound on history_length

[ez-lbz]

What changed

1. Enforce an upper bound on historyLength

Problem: validate_history_length() in src/a2a/utils/task.py only rejected negative values. A client could send historyLength=999999999 and the server would materialize the full task history for every matching task (in tasks/get, tasks/list, and message/send), allowing an unbounded-history read via an absurdly large parameter.

Fix (src/a2a/utils/task.py):

• Added MAX_HISTORY_LENGTH = 1000 with a comment explaining the cap is a pragmatic bound aligned with the other A2A SDKs' "large value ≈ return everything available" semantics.
• validate_history_length() now raises InvalidParamsError when history_length > MAX_HISTORY_LENGTH (in addition to the existing negative-value check). The validation already runs at the entry of on_get_task, on_list_tasks, and on_message_send (V1) and their V2 counterparts, so the cap applies to all JSON-RPC / REST / gRPC paths without further changes.

Testing

• ./.venv/Scripts/python -m pytest tests/utils/test_task.py tests/server/request_handlers/test_default_request_handler.py tests/server/request_handlers/test_default_request_handler_v2.py -q → 150 passed (includes 8 new regression tests: validate_history_length unit tests plus handler-level history_length over-limit rejection for on_get_task and on_message_send).
• ./.venv/Scripts/python -m ruff check on modified files: clean.
• Behavior change: requests with historyLength above 1000 now return InvalidParamsError instead of returning full history. Requests at or below the cap are unaffected (existing tests all use values ≤ 10).

[github-actions]

🧪 Code Coverage (vs main)

⬇️ Download Full Report

	Base	PR	Delta
src/a2a/server/events/event_queue_v2.py	91.79%	91.28%	🔴 -0.51%
src/a2a/utils/task.py	95.16%	95.59%	🟢 +0.43%
src/a2a/utils/telemetry.py	91.47%	90.70%	🔴 -0.78%
Total	93.00%	92.98%	🔴 -0.02%

Generated by coverage-comment.yml