Framework Watch: ADK Java Changes the Timeout Exception That Retry Policies Match

This week's changes include one migration you have to make, plus several fixes where a setting or check existed but did not cover every case.

ADK Java: update retry policies that name TimeoutException

A commit on October 30, 2026 makes a timed-out workflow node fail with NodeTimeoutException. The commit message says the node's "failure, error code, and retry name change from TimeoutException to NodeTimeoutException; update checks and retry policies that use TimeoutException." A retry rule written for the old name will not match the new exception, so a timeout it used to retry could end the run instead. Same-day commits add NodeExecutionException as the new exception's base class, let RetryConfig match exceptions by class, and let a timeout cancel a node that is still starting. These are on the main branch. The latest tag, v1.13.0, is from October 21.

ADK Python: a config key that was ignored

A commit merged October 31 adds eval-case parallelism to EvalConfig, an adk eval --parallelism flag and an AgentEvaluator argument. The commit notes that "a parallelism key already present in an eval config file was ignored before and now takes effect." Teams that set it believing it worked were running at the default of 4.

Claude Code 2.1.316

Version 2.1.316, released October 31, includes several boundary fixes:

--restricted sessions could upload "files from outside the working directories when a Read allow rule covered them."
The Claude apps gateway was "not checking every model a request names" against its allow and deny lists. A blocked model now gets a 400 naming the field.
PowerShell hooks did not block on exit code 2 when the command began with a type cast, param, using or an attribute.
Fast mode for Opus 4.8 is deprecated and will be removed on November 30. After that, such requests "return an error and do not fall back".

Smaller fixes

PyRIT's CredentialLeakScorer missed legacy Slack bot tokens, which have one numeric segment. PR #3659, merged October 30, adds that form using the bounds of the gitleaks rule. In Codex, PR #58456 keeps tool calls marked incomplete in failed inference traces, because they previously appeared "only in the terminal response payload" and were lost. The OpenAI Agents SDK, PR #5457, now reports the request ID, response ID, event count and last event type when a stream ends without response.completed. The PR calls this "a diagnostic improvement, not a fix for the underlying stream interruption."

What remains uncertain. The ADK Java change is untagged, so its release timing is unknown. The Claude Code notes do not say whether the restricted-session upload was exploited or how often the gateway gap mattered.

Analysis: Search your code for TimeoutException in ADK Java retry and error handling before you upgrade. Then add a test that a timed-out node is retried. For the help-desk agents at Belgavi's Book Store, Hansini could also add a test that every model name in a request is checked against the allow list, and a test that a leaked token in a reply is flagged. Both gaps fixed this week would have passed a check that tried only the common case.

Sources and evidence

ADK Java (October 30, untagged) now fails timed-out workflow nodes with NodeTimeoutException, so retry policies that match TimeoutException must be updated; ADK Python made a previously ignored eval parallelism key take effect; Claude Code 2.1.316 fixed restricted sessions uploading files outside the working directories and a gateway that did not check every requested model; PyRIT now detects legacy Slack bot tokens, and Codex keeps incomplete tool calls in failed traces.