Framework Watch: In ADK's Bash Tool, a Limit of Zero Meant No Limit

The changes this week have one thing in common: a setting or a write that looked as if it had worked, but had not.

ADK Python: zero was treated as unset

PR #7984, merged on November 4, 2026 and fixing issue #7983, concerns BashToolPolicy. A limit of 0 for max_memory_bytes, max_file_size_bytes or max_child_processes "used to apply no limit; it is now passed to setrlimit like any other value." The code had tested each limit for truthiness, and in Python 0 is false, so the most restrictive setting silently became no restriction at all. The fix checks for None instead, and "None still means no limit." A new test runs dd with a file size limit of 0 and checks that the command fails and writes nothing.

ADK Python: concurrent sessions lost shared state

A commit on November 5, merged from PR #7942, is titled "fix: stop concurrent writes losing app: and user: state". State with the app: and user: prefixes is shared across sessions, and writers read the stored object, merged their keys and wrote the whole object back, so two sessions writing at once could erase each other's keys. DatabaseSessionService now serialises these writes in process and, when creating a session, locks the existing rows "FOR UPDATE on PostgreSQL and MySQL." RedisSessionService merges them in a watched transaction. In the commit's words, "Concurrent sessions no longer drop each other's app: or user: keys."

ADK Python: A2A leaves experimental

A November 4 commit titled "feat(a2a): graduate the A2A integration from experimental" removes the experimental decorator from RemoteA2aAgent, A2aAgentExecutor, to_a2a, AgentCardBuilder and the A2A converters, so they no longer warn that the implementation may change without notice. The change deletes 44 lines across 15 files and adds none, which makes clear that this is a change of status, not of behaviour. The environment variable that suppressed the warning is no longer needed.

LangGraph 1.2.20: refusing a stale answer

LangGraph 1.2.20, released on November 5, adds a strict resume mode (PR #9574). Previously, a resume that named an interrupt no longer pending was silently ignored: the task ran again up to its interrupt() and paused, and the client had no sign its answer was dropped. With the private configurable key __pregel_strict_resume set, the graph raises UnknownInterruptError before writing anything, with a reason of not_pending, empty_map or ambiguous. It is off by default. A companion change, PR #9589, notes that "Every interrupt() call in one task got the same id, a hash of the task's namespace." Ids now also reflect how many answers the task already has, and the PR warns: "This changes the id of an interrupt raised after its task already got an answer."

ADK Java: tool output now counts toward compaction

A November 4 ADK Java commit, "fix: count events after the last model response toward the compaction threshold", fixes a compactor that read the prompt token count from the latest model response and ignored events added after it, such as tool results. A large tool output could push the real prompt past the threshold without starting compaction. The fix estimates those events at about one token per four characters and ignores a reported count that predates a compaction.

What remains uncertain. The ADK Python and ADK Java changes are on main and not yet in a tagged release; the latest tags are ADK Python 2.13.0 of October 23 and ADK Java 1.14.0 of November 2. The ADK database fix serialises writes within one process, and the commit does not say how fully it protects several server processes sharing one database. We have not run any of these versions.

Analysis: Each bug is cheap to test for. At Belgavi's Book Store, Dinky could add three tests to the help-desk agent's suite: set every sandbox limit to 0 and confirm that a command which writes a file fails; start two sessions for the same customer that each save a different user: preference and confirm both survive; and answer one approval interrupt twice, expecting an error rather than silence. Geetha's team could also add a fourth check after an upgrade: return a very large order history from a tool and confirm that compaction starts.

Sources and evidence

ADK Python PR #7984 (November 4) makes BashToolPolicy limits of 0 apply instead of meaning no limit, and PR #7942 (November 5) stops concurrent sessions overwriting shared app: and user: state; ADK's A2A integration also lost its experimental label. LangGraph 1.2.20 (November 5) adds an opt-in strict resume mode that raises UnknownInterruptError for stale interrupt answers. An ADK Java fix counts tool output toward the compaction threshold. The ADK fixes are not yet in a tagged release.