[devYRPauli]

Related issue

Fixes #8289

Summary

_parse_redis_url now forwards two parts of REDIS_URL that it dropped before:

• The user name goes to connection_pool_kwargs, decoded with urllib.parse.unquote. aiocache 0.12.3 rejects a top-level username key with a TypeError, so the redis connection pool must get it.
• A rediss:// URL sets ssl to True, so aiocache uses SSLConnection.

A password-only URL such as redis://:pw@host has an empty user name, and it adds no connection_pool_kwargs. A redis:// URL adds no ssl key. Both results now match redis-py from_url, which crewai_core/lock_store.py uses for the same REDIS_URL.

Verification

• Tests added or updated for the changed behavior

• Relevant tests and quality checks pass locally

• New class TestParseRedisUrl in lib/crewai/tests/a2a/utils/test_task.py, 3 tests:

  • test_username_and_tls_reach_the_redis_pool builds the cache through aiocache CacheHandler, the path caches.get("default") uses. It checks that the pool sends the user name and uses SSLConnection.
  • test_decodes_percent_encoded_username checks that ag%40ent becomes ag@ent.
  • test_password_only_url_sends_no_username checks the full config for redis://:pw@cache.internal:6379/0.

• On main the first 2 tests fail. I removed each part of the fix on its own: without TLS, without unquote, and without the empty user name check. Each removal makes its test fail.

• The script in the issue prints None False on main and agent True with this change. redis-py prints agent True. Versions: redis 8.0.0, aiocache 0.12.3.

• pytest lib/crewai/tests/a2a on Python 3.12 with the a2a extra: 101 passed on main, 104 passed with this change.

• ruff check, ruff format --check and mypy on task.py pass.

Additional context

I did not connect to a real Redis server with ACL users or TLS. The tests stop at the redis-py connection pool.

PR #8206 changes the password line in the same function, and both PRs add a TestParseRedisUrl class. The PR that merges second needs a rebase. Open PR #5700 replaces this parser with parse_cache_url, which also forwards the user name and TLS.

I used Claude Code CLI with Opus 5.5. I cannot set the llm-generated label, so please add it.

---

Note

Low Risk
Narrows to Redis cache URL parsing for A2A cancel/task caching; no auth or data-model changes, with new unit tests for TLS and ACL URL shapes.

Overview
_parse_redis_url in the A2A task cache setup now honors more of REDIS_URL: non-empty usernames are passed through connection_pool_kwargs (percent-decoded with unquote) because aiocache cannot take a top-level username, and rediss:// URLs set ssl: True so the Redis client uses TLS.

Password-only URLs like redis://:pw@host still omit username pool kwargs, matching redis-py from_url behavior used elsewhere for the same env var.

Adds TestParseRedisUrl with three cases covering TLS + ACL user on the connection pool, encoded usernames, and password-only URLs.

^{Reviewed by Cursor Bugbot for commit cb96f5f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[strix-security]

Strix Security Review

Warning

This pull request has 45 commits after the last Strix review (cb96f5f). Strix has not reviewed these changes.
Automatic review on push is off for this repository. To review the latest changes, tag @strix-security in a comment, or turn on re-review on push.

No security issues found.

Review summary

The change only propagates two additional components of the operator-supplied REDIS_URL into the aiocache configuration: an ACL user name (moved into connection_pool_kwargs with percent-decoding) and ssl=True for rediss:// schemes. Review confirmed the values derive solely from server-side environment configuration, the user name reaches redis-py as a discrete AUTH argument rather than interpolated protocol text, and the TLS path uses the same certificate-verification and hostname-checking defaults as the equivalent redis-py from_url usage elsewhere in the codebase, so no verification is weakened. Password-only and plaintext URLs are unaffected. No security issues were identified in the changed code.

_{Updated for cb96f5f.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}