andre/crewAI
1
0
Fork 0
mirror of https://github.com/crewAIInc/crewAI.git synced 2026-08-10 08:21:54 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

fix: bump aiohttp to >=3.14.2 and cryptography to >=50.0.0 to fix pip-audit vulns

Browse Source 
Co-authored-by: theCyberTech <84775494+theCyberTech@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-08-04 01:29:40 +00:00
committed by GitHub
parent 034658e46c
commit 2ded33f027
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
pyproject.toml
View File

@@ -182,6 +182,10 @@ exclude-newer-package = { pypdf = "2026-06-24T00:00:00Z", msgpack = "2026-06-20T
# langchain-text-splitters <1.1.2 has GHSA-fv5p-p927-qmxr (SSRF bypass in split_text_from_url).
# transformers 4.57.6 has CVE-2026-1839; force 5.4+ (docling 2.84 allows huggingface-hub>=1).
# cryptography 46.0.6 has CVE-2026-39892; force 46.0.7+.
# cryptography <50.0.0 has GHSA-m2h6-j472-rp4c (wildcard DNS name acceptance bypass),
# GHSA-g6cj-pr64-35w5 (Bleichenbacher oracle in PKCS#7 EnvelopedData decryption),
# GHSA-jwv3-5hgf-82ww (exponential path-building via duplicate self-signed intermediates);
# all fixed in 50.0.0; force 50.0.0+.
# pypdf <6.10.2 has GHSA-4pxv-j86v-mhcw, GHSA-7gw9-cf7v-778f, GHSA-x284-j5p8-9c5p.
# pypdf <6.14.2 has GHSA-jm82-fx9c-mx94 and GHSA-5qjq-93h5-hrgp/GHSA-55h5-xmcq-c37v/GHSA-g867-7843-wf8q/GHSA-5xf7-4p34-54qr; force 6.14.2+.
# uv <0.11.15 has GHSA-4gg8-gxpx-9rph (and earlier GHSA-pjjw-68hj-v9mw); force 0.11.15+.
@@ -200,6 +204,8 @@ exclude-newer-package = { pypdf = "2026-06-24T00:00:00Z", msgpack = "2026-06-20T
# authlib <1.6.12 has GHSA-jj8c-mmj3-mmgv (CSRF bypass in cache-based state storage) and PYSEC-2026-188.
# pip 26.1.1 has PYSEC-2026-196; force 26.1.2+.
# aiohttp <=3.13.x has GHSA-jg22-mg44-37j8, GHSA-hg6j-4rv6-33pg; fixed in 3.14.0; force 3.14.0+.
# aiohttp <3.14.2 has GHSA-mq44-7p77-q5h7 (WebSocket client accepts deflate frames without negotiation),
# GHSA-mfx4-hv73-q22v, GHSA-cq5v-8q36-5273; all fixed in 3.14.2; force 3.14.2+.
# docling-core 2.74.0 has GHSA-j5xp-7m2f-49jv, GHSA-jmmv-h3mp-59v8; force 2.74.1+.
# pip <26.1.1 has GHSA-58qw-9mgm-455v (archive handling); OSV considers 26.1.1 unaffected.
# paramiko <5.0.0 has GHSA-r374-rxx8-8654 (SHA-1 in rsakey.py); OSV considers 5.0.0 unaffected. Transitive via composio-core.
@@ -223,7 +229,7 @@ override-dependencies = [
"langchain-text-splitters>=1.1.2,<2",
"urllib3>=2.7.0",
"transformers>=5.4.0; python_version >= '3.10'",
"cryptography>=46.0.7",
"cryptography>=50.0.0",
"pypdf>=6.14.2,<7",
"uv>=0.11.15,<1",
"python-multipart>=0.0.27,<1",
@@ -232,7 +238,7 @@ override-dependencies = [
"langsmith>=0.8.18,<1",
"authlib>=1.6.12",
"pip>=26.1.2",
"aiohttp>=3.14.0",
"aiohttp>=3.14.2",
# [chunking] carried here because override-dependencies replace the whole
# requirement; without it the docling extra's chunking deps get stripped.
"docling-core[chunking]>=2.74.1",