andre/crewAI
1
0
Fork 0
mirror of https://github.com/crewAIInc/crewAI.git synced 2026-07-25 00:35:09 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

fix(deps): raise click and pillow floors past new PYSEC advisories

Browse Source 
click 8.1.8 has PYSEC-2026-2132 (fixed 8.3.3) and pillow 12.2.0 has
PYSEC-2026-2253..2257 (fixed 12.3.0), failing the Vulnerability Scan on
every PR. Raise the override floors and relock (click 8.4.2,
pillow 12.3.0). With json-repair also fixed in this PR, pip-audit
reports zero findings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Joao Moura
2026-07-13 23:38:54 -07:00
parent aaccbe5d62
commit 2fc4bc8a80
2 changed files with 55 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
pyproject.toml
View File

@@ -199,13 +199,15 @@ exclude-newer-package = { pypdf = "2026-06-18T00:00:00Z", msgpack = "2026-06-20T
# starlette <1.3.1 has PYSEC-2026-161, GHSA-jp82-jpqv-5vv3, and GHSA-82w8-qh3p-5jfq. Transitive via fastapi.
# msgpack <1.2.1 has GHSA-6v7p-g79w-8964; transitive via pip-audit[filecache].
# pydantic-settings <2.14.2 has GHSA-4xgf-cpjx-pc3j.
# click <8.3.3 has PYSEC-2026-2132.
# pillow <12.3.0 has PYSEC-2026-2253..2257 (floor raised from 12.1.1).
# Keep OpenAI on the SDK range required by CrewAI when transitive dependencies
# loosen or pin their own lower versions.
override-dependencies = [
"openai>=2.30.0,<3",
"rich>=13.7.1",
"onnxruntime<1.24; python_version < '3.11'",
"pillow>=12.1.1",
"pillow>=12.3.0",
"langchain-core>=1.3.3,<2",
"langchain-text-splitters>=1.1.2,<2",
"urllib3>=2.7.0",
@@ -226,6 +228,7 @@ override-dependencies = [
"starlette>=1.3.1",
"msgpack>=1.2.1",
"pydantic-settings>=2.14.2",
"click>=8.3.3,<9",
]
[tool.uv.workspace]