Update dependencies with security fixes (#6580)

* Pillow 12.1.1 → 12.3.0 (CVE-2026-55798, CVE-2026-54059, CVE-2026-54060,
  CVE-2026-55379, CVE-2026-55380, CVE-2026-59197, CVE-2026-59203)
* mcp 1.26.0 → 1.28.1 (CVE-2026-59950)
* couchbase 4.3.5 → 4.6.0

lib/crewai-files/pyproject.toml

@@ -8,7 +8,7 @@ authors = [
 ]
 requires-python = ">=3.10, <3.14"
 dependencies = [
-    "Pillow~=12.1.1",
+    "Pillow~=12.3.0",
     "pypdf~=6.13.3",
     "python-magic>=0.4.27",
     "aiocache~=0.12.3",

lib/crewai-tools/pyproject.toml

@@ -97,10 +97,10 @@ databricks-sdk = [
     "databricks-sdk>=0.46.0",
 ]
 couchbase = [
-    "couchbase>=4.3.5",
+    "couchbase>=4.6.0",
 ]
 mcp = [
-    "mcp>=1.6.0",
+    "mcp>=1.28.1,<2",
     "mcpadapt>=0.1.9",
 ]
 stagehand = [

lib/crewai/pyproject.toml

@@ -40,7 +40,7 @@ dependencies = [
     "portalocker~=2.7.0",
     "pydantic-settings>=2.10.1,<3",
     "httpx~=0.28.1",
-    "mcp~=1.26.0",
+    "mcp~=1.28.1",
     "aiosqlite~=0.21.0",
     "pyyaml~=6.0",
     "aiofiles~=24.1.0",

lib/crewai/tests/agents/test_crew_agent_parser.py

@@ -30,6 +30,14 @@ def test_valid_action_parsing_with_json_tool_input():
     assert result.tool_input == expected_tool_input
 
 
+def test_valid_action_parsing_preserves_markdown_like_plain_text():
+    text = "Thought: Let's search\nAction: search\nAction Input: ** plain text"
+    result = parser.parse(text)
+    assert isinstance(result, AgentAction)
+    assert result.tool == "search"
+    assert result.tool_input == "** plain text"
+
+
 def test_valid_action_parsing_with_quotes():
     text = 'Thought: Let\'s find the temperature\nAction: search\nAction Input: "temperature in SF"'
     result = parser.parse(text)