andre/crewAI
1
0
Fork 0
mirror of https://github.com/crewAIInc/crewAI.git synced 2026-08-13 01:38:41 +00:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

fix(deps): bump torch to 2.13.0 for GHSA-rrmf-rvhw-rf47 (#6957)

Browse Source 
Force torch>=2.13.0 via override-dependencies so the transitive
docling/unstructured stack picks up the CVE-2025-3000 fix, and drop the
now-unnecessary pip-audit ignore. chromadb's CVE-2026-45829 remains
ignored: the upstream fix is merged but not released on PyPI.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rip&Tear <theCyberTech@users.noreply.github.com>
This commit is contained in:
Rip&Tear
2026-08-11 23:46:39 +08:00
committed by GitHub
parent 094b94e8d0
commit 505d52323f
4 changed files with 111 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
.github/workflows/vulnerability-scan.yml vendored
View File

@@ -86,8 +86,11 @@ jobs:
--skip-editable
--format json
--output pip-audit-report.json
--ignore-vuln GHSA-rrmf-rvhw-rf47 # torch 2.12.0 (CVE-2025-3000): local-only memory corruption in torch.jit.script; no fix available.
--ignore-vuln GHSA-f4j7-r4q5-qw2c # chromadb 1.1.1 (CVE-2026-45829): pre-auth RCE in the HTTP server; no fix available.
# chromadb <=1.5.9 (CVE-2026-45829 / GHSA-f4j7-r4q5-qw2c): pre-auth RCE in
# the Python HTTP server. Fix merged upstream in chroma-core/chroma#7237
# but no PyPI release beyond 1.5.9 yet. CrewAI only uses PersistentClient
# (embedded), not the HTTP server.
--ignore-vuln GHSA-f4j7-r4q5-qw2c
)
uv run pip-audit "${pip_audit_args[@]}"
continue-on-error: true