andre/crewAI
1
0
Fork 0
mirror of https://github.com/crewAIInc/crewAI.git synced 2026-09-22 19:06:25 +00:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

ci: ignore unpatched accelerate GHSA-4j2p-28q2-5m79 (#7347)

Browse Source 
pip-audit fails on accelerate 1.13.0; no PyPI release past 1.14.0 ships the path-traversal fix yet.
This commit is contained in:
Vidit Ostwal
2026-09-09 12:50:55 +05:30
committed by GitHub
parent a68b5e903c
commit 5c47c4a559
3 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.github/workflows/vulnerability-scan.yml vendored
View File

@@ -107,6 +107,16 @@ jobs:
# TODO: drop this ignore when bumping nltk past 3.10.3 to a patched
# release; keep the ignore list in sync with .pre-commit-config.yaml.
--ignore-vuln GHSA-8mgp-746c-j5xp
# accelerate <=1.14.0: GHSA-4j2p-28q2-5m79 (CVE-2026-69112): path
# traversal / FIFO DoS via unsanitized sharded-checkpoint weight_map
# entries. No patched PyPI release yet (fix is huggingface/accelerate
# #4138, not shipped). Transitive via docling extras
# (docling-ibm-models / docling-slim[standard]); CrewAI does not load
# untrusted checkpoints through those APIs.
# TODO: drop this ignore when bumping accelerate past 1.14.0 to a
# patched release; keep the ignore list in sync with
# .pre-commit-config.yaml.
--ignore-vuln GHSA-4j2p-28q2-5m79
)
uv run pip-audit "${pip_audit_args[@]}"
continue-on-error: true