fix: pin vcr record_mode=none + bump gitpython/langchain-core/urllib3 vulns

- test_streaming_properties_from_docs: add record_mode="none" so VCR never
  falls through to the real OpenAI API; cassette already exists.
- gitpython >=3.1.50 (GHSA-mv93-w799-cj2w)
- langchain-core >=1.3.1 (GHSA-pjwx-r37v-7724; resolves to 1.3.3)
- urllib3 >=2.7.0 (GHSA-qccp-gfcp-xxvc, GHSA-mf9v-mfxr-j63j; 2.6.4 was never released)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
alex-clawd
2026-05-13 13:37:38 -07:00
parent 92b24334d5
commit 744a07cc0f
3 changed files with 33 additions and 18 deletions

View File

@@ -89,7 +89,7 @@ class TestStreamingCrewIntegration:
result = streaming.result
assert result is not None
@pytest.mark.vcr()
@pytest.mark.vcr(record_mode="none")
def test_streaming_properties_from_docs(
self, researcher: Agent, simple_task: Task
) -> None: