andre/crewAI
1
0
Fork 0
mirror of https://github.com/crewAIInc/crewAI.git synced 2026-09-24 03:41:36 +00:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

fix(deps): raise gitpython floor to 3.1.60

Browse Source 
Keep consumers off 3.1.59 so they pick up the follow-on security hardening; lock stays on 3.1.61.
This commit is contained in:
ViditOstwal
2026-09-03 21:07:28 +05:30
parent 489060f91e
commit 76f3b9ff12
3 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
lib/crewai-tools/pyproject.toml
View File

@@ -109,8 +109,9 @@ stagehand = [
github = [
# <3.1.59 has PYSEC-2026-3785/GHSA-7833-fr7j-v32q,
# PYSEC-2026-3786/GHSA-284h-m62q-gf8w, PYSEC-2026-3787/GHSA-8mcc-hrx5-hvxc,
# and PYSEC-2026-3788/GHSA-5xxx-qhh7-9287; force 3.1.59+.
"gitpython>=3.1.59,<4",
# and PYSEC-2026-3788/GHSA-5xxx-qhh7-9287. 3.1.60 hardens config escapes,
# diff/actor parsing, and filesystem diffs; force 3.1.60+.
"gitpython>=3.1.60,<4",
"PyGithub==1.59.1",
]
rag = [

9
pyproject.toml
View File

@@ -207,9 +207,10 @@ exclude-newer-package = { msgpack = "2026-06-20T00:00:00Z", pydantic-settings =
# gitpython <3.1.59 has PYSEC-2026-3785/GHSA-7833-fr7j-v32q (.gitmodules [include] file disclosure),
# PYSEC-2026-3786/GHSA-284h-m62q-gf8w (multi-line git-config re-serialization RCE),
# PYSEC-2026-3787/GHSA-8mcc-hrx5-hvxc (clone --separate-git-dir omitted from unsafe options),
# and PYSEC-2026-3788/GHSA-5xxx-qhh7-9287 (Repo.blame --contents/-S arbitrary file read);
# force 3.1.59+. 3.1.59 is older than the global 3-day cutoff, so no
# exclude-newer-package override is needed.
# and PYSEC-2026-3788/GHSA-5xxx-qhh7-9287 (Repo.blame --contents/-S arbitrary file read).
# gitpython 3.1.60 hardens config escape semantics, diff/actor parsing, and
# filesystem diffs; force 3.1.60+. 3.1.60 is older than the global 3-day cutoff,
# so no exclude-newer-package override is needed.
# pyasn1 <0.6.4 has GHSA-8ppf-4f7h-5ppj and GHSA-hm4w-wwcw-mr6r; force 0.6.4+.
# urllib3 <2.7.0 has GHSA-qccp-gfcp-xxvc (ProxyManager cross-origin redirect leaks Authorization/Cookie) and GHSA-mf9v-mfxr-j63j (streaming decompression-bomb bypass); force 2.7.0+.
# langsmith <0.8.18 has GHSA-3644-q5cj-c5c7 (public prompt manifest deserialization, SSRF/secret disclosure)
@@ -262,7 +263,7 @@ override-dependencies = [
"pypdf>=6.16.1,<7",
"uv>=0.11.15,<1",
"python-multipart>=0.0.27,<1",
"gitpython>=3.1.59,<4",
"gitpython>=3.1.60,<4",
"pyasn1>=0.6.4",
"langsmith>=0.8.18,<1",
"authlib>=1.6.12",

4
uv.lock generated
View File

@@ -35,7 +35,7 @@ overrides = [
{ name = "authlib", specifier = ">=1.6.12" },
{ name = "cryptography", specifier = ">=50.0.0" },
{ name = "docling-core", extras = ["chunking"], specifier = ">=2.74.1" },
{ name = "gitpython", specifier = ">=3.1.59,<4" },
{ name = "gitpython", specifier = ">=3.1.60,<4" },
{ name = "h2", specifier = ">=4.4.1" },
{ name = "langchain-core", specifier = ">=1.3.3,<2" },
{ name = "langchain-text-splitters", specifier = ">=1.1.2,<2" },
@@ -1761,7 +1761,7 @@ requires-dist = [
{ name = "e2b-code-interpreter", marker = "extra == 'e2b'", specifier = "~=2.6.0" },
{ name = "exa-py", marker = "extra == 'exa-py'", specifier = ">=1.8.7" },
{ name = "firecrawl-py", marker = "extra == 'firecrawl-py'", specifier = ">=1.8.0" },
{ name = "gitpython", marker = "extra == 'github'", specifier = ">=3.1.59,<4" },
{ name = "gitpython", marker = "extra == 'github'", specifier = ">=3.1.60,<4" },
{ name = "hyperbrowser", marker = "extra == 'hyperbrowser'", specifier = ">=0.18.0" },
{ name = "langchain-apify", marker = "extra == 'apify'", specifier = ">=0.1.2,<1.0.0" },
{ name = "linkup-sdk", marker = "extra == 'linkup-sdk'", specifier = ">=0.2.2" },