andre/crewAI
1
0
Fork 0
mirror of https://github.com/crewAIInc/crewAI.git synced 2026-07-08 08:25:09 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

fix: resolve pip-audit failures (onnx 1.22.0, nltk PYSEC-2026-597) (#6472)

Browse Source 
* fix: upgrade onnx to 1.22.0 and ignore unfixed nltk advisory in pip-audit

* fix: sync pip-audit ignore list in pre-commit config with the workflow
This commit is contained in:
Renato Nitta
2026-07-07 14:09:19 -03:00
committed by GitHub
parent 799ab0f548
commit 792b58f46b
3 changed files with 24 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/vulnerability-scan.yml vendored
View File

@@ -73,11 +73,13 @@ jobs:
--ignore-vuln PYSEC-2025-216 \
--ignore-vuln PYSEC-2025-217 \
--ignore-vuln PYSEC-2025-218 \
--ignore-vuln PYSEC-2026-597 \
--ignore-vuln GHSA-f4j7-r4q5-qw2c
# Ignored CVEs:
# PYSEC-2024-277 - joblib 1.5.3: disputed; NumpyArrayWrapper only used with trusted caches
# PYSEC-2026-89 - markdown 3.10.2: DoS via malformed HTML; fix 3.8.1 — already past, advisory range is stale
# PYSEC-2026-97 - nltk 3.9.4: arbitrary file read in filestring(); no fix available
# PYSEC-2026-597 - nltk 3.9.4 (CVE-2026-12243): path traversal via _UNSAFE_NO_PROTOCOL_RE bypass (incomplete fix of nltk#3504); 3.9.4 is the latest release, no fix available
# PYSEC-2025-148 - onnx 1.21.0: path traversal in save_external_data; no fix available
# PYSEC-2025-183 - pyjwt 2.12.1: disputed weak-encryption claim; key length is application-chosen
# PYSEC-2025-189..197 - torch 2.11.0: memory-corruption/DoS in functions only reachable via untrusted models; no fix available