From 9358ba3c55ff3f7ad934821c0ffc85f73449abfe Mon Sep 17 00:00:00 2001 From: Matt Aitchison Date: Fri, 20 Mar 2026 11:24:14 -0500 Subject: [PATCH] fix: bump pypdf, tinytag, and langchain-core for security fixes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - pypdf ~=6.7.5 → ~=6.9.1 (CVE-2026-33123, CVE-2026-31826) - tinytag ~=1.10.0 → ~=2.2.1 (CVE-2026-32889) - langchain-core >=0.3.80,<1 → >=1.2.11,<2 (CVE-2026-26013) --- lib/crewai-files/pyproject.toml | 4 ++-- pyproject.toml | 4 ++-- uv.lock | 24 ++++++++++++------------ 3 files changed, 16 insertions(+), 16 deletions(-) diff --git a/lib/crewai-files/pyproject.toml b/lib/crewai-files/pyproject.toml index 3ca357622..2e8ef4863 100644 --- a/lib/crewai-files/pyproject.toml +++ b/lib/crewai-files/pyproject.toml @@ -9,11 +9,11 @@ authors = [ requires-python = ">=3.10, <3.14" dependencies = [ "Pillow~=12.1.1", - "pypdf~=6.7.5", + "pypdf~=6.9.1", "python-magic>=0.4.27", "aiocache~=0.12.3", "aiofiles~=24.1.0", - "tinytag~=1.10.0", + "tinytag~=2.2.1", "av~=13.0.0", ] diff --git a/pyproject.toml b/pyproject.toml index 335f51dae..853fa1ab9 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -147,12 +147,12 @@ python_functions = "test_*" # composio-core pins rich<14 but textual requires rich>=14. # onnxruntime 1.24+ dropped Python 3.10 wheels; cap it so qdrant[fastembed] resolves on 3.10. # fastembed 0.7.x and docling 2.63 cap pillow<12; the removed APIs don't affect them. -# langchain-core 0.3.76 has a template-injection vuln (GHSA); force >=0.3.80. +# langchain-core <1.2.11 has SSRF via image_url token counting (CVE-2026-26013). override-dependencies = [ "rich>=13.7.1", "onnxruntime<1.24; python_version < '3.11'", "pillow>=12.1.1", - "langchain-core>=0.3.80,<1", + "langchain-core>=1.2.11,<2", "urllib3>=2.6.3", ] diff --git a/uv.lock b/uv.lock index 0c1a0e168..b9d63dd3d 100644 --- a/uv.lock +++ b/uv.lock @@ -20,7 +20,7 @@ members = [ "crewai-tools", ] overrides = [ - { name = "langchain-core", specifier = ">=0.3.80,<1" }, + { name = "langchain-core", specifier = ">=1.2.11,<2" }, { name = "onnxruntime", marker = "python_full_version < '3.11'", specifier = "<1.24" }, { name = "pillow", specifier = ">=12.1.1" }, { name = "rich", specifier = ">=13.7.1" }, @@ -1275,9 +1275,9 @@ requires-dist = [ { name = "aiofiles", specifier = "~=24.1.0" }, { name = "av", specifier = "~=13.0.0" }, { name = "pillow", specifier = "~=12.1.1" }, - { name = "pypdf", specifier = "~=6.7.5" }, + { name = "pypdf", specifier = "~=6.9.1" }, { name = "python-magic", specifier = ">=0.4.27" }, - { name = "tinytag", specifier = "~=1.10.0" }, + { name = "tinytag", specifier = "~=2.2.1" }, ] [[package]] @@ -3295,7 +3295,7 @@ wheels = [ [[package]] name = "langchain-core" -version = "0.3.83" +version = "1.2.20" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "jsonpatch" }, @@ -3307,9 +3307,9 @@ dependencies = [ { name = "typing-extensions" }, { name = "uuid-utils" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/21/a4/24f2d787bfcf56e5990924cacefe6f6e7971a3629f97c8162fc7a2a3d851/langchain_core-0.3.83.tar.gz", hash = "sha256:a0a4c7b6ea1c446d3b432116f405dc2afa1fe7891c44140d3d5acca221909415", size = 597965, upload-time = "2026-01-13T01:19:23.854Z" } +sdist = { url = "https://files.pythonhosted.org/packages/db/41/6552a419fe549a79601e5a698d1d5ee2ca7fe93bb87fd624a16a8c1bdee3/langchain_core-1.2.20.tar.gz", hash = "sha256:c7ac8b976039b5832abb989fef058b88c270594ba331efc79e835df046e7dc44", size = 838330, upload-time = "2026-03-18T17:34:45.522Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/5a/db/d71b80d3bd6193812485acea4001cdf86cf95a44bbf942f7a240120ff762/langchain_core-0.3.83-py3-none-any.whl", hash = "sha256:8c92506f8b53fc1958b1c07447f58c5783eb8833dd3cb6dc75607c80891ab1ae", size = 458890, upload-time = "2026-01-13T01:19:21.748Z" }, + { url = "https://files.pythonhosted.org/packages/d9/06/08c88ddd4d6766de4e6c43111ae8f3025df383d2a4379cb938fc571b49d4/langchain_core-1.2.20-py3-none-any.whl", hash = "sha256:b65ff678f3c3dc1f1b4d03a3af5ee3b8d51f9be5181d74eb53c6c11cd9dd5e68", size = 504215, upload-time = "2026-03-18T17:34:44.087Z" }, ] [[package]] @@ -6174,14 +6174,14 @@ wheels = [ [[package]] name = "pypdf" -version = "6.7.5" +version = "6.9.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "typing-extensions", marker = "python_full_version < '3.11'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/f6/52/37cc0aa9e9d1bf7729a737a0d83f8b3f851c8eb137373d9f71eafb0a3405/pypdf-6.7.5.tar.gz", hash = "sha256:40bb2e2e872078655f12b9b89e2f900888bb505e88a82150b64f9f34fa25651d", size = 5304278, upload-time = "2026-03-02T09:05:21.464Z" } +sdist = { url = "https://files.pythonhosted.org/packages/f9/fb/dc2e8cb006e80b0020ed20d8649106fe4274e82d8e756ad3e24ade19c0df/pypdf-6.9.1.tar.gz", hash = "sha256:ae052407d33d34de0c86c5c729be6d51010bf36e03035a8f23ab449bca52377d", size = 5311551, upload-time = "2026-03-17T10:46:07.876Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/05/89/336673efd0a88956562658aba4f0bbef7cb92a6fbcbcaf94926dbc82b408/pypdf-6.7.5-py3-none-any.whl", hash = "sha256:07ba7f1d6e6d9aa2a17f5452e320a84718d4ce863367f7ede2fd72280349ab13", size = 331421, upload-time = "2026-03-02T09:05:19.722Z" }, + { url = "https://files.pythonhosted.org/packages/f9/f4/75543fa802b86e72f87e9395440fe1a89a6d149887e3e55745715c3352ac/pypdf-6.9.1-py3-none-any.whl", hash = "sha256:f35a6a022348fae47e092a908339a8f3dc993510c026bb39a96718fc7185e89f", size = 333661, upload-time = "2026-03-17T10:46:06.286Z" }, ] [[package]] @@ -7626,11 +7626,11 @@ wheels = [ [[package]] name = "tinytag" -version = "1.10.1" +version = "2.2.1" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/59/b5/ff5e5f9ca9677be7272260f67c87f7e8e885babc7ce94604e837dcfd8d76/tinytag-1.10.1.tar.gz", hash = "sha256:122a63b836f85094aacca43fc807aaee3290be3de17d134f5f4a08b509ae268f", size = 40906, upload-time = "2023-10-26T19:30:38.791Z" } +sdist = { url = "https://files.pythonhosted.org/packages/96/59/8a8cb2331e2602b53e4dc06960f57d1387a2b18e7efd24e5f9cb60ea4925/tinytag-2.2.1.tar.gz", hash = "sha256:e6d06610ebe7cd66fd07be2d3b9495914ab32654a5e47657bb8cd44c2484523c", size = 38214, upload-time = "2026-03-15T18:48:01.11Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/2f/04/ef783cbc4aa3a5ed75969e300b3e3929daf3d1b52fe80e950c63e0d66d95/tinytag-1.10.1-py3-none-any.whl", hash = "sha256:e437654d04c966fbbbdbf807af61eb9759f1d80e4173a7d26202506b37cfdaf0", size = 37900, upload-time = "2023-10-26T19:30:36.724Z" }, + { url = "https://files.pythonhosted.org/packages/ce/34/d50e338631baaf65ec5396e70085e5de0b52b24b28db1ffbc1c6e82190dc/tinytag-2.2.1-py3-none-any.whl", hash = "sha256:ed8b1e6d25367937e3321e054f4974f9abfde1a3e0a538824c87da377130c2b6", size = 32927, upload-time = "2026-03-15T18:47:59.613Z" }, ] [[package]]