andre/crewAI
1
0
Fork 0
mirror of https://github.com/crewAIInc/crewAI.git synced 2026-07-24 00:05:08 +00:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

chore: bump json-repair to 0.60.1, drop fixed vuln ignores in scan (#6612)
Some checks are pending
Build uv cache / build-cache (3.10) (push) Waiting to run
Details
Build uv cache / build-cache (3.11) (push) Waiting to run
Details
Build uv cache / build-cache (3.12) (push) Waiting to run
Details
Build uv cache / build-cache (3.13) (push) Waiting to run
Details
CodeQL Advanced / Analyze (actions) (push) Waiting to run
Details
CodeQL Advanced / Analyze (python) (push) Waiting to run
Details
Vulnerability Scan / pip-audit (push) Waiting to run
Details

Browse Source 
* chore: bump json-repair to 0.60.1 and un-ignore fixed vulns in scan

- json-repair 0.25.3 -> 0.60.1 (fixes GHSA-xf7x-x43h-rpqh)
- pyOpenSSL already at 26.2.0 in lock (covers CVE-2026-27448, CVE-2026-27459)
- remove the corresponding --ignore-vuln flags from vulnerability-scan.yml

* fix: adapt _safe_repair_json to json-repair 0.60 semantics

json-repair >= 0.60 returns an empty string for plain-text input and
wraps brace-enclosed junk in a single-element list instead of the old
""/{} sentinel values. Treat both as unrepairable so the original
tool input is preserved.

* chore: fix CI - bump gitpython/pyasn1, drop stale type ignores

- gitpython 3.1.50 -> 3.1.52 (GHSA-2f96-g7mh-g2hx, GHSA-v396-v7q4-x2qj,
  GHSA-956x-8gvw-wg5v; fixed in 3.1.51)
- pyasn1 0.6.3 -> 0.6.4 (GHSA-8ppf-4f7h-5ppj, GHSA-hm4w-wwcw-mr6r)
- json-repair 0.60 ships type stubs; remove now-unused
  type: ignore[import-untyped] comments flagged by mypy
This commit is contained in:
Rip&Tear
2026-07-23 07:47:33 +08:00
committed by GitHub
parent 3bb87532da
commit b14d36bfe4
7 changed files with 74 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
.github/workflows/vulnerability-scan.yml vendored
View File

@@ -53,12 +53,9 @@ jobs:
--skip-editable
--format json
--output pip-audit-report.json
--ignore-vuln CVE-2026-27448 # pyOpenSSL: fixes require 26.0.0, blocked by snowflake-connector-python 3.x.
--ignore-vuln CVE-2026-27459 # pyOpenSSL: same constraint as CVE-2026-27448.
--ignore-vuln PYSEC-2026-597 # nltk 3.9.4 (CVE-2026-12243): no fix available, transitive through crewai-tools[xml] -> unstructured.
--ignore-vuln GHSA-rrmf-rvhw-rf47 # torch 2.12.0 (CVE-2025-3000): local-only memory corruption in torch.jit.script; no fix available.
--ignore-vuln GHSA-f4j7-r4q5-qw2c # chromadb 1.1.1 (CVE-2026-45829): pre-auth RCE in the HTTP server; no fix available.
--ignore-vuln GHSA-xf7x-x43h-rpqh # json-repair 0.25.3: the affected schema module is absent, and CrewAI does not pass schemas.
)
uv run pip-audit "${pip_audit_args[@]}"
continue-on-error: true