chore: bump json-repair to 0.60.1, drop fixed vuln ignores in scan (#6612)

* chore: bump json-repair to 0.60.1 and un-ignore fixed vulns in scan

- json-repair 0.25.3 -> 0.60.1 (fixes GHSA-xf7x-x43h-rpqh)
- pyOpenSSL already at 26.2.0 in lock (covers CVE-2026-27448, CVE-2026-27459)
- remove the corresponding --ignore-vuln flags from vulnerability-scan.yml

* fix: adapt _safe_repair_json to json-repair 0.60 semantics

json-repair >= 0.60 returns an empty string for plain-text input and
wraps brace-enclosed junk in a single-element list instead of the old
""/{} sentinel values. Treat both as unrepairable so the original
tool input is preserved.

* chore: fix CI - bump gitpython/pyasn1, drop stale type ignores

- gitpython 3.1.50 -> 3.1.52 (GHSA-2f96-g7mh-g2hx, GHSA-v396-v7q4-x2qj,
  GHSA-956x-8gvw-wg5v; fixed in 3.1.51)
- pyasn1 0.6.3 -> 0.6.4 (GHSA-8ppf-4f7h-5ppj, GHSA-hm4w-wwcw-mr6r)
- json-repair 0.60 ships type stubs; remove now-unused
  type: ignore[import-untyped] comments flagged by mypy

lib/crewai-tools/pyproject.toml

@@ -107,7 +107,7 @@ stagehand = [
     "stagehand>=0.4.1",
 ]
 github = [
-    "gitpython>=3.1.50,<4",
+    "gitpython>=3.1.51,<4",
     "PyGithub==1.59.1",
 ]
 rag = [

lib/crewai/pyproject.toml

@@ -32,7 +32,7 @@ dependencies = [
     "click>=8.1.7,<9",
     "appdirs~=1.4.4",
     "jsonref~=1.1.0",
-    "json-repair~=0.25.2",
+    "json-repair~=0.60.1",
     "cel-python>=0.5.0,<0.6",
     "tomli-w~=1.1.0",
     "tomli~=2.0.2",

lib/crewai/src/crewai/agents/parser.py

@@ -7,7 +7,7 @@ AgentAction or AgentFinish objects.
 
 from dataclasses import dataclass
 
-from json_repair import repair_json  # type: ignore[import-untyped]
+from json_repair import repair_json
 from pydantic import BaseModel
 
 from crewai.agents.constants import (
@@ -173,7 +173,12 @@ def _safe_repair_json(tool_input: str) -> str:
     tool_input = tool_input.replace('"""', '"')
 
     result = repair_json(tool_input)
-    if result in UNABLE_TO_REPAIR_JSON_RESULTS:
+    if not result or result in UNABLE_TO_REPAIR_JSON_RESULTS:
+        return tool_input
+
+    # json-repair >= 0.60 wraps non-JSON input in a single-element list;
+    # treat that as unrepairable and return the original.
+    if result.startswith("[") and not tool_input.lstrip().startswith("["):
         return tool_input
 
     return str(result)

lib/crewai/src/crewai/tools/tool_usage.py

@@ -11,7 +11,7 @@ from typing import TYPE_CHECKING, Any, Literal
 
 from crewai_core.printer import PRINTER
 import json5
-from json_repair import repair_json  # type: ignore[import-untyped]
+from json_repair import repair_json
 
 from crewai.events.event_bus import crewai_event_bus
 from crewai.events.types.tool_usage_events import (