andre/crewAI
1
0
Fork 0
mirror of https://github.com/crewAIInc/crewAI.git synced 2026-07-29 02:29:31 +00:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

fix: bump transformers to 5.5.0 to resolve CVE-2026-1839

Browse Source 
Bumps docling pin from ~=2.75.0 to ~=2.84.0 (allows huggingface-hub>=1)
and adds a transformers>=5.4.0 override to force resolution past 4.57.6.
This commit is contained in:
Greyson LaLonde
2026-04-08 18:59:51 +08:00
committed by GitHub
parent 0450d06a65
commit f4c0667d34
3 changed files with 21 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pyproject.toml
View File

@@ -166,12 +166,14 @@ exclude-newer = "3 days"
# onnxruntime 1.24+ dropped Python 3.10 wheels; cap it so qdrant[fastembed] resolves on 3.10.
# fastembed 0.7.x and docling 2.63 cap pillow<12; the removed APIs don't affect them.
# langchain-core <1.2.11 has SSRF via image_url token counting (CVE-2026-26013).
# transformers 4.57.6 has CVE-2026-1839; force 5.4+ (docling 2.84 allows huggingface-hub>=1).
override-dependencies = [
"rich>=13.7.1",
"onnxruntime<1.24; python_version < '3.11'",
"pillow>=12.1.1",
"langchain-core>=1.2.11,<2",
"urllib3>=2.6.3",
"transformers>=5.4.0; python_version >= '3.10'",
]
[tool.uv.workspace]