andre/crewAI
1
0
Fork 0
mirror of https://github.com/crewAIInc/crewAI.git synced 2026-08-10 16:32:28 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

fix(deps): bump gitpython to 3.1.58 in crewai-tools[github]

Browse Source 
gitpython 3.1.57 has GHSA-9rj7-rf2p-w77r, GHSA-4gmw-gg2m-w46p,
GHSA-hh9p-6wh2-4mfc, GHSA-wvpp-8hx9-p66j and GHSA-jm78-9fvv-mhgr
(further unguarded git option forwarding / arbitrary file read via
--pathspec-from-file). All are fixed in 3.1.58, which the root
override-dependencies already require; align the crewai-tools github
extra with it and regenerate the lockfile.
This commit is contained in:
Rip&Tear
2026-08-09 22:30:48 +08:00
parent f7ba8e3521
commit fc1cc1dd78
2 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
lib/crewai-tools/pyproject.toml
View File

@@ -107,9 +107,12 @@ stagehand = [
"stagehand>=0.4.1",
]
github = [
# <3.1.57 has GHSA-p538-c434-8v24 (arbitrary file truncation) and
# GHSA-3f7w-8rr8-f37f (unguarded git option forwarding).
"gitpython>=3.1.57,<4",
# <3.1.58 has GHSA-p538-c434-8v24 (arbitrary file truncation),
# GHSA-3f7w-8rr8-f37f (unguarded git option forwarding),
# GHSA-9rj7-rf2p-w77r, GHSA-4gmw-gg2m-w46p, GHSA-hh9p-6wh2-4mfc,
# GHSA-wvpp-8hx9-p66j and GHSA-jm78-9fvv-mhgr (further unguarded git
# option forwarding / arbitrary file read); force 3.1.58+.
"gitpython>=3.1.58,<4",
"PyGithub==1.59.1",
]
rag = [