dependabot[bot]
7d1657feda
chore(deps): bump the patch-minor-updates group across 1 directory with 18 updates
...
Bumps the patch-minor-updates group with 18 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [ruff](https://github.com/astral-sh/ruff ) | `0.15.1` | `0.16.1` |
| [mypy](https://github.com/python/mypy ) | `1.19.1` | `1.20.2` |
| [pre-commit](https://github.com/pre-commit/pre-commit ) | `4.5.1` | `4.6.1` |
| [bandit](https://github.com/PyCQA/bandit ) | `1.9.2` | `1.9.4` |
| [pytest](https://github.com/pytest-dev/pytest ) | `9.0.3` | `9.1.1` |
| [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio ) | `1.3.0` | `1.4.0` |
| [pytest-subprocess](https://github.com/aklajnert/pytest-subprocess ) | `1.5.3` | `1.6.0` |
| [vcrpy](https://github.com/kevin1024/vcrpy ) | `8.2.1` | `8.3.0` |
| [pytest-randomly](https://github.com/pytest-dev/pytest-randomly ) | `4.0.1` | `4.1.0` |
| [types-requests](https://github.com/python/typeshed ) | `2.31.0.20240406` | `2.33.0.20260712` |
| [types-regex](https://github.com/python/typeshed ) | `2026.1.15.20260116` | `2026.7.19.20260720` |
| [boto3-stubs[bedrock-runtime]](https://github.com/youtype/mypy_boto3_builder ) | `1.42.40` | `1.43.62` |
| [types-pymysql](https://github.com/python/typeshed ) | `1.1.0.20250916` | `1.2.0.20260724` |
| [commitizen](https://github.com/commitizen-tools/commitizen ) | `4.16.3` | `4.17.0` |
| [pydantic](https://github.com/pydantic/pydantic ) | `2.12.5` | `2.13.4` |
| [openai](https://github.com/openai/openai-python ) | `2.41.0` | `2.52.0` |
| [pymupdf](https://github.com/pymupdf/pymupdf ) | `1.26.7` | `1.28.0` |
| [tinytag](https://github.com/tinytag/tinytag ) | `2.2.1` | `2.3.0` |
Updates `ruff` from 0.15.1 to 0.16.1
- [Release notes](https://github.com/astral-sh/ruff/releases )
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md )
- [Commits](https://github.com/astral-sh/ruff/compare/0.15.1...0.16.1 )
Updates `mypy` from 1.19.1 to 1.20.2
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md )
- [Commits](https://github.com/python/mypy/compare/v1.19.1...v1.20.2 )
Updates `pre-commit` from 4.5.1 to 4.6.1
- [Release notes](https://github.com/pre-commit/pre-commit/releases )
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md )
- [Commits](https://github.com/pre-commit/pre-commit/compare/v4.5.1...v4.6.1 )
Updates `bandit` from 1.9.2 to 1.9.4
- [Release notes](https://github.com/PyCQA/bandit/releases )
- [Commits](https://github.com/PyCQA/bandit/compare/1.9.2...1.9.4 )
Updates `pytest` from 9.0.3 to 9.1.1
- [Release notes](https://github.com/pytest-dev/pytest/releases )
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pytest-dev/pytest/compare/9.0.3...9.1.1 )
Updates `pytest-asyncio` from 1.3.0 to 1.4.0
- [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases )
- [Commits](https://github.com/pytest-dev/pytest-asyncio/compare/v1.3.0...v1.4.0 )
Updates `pytest-subprocess` from 1.5.3 to 1.6.0
- [Release notes](https://github.com/aklajnert/pytest-subprocess/releases )
- [Changelog](https://github.com/aklajnert/pytest-subprocess/blob/master/HISTORY.rst )
- [Commits](https://github.com/aklajnert/pytest-subprocess/compare/1.5.3...1.6.0 )
Updates `vcrpy` from 8.2.1 to 8.3.0
- [Release notes](https://github.com/kevin1024/vcrpy/releases )
- [Changelog](https://github.com/kevin1024/vcrpy/blob/master/docs/changelog.rst )
- [Commits](https://github.com/kevin1024/vcrpy/compare/v8.2.1...v8.3.0 )
Updates `pytest-randomly` from 4.0.1 to 4.1.0
- [Changelog](https://github.com/pytest-dev/pytest-randomly/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pytest-dev/pytest-randomly/compare/4.0.1...4.1.0 )
Updates `types-requests` from 2.31.0.20240406 to 2.33.0.20260712
- [Commits](https://github.com/python/typeshed/commits )
Updates `types-regex` from 2026.1.15.20260116 to 2026.7.19.20260720
- [Commits](https://github.com/python/typeshed/commits )
Updates `boto3-stubs[bedrock-runtime]` from 1.42.40 to 1.43.62
- [Release notes](https://github.com/youtype/mypy_boto3_builder/releases )
- [Commits](https://github.com/youtype/mypy_boto3_builder/commits )
Updates `types-pymysql` from 1.1.0.20250916 to 1.2.0.20260724
- [Commits](https://github.com/python/typeshed/commits )
Updates `commitizen` from 4.16.3 to 4.17.0
- [Release notes](https://github.com/commitizen-tools/commitizen/releases )
- [Changelog](https://github.com/commitizen-tools/commitizen/blob/master/CHANGELOG.md )
- [Commits](https://github.com/commitizen-tools/commitizen/compare/v4.16.3...v4.17.0 )
Updates `pydantic` from 2.12.5 to 2.13.4
- [Release notes](https://github.com/pydantic/pydantic/releases )
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md )
- [Commits](https://github.com/pydantic/pydantic/compare/v2.12.5...v2.13.4 )
Updates `openai` from 2.41.0 to 2.52.0
- [Release notes](https://github.com/openai/openai-python/releases )
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md )
- [Commits](https://github.com/openai/openai-python/compare/v2.41.0...v2.52.0 )
Updates `pymupdf` from 1.26.7 to 1.28.0
- [Release notes](https://github.com/pymupdf/pymupdf/releases )
- [Changelog](https://github.com/pymupdf/PyMuPDF/blob/main/changes.txt )
- [Commits](https://github.com/pymupdf/pymupdf/compare/1.26.7...1.28.0 )
Updates `tinytag` from 2.2.1 to 2.3.0
- [Release notes](https://github.com/tinytag/tinytag/releases )
- [Commits](https://github.com/tinytag/tinytag/compare/2.2.1...2.3.0 )
---
updated-dependencies:
- dependency-name: bandit
dependency-version: 1.9.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: patch-minor-updates
- dependency-name: boto3-stubs[bedrock-runtime]
dependency-version: 1.43.62
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: commitizen
dependency-version: 4.17.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: mypy
dependency-version: 1.20.2
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: openai
dependency-version: 2.52.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: pre-commit
dependency-version: 4.6.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: pydantic
dependency-version: 2.13.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: pymupdf
dependency-version: 1.28.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: pytest
dependency-version: 9.1.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: pytest-asyncio
dependency-version: 1.4.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: pytest-randomly
dependency-version: 4.1.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: pytest-subprocess
dependency-version: 1.6.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: ruff
dependency-version: 0.16.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: tinytag
dependency-version: 2.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: types-pymysql
dependency-version: 1.2.0.20260724
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: types-regex
dependency-version: 2026.7.19.20260720
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: types-requests
dependency-version: 2.33.0.20260712
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
- dependency-name: vcrpy
dependency-version: 8.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: patch-minor-updates
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-08-06 00:02:48 +00:00
alex-clawd
c06043f7e8
fix: preserve strict tool schema property names ( #6628 )
2026-07-24 09:49:05 -07:00
Vinicius Brasil
4e23bf6d45
Update dependencies with security fixes ( #6580 )
...
CodeQL Advanced / Analyze (actions) (push) Has been cancelled
CodeQL Advanced / Analyze (python) (push) Has been cancelled
Vulnerability Scan / pip-audit (push) Has been cancelled
Build uv cache / build-cache (3.10) (push) Has been cancelled
Build uv cache / build-cache (3.11) (push) Has been cancelled
Build uv cache / build-cache (3.12) (push) Has been cancelled
Build uv cache / build-cache (3.13) (push) Has been cancelled
* Pillow 12.1.1 → 12.3.0 (CVE-2026-55798, CVE-2026-54059, CVE-2026-54060,
CVE-2026-55379, CVE-2026-55380, CVE-2026-59197, CVE-2026-59203)
* mcp 1.26.0 → 1.28.1 (CVE-2026-59950)
* couchbase 4.3.5 → 4.6.0
2026-07-17 09:12:45 -03:00
João Moura
504c5c9b04
JSON crew fixes ( #6217 )
...
* feat: update pyproject.toml to specify wheel targets
Added a new section to the pyproject.toml file to include only specific files in the wheel build, enhancing the packaging process. Updated tests to verify the inclusion of these targets.
* feat: add memory save event handling to activity log
Implemented event handlers for MemorySaveStartedEvent, MemorySaveCompletedEvent, and MemorySaveFailedEvent in the crew_run_tui module. This allows the application to log memory save operations, capturing their status and details in the activity log. Added corresponding tests to verify the correct logging behavior for successful and failed memory saves.
* feat: enhance memory save event handling in activity log
Added functionality to suppress nested memory save events and updated the handling of MemorySaveStartedEvent, MemorySaveCompletedEvent, and MemorySaveFailedEvent to improve logging accuracy. Introduced new tests to verify the correct behavior of memory save events, including scenarios for nested events and completion updates for timed-out entries.
* Fix memory save activity log handling
* Normalize alpha package versions
* Update scaffolded crew dependency
* feat: add button to copy setup instructions for CrewAI coding agents
Introduced a button in the documentation that allows users to easily copy setup instructions for CrewAI coding agents. The instructions include installation steps, environment setup, and best practices for using the CrewAI CLI. This enhancement aims to streamline the onboarding process for new users.
* Improve missing CrewAI install guidance
* fix: address pr review feedback
* fix: avoid mismatched memory save rows
* fix: wait for queued memory save events
* fix: avoid matching memory saves on missing ids
* chore: normalize prerelease version to 1.14.8a1
2026-06-18 14:14:54 -03:00
Greyson LaLonde
3b280e41fb
chore: bump pypdf to 6.10.0 for GHSA-3crg-w4f6-42mx
...
Nightly Canary Release / Build nightly packages (push) Has been cancelled
Nightly Canary Release / Publish nightly to PyPI (push) Has been cancelled
Build uv cache / build-cache (3.10) (push) Has been cancelled
Build uv cache / build-cache (3.11) (push) Has been cancelled
Build uv cache / build-cache (3.12) (push) Has been cancelled
CodeQL Advanced / Analyze (actions) (push) Has been cancelled
CodeQL Advanced / Analyze (python) (push) Has been cancelled
Vulnerability Scan / pip-audit (push) Has been cancelled
Build uv cache / build-cache (3.13) (push) Has been cancelled
Mark stale issues and pull requests / stale (push) Has been cancelled
Nightly Canary Release / Check for new commits (push) Has been cancelled
Resolves CVE-2026-40260 where manipulated XMP metadata entity
declarations can exhaust RAM in pypdf <6.10.0.
2026-04-11 05:56:11 +08:00
Greyson LaLonde
ce99312db1
chore: add exclude-newer = 3 days to all pyproject.toml files
2026-04-04 02:02:58 +08:00
Matt Aitchison
e88a8f2785
fix: bump pypdf, tinytag, and langchain-core for security fixes ( #4989 )
...
- pypdf ~=6.7.5 → ~=6.9.1 (CVE-2026-33123, CVE-2026-31826)
- tinytag ~=1.10.0 → ~=2.2.1 (CVE-2026-32889)
- langchain-core >=0.3.80,<1 → >=1.2.11,<2 (CVE-2026-26013)
Co-authored-by: Greyson LaLonde <greyson.r.lalonde@gmail.com >
Co-authored-by: Lorenze Jay <63378463+lorenzejay@users.noreply.github.com >
2026-03-23 15:24:26 -07:00
Matt Aitchison
9336702ebc
fix(deps): bump pypdf, urllib3 override, and dev dependencies for security fixes
...
CodeQL Advanced / Analyze (actions) (push) Has been cancelled
CodeQL Advanced / Analyze (python) (push) Has been cancelled
Mark stale issues and pull requests / stale (push) Has been cancelled
Build uv cache / build-cache (3.10) (push) Has been cancelled
Build uv cache / build-cache (3.11) (push) Has been cancelled
Build uv cache / build-cache (3.12) (push) Has been cancelled
Build uv cache / build-cache (3.13) (push) Has been cancelled
- pypdf ~6.7.4 → ~6.7.5 (CVE: inefficient ASCIIHexDecode stream decoding)
- Add urllib3>=2.6.3 override (CVE: decompression-bomb bypass on redirects)
- ruff 0.14.7 → 0.15.1, mypy 1.19.0 → 1.19.1, pre-commit 4.5.0 → 4.5.1
- types-regex 2024.11.6 → 2026.1.15, boto3-stubs 1.40.54 → 1.42.40
- Auto-fixed 13 lint issues from new ruff rules
Co-authored-by: Greyson LaLonde <greyson.r.lalonde@gmail.com >
2026-03-04 01:13:38 -05:00
Matt Aitchison
c00a348837
fix: upgrade pypdf 4.x → 6.7.4 to resolve 11 Dependabot alerts
...
CodeQL Advanced / Analyze (actions) (push) Has been cancelled
CodeQL Advanced / Analyze (python) (push) Has been cancelled
Build uv cache / build-cache (3.10) (push) Has been cancelled
Build uv cache / build-cache (3.11) (push) Has been cancelled
Build uv cache / build-cache (3.12) (push) Has been cancelled
Build uv cache / build-cache (3.13) (push) Has been cancelled
pypdf <6.7.4 has multiple DoS vulnerabilities via crafted PDF streams
(FlateDecode, LZWDecode, RunLengthDecode, XFA, TreeObject, outlines).
Only basic PdfReader/PdfWriter APIs are used in crewai-files, none of
which changed in the 5.0 or 6.0 breaking releases.
2026-02-28 17:16:45 -05:00
Matt Aitchison
6c8c6c8e12
fix: resolve critical/high Dependabot security alerts ( #4652 )
...
Upgrade pillow 10.4.0 → 12.1.1 (out-of-bounds write on PSD images),
langchain-core 0.3.76 → 0.3.83 (template injection), and
urllib3 2.6.1 → 2.6.3 (decompression-bomb bypass on redirects).
Bump docling ~=2.63.0 → ~=2.75.0 for pillow 12 compat, and add
uv overrides for pillow/langchain-core to unblock transitive pins
from fastembed and langchain-apify.
2026-02-28 13:04:35 -06:00
Greyson LaLonde
c4c9208229
feat: native multimodal file handling; openai responses api
...
- add input_files parameter to Crew.kickoff(), Flow.kickoff(), Task, and Agent.kickoff()
- add provider-specific file uploaders for OpenAI, Anthropic, Gemini, and Bedrock
- add file type detection, constraint validation, and automatic format conversion
- add URL file source support for multimodal content
- add streaming uploads for large files
- add prompt caching support for Anthropic
- add OpenAI Responses API support
2026-01-23 15:13:25 -05:00
