353 Commits

Include renames

Author	SHA1	Message	Date
Vidit Ostwal	65cdd70ac0	fix(deps): update aiohttp security floor (#8288)	2026-10-19 14:55:47 -03:00
Stoyan Dimitrov	274fba60f9	COR-891 Fix SQLite flow initialization contention (#7821) ... * COR-891 Fix SQLite flow initialization contention * fix: update vulnerable auth dependencies (COR-891) * COR-891 Fix SQLite flow initialization contention	2026-10-08 16:19:30 -07:00
Vidit Ostwal	8225e322e5	fix(deps): clear docling, fsspec, multidict, pymongo, and snowflake advisories (#7916) ... The lock was still on versions flagged by GHSA-q43m-vhcp-mhvm, GHSA-27vj-qcqg-25rc, GHSA-54p9-h82j-f925, the pymongo 4.18.2 fixes, and GHSA-qqj6-54q6-cxv6.	2026-10-06 09:32:22 -07:00
Vidit Ostwal	1133f16cab	fix(deps): bump oauthlib to 4.0.0 to clear PYSEC-2026-4114 (#7906)	2026-10-05 11:45:05 -07:00
Vidit Ostwal	19713955dd	fix(deps): bump pypdf to 6.19.0 to clear pip-audit findings (#7851) ... pypdf 6.16.2 is flagged for eight advisories, all fixed in 6.19.0.	2026-10-01 17:25:38 +00:00
João MouraandClaude Opus 5.5	b6bfae60b5	fix(deps): bump litellm to 1.88.6 for GHSA-3cv6-jpf6-8222 (#7835) ... litellm <1.88.6 has GHSA-3cv6-jpf6-8222 (CVE-2026-84377): authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters in the LiteLLM proxy server. crewAI uses litellm as a client SDK and never runs the proxy, but pip-audit flags the package and fails the vulnerability scan on every PR. - lib/crewai/pyproject.toml: crewai[litellm] floor litellm>=1.84.0 -> >=1.88.6 - pyproject.toml: advisory comment beside the other overrides - uv.lock: litellm 1.84.8 -> 1.88.6; nothing else moved (same dependency set) 1.88.6 (2026-08-09) is older than the 3-day exclude-newer cutoff, so no exclude-newer-package override is needed. Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-01 01:34:20 -03:00
João MouraandClaude Opus 5.5	1b9bbccbed	feat(cli): crewai eval --models, and llm_overlay swaps models as well as roles (#7811) ... * feat(llm): llm_overlay maps models too, not only agent roles A key `model:<provider/model>` maps every LLM built from that model string inside the block, and `model:*` every LLM built from any model string. That reaches what a role cannot: a flow step's own `LLM(...).call()`. The key is read in `LLM.__new__` (and so `create_llm` and an agent's `llm="..."`), and on an agent's declared llm built outside the block; a role key still wins for that agent. The caller's settings follow the mapped model by the rule a declared llm's do. `MODEL_KEY_PREFIX` is public so another package can feature-detect the form. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat(telemetry): allow-list cli_usage:eval_models attributes The span `crewai eval --models` records carries whether the caller was logged in, the models compared (provider/model names) and how many, in both telemetry classes. Nothing about the run, its output or the organization. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat(cli): crewai eval --models compares models on the deployment `crewai eval --models "a,b"` (and `--deployment UUID` when AMP cannot tell the deployment from the project id) asks AMP for a models evaluation: the project id, the models from one comma-separated list (stripped, repeats dropped, provider/model required, 1-5) and the project's eval.jsonc. It needs the login, prints and opens the report link, says where the comparison is while it runs, then prints one row per model (goal, tasks, agents, tools, cost, time; the deployed one marked, the best per column starred) and the top three suggestions. Exit 0 when it finished, 1 when it failed or could not start. Everything from the wire is printed as Text. The comparison is counted as `cli_usage:eval_models` once AMP accepts it. Mode 1 now sends the project id with `create_evaluation` too, so every evaluation is filed under the project it is about. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat(cli): crewai deploy create and push send the project id Every create (git or ZIP) and every push (redeploy by name or uuid, or a ZIP update) carries `[tool.crewai].project_id` when the project has one, so AMP knows which project a deployment runs and `crewai eval --models` can find it. The id is read, never minted: a deploy does not rewrite pyproject.toml. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(llm): a model key maps an LLM whose declared SDK is not installed Nothing is built on the declared model, so a missing SDK for it is no reason to fail the mapped build; its credentials cannot be matched to the new provider, so none are carried. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat(cli): crewai eval --models leaves its criteria behind as eval.jsonc When the comparison's answer carries `eval_config` and the project has no eval.jsonc, it is written through `write_eval_config` and the same one line Mode 1 prints says so. An existing file is never overwritten. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(llm): a model key compares providers by provider, not by class `_same_route_provider` now follows `_same_provider`'s rule case for case: a LiteLLM-routed `LLM(...)` is on the same provider as a native route when its provider names that native class, so its key and endpoint follow a model key to another model of the same provider. Another provider still gets none. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(llm): say why mark_mapped may skip an object, and one import form in its tests Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(cli): usage stats name a compared model only when it is a public one `cli_usage:eval_models` carried the `--models` strings as typed, and those can identify a customer: a fine-tune id, an Azure deployment name, a self-hosted model or host. A model is now sent by name only when it is an exact entry of crewAI's model catalog (`LLM_CONTEXT_WINDOW_SIZES`), else as `<provider>/other`, and a provider crewAI does not route as `other/other`. An `ft:` id is never sent. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test(cli): a refused comparison's test no longer keeps a None return Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test(llms): re-importing OpenAI's completion module restores its package attribute `test_openai_completion_module_is_imported` deletes the module from sys.modules and lets `LLM(...)` import it again, which binds the new module on `crewai.llms.providers.openai` as well. monkeypatch restored only the sys.modules entry, so every later test on that worker saw two module objects for one name: `patch("crewai.llms.providers.openai.completion.X")` patched the attribute's module while `from ... import X` read sys.modules'. On Python 3.10 that made tests/llms/azure/test_azure_responses.py fail whenever it shared a worker with test_openai.py and test_crew_loader.py, which the new tests' even split now did. The attribute is restored too. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(llm): model keys strip only a model's own prefix; a role builds from the declaration Two review findings on the model-for-model overlay: - `overlay_model_for_model` took the text after the first slash as another name for the model, so an aggregator's route (`openrouter/openai/gpt-4o`) matched a `model:openai/gpt-4o` or `model:gpt-4o` key meant for the native model. A prefix is now stripped only when it is a native provider's own and what remains has no slash; an instance on an aggregator is compared as `<provider>/<its model id>`. - With a role key and a model key both active, the model key mapped the declared llm first and the role's model was built like that mapped instance, losing the caller's key and endpoint. The overlay now remembers what the caller declared for every llm it built, and a role key is built from that declaration. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(llm): model keys read a provider's other names; a LiteLLM choice survives a missing SDK - The router's provider aliases are now one table, `crewai.llm.PROVIDER_ALIASES`, and `llm_overlay` compares model names through it: `google/x` and `gemini/x` are one model whether the llm is built in the block or was built before it (a prebuilt instance records `gemini`). An exact key still wins, and an aggregator's route is still compared whole. - When the declared model's SDK is missing, a caller's explicit `is_litellm=True` is kept for the mapped model instead of dropping to a native route. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(deploy): a git create sends the project id once, at the top level AMP reads project_id at the top level on every deploy route, so the git create no longer repeats it inside `deploy`. The redeploy docstring records why its optional body is safe on an AMP that predates project ids. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-30 10:53:42 -07:00
Lorenze Jay	3831e8b6c8	ensure link is shown after finalizing traces (#7593)	2026-09-18 20:13:44 -03:00
Vidit Ostwal	17feaf48fb	fix(deps): upgrade soupsieve security patch (#7571)	2026-09-18 09:13:52 +02:00
Vidit Ostwal	5c47c4a559	ci: ignore unpatched accelerate GHSA-4j2p-28q2-5m79 (#7347) ... pip-audit fails on accelerate 1.13.0; no PyPI release past 1.14.0 ships the path-traversal fix yet.	2026-09-09 12:50:55 +05:30
3 people	1e8cbef1b8	fix(tools): read octet-stream and xlsx urls in urlreadtool (#7261) ... * fix(tools): read octet-stream URLs by sniffing the body URLReadTool resolved content type from the Content-Type header and then the URL path extension. Presigned object-store links carry neither: they pin every object to application/octet-stream and use a content hash for a path, so a SharePoint download landing in R2 was refused outright. Sniff the already-fetched body as a third source, consulted only after the header and both URL extensions come back with nothing. The sniff can turn a refusal into a read but never a read into a different read, so no URL that works today changes behavior. Fails closed: a zip is DOCX only when word/document.xml is in its central directory, so an .xlsx keeps its honest refusal instead of surfacing a misleading "failed to read DOCX"; text requires a strict, whole-body UTF-8 decode with no NUL byte; an empty body identifies nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(tools): extract text from XLSX URLs The reported presigned SharePoint link is a spreadsheet, so sniffing the body identified it as OOXML but still had nowhere to send it: URLReadTool had no XLSX extractor, and the file would have been refused even with a correct spreadsheetml Content-Type. Read workbooks with openpyxl, already a core crewai dependency, so this adds no new one. Sheets are emitted as CSV under a "Sheet <name>:" heading, mirroring the PDF extractor's per-page shape. read_only streams the sheets instead of building the whole object graph and data_only takes cached values, both of which matter for a workbook arriving from an untrusted URL. Cells are written through csv rather than joined, so a comma, quote or newline inside a cell cannot corrupt the grid, and trailing phantom rows are trimmed because Excel reports sheet dimensions generously. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(tools): bound xlsx expansion and refuse ambiguous ooxml packages Bot review found two real defects in the XLSX extractor, both reproduced. openpyxl pads every row up to a sheet's declared dimension, so a single stray cell far down the sheet turned a 4.8 KB upload into 100,000 rows and 200,000 cells. Trimming only trailing blanks did not help, because the stray cell sits at the end and keeps the last row non-empty. Blank rows are now skipped as they stream, and a cell budget caps what any one workbook can hand an agent -- announced in the output rather than silently applied. A zip carrying both word/document.xml and xl/workbook.xml was classified as DOCX. Two identities is not a positive identification, so it is refused. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(tools): keep whitespace-only xlsx cell values Bot review, verified: openpyxl's row padding arrives as None, so testing cells for exactly-empty drops it just as well as .strip() did while leaving a row whose cells the author really did fill with spaces. And rstrip() on the rendered grid removed a trailing space from the final cell along with the line terminator; only the terminator should go. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(tools): bound xlsx scan work, not just emitted cells The cell budget only counted cells that reached the output, and blank rows skip before that point. A sheet can declare Excel's maximum dimension while holding two real cells; openpyxl then pads every row out to 16,384 columns and yields one row per gap. Measured: a 4,848-byte workbook drove 1.64 billion cell normalizations in 15.2 seconds with the budget never touched. Charge a separate scan budget per row, before the row is normalized and before the blank check, so the work a hostile sheet can demand is bounded whether or not any of it is emitted. The regression test asserts the read completes in under 5 seconds and is mutation-verified: dropping the per-row charge takes it back to 26 seconds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(deps): clear the six pip-audit advisories gitpython 3.1.58 has PYSEC-2026-3785 through -3788, fixed in 3.1.59; the lock now takes 3.1.61. Its exclude-newer-package cutoff is dropped rather than bumped -- the global 3-day cutoff has long since passed 2026-08-05, so that per-package pin was only holding the fix back. snowflake-sqlalchemy 1.10.0 has GHSA-8g6f-qw9x-4q6q (SQL injection and local file disclosure), fixed in 1.11.0. unstructured 0.18.32 has GHSA-4mvj-m6j5-pmf7, a full-read SSRF via the url= argument of partition(). The patched 0.24.0 requires Python >=3.11 while crewai-tools supports 3.10, so the floor carries a marker and 3.10 stays on the old line. 0.24+ also requires beautifulsoup4>=4.14.3, so the bs4 pin widens from ~=4.13.4 to >=4.13.4,<5 -- a widening, so no existing install breaks. uv resolves bs4 4.13.5 on 3.10 and 4.15.0 on 3.11+. pip-audit locally: "No known vulnerabilities found, 5 ignored", with no new --ignore-vuln entries. Only crewai-tools[xml] grows, gaining spacy and openai-whisper transitively through unstructured's extras. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(tools): narrow bs4 find_all results without a cast Widening the beautifulsoup4 pin let uv resolve 4.15.0 on Python 3.11+ while 3.10 stays on 4.13.5, because the old unstructured line holds it back there. 4.15 types find_all precisely, so cast(Tag, link) became redundant and mypy failed the 3.11-3.13 type-checker jobs while 3.10 passed. isinstance narrowing is correct under both versions and is what AGENTS.md asks for anyway. Verified by running mypy against 4.15.0 and again against 4.13.5: browser_toolkit is clean under both, leaving only the pre-existing errors in crewai/rag/embeddings/providers/ibm. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(deps): declare security floors in crewai-tools, not only as overrides Bot review caught a regression I introduced. override-dependencies replace the whole requirement including its marker, so gating the unstructured override on python_version >= '3.11' dropped the dependency outright on 3.10: the lock held only 0.24.1, never the 0.18 line the comment claimed. crewai-tools[xml] would have installed no unstructured at all there. Move the floors into lib/crewai-tools/pyproject.toml, where a marker split means what it says -- >=0.24.0 on 3.11+, >=0.17.2 below -- and drop the root override for unstructured entirely. The lock now carries both 0.18.32 and 0.24.1 under complementary markers. Same reasoning applies to the other two, per the nltk precedent already in that file: a uv override only shapes this workspace's lock, so consumers installing crewai-tools[snowflake] or [github] were still getting the vulnerable floors. Declared there now as well. Also documents the tool as a fit for presigned and share links from S3, R2, Google Drive, OneDrive and SharePoint -- the case this PR fixes -- while saying plainly that it reads a URL and does not authenticate. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore: update tool specifications --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-04 16:51:47 +05:30
3 people	3d72c707d5	chore(ci): ignore unpatched nltk GHSA-8mgp-746c-j5xp (#7215) ... * chore(ci): ignore unpatched nltk GHSA-8mgp-746c-j5xp No patched PyPI release exists beyond 3.10.3. nltk is transitive via crewai-tools[xml] -> unstructured; CrewAI does not call the vulnerable model-artifact APIs. Co-authored-by: Vidit Ostwal <Vidit-Ostwal@users.noreply.github.com> * chore(ci): note dropping nltk GHSA ignore on the next bump Leave an explicit TODO beside the ignore so GHSA-8mgp-746c-j5xp is removed when nltk moves past the unpatched 3.10.3 floor. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Vidit Ostwal <Vidit-Ostwal@users.noreply.github.com>	2026-09-02 10:04:20 -07:00
Vidit Ostwal	1cef70de52	fix: bump pypdf to 6.16.2 for GHSA-jp53-mhqp-8xcg (#7200) ... * fix: bump pypdf to 6.16.2 for GHSA-jp53-mhqp-8xcg pypdf 6.15.0 fails pip-audit on three moderate DoS advisories; 6.16.1+ patches them. * chore: keep existing uv.lock environment markers A full uv lock refresh rewrote unrelated dependency markers; restore them so the pypdf bump stays isolated. * chore: drop unused pypdf exclude-newer-package in crewai-files ~=6.16.1 plus the global 3-day cutoff already admits 6.16.2. * chore: drop pypdf from exclude-newer-package 6.16.2 is already older than the global 3-day cutoff; the version floor is enough.	2026-09-02 10:38:33 -03:00
João MouraandClaude Opus 5	ec53d6f534	fix(llms): native structured outputs for current claude models, and snowflake CVE floor (#7182) ... * fix(llms): let current claude models use native structured outputs NATIVE_STRUCTURED_OUTPUT_MODELS only listed 4.5-era prefixes, so Opus 5, Sonnet 5, Fable 5 and Opus 4.8 fell through to the forced-tool-call fallback. That path also overwrites params["tools"], so a call combining tools with a response_model silently lost the caller's tools. _infer_provider_from_model documented a pattern-matching fallback it never performed, so a Claude release newer than the constants list resolved to "openai". Bedrock ('.' in model) and Azure (every OpenAI prefix) are left out of that fallback because they would capture gpt-* models. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(llms): route bedrock-namespaced anthropic ids to bedrock "anthropic.claude-*" is Bedrock's namespace, not the Anthropic API, and it satisfies the anthropic prefix pattern. Settle it before the pattern loop so an unlisted Bedrock id picks BedrockCompletion. The region-prefixed form ("us.anthropic.claude-*") was resolving to openai, so this repairs that too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(deps): raise snowflake-connector-python floor for CVE-2026-15925 GHSA-5cc2-282f-jjq2 (CRITICAL): the connector does not verify TLS hostnames, so a network attacker can impersonate the Snowflake endpoint. Fixed in 4.7.1. crewai-tools[snowflake] declares "snowflake-connector-python>=3.12.4", which the lock had resolved to 4.6.0. Following the existing convention, the security floor goes in [tool.uv] override-dependencies rather than the source declaration, matching how cryptography is handled. Relocking also refreshes numpy/humanfriendly/nvidia environment markers, which re-resolution under the relative exclude-newer window produces regardless of this change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-01 12:01:22 +05:30
Vidit Ostwal	0e7625813b	fix: bump nltk to 3.10.3 for PYSEC-2026-3726 (#7162) ... Force the xml extra and workspace override onto the patched release so pip-audit stops failing on the 3.10.0 symlink file-read advisory.	2026-08-31 21:26:41 +05:30
3 people	113e572e05	fix(deps): raise the pip floor to 26.2 for PYSEC-2026-3721 (#7076) ... pip-audit started failing on every open PR. The advisory is against pip itself: PYSEC-2026-3721 / CVE-2026-13346, which OSV records as affecting pip up to but not including 26.2. The floor was already pinned at >=26.1.2, so the previously patched version became the vulnerable one. Not caused by any open PR. Reproduced on tag 1.15.17 itself (`b3ab193c3`), which resolves pip 26.1.2: `uv run pip-audit` with CI's exact arguments reports "Found 1 known vulnerability" there with no branch changes at all. That is why this is its own PR rather than a fix inside whichever PR happened to run first. Raising the floor rather than adding --ignore-vuln, since a patched release exists: 26.2 fixes it and 26.2.1 is current. The trailing comment follows the convention already used for setuptools>=83.0.0. The uv.lock change is deliberately hand-scoped to pip's four lines. Running `uv lock` -- with either uv 0.11.12 or 0.11.15 -- also re-expands environment markers for numpy, humanfriendly, grpcio, mcp and a dozen nvidia-* packages, because the committed lock was produced by a uv that simplifies markers differently from any version available here. Those rewrites change CUDA and platform resolution and have no business riding along in a security fix. The four lines applied here are exactly the ones uv itself produced for pip. Verified: `uv lock --check` passes, so the lock is consistent with pyproject and needs no regeneration; pip resolves to 26.2.1; `uv run pip-audit` with CI's arguments reports "No known vulnerabilities found, 1 ignored"; crewai and crewai_core still import. Claude-Session: https://claude.ai/code/session_01RfV2uMqWRcdfufMvtdCVoN Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Vidit Ostwal <110953813+Vidit-Ostwal@users.noreply.github.com>	2026-08-21 16:02:32 +05:30
3 people	505d52323f	fix(deps): bump torch to 2.13.0 for GHSA-rrmf-rvhw-rf47 (#6957) ... Force torch>=2.13.0 via override-dependencies so the transitive docling/unstructured stack picks up the CVE-2025-3000 fix, and drop the now-unnecessary pip-audit ignore. chromadb's CVE-2026-45829 remains ignored: the upstream fix is merged but not released on PyPI. Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Rip&Tear <theCyberTech@users.noreply.github.com>	2026-08-11 21:16:39 +05:30
João MouraandClaude Opus 5	92012aec55	feat: split runtime context from coding agent, add project id (#6867) ... * feat(telemetry): split runtime context from coding agent, add project id The coding-agent field answered two questions at once. A run with no TTY reported "non_interactive" and an editor's integrated terminal reported "vscode_terminal", both in the same field as the assistant name, so a run that never had an assistant to detect was indistinguishable from one whose assistant we failed to recognize. Together those two values were the majority of what the field reported. detect_coding_agent now answers only which assistant, returning "unknown" when no marker matches. detect_runtime_context answers where the process runs: ci, serverless, hosted_ide, notebook, container, the editor terminals, and the interactive/non_interactive fallback. Both ride on every span, so an assistant running inside CI reports both rather than one masking the other. The runtime markers are published platform contracts - CI providers, container and serverless runtimes, hosted IDEs - so unlike the assistant table they need no per-tool verification step. Presence is checked; no value is read. The assistant table is unchanged: its entries still require a confirmed, session-scoped variable, and the existing guard test still enforces that. Spans also carry project_id when the project declares one. It is read through the read-only accessor, since minting an id belongs to the CLI commands a user invoked rather than to a library call during execution, and it is omitted entirely for projects without one. The attributes are computed once per process and memoized, so the project file is not re-read for each provider. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: document execution environment telemetry attributes Adds the execution-environment row to the data table in en, ar, ko and pt-BR. Covers the assistant and runtime fields this branch splits apart and the project id, and states that detection reads only whether known environment variables are set. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(telemetry): detect runtime markers by presence, split paas from serverless Three findings from the CodeRabbit, code-quality and Cursor reviews. The runtime loop tested truthiness while constants.py documented presence, so a platform exporting a bare CI= fell through to the TTY fallback and was mislabelled as an ordinary local run. Presence is now what it says. The assistant markers keep truthiness deliberately: there an empty value means the tool set a placeholder rather than claiming the session. DYNO and WEBSITE_INSTANCE_ID marked Heroku dynos and Azure App Service instances as serverless, and since serverless is checked first they could never reach the container label. They move to a paas context, which is what they are: long-lived containers rather than per-invocation functions. AWS_EXECUTION_ENV is dropped entirely - it is set on ECS and EC2 as well as Lambda, and AWS_LAMBDA_FUNCTION_NAME already covers Lambda without the collision. The container probe no longer wraps os.path.exists in a try/except. os.path.exists handles OSError internally and returns False, so the handler guarded a condition that cannot occur and only hid the intent. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(telemetry): widen assistant detection from published marker sets The table previously covered three assistants because the rest were unverified. They are documented after all: vercel/detect-agent publishes a machine-readable detection matrix (agents.json), corroborated by the proposal in agentsmd/agents.md#136 and by microsoft/vscode#311734. Adds cline, gemini_cli, augment, opencode, antigravity and junie, plus CLAUDE_CODE alongside CLAUDECODE. Gemini's marker is confirmed by its own docs, which state that run_shell_command sets GEMINI_CLI=1 in the subprocess environment. Rule 2 excluded several entries those sources list. Goose's GOOSE_PROVIDER and Copilot's COPILOT_MODEL and COPILOT_GITHUB_TOKEN are user configuration, and a committed .env carrying one would relabel every ordinary run - the AIDER_MODEL trap the guard test already pins, now parametrized over all four. Replit's REPL_ID names a hosted environment rather than an assistant, so it stays a runtime context. Copilot sets no session marker at all today; that is an open request upstream. The new assistants are ordered ahead of Cursor, since CURSOR_* is set for every integrated terminal and would otherwise mask anything spawned inside it - the same ordering Codex already needed. Also adds the proposed cross-vendor AI_AGENT marker as a last resort, reported as "other". It establishes that an assistant is present without naming one, and its value is an arbitrary vendor string, so the value is never read. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(deps): raise gitpython and pypdf floors for new advisories gitpython 3.1.57 carries GHSA-9rj7-rf2p-w77r, GHSA-4gmw-gg2m-w46p, GHSA-hh9p-6wh2-4mfc, GHSA-wvpp-8hx9-p66j and GHSA-jm78-9fvv-mhgr: further unguarded git option forwarding in Repo.init, read-tree and git-config, plus arbitrary file read via --pathspec-from-file. Fixed in 3.1.58. pypdf 6.14.2 carries GHSA-fwg2-594c-jp42 and GHSA-fp3f-mc75-235c, unbounded runtime and memory on large content and /ToUnicode streams. Fixed in 6.15.0. Both floors were already pinned, so only the versions move. Their exclude-newer-package cutoffs had to move with them - 3.1.58 landed 2026-08-04 and 6.15.0 on 2026-08-06, both past the existing dates, so the resolver could not have seen either release. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(telemetry): share assistant precedence with the env-context path Four findings from the Cursor and CodeRabbit reviews, three of them the same root cause. get_env_context restated the precedence the shared table already defines, so every marker added for telemetry was invisible to it: a session exposing only CLAUDE_CODE reported claude_code on spans while emitting DefaultEnvEvent, and an assistant running inside a Cursor terminal reported that assistant on spans while emitting CursorEnvEvent. It now walks CODING_AGENT_ENV_MARKERS and maps the three assistants that have an event class of their own, defaulting the rest to DefaultEnvEvent. A test now asserts the two paths agree for every marker in the table, so they cannot drift again. The generic AI_AGENT marker was documented as presence-only but ran through the truthiness loop with everything else, so an empty value fell through to unknown. It moves out of the table and is checked by presence after it, which also keeps the named markers' truthiness intact. Azure Functions run on the App Service host and inherit WEBSITE_INSTANCE_ID, so moving that marker to paas would have relabelled them. The FUNCTIONS_* markers are checked first to keep them serverless. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(telemetry): stop export assertions depending on test order test_all_common_attributes_land_on_exported_spans failed in CI with an IndexError on an empty span list, and only in one shard: the suite runs with OTEL_SDK_DISABLED set, so TracerProvider hands out no-op tracers and an export-based assertion sees zero spans rather than a wrong attribute. It passed only when it happened to run after a test whose fixture flips the variable, which random ordering decides. Adds an otel_enabled fixture that sets the variable for the four tests asserting on exported spans. Three of them predate this branch and had the same latent dependency - they are fixed here because the new test made the ordering hit reachable, and leaving them would keep the required check red. Verified by running every test in the file individually, all of which previously exposed the dependency, and the telemetry suite three times under random ordering. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-07 17:28:52 -07:00
Vidit Ostwal	150dd1cadd	fix: bump h2 to 4.4.1 for GHSA-6hr6-w5qg-qmwg (#6860) ... Override the transitive h2 pin so pip-audit no longer fails on CVE-2026-71554 (duplicate Host header request smuggling).	2026-08-07 16:50:56 +05:30
Vidit Ostwal	c5b9d9a4c9	fix(deps): bump aiohttp and cryptography to clear six GHSA advisories (#6802) ... Raise override floors to aiohttp>=3.14.3 and cryptography>=50.0.0 so pip-audit no longer reports WebSocket smuggling, C parser OOB read, wildcard cert, path building, and PKCS#7 oracle issues in the locked dependency tree.	2026-08-04 19:33:54 +05:30
João MouraandClaude Opus 5	b10c4ffcdc	feat: add project_id to link OSS usage to an enterprise account (#6791) ... * feat: add project_id to link OSS usage to an enterprise account Adds a stable per-project identifier so a project's OSS traces and runs can be attributed to an account after signup. There was no such identifier before: [tool.crewai] held only `type`, the deploy UUID was printed to the console but never persisted, Settings.org_uuid is global rather than per-project, and trace batches carried only crew_fingerprint/crew_name. The id lives in the project's pyproject.toml, so it is committed with the repository and stays stable across machines, teammates, CI, and containers - unlike a machine- or user-derived identifier, which is unstable in exactly the containerized production environments that matter most. crewai-core: - get_project_id(): read-only lookup of [tool.crewai].project_id. Safe for library code; never creates or modifies anything. - get_or_create_project_id(): mints a uuid4 and persists it, returning (id, created) so callers can tell the user. Best-effort - returns (None, False) for a missing, malformed, or read-only pyproject.toml rather than raising. - Insertion edits the raw TOML text instead of round-tripping through a writer, so comments, key order, and formatting elsewhere survive. The key is placed at the end of the [tool.crewai] table, before the next table header, so it cannot land in a neighbouring section. - LoginPayload and TraceExecutionContext gain optional project_id. Sent on two paths: - Traces: project_id is added to execution_context, which is sent on both the ephemeral and authenticated paths, so a project's traces remain attributable before and after the user creates an account. - Login: `crewai login` already sends the pseudonymous user_identifier on an authenticated request; adding project_id means one request carries account + user + project, which is the link itself. Minting is restricted to CLI commands the user explicitly invoked - `crewai create` for new projects and `crewai run` to backfill existing ones - and is announced when it happens. Library code only ever reads. Silently rewriting a user's pyproject.toml during Crew.kickoff() would be surprising. Privacy: project_id is a random uuid4 in a file the user commits. It is visible in a diff, contains nothing personal, and identifies a project rather than a person - so this needs none of the notice changes that attaching a user identifier to all telemetry would require. Tests: 18 new tests covering minting, stability, table placement, comment and formatting preservation, five pyproject layouts, the neighbouring-table regression, and graceful handling of missing/malformed/read-only files. Verified end-to-end that both create paths mint distinct ids, that the trace payload carries project_id on both the ephemeral and authenticated paths, and that the login payload carries user_identifier and project_id together. Follow-ups, deliberately not included: adding project_id to telemetry spans, and backend persistence of the (account, user_identifier, project_id) triple. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UNumDnNbiyw3pv1WakAe6t * refactor: drop the console announcement when minting project_id Minting now happens silently. With no message to print, the (id, created) tuple had no consumer, so simplify the API rather than keep the flag around for a hypothetical caller: - get_or_create_project_id() returns `str | None` instead of `tuple[str | None, bool]`. - Remove crewai_cli.utils.ensure_project_id, which existed only to print the message and discard the flag. The four call sites (crewai create crew, crewai create flow, crewai run, and tool-repository login) now call get_or_create_project_id directly. - Update tests for the simplified signature; still 18 tests covering minting, stability, table placement, formatting preservation, five pyproject layouts, and missing/malformed/read-only handling. Behaviour is otherwise unchanged: minting stays restricted to CLI commands the user invoked, library code still only reads via get_project_id, and a missing or read-only pyproject.toml still returns None rather than raising. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UNumDnNbiyw3pv1WakAe6t * fix: harden project_id minting against TOML corruption; address review Several reviewers found ways the raw-text edit could produce invalid TOML. Each is now fixed and covered by a test that fails without the fix. Duplicate project_id key (Cursor bugbot, Copilot x2): - get_project_id() reports a blank or non-string value as "absent", so a file containing `project_id = ""` took the insert path and gained a second project_id line - a duplicate key, and therefore invalid TOML that no tomli-based tool could read afterwards. - _insert_project_id is now _set_project_id: it replaces an existing assignment inside [tool.crewai] instead of appending unconditionally. Table header with a trailing comment (CodeRabbit major, Cursor bugbot): - `[tool.crewai] # config` is valid TOML but failed exact string equality, so the fallback appended a second [tool.crewai] header - a redefined table, also invalid TOML, and silent because get_project_id swallows the resulting decode error. - Added _is_table_header(), which tolerates a trailing comment and does not match similar names such as [tool.crewai-extra]. Writing into malformed TOML (Cursor bugbot, Copilot): - get_or_create_project_id relied on get_project_id, which cannot distinguish "no id" from "unparsable file", so it appended to files it could not parse. - The locked path now parses explicitly and bails on a decode error, and re-parses the updated content before writing, so this feature can never be the reason a project's pyproject.toml stops parsing. Concurrency and atomicity (CodeRabbit major): - Two CLI processes could both see no id, mint different uuids, and clobber each other, leaving a caller holding an id that is not on disk. Minting now takes the existing crewai_core cross-process lock, re-reads under it, and returns the id that persists. - Writes go through a temp file in the same directory plus os.replace, so an interruption cannot truncate pyproject.toml. File mode is copied across, and the temp file is removed on failure. - os.replace only needs a writable directory, which would have let an atomic write silently overwrite a file the user marked read-only; writability is now checked explicitly so that case still returns None. Line endings (CodeRabbit): - Path.read_text/write_text normalized CRLF to LF, so minting would rewrite a CRLF-committed file entirely. Read and write now use newline="" and the inserted line ending is derived from the existing content. Default create path skipped minting (Cursor bugbot): - `crewai create crew` defaults to create_json_crew; only the --classic and flow paths minted, so most new projects had no id until a later command. Wired into create_json_crew as well. Verified all three paths now mint distinct ids. Do not mint during login (CodeRabbit major): - ToolCommand.login ran get_or_create_project_id, which is outside the sanctioned minting commands and is invoked by `crewai tools create` from a freshly scaffolded directory before the project is persisted. It now uses the read-only get_project_id. Verified login leaves pyproject.toml untouched. Not applied: Copilot asked for a console message when an id is written, in create_crew and create_flow. Minting was made deliberately silent in the previous commit, so the (id, created) tuple and the announcement are both gone by design. Tests: 32 in test_project_id.py, up from 18. New cases cover blank and non-string existing ids, three commented-header forms, similar table names, malformed input, CRLF and LF preservation, concurrent minting convergence, file-mode preservation, and temp-file cleanup. Confirmed the header and duplicate-key tests fail when the fixes are reverted. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UNumDnNbiyw3pv1WakAe6t * fix: never create [tool.crewai], treat whitespace ids as absent, harden test `crewai run` could rewrite unrelated projects (Cursor bugbot, high): - get_or_create_project_id ran before the cwd was established as a CrewAI project, and _set_project_id appended a [tool.crewai] table when none existed. Any directory with a pyproject.toml could therefore gain one - including on `crewai run --definition`, which may otherwise succeed. - _set_project_id no longer creates the table; it returns None when [tool.crewai] is absent, so a key is only ever added to a table the project already declares. The templates all ship the table, so no create path needs the old fallback. - The minting call in run_crew moved after the --definition early return, so an explicit-flow run does not touch the cwd at all. - Presence is checked, not truthiness: an empty [tool.crewai] is still a CrewAI marker, and get_crewai_project_config returns {} both for that and for an absent table. - Verified an unrelated project's pyproject.toml is byte-identical after a mint attempt. Whitespace-only project_id accepted as valid (CodeRabbit): - `project_id = " "` is truthy, so it was returned as an identity and would have propagated into login payloads and tracing context. It also meant the '" "' parameter of the replacement test asserted nothing. - Added _usable_project_id, which strips before deciding, used by both get_project_id and the locked mint path. Concurrency test could hang CI (CodeRabbit, major): - Neither the barrier nor the joins had timeouts, so a thread dying early or blocking on the lock would hang the job rather than fail it. The result count was also unchecked, so a dead thread still passed. - Added timeouts, an explicit liveness assertion, a result-count assertion, a lock around the shared result list, and corrected the docstring: this covers the read-modify-write race with threads, not the cross-process backend. Tests: 35, up from 32. New coverage for the absent-table refusal and three whitespace forms; the blank-id replacement case now asserts a real uuid replaced the blank value. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UNumDnNbiyw3pv1WakAe6t * chore(deps): force gitpython 3.1.57+ for GHSA-p538-c434-8v24 and GHSA-3f7w-8rr8-f37f Unrelated to project_id; bundled here only because it blocks this PR's vulnerability scan. Two advisories were published for gitpython 3.1.55 after main last passed the scan: - GHSA-p538-c434-8v24: arbitrary file truncation via `git rev-list --output` argument injection. Fixed in 3.1.56. - GHSA-3f7w-8rr8-f37f: unguarded git option forwarding in IndexFile.checkout() and TagReference. Fixed in 3.1.57. - Bump the override floor to gitpython>=3.1.57 and declare the same floor in crewai-tools, so consumers installing the published package are covered and not only this repo's lock. - 3.1.57 was published 2026-07-26, past gitpython's exclude-newer-package cutoff of 2026-07-24, so that cutoff moves to 2026-07-27. Without it the floor is unresolvable. pip-audit against the updated lock reports no known vulnerabilities. Verified gitpython 3.1.57 resolves and that crewai_tools and crewai_cli.git still import. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UNumDnNbiyw3pv1WakAe6t --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-03 15:25:06 -07:00
João Moura	766d71aefb	feat: surface AMP in AGENTS.md and detect coding agents in telemetry (#6779)	2026-08-03 12:13:05 -07:00
alex-clawdandLorenze Jay	c528e8bdee	fix: detect Anthropic preview tool-use blocks (#6629) ... * fix: detect anthropic preview tool-use blocks * fix: preserve typed Anthropic tool-use blocks * fix: bump gitpython for vulnerability scan * docs: clarify gitpython advisory ranges --------- Co-authored-by: Lorenze Jay <63378463+lorenzejay@users.noreply.github.com>	2026-07-24 15:32:38 -03:00
alex-clawd	c06043f7e8	fix: preserve strict tool schema property names (#6628)	2026-07-24 09:49:05 -07:00
Rip&Tear	b14d36bfe4	chore: bump json-repair to 0.60.1, drop fixed vuln ignores in scan (#6612) ... * chore: bump json-repair to 0.60.1 and un-ignore fixed vulns in scan - json-repair 0.25.3 -> 0.60.1 (fixes GHSA-xf7x-x43h-rpqh) - pyOpenSSL already at 26.2.0 in lock (covers CVE-2026-27448, CVE-2026-27459) - remove the corresponding --ignore-vuln flags from vulnerability-scan.yml * fix: adapt _safe_repair_json to json-repair 0.60 semantics json-repair >= 0.60 returns an empty string for plain-text input and wraps brace-enclosed junk in a single-element list instead of the old ""/{} sentinel values. Treat both as unrepairable so the original tool input is preserved. * chore: fix CI - bump gitpython/pyasn1, drop stale type ignores - gitpython 3.1.50 -> 3.1.52 (GHSA-2f96-g7mh-g2hx, GHSA-v396-v7q4-x2qj, GHSA-956x-8gvw-wg5v; fixed in 3.1.51) - pyasn1 0.6.3 -> 0.6.4 (GHSA-8ppf-4f7h-5ppj, GHSA-hm4w-wwcw-mr6r) - json-repair 0.60 ships type stubs; remove now-unused type: ignore[import-untyped] comments flagged by mypy	2026-07-22 16:47:33 -07:00
Vinicius Brasil	4e23bf6d45	Update dependencies with security fixes (#6580) ... * Pillow 12.1.1 → 12.3.0 (CVE-2026-55798, CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380, CVE-2026-59197, CVE-2026-59203) * mcp 1.26.0 → 1.28.1 (CVE-2026-59950) * couchbase 4.3.5 → 4.6.0	2026-07-17 09:12:45 -03:00
Vinicius Brasil	5dba2ef623	Bump setuptools to 0.83.0 to fix PYSEC-2026-3447 (#6570)	2026-07-16 15:08:28 -03:00
João Moura	4cbfbdb232	Keep JSON crew projects and deploy archives Python-free (#6228) ... * fix: scaffold deployable json crews * fix: keep json crew scaffolds python-free * fix: keep json deploy archives python-free * fix: tighten json crew deploy validation * fix: address json crew pr checks * fix: clear langsmith audit advisory	2026-06-22 13:22:46 -03:00
João Moura	504c5c9b04	JSON crew fixes (#6217) ... * feat: update pyproject.toml to specify wheel targets Added a new section to the pyproject.toml file to include only specific files in the wheel build, enhancing the packaging process. Updated tests to verify the inclusion of these targets. * feat: add memory save event handling to activity log Implemented event handlers for MemorySaveStartedEvent, MemorySaveCompletedEvent, and MemorySaveFailedEvent in the crew_run_tui module. This allows the application to log memory save operations, capturing their status and details in the activity log. Added corresponding tests to verify the correct logging behavior for successful and failed memory saves. * feat: enhance memory save event handling in activity log Added functionality to suppress nested memory save events and updated the handling of MemorySaveStartedEvent, MemorySaveCompletedEvent, and MemorySaveFailedEvent to improve logging accuracy. Introduced new tests to verify the correct behavior of memory save events, including scenarios for nested events and completion updates for timed-out entries. * Fix memory save activity log handling * Normalize alpha package versions * Update scaffolded crew dependency * feat: add button to copy setup instructions for CrewAI coding agents Introduced a button in the documentation that allows users to easily copy setup instructions for CrewAI coding agents. The instructions include installation steps, environment setup, and best practices for using the CrewAI CLI. This enhancement aims to streamline the onboarding process for new users. * Improve missing CrewAI install guidance * fix: address pr review feedback * fix: avoid mismatched memory save rows * fix: wait for queued memory save events * fix: avoid matching memory saves on missing ids * chore: normalize prerelease version to 1.14.8a1	2026-06-18 14:14:54 -03:00
João Moura	d3c37c4a40	Enhance memory reset functionality and JSON crew handling (#6195) ... * Enhance memory reset functionality and JSON crew handling - Added `reset_all` method to the `Memory` class to reset the entire memory store, ignoring `root_scope`. - Updated the `Crew` class to utilize `reset_all` when resetting memory. - Enhanced the `_reset_flow_memory` function to check for `Memory` instances and call `reset_all` accordingly. - Introduced helper functions to load JSON crew configurations and handle project declarations, improving the reset command's flexibility. - Added tests to validate the new JSON crew memory reset behavior and ensure proper handling of declared flow projects. * Fix memory reset review issues * Bump litellm for security advisory	2026-06-17 12:14:50 -03:00
João Moura	53c2284484	Support ZIP deployment fallback and JSON crew project env runs (#6166) ... * Update crewAI CLI with various enhancements and fixes - Updated `create_json_crew.py` to require `crewai[tools]>=1.14.7`. - Enhanced `git.py` with improved repository initialization, including automatic initial commit creation and exclusion patterns for initial commits. - Modified `install_crew.py` to allow error handling during installation with an optional `raise_on_error` parameter. - Expanded `plus_api.py` to include methods for creating and updating crews from ZIP files. - Introduced a new `archive.py` for creating deployable ZIP archives of CrewAI projects, ensuring local artifacts are excluded. - Updated `run_crew.py` to manage JSON crew dependencies and run crews in the project's environment. - Enhanced deployment logic in `main.py` to handle ZIP uploads and improve user feedback during deployment processes. - Added tests for new functionalities and ensured existing tests reflect recent changes in behavior and requirements. * fix(cli): address deploy zip review feedback * fix(cli): sync missing lockfile before deploy * fix(cli): preserve remote deploy on git setup warnings * test(cli): use single deploy main import style * fix(cli): skip project install for json crew sync * fix(cli): load json runner from source checkout * fix(cli): skip json crew sync when locked * fix(cli): address deploy zip review feedback * fix(cli): pass env on zip redeploy * fix(cli): harden json run and zip fallback * fix(cli): validate before deploy lock install * fix(cli): respect poetry lock for json runs * fix(cli): align json zip wrapper detection * fix(deps): bump starlette audit floor * fix(cli): avoid auth retry for deploy exits * fix(cli): update json zip script entrypoints	2026-06-15 18:46:54 -03:00
Greyson LaLonde	1b14e162e9	fix: resolve pip-audit CVEs (aiohttp, docling, docling-core, pip) ... * fix: resolve pip-audit CVEs for aiohttp, docling, docling-core, pip - aiohttp 3.13.4 → 3.14.0: fixes GHSA-jg22-mg44-37j8, GHSA-hg6j-4rv6-33pg - docling 2.84.0 → 2.97.0: fixes GHSA-cjqg-rq2h-2fvj, GHSA-pj2v-ggqh-cmq2, GHSA-r3xg-rg9j-67fv, GHSA-q29v-xc37-wh5m - docling-core 2.74.0 → 2.79.0: fixes GHSA-j5xp-7m2f-49jv, GHSA-jmmv-h3mp-59v8 - pip 26.1.1 → 26.1.2: fixes PYSEC-2026-196 docling-core 2.74.1+ requires pydantic-settings>=2.14.0, so the crewai pin is loosened from ~=2.10.1 to >=2.10.1,<3. pydantic-settings resolves to 2.14.1 in the lock. * fix: correct aiohttp CVE floor to 3.14.0 (not 3.13.5) * test: shim AsyncStreamReaderMixin for vcrpy under aiohttp 3.14.0 aiohttp 3.14.0 removed aiohttp.streams.AsyncStreamReaderMixin (folded into StreamReader). vcrpy's aiohttp stub still subclasses it, so vcr's patch machinery raised AttributeError at test collection. Restore an equivalent mixin in conftest before vcr is imported. * test: rebuild vcrpy MockClientResponse init for aiohttp 3.14.0 aiohttp 3.14.0 added a required stream_writer kwarg to ClientResponse.__init__ and reads stream_writer.output_size when writer is None. vcrpy's MockClientResponse doesn't pass it, raising TypeError at cassette playback. Rebuild the super().__init__ call from the live signature (defaulting required keyword-only args to None, with a stream_writer stub exposing output_size) so it survives future aiohttp signature additions too. * test: avoid deprecated get_event_loop in vcrpy aiohttp shim asyncio.get_event_loop() emits a DeprecationWarning (and can RuntimeError) when no current loop is set on Python 3.12+. Prefer get_running_loop() (the real cassette-playback path always has one) and fall back to a single cached loop in sync contexts, since the mock only stores the loop and calls get_debug(). * fix: pull docling-core[chunking] so HierarchicalChunker imports docling 2.97 split into docling-slim, moving the chunker's code-chunking deps (tree-sitter, semchunk, language grammars) behind docling-core's [chunking] extra. crewai's knowledge source imports HierarchicalChunker, whose package __init__ eagerly imports those submodules -> ModuleNotFoundError ('tree_sitter') without the extra. Request docling-core[chunking]; carry the extra in override-dependencies too, since overrides replace the whole requirement and would otherwise strip it.	2026-06-08 17:45:07 -07:00
Greyson LaLonde	7676b0937c	fix(deps): bump authlib to >=1.6.12 to patch PYSEC-2026-188	2026-06-03 09:45:59 -07:00
Greyson LaLonde	4dafb05735	chore(deps): bump uv to >=0.11.15 and ignore unfixable chromadb CVE ... uv 0.11.7 -> 0.11.17 patches GHSA-4gg8-gxpx-9rph. chromadb has no patched release for GHSA-f4j7-r4q5-qw2c (server-only pre-auth RCE, not reachable in our embedded use); ignore until upstream ships a fix.	2026-06-01 00:10:19 -07:00
Greyson LaLonde	4990041ef7	chore(deps): force starlette>=1.0.1 for PYSEC-2026-161 ... starlette <1.0.1 has PYSEC-2026-161 (missing Host header validation poisons request.url.path, bypassing path-based auth). Pulled in as a transitive of fastapi. Override-dependencies forces the patched version; lock regenerated against starlette 1.0.1.	2026-05-22 23:33:08 +08:00
Greyson LaLonde	7cc1a7bb41	fix(deps): bump pip and paramiko to drop pip-audit ignores ... OSV no longer flags pip 26.1.1 (GHSA-58qw-9mgm-455v) or paramiko 5.0.0 (GHSA-r374-rxx8-8654), so override both to those minimums and remove the corresponding --ignore-vuln entries. paramiko is pulled in transitively via composio-core.	2026-05-20 22:33:43 +08:00
Greyson LaLonde	75bb882911	fix(deps): bump langsmith to >=0.8.0 for GHSA-3644-q5cj-c5c7	2026-05-15 21:32:52 +08:00
Greyson LaLonde	63a9e7eb5e	fix(deps): patch urllib3 GHSA-qccp-gfcp-xxvc, GHSA-mf9v-mfxr-j63j	2026-05-12 00:48:42 +08:00
Greyson LaLonde	b0d4dd256d	fix(deps): patch gitpython, langchain-core; ignore unpatched paramiko CVE	2026-05-11 22:31:56 +08:00
Greyson LaLonde	d6f7e7d5f8	chore(deps): use 3-day exclude-newer window ... * chore(deps): use 3-day exclude-newer window Aligns the root workspace with the per-package pyprojects, which already use `exclude-newer = "3 days"`. The fixed 2026-04-27 cutoff blocks legitimate dependency bumps (e.g. daytona ~=0.171 in #5740) without adding meaningful protection — the relative window still includes the security patches that motivated the original pin. * fix(deps): bump gitpython and python-multipart for new advisories - gitpython >=3.1.49 for GHSA-v87r-6q3f-2j67 (newline injection in config_writer().set_value() enables RCE via core.hooksPath). - python-multipart >=0.0.27 for GHSA-pp6c-gr5w-3c5g (DoS via unbounded multipart part headers). Both surfaced via pip-audit on this branch.	2026-05-08 00:11:05 +08:00
Greyson LaLonde	93e786d263	refactor: extract CLI into standalone crewai-cli package	2026-05-06 20:46:46 +08:00
Greyson LaLonde	de0b2a4fe0	fix(deps): bump litellm for SSTI fix; ignore unfixable pip CVE	2026-04-28 04:34:17 +08:00
3 people	3be2fb65dc	perf: lazy-load MCP SDK and event types to reduce cold start by ~29% (#5584) ... * perf: defer MCP SDK import by fixing import path in agent/core.py - Change 'from crewai.mcp import MCPServerConfig' to direct path 'from crewai.mcp.config import MCPServerConfig' to avoid triggering mcp/__init__.py which eagerly loads the full mcp SDK (~300-400ms) - Move MCPToolResolver import into get_mcp_tools() method body since it's only used at runtime, not in type annotations Saves ~200ms on 'import crewai' cold start. * perf: lazy-load heavy MCP imports in mcp/__init__.py MCPClient, MCPToolResolver, BaseTransport, and TransportType now use __getattr__ lazy loading. These pull in the full mcp SDK (~400ms) but are only needed at runtime when agents actually connect to MCP servers. Lightweight config and filter types remain eagerly imported. * perf: lazy-load all event type modules in events/__init__.py Previously only agent_events were lazy-loaded; all other event type modules (crew, flow, knowledge, llm, guardrail, logging, mcp, memory, reasoning, skill, task, tool_usage) were eagerly imported at package init time. Since events/__init__.py runs whenever ANY crewai.events.* submodule is accessed, this loaded ~12 Pydantic model modules unnecessarily. Now all event types use the same __getattr__ lazy-loading pattern, with TYPE_CHECKING imports preserved for IDE/type-checker support. Saves ~550ms on 'import crewai' cold start. * chore: remove UNKNOWN.egg-info from version control * fix: add MCPToolResolver to TYPE_CHECKING imports Fixes F821 (ruff) and name-defined (mypy) from lazy-loading the MCP import. The type annotation on _mcp_resolver needs the name available at type-check time. * fix: bump lxml to >=5.4.0 for GHSA-vfmq-68hx-4jfw lxml 5.3.2 has a known vulnerability. Bump to 5.4.0+ which includes the fix (libxml2 2.13.8). The previous <5.4.0 pin was for etree import issues that have since been resolved. * fix: bump exclude-newer to 2026-04-22 for lxml 6.1.0 resolution lxml 6.1.0 (GHSA fix) was released April 17 but the exclude-newer date was set to April 17, missing it by timestamp. Bump to April 22. * perf: add import time benchmark script scripts/benchmark_import_time.py measures import crewai cold start in fresh subprocesses. Supports --runs, --json (for CI), and --threshold (fail if median exceeds N seconds). The companion GitHub Action workflow needs to be pushed separately (requires workflow scope). * new action * Potential fix for pull request finding 'CodeQL / Workflow does not contain permissions' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Joao Moura <joaomdmoura@gmail.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>	2026-04-22 02:17:33 -03:00
Greyson LaLonde	19ac7d2f64	fix: patch authlib, langchain-text-splitters, and pypdf vulnerabilities ... - authlib 1.6.9 -> 1.6.11 (GHSA-jj8c-mmj3-mmgv) - langchain-text-splitters 1.1.1 -> 1.1.2 (GHSA-fv5p-p927-qmxr) - langchain-core 1.2.28 -> 1.2.31 (required by text-splitters 1.1.2) - pypdf 6.10.1 -> 6.10.2 (GHSA-4pxv-j86v-mhcw, GHSA-7gw9-cf7v-778f, GHSA-x284-j5p8-9c5p) Pinned tool.uv.exclude-newer to 2026-04-17 so the 2026-04-16 patch releases fall inside the resolution window.	2026-04-17 21:25:47 +08:00
Greyson LaLonde	749fe85325	fix: bump langsmith to 0.7.31 to patch GHSA-rr7j-v2q5-chgv ... langsmith <0.7.31 bypasses output redaction for streaming token events, leaking sensitive LLM outputs into LangSmith storage.	2026-04-16 23:55:30 +08:00
Greyson LaLonde	74d061e994	fix: bump python-multipart to 0.0.26 to patch GHSA-mj87-hwqh-73pj ... Fixes GHSA-mj87-hwqh-73pj	2026-04-16 04:25:35 +08:00
Greyson LaLonde	18d0fd6b80	fix: bump pypdf to 6.10.1 to patch GHSA-jj6c-8h6c-hppx ... Fixes GHSA-jj6c-8h6c-hppx	2026-04-16 04:11:08 +08:00
Greyson LaLonde	0dba95e166	fix: bump pytest to 9.0.3 for GHSA-6w46-j5rx-g56g ... pytest <9.0.3 has an insecure tmpdir vulnerability (CVE / GHSA-6w46-j5rx-g56g). Bump pytest-split to 0.11.0 to satisfy the new pytest>=9 requirement.	2026-04-14 02:38:05 +08:00
Greyson LaLonde	c8694fbed2	fix: override pypdf and uv to patched versions for CVE-2026-40260 and GHSA-pjjw-68hj-v9mw	2026-04-13 21:04:37 +08:00
Greyson LaLonde	9537ba0413	ci: add pip-audit pre-commit hook	2026-04-11 03:06:31 +08:00