mirror of
https://github.com/crewAIInc/crewAI.git
synced 2026-10-21 17:36:42 +02:00
Craig EstepandClaude Opus 5.5
20b78a0069
PyJWT 2.14.0 fixes GHSA-w6j9-cwv2-h6wq and several other advisories in PyJWKClient and JWK parsing, which crewai-core uses to verify CLI login tokens. Raise the floor in crewai, crewai-cli and crewai-core so installs cannot resolve a vulnerable release, and lock 2.14.0 (2.15.0 rejects padded tokens until 2.15.1, which is still inside the uv cooldown). oauthlib 4.0.0, the fix for GHSA-xpv3-w29h-x7cv, is under two days old and inside the 3-day exclude-newer cooldown. The flaw is in the server-side PKCE verifier check; oauthlib reaches CrewAI only as an OAuth client (chromadb -> kubernetes -> requests-oauthlib). Ignore the advisory in pip-audit until 4.0.0 clears the cooldown, with a dated TODO. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>