mirror of
https://github.com/crewAIInc/crewAI.git
synced 2026-07-25 08:45:09 +00:00
69f63de100
json-repair < 0.60.1 has an unbounded-CPU DoS on circular JSON Schema $ref structures, and crewai feeds LLM output straight into repair_json, so the ~=0.25.2 pin kept every install inside the vulnerable range and flagged HIGH by dependency scanners with no resolvable path. Raise the requirement to >=0.60.1,<1.0.0 and adapt the agent parser to the new failure semantics: json-repair >= 0.60 returns "" (not '""') for unrepairable input and coerces non-JSON brace text into arrays, so _safe_repair_json now also keeps the original tool input unless the repair produced a JSON object. Adds a regression test asserting the published requirement excludes the vulnerable range and admits patched releases. Linear: OSS-91 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>