Joao Moura 69f63de100 fix(deps): bump json-repair past GHSA-xf7x-x43h-rpqh vulnerable range ...

json-repair < 0.60.1 has an unbounded-CPU DoS on circular JSON Schema
$ref structures, and crewai feeds LLM output straight into repair_json,
so the ~=0.25.2 pin kept every install inside the vulnerable range and
flagged HIGH by dependency scanners with no resolvable path.

Raise the requirement to >=0.60.1,<1.0.0 and adapt the agent parser to
the new failure semantics: json-repair >= 0.60 returns "" (not '""')
for unrepairable input and coerces non-JSON brace text into arrays, so
_safe_repair_json now also keeps the original tool input unless the
repair produced a JSON object.

Adds a regression test asserting the published requirement excludes the
vulnerable range and admits patched releases.

Linear: OSS-91

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-13 20:55:04 -07:00

1.6 MiB

Raw Blame History

View Raw