mirror of
https://github.com/crewAIInc/crewAI.git
synced 2026-07-26 17:25:10 +00:00
728183e420
bedrock-agentcore 1.7.0 has GHSA-j6g5-3hh3-pgw8 (CVE-2026-16796, high):
argument-delimiter injection in CodeInterpreter.install_packages(). It fails
the pip-audit vulnerability scan on every PR in the repo.
The patch is 1.18.1, which requires boto3>=1.43.31. The old <1.8.0 cap plus
aiobotocore~=3.5.0 (botocore<1.42.92) made that unsatisfiable, so the AWS
stack moves together:
- bedrock-agentcore >=1.7.0,<1.8.0 -> >=1.18.1,<2.0.0
- boto3 ~=1.42.90 -> ~=1.43.46 (aws + bedrock extras)
- aiobotocore ~=3.5.0 -> ~=3.8.0 (aws + bedrock extras)
aiobotocore 3.8.0 allows botocore <1.43.47 and boto3 1.43.46 pins botocore
1.43.46, so the ranges overlap.
Verified: uv lock resolves, pip-audit reports no vulnerabilities (3 existing
ignores, none new), 48 bedrock tests pass, and both bedrock toolkits import
cleanly. BrowserClient.{start,stop,generate_ws_headers} and
CodeInterpreter.{start,stop,invoke} are unchanged in 1.18.1.
161 lines
2.7 KiB
TOML
161 lines
2.7 KiB
TOML
[project]
|
|
name = "crewai-tools"
|
|
dynamic = ["version"]
|
|
description = "Set of tools for the crewAI framework"
|
|
readme = "README.md"
|
|
authors = [
|
|
{ name = "João Moura", email = "joaomdmoura@gmail.com" },
|
|
]
|
|
requires-python = ">=3.10, <3.14"
|
|
dependencies = [
|
|
"pytube~=15.0.0",
|
|
"requests>=2.33.0,<3",
|
|
"crewai==1.15.6",
|
|
"tiktoken>=0.8.0,<0.13",
|
|
"beautifulsoup4~=4.13.4",
|
|
"python-docx~=1.2.0",
|
|
"youtube-transcript-api~=1.2.2",
|
|
"pymupdf~=1.26.6",
|
|
]
|
|
|
|
|
|
[project.urls]
|
|
Homepage = "https://crewai.com"
|
|
Repository = "https://github.com/crewAIInc/crewAI"
|
|
Documentation = "https://docs.crewai.com"
|
|
|
|
|
|
[project.optional-dependencies]
|
|
scrapfly-sdk = [
|
|
"scrapfly-sdk>=0.8.19",
|
|
]
|
|
sqlalchemy = [
|
|
"sqlalchemy>=2.0.35",
|
|
]
|
|
multion = [
|
|
"multion>=1.1.0",
|
|
]
|
|
firecrawl-py = [
|
|
"firecrawl-py>=1.8.0",
|
|
]
|
|
composio-core = [
|
|
"composio-core>=0.6.11.post1",
|
|
]
|
|
browserbase = [
|
|
"browserbase>=1.0.5",
|
|
]
|
|
weaviate-client = [
|
|
"weaviate-client>=4.10.2",
|
|
]
|
|
patronus = [
|
|
"patronus>=0.0.16",
|
|
]
|
|
serpapi = [
|
|
"serpapi>=0.1.5",
|
|
]
|
|
beautifulsoup4 = [
|
|
"beautifulsoup4>=4.12.3",
|
|
]
|
|
selenium = [
|
|
"selenium>=4.27.1",
|
|
]
|
|
spider-client = [
|
|
"spider-client>=0.1.25",
|
|
]
|
|
scrapegraph-py = [
|
|
"scrapegraph-py>=1.9.0,<2",
|
|
]
|
|
linkup-sdk = [
|
|
"linkup-sdk>=0.2.2",
|
|
]
|
|
tavily-python = [
|
|
"tavily-python~=0.7.14",
|
|
]
|
|
hyperbrowser = [
|
|
"hyperbrowser>=0.18.0",
|
|
]
|
|
snowflake = [
|
|
"cryptography>=43.0.3",
|
|
"snowflake-connector-python>=3.12.4",
|
|
"snowflake-sqlalchemy>=1.7.3",
|
|
]
|
|
singlestore = [
|
|
"singlestoredb>=1.12.4",
|
|
"SQLAlchemy>=2.0.40",
|
|
]
|
|
exa-py = [
|
|
"exa-py>=1.8.7",
|
|
]
|
|
qdrant-client = [
|
|
"qdrant-client>=1.12.1",
|
|
]
|
|
apify = [
|
|
"langchain-apify>=0.1.2,<1.0.0",
|
|
]
|
|
|
|
databricks-sdk = [
|
|
"databricks-sdk>=0.46.0",
|
|
]
|
|
couchbase = [
|
|
"couchbase>=4.6.0",
|
|
]
|
|
mcp = [
|
|
"mcp>=1.28.1,<2",
|
|
"mcpadapt>=0.1.9",
|
|
]
|
|
stagehand = [
|
|
"stagehand>=0.4.1",
|
|
]
|
|
github = [
|
|
"gitpython>=3.1.55,<4",
|
|
"PyGithub==1.59.1",
|
|
]
|
|
rag = [
|
|
"python-docx>=1.1.0",
|
|
"lxml>=6.1.0,<7", # 6.1.0+ required for GHSA-vfmq-68hx-4jfw (XXE in iterparse)
|
|
]
|
|
xml = [
|
|
"unstructured[local-inference, all-docs]>=0.17.2"
|
|
]
|
|
oxylabs = [
|
|
"oxylabs==2.0.0"
|
|
]
|
|
mongodb = [
|
|
"pymongo>=4.13"
|
|
]
|
|
mysql = [
|
|
"pymysql>=1.1.1"
|
|
]
|
|
postgresql = [
|
|
"psycopg2-binary>=2.9.10"
|
|
]
|
|
bedrock = [
|
|
"beautifulsoup4>=4.13.4",
|
|
"bedrock-agentcore>=1.18.1,<2.0.0",
|
|
"playwright>=1.52.0",
|
|
"nest-asyncio>=1.6.0",
|
|
]
|
|
contextual = [
|
|
"contextual-client>=0.1.0",
|
|
"nest-asyncio>=1.6.0",
|
|
]
|
|
daytona = [
|
|
"daytona~=0.140.0",
|
|
]
|
|
|
|
e2b = [
|
|
"e2b~=2.20.0",
|
|
"e2b-code-interpreter~=2.6.0",
|
|
]
|
|
|
|
|
|
[tool.uv]
|
|
exclude-newer = "3 days"
|
|
|
|
[build-system]
|
|
requires = ["hatchling"]
|
|
build-backend = "hatchling.build"
|
|
|
|
[tool.hatch.version]
|
|
path = "src/crewai_tools/__init__.py"
|