Alex 74f0f11e3f fix: close three NL2SQLTool security gaps (writable CTEs, EXPLAIN ANALYZE, multi-stmt commit) ...

- Remove WITH from _READ_ONLY_COMMANDS; scan CTE body for write keywords so
  writable CTEs like `WITH d AS (DELETE …) SELECT …` are blocked in read-only mode.
- EXPLAIN ANALYZE/ANALYSE now resolves the underlying command; EXPLAIN ANALYZE DELETE
  is treated as a write and blocked in read-only mode.
- execute_sql commit decision now checks ALL semicolon-separated statements so
  a SELECT-first batch like `SELECT 1; DROP TABLE t` still triggers a commit
  when allow_dml=True.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-07 09:17:34 -07:00

..

crewai

fix: address CI lint failures and remove unused import

2026-04-07 09:17:34 -07:00

crewai-files

feat: bump versions to 1.14.0a4

2026-04-07 23:22:58 +08:00

crewai-tools

fix: close three NL2SQLTool security gaps (writable CTEs, EXPLAIN ANALYZE, multi-stmt commit)

2026-04-07 09:17:34 -07:00

devtools

feat: bump versions to 1.14.0a4

2026-04-07 23:22:58 +08:00