Devin AI 614354df4c fix: replace insecure pickle deserialization with JSON serialization ...

Fixes #4746 - Security: Insecure Pickle Deserialization enables Arbitrary Code Execution

- Replace pickle.load/dump with json.load/dump in PickleHandler (file_handler.py)
- Add backward compatibility to auto-migrate legacy .pkl files to .json
- Replace PickleSerializer with JSON-based _CachedUploadSerializer in upload_cache.py
- Replace PickleSerializer with JsonSerializer in file_store.py and agent_card.py
- Update and add comprehensive security tests for all changes

Co-Authored-By: João <joao@crewai.com>

2026-03-06 15:19:49 +00:00

..

fixtures

feat: native multimodal file handling; openai responses api

2026-01-23 15:13:25 -05:00

processing

feat: native multimodal file handling; openai responses api

2026-01-23 15:13:25 -05:00

test_file_url.py

feat: native multimodal file handling; openai responses api

2026-01-23 15:13:25 -05:00

test_resolved.py

feat: native multimodal file handling; openai responses api

2026-01-23 15:13:25 -05:00

test_resolver.py

feat: native multimodal file handling; openai responses api

2026-01-23 15:13:25 -05:00

test_upload_cache.py

fix: replace insecure pickle deserialization with JSON serialization

2026-03-06 15:19:49 +00:00