Devin AI 614354df4c fix: replace insecure pickle deserialization with JSON serialization ...

Fixes #4746 - Security: Insecure Pickle Deserialization enables Arbitrary Code Execution

- Replace pickle.load/dump with json.load/dump in PickleHandler (file_handler.py)
- Add backward compatibility to auto-migrate legacy .pkl files to .json
- Replace PickleSerializer with JSON-based _CachedUploadSerializer in upload_cache.py
- Replace PickleSerializer with JsonSerializer in file_store.py and agent_card.py
- Update and add comprehensive security tests for all changes

Co-Authored-By: João <joao@crewai.com>

2026-03-06 15:19:49 +00:00

..

crew

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

evaluators

feat: use json schema for tool argument serialization

2025-12-11 15:50:19 -05:00

events

chore: restructure test env, cassettes, and conftest; fix flaky tests

2025-11-29 16:55:24 -05:00

__init__.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

prompts.json

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_agent_utils.py

fix: inject tool errors as observations and resolve name collisions

2026-03-01 00:46:04 -05:00

test_console_formatter_pause_resume.py

Improve EventListener and TraceCollectionListener for improved event… (#4160)

2025-12-30 11:36:31 -08:00

test_converter.py

fix: improve output handling and response model integration in agents (#4307)

2026-01-30 12:27:46 -08:00

test_events.py

Add call_id to LLM events for correlating requests (#4281)

2026-02-03 10:10:33 -03:00

test_file_handler.py

fix: replace insecure pickle deserialization with JSON serialization

2026-03-06 15:19:49 +00:00

test_file_store.py

feat: native multimodal file handling; openai responses api

2026-01-23 15:13:25 -05:00

test_files.py

feat: native multimodal file handling; openai responses api

2026-01-23 15:13:25 -05:00

test_i18n.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_import_utils.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_knowledge_planning.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_llm_utils.py

fix: bedrock region was always set to "us-east-1" not respecting the env var. (#4582)

2026-02-24 09:59:01 -08:00

test_planning_handler.py

fix: add idx for task ordering, tests

2025-12-11 10:18:15 -05:00

test_prompts_no_thought_leakage.py

Lorenze/improve tool response pt2 (#4297)

2026-01-28 16:53:19 -08:00

test_pydantic_schema_utils.py

Enhance MCP tool resolution and related events (#4580)

2026-02-26 13:59:30 -08:00

test_serialization.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_string_utils.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_summarize_integration.py

imp compaction (#4399)

2026-02-11 15:52:03 -08:00

test_training_converter.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_training_handler.py

fix: replace insecure pickle deserialization with JSON serialization

2026-03-06 15:19:49 +00:00