Joao Moura dd0f536616 fix(deps): stop capping chromadb at 1.1.x so the CVE-2026-45829 patch can land ...

CVE-2026-45829 (pre-auth code injection in the ChromaDB server) has no
patched release yet — every 1.x up to 1.5.9 is in the vulnerable range.
The compatible-release pin ~=1.1.0 would silently block the 1.6+ patch
the moment it ships, forcing users to wait for a crewai release to
remediate a CRITICAL.

Relax the requirement to >=1.1.0,<2.0.0 and lock to the current top of
the range (1.5.9), validated against the rag/memory/knowledge suites.
Adds a regression test asserting the specifier keeps the 1.x line open.

Linear: OSS-90

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-13 20:58:27 -07:00

..

__init__.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_chromadb_pin.py

fix(deps): stop capping chromadb at 1.1.x so the CVE-2026-45829 patch can land

2026-07-13 20:58:27 -07:00

test_deterministic_fingerprints.py

chore(crewai): drop self-explanatory comments

2026-05-26 10:23:33 -07:00

test_examples.py

chore(crewai): drop self-explanatory comments

2026-05-26 10:23:33 -07:00

test_fingerprint.py

chore(crewai): drop self-explanatory comments

2026-05-26 10:23:33 -07:00

test_integration.py

chore(crewai): drop self-explanatory comments

2026-05-26 10:23:33 -07:00

test_security_config.py

chore(crewai): drop self-explanatory comments

2026-05-26 10:23:33 -07:00