Joao Moura dd0f536616 fix(deps): stop capping chromadb at 1.1.x so the CVE-2026-45829 patch can land ...

CVE-2026-45829 (pre-auth code injection in the ChromaDB server) has no
patched release yet — every 1.x up to 1.5.9 is in the vulnerable range.
The compatible-release pin ~=1.1.0 would silently block the 1.6+ patch
the moment it ships, forcing users to wait for a crewai release to
remediate a CRITICAL.

Relax the requirement to >=1.1.0,<2.0.0 and lock to the current top of
the range (1.5.9), validated against the rag/memory/knowledge suites.
Adds a regression test asserting the specifier keeps the 1.x line open.

Linear: OSS-90

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-13 20:58:27 -07:00

1.6 MiB

Raw Blame History

View Raw