Skip to content

Commit 17f107c

Browse files
authored
fix(deps): bump gitpython to 3.1.58 in crewai-tools[github] (#6885)
gitpython 3.1.57 has GHSA-9rj7-rf2p-w77r, GHSA-4gmw-gg2m-w46p, GHSA-hh9p-6wh2-4mfc, GHSA-wvpp-8hx9-p66j and GHSA-jm78-9fvv-mhgr (further unguarded git option forwarding / arbitrary file read via --pathspec-from-file). All are fixed in 3.1.58, which the root override-dependencies already require; align the crewai-tools github extra with it and regenerate the lockfile.
1 parent f7ba8e3 commit 17f107c

2 files changed

Lines changed: 7 additions & 4 deletions

File tree

lib/crewai-tools/pyproject.toml

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -107,9 +107,12 @@ stagehand = [
107107
"stagehand>=0.4.1",
108108
]
109109
github = [
110-
# <3.1.57 has GHSA-p538-c434-8v24 (arbitrary file truncation) and
111-
# GHSA-3f7w-8rr8-f37f (unguarded git option forwarding).
112-
"gitpython>=3.1.57,<4",
110+
# <3.1.58 has GHSA-p538-c434-8v24 (arbitrary file truncation),
111+
# GHSA-3f7w-8rr8-f37f (unguarded git option forwarding),
112+
# GHSA-9rj7-rf2p-w77r, GHSA-4gmw-gg2m-w46p, GHSA-hh9p-6wh2-4mfc,
113+
# GHSA-wvpp-8hx9-p66j and GHSA-jm78-9fvv-mhgr (further unguarded git
114+
# option forwarding / arbitrary file read); force 3.1.58+.
115+
"gitpython>=3.1.58,<4",
113116
"PyGithub==1.59.1",
114117
]
115118
rag = [

uv.lock

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)