mirror of
https://github.com/agent0ai/agent-zero.git
synced 2026-10-16 12:50:02 +00:00
b91384f4fb
Update LiteLLM to 1.104.0, OpenAI to 2.54.0, and python-dotenv to 1.2.2. Raise shared security floors for aiohttp, anyio, urllib3, filelock, fsspec, and multidict while retaining the compatible OpenAI 2.x SDK line. Use the existing startup_migration hook to apply the same requirements to v2.x Docker instances updating to v2.14. Read versions from requirements.txt, install only when requirements are unmet, and reuse restart_process() to load the upgraded SDKs before serving requests. Skip current and non-Docker environments, bound installation time, and propagate installation failures. Add installed-SDK HTTP tests for Chat Completions, Responses, streaming, tools, state, usage, fallback, embeddings, and Anthropic cache markers. Cover dependency migration, restart behavior, and installation failures. Validation: - 70 focused dependency, SDK, and self-update tests passed. - Docker startup upgraded the v2.0-v2.13 SDK pins and became healthy in 24 seconds, with exactly one dependency installation and process restart. - An already-current startup performed no installation or extra restart. - pip check passed; live Codex Responses and Moonshot Chat Completions tasks and follow-ups validated the upgraded SDK versions.
75 lines
2.3 KiB
Text
75 lines
2.3 KiB
Text
a2wsgi==1.10.8
|
|
ansio==0.0.1
|
|
docker==7.1.0
|
|
duckduckgo-search==6.1.12
|
|
pyreqwest-impersonate==0.5.3 # freeze nearest wheel-backed release; 0.5.5 is source-only
|
|
faiss-cpu==1.11.0
|
|
fastmcp==3.2.4
|
|
fasta2a==0.5.0
|
|
flask[async]==3.0.3
|
|
flask-basicauth==0.2.0
|
|
flaredantic==0.1.5
|
|
GitPython==3.1.43
|
|
giturlparse==0.14.0
|
|
httpx[socks]==0.28.1
|
|
inputimeout==1.0.4
|
|
json_repair==0.63.4
|
|
kokoro>=0.9.2
|
|
simpleeval==1.0.3
|
|
langchain-core==0.3.49
|
|
langchain-community==0.3.19
|
|
langchain-unstructured==0.1.6
|
|
liteparse==2.0.3
|
|
litellm==1.104.0
|
|
openai==2.54.0
|
|
openai-whisper==20250625
|
|
lxml_html_clean>=0.4.0 # CVE-2024-52595 fix: XSS CWE-79 CVSS 8.4
|
|
markdown==3.7
|
|
mcp==1.27.0
|
|
newspaper3k==0.2.8
|
|
paramiko==3.5.0
|
|
patchright==1.61.2
|
|
pypdf==6.0.0
|
|
python-dotenv==1.2.2
|
|
pytz==2024.2
|
|
sentence-transformers==3.0.1
|
|
tiktoken==0.8.0
|
|
unstructured[all-docs]==0.16.23
|
|
unstructured-client==0.31.0
|
|
webcolors==24.6.0
|
|
nest-asyncio==1.6.0
|
|
crontab==1.0.1
|
|
markdownify==1.1.0
|
|
pydantic==2.11.7
|
|
pymupdf==1.25.3
|
|
pytesseract==0.3.13
|
|
pdf2image==1.17.0
|
|
crontab==1.0.1
|
|
pathspec>=0.12.1
|
|
psutil>=7.0.0
|
|
soundfile==0.13.1
|
|
imapclient>=3.0.1
|
|
html2text>=2024.2.26
|
|
beautifulsoup4>=4.12.3
|
|
boto3>=1.35.0
|
|
chardet<6 # unstructured may pull chardet; requests warns when chardet>=6 is present
|
|
exchangelib>=5.4.3
|
|
pywinpty==3.0.2; sys_platform == "win32"
|
|
python-socketio>=5.14.2
|
|
uvicorn>=0.38.0
|
|
watchdog==6.0.0
|
|
wsproto>=1.2.0
|
|
# Security floor pins for transitive dependencies
|
|
# These packages are pulled transitively — floor pins prevent resolver regressions
|
|
Pillow>=10.2.0 # security floor: heap buffer overflow CWE-122, eval injection CWE-95, DoS CWE-400
|
|
nltk>=3.9.3 # security floor: RCE CWE-94, code injection CWE-94
|
|
h11>=0.16.0 # security floor: HTTP request smuggling CWE-444
|
|
urllib3>=2.8.0 # security floor: proxy TLS verification and streaming resource exhaustion
|
|
cryptography>=46.0.0 # security floor: insufficient data authenticity CWE-345
|
|
werkzeug>=3.0.3 # security floor: RCE CWE-94
|
|
starlette==1.0.1 # security fix: Host header validation bypass GHSA-86qp-5c8j-p5mr
|
|
aiohttp>=3.14.3 # security floor: malformed-response parser and WebSocket handling
|
|
anyio>=4.14.2 # security floor: TLS hostname validation and subprocess handling
|
|
filelock>=3.20.3 # security floor: symlink attacks during lock creation
|
|
fsspec>=2026.6.0 # security floor: template injection in reference filesystems
|
|
multidict>=6.9.1 # security floor: items-view reference leaks
|