chore: bump json-repair to 0.60.1, drop fixed vuln ignores in scan

[theCyberTech]

Summary

• Bump json-repair from ~=0.25.2 to ~=0.60.1 (fixes GHSA-xf7x-x43h-rpqh).
• uv.lock regenerated: json-repair 0.25.3 → 0.60.1. pyOpenSSL is already at 26.2.0 (≥ 26.0.0), covering CVE-2026-27448 and CVE-2026-27459.
• Remove the --ignore-vuln exclusions for CVE-2026-27448, CVE-2026-27459, and GHSA-xf7x-x43h-rpqh from vulnerability-scan.yml (remaining ignores for nltk/torch/chromadb have no available fixes).
• Adapt _safe_repair_json in lib/crewai/src/crewai/agents/parser.py to json-repair 0.60 semantics: plain text now repairs to '' and brace-enclosed junk to a single-element list; both are treated as unrepairable so the original tool input is preserved.

Tests

• test_crew_agent_parser.py and test_tool_usage.py pass with json-repair 0.60.1.
• Remaining local failures are environmental only (missing optional extras: litellm, anthropic, google-genai, a2a) and unrelated to this change.

[coderabbitai]

📝 Walkthrough

Walkthrough

The changes update GitPython, pyasn1, and json-repair dependency constraints, revise vulnerability scan exclusions, and adjust JSON repair handling for newer json-repair behavior.

Changes

Dependency and JSON repair updates

Layer / File(s)	Summary
Security dependency constraints .github/workflows/vulnerability-scan.yml, lib/crewai-tools/pyproject.toml, pyproject.toml	GitPython minimum versions and the pyasn1 override are raised, while the pip-audit vulnerability ignore list is updated.
JSON repair compatibility lib/crewai/pyproject.toml, lib/crewai/src/crewai/agents/parser.py, lib/crewai/src/crewai/tools/tool_usage.py	json-repair is upgraded to 0.60.1; parser handling preserves original input for falsy, unrepairable, or list-wrapped non-JSON results, and import suppression comments are removed.

Suggested reviewers: lorenzejay

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: upgrading json-repair and removing fixed vulnerability ignores.
Description check	✅ Passed	The description is directly related to the dependency bump, scan ignore updates, and parser adjustments in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/vulnerability-scan-updates

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates CrewAI’s Python dependency set to remediate a json-repair security advisory and tightens the GitHub Actions vulnerability scan configuration by removing now-unneeded ignore rules.

Changes:

• Bump json-repair dependency from ~=0.25.2 to ~=0.60.1.
• Regenerate uv.lock to reflect the new resolved dependency graph (including updated markers).
• Remove pip-audit ignore entries for vulnerabilities that should be fixed by the updated dependency set.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
uv.lock	Regenerated lockfile reflecting json-repair 0.60.1 and updated resolution markers.
lib/crewai/pyproject.toml	Updates the project dependency constraint for json-repair to ~=0.60.1.
.github/workflows/vulnerability-scan.yml	Removes pip-audit ignore rules for vulnerabilities expected to be resolved by the dependency updates.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 2 comments.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@lib/crewai/src/crewai/agents/parser.py`:
- Around line 176-181: Preserve the untouched tool input before the triple-quote
normalization in the parser flow, then return that original value from both
fallback branches in the result handling around UNABLE_TO_REPAIR_JSON_RESULTS
and the single-element-list check. Add a regression test covering input
containing """, verifying fallback returns it verbatim.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 726e74d6-ef9e-4dd7-a786-4ed1548d8810

📥 Commits

Reviewing files that changed from the base of the PR and between 3bb8753 and 93f3241.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (6)

• .github/workflows/vulnerability-scan.yml
• lib/crewai-tools/pyproject.toml
• lib/crewai/pyproject.toml
• lib/crewai/src/crewai/agents/parser.py
• lib/crewai/src/crewai/tools/tool_usage.py
• pyproject.toml

💤 Files with no reviewable changes (1)

• .github/workflows/vulnerability-scan.yml