2 commits

Author	SHA1	Message	Date
Nicolò Boschi	ea27ef95ec	fix: resolve all Dependabot security vulnerabilities (#486) ... * fix: resolve all Dependabot security vulnerabilities npm (package-lock.json): - fast-xml-parser: 4.5.3 → 4.5.4 (critical entity encoding bypass + DoS) - serialize-javascript: 6.0.2 → 7.0.4 (high RCE via RegExp/Date) - minimatch: 3.1.2 → 3.1.5, 5.1.6 → 5.1.9, 9.0.5 → 9.0.9 (high ReDoS) - ajv: 6.12.6 → 6.14.0, 8.17.1 → 8.18.0 (medium ReDoS with $data option) - qs: 6.14.1 → 6.15.0 (low arrayLimit bypass DoS) - rollup: 4.57.x → 4.59.0 in ai-sdk and openclaw integrations (high path traversal) Python (uv.lock / pyproject.toml): - cryptography: 46.0.3 → 46.0.5 (high subgroup attack on SECT curves) - pillow: 12.0.0 → 12.1.1 (high out-of-bounds write in PSD loading) - langchain-core: 1.2.7 → 1.2.17 (low SSRF in ChatOpenAI token counting) - langsmith: 0.4.42 → 0.7.11 (medium SSRF via tracing header injection) - protobuf: 6.33.1 → 6.33.5 (high JSON recursion depth bypass) Rust (Cargo.lock): - bytes: 1.11.0 → 1.11.1 in hindsight-clients/rust (medium integer overflow) Remaining unfixable: diskcache <= 5.6.3 (no patched version available) * fix: remove over-broad schema-utils ajv override that broke docs build The 'schema-utils': {'ajv': '^8.18.0'} override was forcing schema-utils@3.x (used by url-loader/file-loader with ajv-keywords@3.x) to use ajv@8.18.0. In 8.18.0, internal property _formats was renamed to formats, breaking ajv-keywords@3.x's _formatLimit.js which accesses ajv._formats.date. Removing the broad override: schema-utils@4.3.3 (root level) already has ajv@8.18.0 in its nested install from the prior npm update, while schema-utils@3.x correctly falls back to the hoisted root ajv@6.14.0.	2026-03-04 13:14:50 +01:00
Ben	41db2960c5	feat: add CrewAI integration for persistent crew memory (#319) ... * feat: add CrewAI integration for persistent crew memory Implements a CrewAI ExternalMemory storage backend that maps CrewAI's Storage interface (save/search/reset) to Hindsight's retain/recall/delete APIs, giving crews long-term memory with fact extraction, entity tracking, and temporal awareness across runs. Key features: - HindsightStorage: drop-in Storage backend for CrewAI ExternalMemory - HindsightReflectTool: BaseTool exposing Hindsight's reflect API - Per-agent memory banks with customizable bank resolver - Async compatibility layer for CrewAI's threading model - 35 unit tests, docs site page, example script Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: move CrewAI example to hindsight-cookbook Move research_crew.py example from hindsight-integrations/crewai/examples/ to the cookbook repo and update the integration README to link there instead. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: add GitHub Actions test job for CrewAI integration Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: add uv.lock for frozen installs in CI The test-crewai-integration CI job uses `uv sync --frozen` which requires a committed lock file. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-18 17:05:52 +01:00