rayhan bcf1570ba4 fix: remediate CVE's by upgrading lxml and lxml_html_clean (#17366) ...

## Summary
  
Remediates four CVEs in `lxml` and `lxml_html_clean` by upgrading
transitive dependency constraints and bumping `crawl4ai` to unblock the
resolution.
  
  | CVE | Severity | Package | Installed | Fixed in |
  |---|---|---|---|---|
  | CVE-2026-41066 | HIGH | lxml | 5.4.0 | 6.1.0 |
  | CVE-2026-49825 | HIGH | lxml_html_clean | 0.4.3 | 0.4.5 |
  | CVE-2026-28348 | MEDIUM | lxml_html_clean | 0.4.3 | 0.4.5 |
  | CVE-2026-28350 | MEDIUM | lxml_html_clean | 0.4.3 | 0.4.5 |
  

- Bumped `crawl4ai` from `>=0.9.0,<0.9.1` to `>=0.9.2,<0.9.3`, version
0.9.2 relaxes lxml constraint to `>=5.3,<7`. The strict `<0.9.3` upper
bound on crawl4ai is maintained per project convention
- Added `inscriptis>=2.7.3` to `constraint-dependencies`, version 2.7.3
relaxes lxml constraint to `>=5.4.0,<6.2.0`
- Added `lxml>=6.1.0` to `constraint-dependencies`
- Added `lxml_html_clean>=0.4.5` to `constraint-dependencies`

`exclude-dependencies` entry for `unclecode-litellm` (still declared by
crawl4ai 0.9.2) continues to prevent the namespace collision that
previously crashed RAGFlow.
  
## Verification
  
- `lxml` is used widely across the codebase for HTML/XML parsing. The
5.x → 6.x upgrade maintains API compatibility for standard usage
(`lxml.html`, `lxml.etree`).
  - `lxml_html_clean` API is unchanged between 0.4.3 and 0.4.5.
- `crawl4ai` 0.9.2 is a patch bump from 0.9.0 with no API changes
affecting RAGFlow's usage.
  - `inscriptis` 2.7.3 is a patch bump from 2.7.0.
  
## Testing
  
  - Full unit test suite passes
  - `uv sync` resolves cleanly
  - Verified `crawl4ai` imports without litellm namespace collision

2026-07-24 20:27:34 +08:00

12 KiB

Raw Blame History

View Raw