github-featured / infiniflow--ragflow

发布

0 发布 98 Git 标签

RSS 订阅源
  • dev-20260722 6a85d1c5c4
    比较

    migrate: replace zhipuai with zai-sdk to unblock pyjwt CVE fix (#17197)

    frostbyte_neo 发布于 2026-07-21 14:24:29 +00:00

    Summary

    Old zhipuai==2.0.1 SDK (MetaGLM/zhipuai-sdk-python-v4) requires
    pyjwt~=2.8.0, which blocks upgrading pyjwt past 2.8.0 to address
    active CVEs. The upstream project now recommends the maintained
    successor zai-sdk.

    zai-sdk relaxes the pyjwt constraint to >=2.9.0,<3.0.0, allowing
    pyjwt 2.13.0+. The embedding API surface (client.embeddings.create) is
    identical, no functional changes required.

    Related CVE's:

    • CVE-2026-48522
    • CVE-2026-48524
    • CVE-2026-48525
    • CVE-2026-48526
    • CVE-2026-32597
    下载附件