fix(deps): bump torch to 2.13.0 for GHSA-rrmf-rvhw-rf47 (#6957)

Force torch>=2.13.0 via override-dependencies so the transitive
docling/unstructured stack picks up the CVE-2025-3000 fix, and drop the
now-unnecessary pip-audit ignore. chromadb's CVE-2026-45829 remains
ignored: the upstream fix is merged but not released on PyPI.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rip&Tear <theCyberTech@users.noreply.github.com>

Author: theCyberTech

.github/workflows/vulnerability-scan.yml

@@ -86,8 +86,11 @@ jobs:
             --skip-editable
             --format json
             --output pip-audit-report.json
-            --ignore-vuln GHSA-rrmf-rvhw-rf47 # torch 2.12.0 (CVE-2025-3000): local-only memory corruption in torch.jit.script; no fix available.
-            --ignore-vuln GHSA-f4j7-r4q5-qw2c # chromadb 1.1.1 (CVE-2026-45829): pre-auth RCE in the HTTP server; no fix available.
+            # chromadb <=1.5.9 (CVE-2026-45829 / GHSA-f4j7-r4q5-qw2c): pre-auth RCE in
+            # the Python HTTP server. Fix merged upstream in chroma-core/chroma#7237
+            # but no PyPI release beyond 1.5.9 yet. CrewAI only uses PersistentClient
+            # (embedded), not the HTTP server.
+            --ignore-vuln GHSA-f4j7-r4q5-qw2c
           )
           uv run pip-audit "${pip_audit_args[@]}"
         continue-on-error: true

.pre-commit-config.yaml

@@ -48,7 +48,6 @@ repos:
           --ignore-vuln PYSEC-2025-197
           --ignore-vuln PYSEC-2025-210
           --ignore-vuln PYSEC-2026-139
-          --ignore-vuln GHSA-rrmf-rvhw-rf47
           --ignore-vuln PYSEC-2025-211
           --ignore-vuln PYSEC-2025-212
           --ignore-vuln PYSEC-2025-213

pyproject.toml

@@ -226,6 +226,8 @@ exclude-newer-package = { pypdf = "2026-08-07T00:00:00Z", msgpack = "2026-06-20T
 # h2 <=4.4.0 has GHSA-6hr6-w5qg-qmwg (CVE-2026-71554): duplicate Host headers
 # can facilitate request smuggling; fixed in 4.4.1. Transitive via
 # qdrant-client -> httpx[http2].
+# torch <=2.12.1 has GHSA-rrmf-rvhw-rf47 (CVE-2025-3000): memory corruption in
+# torch.jit.script; fixed in 2.13.0. Transitive via docling/unstructured extras.
 # Keep OpenAI on the SDK range required by CrewAI when transitive dependencies
 # loosen or pin their own lower versions.
 override-dependencies = [
@@ -257,6 +259,7 @@ override-dependencies = [
     "setuptools>=83.0.0", # PYSEC-2026-3447
     "nltk>=3.10.0",
     "h2>=4.4.1",
+    "torch>=2.13.0",
 ]
 
 [tool.uv.workspace]