chore: bump json-repair to 0.60.1 and un-ignore fixed vulns in scan

- json-repair 0.25.3 -> 0.60.1 (fixes GHSA-xf7x-x43h-rpqh)
- pyOpenSSL already at 26.2.0 in lock (covers CVE-2026-27448, CVE-2026-27459)
- remove the corresponding --ignore-vuln flags from vulnerability-scan.yml

Author: theCyberTech

.github/workflows/vulnerability-scan.yml

@@ -53,12 +53,9 @@ jobs:
             --skip-editable
             --format json
             --output pip-audit-report.json
-            --ignore-vuln CVE-2026-27448      # pyOpenSSL: fixes require 26.0.0, blocked by snowflake-connector-python 3.x.
-            --ignore-vuln CVE-2026-27459      # pyOpenSSL: same constraint as CVE-2026-27448.
             --ignore-vuln PYSEC-2026-597      # nltk 3.9.4 (CVE-2026-12243): no fix available, transitive through crewai-tools[xml] -> unstructured.
             --ignore-vuln GHSA-rrmf-rvhw-rf47 # torch 2.12.0 (CVE-2025-3000): local-only memory corruption in torch.jit.script; no fix available.
             --ignore-vuln GHSA-f4j7-r4q5-qw2c # chromadb 1.1.1 (CVE-2026-45829): pre-auth RCE in the HTTP server; no fix available.
-            --ignore-vuln GHSA-xf7x-x43h-rpqh # json-repair 0.25.3: the affected schema module is absent, and CrewAI does not pass schemas.
           )
           uv run pip-audit "${pip_audit_args[@]}"
         continue-on-error: true

lib/crewai/pyproject.toml

@@ -32,7 +32,7 @@ dependencies = [
     "click>=8.1.7,<9",
     "appdirs~=1.4.4",
     "jsonref~=1.1.0",
-    "json-repair~=0.25.2",
+    "json-repair~=0.60.1",
     "cel-python>=0.5.0,<0.6",
     "tomli-w~=1.1.0",
     "tomli~=2.0.2",