StdioTransport enhancement + bug fixes + ACP Beta docs
crewAI
AI Agents & AssistantsFramework for orchestrating role-playing, autonomous AI agents. By fostering collaborative intelligence, CrewAI empowers agents to work together seamlessly, tackling complex tasks.
Features
- Multi‑agent orchestration with high‑level simplicity and low‑level control
- Enterprise‑grade Flows for event‑driven, precise task orchestration
- Crews that enable autonomous collaboration between agents
Security Response History
2 CVEs| CVE | Severity | Disclosed | Patched (this tool) | vs Ecosystem Median |
|---|---|---|---|---|
| CVE-2026-42208 KEV |
critical
CVSS 9.8
|
2026-05-08 | 2026-05-18 | 11d |
| CVE-2023-4863 KEV |
high
CVSS 8.8
|
2023-09-13 | 2026-01-08 | 2y 4mo / median 2y 4mo |
Recent releases
View all 21 releases →CrewAgentExecutor deprecation + tool rename
- Support for custom persistence key in @persist decorator
- Responses API integration with Azure OpenAI provider
- Vertex AI workload identity federation setup guide
Full changelog
What's Changed
Features
- Add support for custom persistence key in @persist
- Add Responses API support for Azure OpenAI provider
- Forward credential_scopes to Azure AI Inference client
- Add Vertex AI workload identity setup guide
- Add Tavily Research and get Research
- Add You.com MCP tools for search, research, and content extraction
Bug Fixes
- Fix fall through when JSON regex match isn't valid JSON
- Fix to preserve tool_calls when response also contains text
- Fix to forward base_url and api_key to instructor.from_provider
- Fix to warn and return empty when native MCP server returns no tools
- Fix to use validated messages variable in non-streaming handlers
- Fix to guard crew chat description helpers against LLM failures
- Fix to reset messages and iterations between invocations
- Fix to forward trained-agents file through replay and test
- Fix to honor custom trained-agents file at inference
- Fix to bind task-only agents to crew for multimodal input_files
- Fix to serialize guardrail callables as null for JSON checkpointing
- Fix renaming of force_final_answer to avoid self-referential router
- Fix bump of litellm for SSTI fix; ignore unfixable pip CVE
Documentation
- Update changelog and version for v1.14.4a1
- Add E2B Sandbox Tools page
- Add Daytona sandbox tools documentation
Contributors
@EdwardIrby, @dependabot[bot], @factory-droid-oss, @factory-droid[bot], @greysonlalonde, @kunalk16, @lorenzejay, @lucasgomide, @manisrinivasan2k1, @mattatcha, @vinibrsl
- Upgraded lxml to >=6.1.0 for security patch
- Bumped python-dotenv to >=1.2.2 for security patch
- Checkpoint and fork support for standalone agents
- Lifecycle events for checkpoint operations
- Bedrock V4 support with e2b and Daytona sandbox tools
Full changelog
What's Changed
Features
- Add lifecycle events for checkpoint operations
- Add support for e2b
- Fall back to DefaultAzureCredential when no API key is provided in Azure integration
- Add Bedrock V4 support
- Add Daytona sandbox tools for enhanced functionality
- Add checkpoint and fork support to standalone agents
Bug Fixes
- Fix execution_id to be separate from state.id
- Resolve replay of recorded method events on checkpoint resume
- Fix serialization of initial_state class references as JSON schema
- Preserve metadata-only agent skills
- Propagate implicit @CrewBase names to crew events
- Merge execution metadata on duplicate batch initialization
- Fix serialization of Task class-reference fields for checkpointing
- Handle BaseModel result in guardrail retry loop
- Preserve thought_signature in Gemini streaming tool calls
- Emit task_started on fork resume and redesign checkpoint TUI
- Use future dates in checkpoint prune tests to prevent time-dependent failures
- Fix dry-run order and handle checked-out stale branch in devtools release
- Upgrade lxml to >=6.1.0 for security patch
- Bump python-dotenv to >=1.2.2 for security patch
Documentation
- Update changelog and version for v1.14.3
- Add 'Build with AI' page and update navigation for all languages
- Remove pricing FAQ from build-with-ai page across all locales
Performance
- Optimize MCP SDK and event types to reduce cold start by ~29%
Refactoring
- Refactor checkpoint helpers to eliminate duplication and tighten state type hints
Contributors
@MatthiasHowellYopp, @akaKuruma, @alex-clawd, @github-actions[bot], @github-advanced-security[bot], @greysonlalonde, @iris-clawd, @lorenzejay, @mattatcha, @renatonitta
- Patched vulnerabilities in authlib, langchain-text-splitters, pypdf, requests, cryptography, and pytest
- Checkpoint resume, diff, and prune commands
- from_checkpoint parameter for Agent.kickoff
- Checkpoint forking with lineage tracking
Full changelog
What's Changed
Features
- Add checkpoint resume, diff, and prune commands with improved discoverability.
- Add
from_checkpointparameter toAgent.kickoffand related methods. - Add template management commands for project templates.
- Add resume hints to devtools release on failure.
- Add deploy validation CLI and enhance LLM initialization ergonomics.
- Add checkpoint forking with lineage tracking.
- Enrich LLM token tracking with reasoning tokens and cache creation tokens.
Bug Fixes
- Fix prompt on stale branch conflicts in devtools release.
- Patch vulnerabilities in
authlib,langchain-text-splitters, andpypdf. - Scope streaming handlers to prevent cross-run chunk contamination.
- Dispatch Flow checkpoints through Flow APIs in TUI.
- Use recursive glob for JSON checkpoint discovery.
- Handle cyclic JSON schemas in MCP tool resolution.
- Preserve Bedrock tool call arguments by removing truthy default.
- Emit flow_finished event after HITL resume.
- Fix various vulnerabilities by updating dependencies, including
requests,cryptography, andpytest. - Fix to stop forwarding strict mode to Bedrock Converse API.
Documentation
- Document missing parameters and add Checkpointing section.
- Update changelog and version for v1.14.2 and previous release candidates.
- Add enterprise A2A feature documentation and update OSS A2A docs.
Contributors
@Yanhu007, @alex-clawd, @github-actions[bot], @greysonlalonde, @iris-clawd, @lorenzejay, @lucasgomide
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.