[justgithubaccount]

Scope (Draft — migration validation, not production activation)

Related to #15 and parent audit justgithubaccount/app-poly-gitops-infra#27.

• CrewAI 1.15.33 with native OpenAI SDK and opt-in OpenRouter; no LiteLLM package, proxy, service or gateway.
• Existing API, flows, mutation guards, telemetry and container behavior preserved.
• Explicit memory=False plus regression proof that no Chroma client, memory, knowledge source or storage initializes.

Current upstream gate — checked 2026-10-30

Exact head remains cb228e529a49a8dc6f07ee5179eb947af98260d8; base a313a39eb79481b9ed155c1ee99fc0e3c26af63c. No source or lock change was justified by the refresh.

PyPI and GitHub still publish ChromaDB 1.5.9 as the latest stable package. CrewAI 1.15.33 remains the latest stable CrewAI release and declares chromadb~=1.5.9 (>=1.5.9,<1.6.0); LiteLLM remains an unselected optional extra.

Fresh pip-audit 2.10.1 of the exact locked Python 3.12.12 environment inspected 160 dependencies and returned five rows / four unique ChromaDB advisories:

• PYSEC-2026-311 / GHSA-f4j7-r4q5-qw2c / CVE-2026-45829, critical;
• PYSEC-2026-3813 / GHSA-2wm9-hf6c-p5cr / CVE-2026-45830, high;
• PYSEC-2026-3814 / GHSA-36p7-vc44-83pf / CVE-2026-45833, critical;
• PYSEC-2026-3815 / GHSA-xph7-9rjv-w5fr / CVE-2026-45831, high.

All four reviewed GitHub advisories still have first_patched_version: null; pip-audit reports empty fix_versions. Chroma PR #7237 merged source validation for CVE-2026-45829 after the 1.5.9 tag, but no wheel contains it and the PR does not establish published coverage for CVE-2026-45833. Chroma PR #7602, intended to address the Python-server tenant/resource authorization defects behind CVE-2026-45830/45831, is open and unmerged. Chroma #7909/#7966 and CrewAI #8313 remain open.

Reachability and boundary

The image starts only auto_k8s_pilot.api on port 8000, not a Chroma server. The app creates no Chroma HttpClient/PersistentClient and defines no memory, knowledge or storage. The regression suite fails if Crew construction initializes PersistentClient. The four published Python-server and poisoned-client paths are therefore not reached by the current application configuration.

The affected package is still installed and imported transitively by CrewAI, and no live-cluster exposure check or operator risk acceptance exists. This is containment, not vulnerability removal or security clearance. Enabling Chroma memory/knowledge/client/server invalidates the assessment.

Validation and status

• refreshed uv sync --locked --dev and uv lock --check: PASS;
• dependency graph: auto-k8s-pilot 0.1.3 -> crewai 1.15.33 -> chromadb 1.5.9; no LiteLLM node;
• fresh audit evidence SHA-256: 954384bc1106ada3d1316adcb30c7f9b6332f341c93f73d2097d6d32e6200a04;
• unchanged exact-head Actions 41065650147: test and built container jobs PASS, including 70 tests, kubectl client and /health, /flows, /agents smoke;
• PR remains open, Draft and mergeable. No live LLM request was made.

Verdict: WAITING_UPSTREAM / SECURITY_BLOCKED_FOR_OPERATOR. A compatible update is unblocked only when a stable Chroma wheel within CrewAI's supported constraint (or a new stable CrewAI constraint) contains verified fixes for all four advisories, the published advisory metadata identifies patched versions, and a regenerated exact lock passes audit plus the complete offline/container suite. Unreleased Git commits and forced overrides are not acceptable substitutes.

No merge, release, image publication, deployment, Kubernetes/Argo/cloud mutation or credential switch is included.