v4.5.0.1

swirlai/swirl-searchv4.5.0.1May 19, 2026by sid-swirl

AI Summary

A security patch that re-freezes Python dependencies to address approximately 30 vulnerabilities reported by Docker Scout, including two critical CVEs.

Key Highlights

Addresses 2 critical CVEs (nltk and litellm) and 26 high-severity CVEs.
Updates dependencies such as openai, snowflake-connector-python, and cryptography.
No SWIRL application code changes; a drop-in replacement.

Full Release Notes

# 🔒 SWIRL Community 4.5.0.1 — Security Patch

This release re-freezes Python dependencies to clear ~30 vulnerabilities reported by Docker Scout. No SWIRL application code changed.

⭐ PLEASE STAR OUR REPO: [https://github.com/swirlai/swirl-search](https://github.com/swirlai/swirl-search)
🌐 PLEASE VISIT OUR WEBSITE: [https://www.swirlaiconnect.com/](https://www.swirlaiconnect.com/)

---

## Updates

⚠️ **2 critical CVEs** addressed (CVSS ≥ 9.0):

- `nltk 3.9.2 → 3.9.4` — **CVE-2025-14009** (CVSS 10.0)
- `litellm 1.83.0 → 1.83.10` — **CVE-2026-42208** (CVSS 9.3)

Plus 26 high-severity CVEs across `Django`, `urllib3`, `cryptography`, `ujson`, `pyOpenSSL`, `lxml`, `PyJWT`, `pyasn1`, `azure-core`, `cbor2`, `protobuf`, `orjson`, and previously-transitive `wheel` + `jaraco.context`.

Some upstream constraints forced additional version moves:

- `openai 2.9.0 → 2.24.0` — required by `litellm 1.83.10`
- `snowflake-connector-python 3.17.3 → 4.5.0` — required for `cffi 2.0.0` (which `cryptography 46.0.5` requires)
- `cffi 1.17.1 → 2.0.0`

The OpenAI integration path has been re-validated against both OpenAI and Anthropic models via LiteLLM.

## Deferred

- `twisted 25.5.0 → 26.4.0` — fix is currently only available as a release candidate (`26.4.0rc2`). Will be picked up in 4.5.1 / 4.6 once `26.4.0` final ships. The associated CVE-2026-42304 (CVSS 7.5) is acknowledged but does not affect the SWIRL request path in normal deployment.

## Upgrading

⚠️ **No database migration required.** 4.5.0.1 is a drop-in replacement for 4.5.0.0.