From 5a1c0e7760a7ab0778f0b8d38d4d8a112ed401a8 Mon Sep 17 00:00:00 2001 From: Kajal Jain Date: Tue, 25 Aug 2026 01:17:40 -0500 Subject: [PATCH 1/2] fix: bump Pillow to 12.3.0 in osworld_agent Pillow was pinned to ~=11.0.0 in osworld_agent while every other agent/resource server in the repo already pins ==12.3.0. Signed-off-by: Kajal Jain --- responses_api_agents/osworld_agent/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/responses_api_agents/osworld_agent/requirements.txt b/responses_api_agents/osworld_agent/requirements.txt index 41dcea31d4..4bc8ff9599 100644 --- a/responses_api_agents/osworld_agent/requirements.txt +++ b/responses_api_agents/osworld_agent/requirements.txt @@ -35,7 +35,7 @@ numpy<2 pynput ag2 -Pillow~=11.0.0 +Pillow==12.3.0 scikit-learn matplotlib~=3.7.4 func-timeout From e25f13e469e304fa8b07d136496ed8a92db15da5 Mon Sep 17 00:00:00 2001 From: Kajal Jain Date: Tue, 25 Aug 2026 01:29:45 -0500 Subject: [PATCH 2/2] fix: override osworld's stale pillow pin osworld==0.1.0 pins pillow>=11.0.0,<11.1.dev0, making the plain requirements.txt bump unsatisfiable. Add an overrides.txt entry to bypass the stale transitive pin, matching the pattern used elsewhere in the repo (e.g. stirrup_agent). Signed-off-by: Kajal Jain --- responses_api_agents/osworld_agent/overrides.txt | 4 ++++ responses_api_agents/osworld_agent/requirements.txt | 2 ++ 2 files changed, 6 insertions(+) diff --git a/responses_api_agents/osworld_agent/overrides.txt b/responses_api_agents/osworld_agent/overrides.txt index 2831314f96..a9b6c0f7c6 100644 --- a/responses_api_agents/osworld_agent/overrides.txt +++ b/responses_api_agents/osworld_agent/overrides.txt @@ -11,6 +11,10 @@ torch==2.11.0 # another Gym server on the repository's Python 3.13 line. matplotlib==3.10.6 +# OSWorld pins pillow<11.1.dev0 (CVE-affected). Bypass the stale constraint +# to install the patched version already used elsewhere in the repo. +pillow==12.3.0 + # SurferH is not loaded by this Gym adapter, and agp-client is not published on # the configured package indexes. agp-client; sys_platform == 'never' diff --git a/responses_api_agents/osworld_agent/requirements.txt b/responses_api_agents/osworld_agent/requirements.txt index 4bc8ff9599..8ca399185b 100644 --- a/responses_api_agents/osworld_agent/requirements.txt +++ b/responses_api_agents/osworld_agent/requirements.txt @@ -35,6 +35,8 @@ numpy<2 pynput ag2 +# osworld pins pillow>=11.0.0,<11.1.dev0; overrides.txt bypasses that stale +# constraint so the CVE fix can install. Pillow==12.3.0 scikit-learn matplotlib~=3.7.4