crewAI 1.15.31

crewAI 1.15.31 fixes a path traversal bug that let run-time inputs decide where a task wrote its output file. crewAI is an open-source Python framework for orchestrating teams of AI agents, and a task in it can declare an `output_file` with placeholders such as `{topic}` that are filled from inputs when the crew runs. The framework validated that path when the task was created but not after the placeholders were filled, so an input like `../../etc/cron.d` could send the file to any location the process could write, according to a pull request that carries the same title as the release-note entry and was merged the day before the release.

That pull request checks the path again after filling it, rejecting `..`, shell characters and leftover placeholders, and refuses inputs that turn a relative template into an absolute path. A rejected value is no longer stored on the task, so a later run without inputs cannot reuse it. Applications that pass user-supplied text into output paths will now get a `ValueError` for such inputs, while absolute templates written by the developer, such as `/var/out/{topic}.txt`, still work. The release notes also list patches for deserialization, SQL injection and other path traversal vulnerabilities without saying where they were.