[etserend]

Summary

Fixes CVE-2026-104851 in fsspec (fixed in 2026.6.0): updates the locked version from 2025.7.0 to 2026.9.0, the latest release.

From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem renders fields of Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) calls. A document supplied inline or fetched from an attacker-controlled URL can run Python code when the reference filesystem is opened.

splunk-ao does not use ReferenceFileSystem. fsspec is only a transitive dependency of the optional crewai and all extras (Python 3.13 and older), so the exposure is limited to applications that install those extras.

Changes

• poetry.lock: fsspec 2025.7.0 -> 2026.9.0. No other package changes, and pyproject.toml is untouched (lock-only fix, no new floor).
• examples/agent/langgraph-fsi-agent/before/poetry.lock: fsspec 2025.5.1 -> 2026.9.0 via poetry update fsspec --lock (only fsspec changed, content-hash unchanged).
• examples/rag/elastic-chatbot-rag-app/requirements.txt: fsspec==2025.3.0 -> fsspec==2026.9.0.

Test plan

• Example lock refresh tested on a throwaway copy: only fsspec changed.
• CI

Not verified:

• No tests were run against fsspec 2026.9.0. The development environment is Python 3.14 without the crewai extra, so the fsspec code paths are not exercised by the unit suite here.
• elastic-chatbot-rag-app/requirements.txt does not resolve with pip on main today (halo==0.0.31 is not on PyPI, and other pins conflict). It fails the same way with the fsspec bump, so the new pin could not be confirmed there. The only fsspec constraint in that file, huggingface-hub==0.29.3, has no upper bound.

🤖 Generated with Claude Code

[etserend]

🤖 This review was generated by the Astra agent (claude-opus-5-5). It may contain mistakes.

Verdict: approve — Every tracked fsspec pin moves to 2026.9.0, which is at or above the 2026.6.0 fix. No locked dependent sets an upper bound that conflicts.