From 108f7da9076500e0f58cceb55f15387269182e8b Mon Sep 17 00:00:00 2001
From: Alexsander Hamir <alexsanderhamirgomesbaptista@gmail.com>
Date: Mon, 5 Jan 2026 15:53:54 -0800
Subject: [PATCH] Fix security vulnerabilities in UI dashboard: Update next to
 14.2.35 and qs to 6.14.1

- Fix GHSA-5j59-xgg2-r9c4 and GHSA-mwv6-3258-q52c: Update next from 14.2.33 to 14.2.35
- Fix CVE-2025-15284: Update qs from 6.13.0 to 6.14.1
- Add override for qs to enforce fixed version
---
 ui/litellm-dashboard/package-lock.json | 24 ++++++++++++------------
 ui/litellm-dashboard/package.json      |  5 +++--
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/ui/litellm-dashboard/package-lock.json b/ui/litellm-dashboard/package-lock.json
index 641db8b107d..3ceeb9a5d61 100644
--- a/ui/litellm-dashboard/package-lock.json
+++ b/ui/litellm-dashboard/package-lock.json
@@ -26,7 +26,7 @@
         "jwt-decode": "^4.0.0",
         "lucide-react": "^0.513.0",
         "moment": "^2.30.1",
-        "next": "^14.2.32",
+        "next": "^14.2.35",
         "openai": "^4.93.0",
         "papaparse": "^5.5.2",
         "react": "^18",
@@ -4779,9 +4779,9 @@
       }
     },
     "node_modules/@next/env": {
-      "version": "14.2.33",
-      "resolved": "https://registry.npmjs.org/@next/env/-/env-14.2.33.tgz",
-      "integrity": "sha512-CgVHNZ1fRIlxkLhIX22flAZI/HmpDaZ8vwyJ/B0SDPTBuLZ1PJ+DWMjCHhqnExfmSQzA/PbZi8OAc7PAq2w9IA==",
+      "version": "14.2.35",
+      "resolved": "https://registry.npmjs.org/@next/env/-/env-14.2.35.tgz",
+      "integrity": "sha512-DuhvCtj4t9Gwrx80dmz2F4t/zKQ4ktN8WrMwOuVzkJfBilwAwGr6v16M5eI8yCuZ63H9TTuEU09Iu2HqkzFPVQ==",
       "license": "MIT"
     },
     "node_modules/@next/eslint-plugin-next": {
@@ -18237,12 +18237,12 @@
       "license": "MIT"
     },
     "node_modules/next": {
-      "version": "14.2.33",
-      "resolved": "https://registry.npmjs.org/next/-/next-14.2.33.tgz",
-      "integrity": "sha512-GiKHLsD00t4ACm1p00VgrI0rUFAC9cRDGReKyERlM57aeEZkOQGcZTpIbsGn0b562FTPJWmYfKwplfO9EaT6ng==",
+      "version": "14.2.35",
+      "resolved": "https://registry.npmjs.org/next/-/next-14.2.35.tgz",
+      "integrity": "sha512-KhYd2Hjt/O1/1aZVX3dCwGXM1QmOV4eNM2UTacK5gipDdPN/oHHK/4oVGy7X8GMfPMsUTUEmGlsy0EY1YGAkig==",
       "license": "MIT",
       "dependencies": {
-        "@next/env": "14.2.33",
+        "@next/env": "14.2.35",
         "@swc/helpers": "0.5.5",
         "busboy": "1.6.0",
         "caniuse-lite": "^1.0.30001579",
@@ -21073,12 +21073,12 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.13.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.13.0.tgz",
-      "integrity": "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==",
+      "version": "6.14.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.1.tgz",
+      "integrity": "sha512-4EK3+xJl8Ts67nLYNwqw/dsFVnCf+qR7RgXSK9jEEm9unao3njwMDdmsdvoKBKHzxd7tCYz5e5M+SnMjdtXGQQ==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.0.6"
+        "side-channel": "^1.1.0"
       },
       "engines": {
         "node": ">=0.6"
diff --git a/ui/litellm-dashboard/package.json b/ui/litellm-dashboard/package.json
index e366b4febff..8ebdf3f35e2 100644
--- a/ui/litellm-dashboard/package.json
+++ b/ui/litellm-dashboard/package.json
@@ -31,7 +31,7 @@
     "jwt-decode": "^4.0.0",
     "lucide-react": "^0.513.0",
     "moment": "^2.30.1",
-    "next": "^14.2.32",
+    "next": "^14.2.35",
     "openai": "^4.93.0",
     "papaparse": "^5.5.2",
     "react": "^18",
@@ -79,7 +79,8 @@
     "mermaid": ">=11.10.0",
     "js-yaml": ">=4.1.1",
     "glob": ">=11.1.0",
-    "node-forge": ">=1.3.2"
+    "node-forge": ">=1.3.2",
+    "qs": ">=6.14.1"
   },
   "engines": {
     "node": ">=18.17.0",