From 8aa8fbca9fbdb41fe2e6f986546ae81597f5f7d7 Mon Sep 17 00:00:00 2001 From: mateo Date: Wed, 9 Sep 2026 00:20:21 +0000 Subject: [PATCH] build(deps): extend the diskcache osv suppression to 2026-10-09 and drop the vitest entry now that staging carries 4.1.11 Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- osv-scanner.toml | 9 ++------- ui/litellm-dashboard/next.config.mjs | 3 --- 2 files changed, 2 insertions(+), 10 deletions(-) diff --git a/osv-scanner.toml b/osv-scanner.toml index 94795e12795..d9883386dfa 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -1,14 +1,9 @@ [[IgnoredVulns]] id = "GHSA-w8v5-vhqr-4h9v" -ignoreUntil = 2026-09-09 -reason = "diskcache has no fixed release published; remove this entry once one exists" +ignoreUntil = 2026-10-09 +reason = "diskcache unsafe pickle deserialization (CVSS 5.2); latest release is still 5.6.3 (2023-08-31) and no fixed release exists on PyPI as of 2026-09-09; remove this entry once one exists" [[IgnoredVulns]] id = "GHSA-h7x2-h6g9-p789" ignoreUntil = 2026-09-14 reason = "mlflow has no fixed release published; remove this entry once one exists" - -[[IgnoredVulns]] -id = "GHSA-82fw-gwwq-j7x9" -ignoreUntil = 2026-10-08 -reason = "vitest/@vitest/mocker path traversal (CVSS 5.9, dev-only test runner). The only fix is vitest 4.1.11 (published 2026-08-18), a major upgrade off 3.2.6 that breaks the ui-unit-tests --poolOptions CLI flags and ~1800 test-file type errors in build-ui; needs a dedicated vitest 3->4 migration PR, bump possible as soon as that lands" diff --git a/ui/litellm-dashboard/next.config.mjs b/ui/litellm-dashboard/next.config.mjs index 6d03d70f73a..128ce0a84a7 100644 --- a/ui/litellm-dashboard/next.config.mjs +++ b/ui/litellm-dashboard/next.config.mjs @@ -21,9 +21,6 @@ const nextConfig = { basePath: "", assetPrefix: "/litellm-asset-prefix", trailingSlash: true, - experimental: { - useTypeScriptCli: false, - }, turbopack: { // Must be absolute; "." is no longer allowed root: __dirname,