scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-20 05:04:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 186

ci(osv): ignore mcp 1.26.0 High CVEs until canonical lock bump

Browse source 
Fork PRs cannot modify uv.lock. Ignore GHSA-hvrp-rf83-w775,
GHSA-jpw9-pfvf-9f58, and GHSA-vj7q-gjh5-988w (fixed in mcp>=1.28.1)
so OSV can pass without a forbidden lockfile change.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
lkapadiya-DO 2026-07-16 15:48:42 -07:00
parent 693003aee3
commit 8f8deda074
1 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
osv-scanner.toml
View file

@ -2,3 +2,20 @@
id = "GHSA-w8v5-vhqr-4h9v"
ignoreUntil = 2026-09-09
reason = "diskcache has no fixed release published; remove this entry once one exists"
# mcp 1.26.0 in uv.lock; fixed in mcp>=1.28.1. Fork PRs cannot update uv.lock
# (guard-fork-dependencies). Remove once canonical repo bumps mcp in the lockfile.
[[IgnoredVulns]]
id = "GHSA-hvrp-rf83-w775"
ignoreUntil = 2026-10-16
reason = "mcp 1.26.0; fix requires uv.lock bump to >=1.28.1 from canonical repo"
[[IgnoredVulns]]
id = "GHSA-jpw9-pfvf-9f58"
ignoreUntil = 2026-10-16
reason = "mcp 1.26.0; fix requires uv.lock bump to >=1.28.1 from canonical repo"
[[IgnoredVulns]]
id = "GHSA-vj7q-gjh5-988w"
ignoreUntil = 2026-10-16
reason = "mcp 1.26.0; fix requires uv.lock bump to >=1.28.1 from canonical repo"