From 95796eb8463bba531bdca576f60a21e8325be247 Mon Sep 17 00:00:00 2001 From: Alexsander Hamir Date: Tue, 27 Jan 2026 12:16:21 -0800 Subject: [PATCH] fix(security): upgrade python-multipart from 0.0.18 to 0.0.22 Addresses GHSA-wp53-j4wj-2cfg (CVE with CVSS 8.6) - Arbitrary File Write vulnerability. Updated python-multipart to version 0.0.22 which includes the security fix. --- .github/workflows/test-litellm.yml | 2 +- poetry.lock | 6 +++--- pyproject.toml | 2 +- requirements.txt | 2 +- tests/code_coverage_tests/license_cache.json | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/test-litellm.yml b/.github/workflows/test-litellm.yml index ba32dc1bf54..d9cf2e74a11 100644 --- a/.github/workflows/test-litellm.yml +++ b/.github/workflows/test-litellm.yml @@ -34,7 +34,7 @@ jobs: poetry run pip install "google-genai==1.22.0" poetry run pip install "google-cloud-aiplatform>=1.38" poetry run pip install "fastapi-offline==1.7.3" - poetry run pip install "python-multipart==0.0.18" + poetry run pip install "python-multipart==0.0.22" poetry run pip install "openapi-core" - name: Setup litellm-enterprise as local package run: | diff --git a/poetry.lock b/poetry.lock index 462a56fe42a..9ded0c773c8 100644 --- a/poetry.lock +++ b/poetry.lock @@ -5719,15 +5719,15 @@ cli = ["click (>=5.0)"] [[package]] name = "python-multipart" -version = "0.0.18" +version = "0.0.22" description = "A streaming multipart parser for Python" optional = true python-versions = ">=3.8" groups = ["main"] markers = "extra == \"proxy\"" files = [ - {file = "python_multipart-0.0.18-py3-none-any.whl", hash = "sha256:efe91480f485f6a361427a541db4796f9e1591afc0fb8e7a4ba06bfbc6708996"}, - {file = "python_multipart-0.0.18.tar.gz", hash = "sha256:7a68db60c8bfb82e460637fa4750727b45af1d5e2ed215593f917f64694d34fe"}, + {file = "python_multipart-0.0.22-py3-none-any.whl", hash = "sha256:2b2cd894c83d21bf49d702499531c7bafd057d730c201782048f7945d82de155"}, + {file = "python_multipart-0.0.22.tar.gz", hash = "sha256:7340bef99a7e0032613f56dc36027b959fd3b30a787ed62d310e951f7c3a3a58"}, ] [[package]] diff --git a/pyproject.toml b/pyproject.toml index 1e4836ed19b..2068f92fcee 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -45,7 +45,7 @@ orjson = {version = "^3.9.7", optional = true} apscheduler = {version = "^3.10.4", optional = true} fastapi-sso = { version = "^0.16.0", optional = true } PyJWT = { version = "^2.10.1", optional = true, python = ">=3.9" } -python-multipart = { version = "^0.0.18", optional = true} +python-multipart = { version = "^0.0.22", optional = true} cryptography = {version = "*", optional = true} prisma = {version = "0.11.0", optional = true} azure-identity = {version = "^1.15.0", optional = true, python = ">=3.9"} diff --git a/requirements.txt b/requirements.txt index 36328a081a6..10854d57494 100644 --- a/requirements.txt +++ b/requirements.txt @@ -32,7 +32,7 @@ polars==1.31.0 # for data processing apscheduler==3.10.4 # for resetting budget in background fastapi-sso==0.19.0 # admin UI, SSO pyjwt[crypto]==2.10.1 ; python_version >= "3.9" -python-multipart==0.0.18 # admin UI +python-multipart==0.0.22 # admin UI Pillow==11.0.0 jaraco.context>=6.1.0 azure-ai-contentsafety==1.0.0 # for azure content safety diff --git a/tests/code_coverage_tests/license_cache.json b/tests/code_coverage_tests/license_cache.json index 910ec931c86..a9c7fad2b14 100644 --- a/tests/code_coverage_tests/license_cache.json +++ b/tests/code_coverage_tests/license_cache.json @@ -20,7 +20,7 @@ "apscheduler:3.10.4": "MIT", "fastapi-sso:0.16.0": "MIT", "pyjwt:2.9.0": "MIT", - "python-multipart:0.0.18": "Apache-2.0", + "python-multipart:0.0.22": "Apache-2.0", "Pillow:11.0.0": "MIT-CMU", "azure-ai-contentsafety:1.0.0": "MIT License", "azure-identity:1.16.1": "MIT License",