mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-29 01:42:19 +00:00
6 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
dependabot[bot]
|
f773353854
|
build(deps): bump the github-actions group across 1 directory with 21 updates
Some checks are pending
LiteLLM Rust / rust-lint (push) Waiting to run
LiteLLM Rust / rust-test (push) Waiting to run
LiteLLM Rust / rust-wheel (push) Waiting to run
Terraform Provider / gofmt, vet, build, test (push) Waiting to run
Terraform Provider / Provider endpoints vs proxy OpenAPI schema (push) Waiting to run
Bumps the github-actions group with 21 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `7.0.1` | | [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `7.0.0` | | [actions/cache](https://github.com/actions/cache) | `4.3.0` | `6.1.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.1` | `7.0.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.2.1` | `8.0.1` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.4` | `7.1.1` | | [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `7.0.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `3.34.1` | `4.38.2` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `3.34.1` | `4.38.2` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `3.34.1` | `4.38.2` | | [CodSpeedHQ/action](https://github.com/codspeedhq/action) | `4.12.1` | `5.2.1` | | [actions/github-script](https://github.com/actions/github-script) | `7.0.1` | `9.0.0` | | [openai/codex-action](https://github.com/openai/codex-action) | `1.9` | `1.12` | | [azure/setup-helm](https://github.com/azure/setup-helm) | `4.3.1` | `5.0.1` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.4.4` | | [actions/stale](https://github.com/actions/stale) | `8.0.0` | `11.0.0` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.0` | `6.3.0` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.87.8` | `2.87.21` | | [hashicorp/setup-terraform](https://github.com/hashicorp/setup-terraform) | `3.1.2` | `4.0.1` | | [actions/setup-go](https://github.com/actions/setup-go) | `6.2.0` | `7.0.0` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.6` | `0.6.4` | Updates `actions/checkout` from 4.2.2 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4.2.2...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/setup-python` from 5.6.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits]( |
||
|
devin-ai-integration[bot]
|
48050d9646
|
chore(ci): drop litellm_internal_staging and litellm_oss_staging references, main is the only trunk (#42745) | ||
|
mateo-berri
|
d16d17d2d2 | ci(osv-scan): scan the VS Code extension lockfile | ||
|
Sameer Kankute
|
c712c20d0f
|
fix(ci): point OSS contributor workflows to litellm_oss_staging (#31270)
* fix(ci): point OSS contributor workflows to litellm_oss_staging Workflow triggers and guard error messages incorrectly referenced litellm_oss_branch; update them to the branch we actually use for external contributions. * fix(ci): include test-rust.yml in litellm_oss_staging rename Missed test-rust.yml when updating OSS contributor target branch references. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
yucheng-berri
|
a8a1472428
|
fix(deps): bump osv-flagged dependencies to clear known CVEs (#31122)
Bumps the 12 packages osv-scanner flags on litellm_internal_staging, taking the scan from 24 known vulnerabilities to zero. vcrpy goes to 8.2.1 first so aiohttp can move to 3.14.1 (vcrpy <= 8.1.1 cannot import aiohttp 3.14), then the two aiohttp ignore entries are dropped from osv-scanner.toml. The langchain stack moves together since langchain 1.3.9 requires langgraph 1.2.x. Runtime deps cryptography (48.0.1), starlette (1.3.1), python-multipart (0.0.32), pydantic-settings (2.14.2) and pypdf (6.13.3) are bumped via relock, and the dashboard's js-yaml, ws and form-data overrides are bumped too. Also removes the paths filter on the OSV workflow so it runs on every PR rather than only when a lockfile changes, which is why it never showed up on recent code-only PRs |
||
|
yuneng-jiang
|
a519a37c56
|
ci: add osv-scanner lockfile scan workflow (#30222)
* ci: add osv-scanner lockfile scan workflow Daily scheduled scan plus a pull_request scan scoped to uv.lock and the dashboard package-lock.json. The osv-scanner v2.3.8 binary is fetched by full release URL and verified against its official SHA-256 before use; the job needs no credentials and runs with contents: read only. osv-scanner.toml carries the single suppression for the diskcache advisory, which has no fixed release published * ci: temporary push trigger for runtime verification (will be dropped) * ci: harden osv-scan per review (RUNNER_TEMP, job-scoped permissions, suppression expiry) * ci: drop temporary push trigger after runtime verification * ci: suppress aiohttp advisories while vcrpy blocks the 3.14 bump Time-boxed like the diskcache entry: ignoreUntil forces a dated re-triage if no vcrpy release has shipped by then |