* fix(docker): bump tar/minimatch/pypdf for CVE fixes + harden SBOM patching
- Bump tar 7.5.8→7.5.10, minimatch 10.2.1→10.2.4, pypdf 6.6.2→6.7.3
- Add sed-based SBOM metadata patching with properly indented find/sed
- Add npm package manager cleanup (apk del / apt-get purge) to remove
stale SBOM entries from image scanners
- Scope || true to only apk del via brace grouping { ... || true; }
- Guard npm root -g with non-empty assertion to prevent silent failures
- Scope minimatch sed regex to ^10.x to avoid matching other major versions
Addresses: CVE-2026-27903, CVE-2026-27904, GHSA-qffp-2rhf-9h96, CVE-2026-27888
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(docker): scope find to /usr/local/lib /usr/lib, drop autoremove
- Replace `find /` with `find /usr/local/lib /usr/lib` to avoid
traversing /proc, /sys, /dev during SBOM metadata patching
- Remove `apt-get autoremove -y` from Debian-based Dockerfiles to
prevent nodejs from being removed as an auto-installed dependency
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix(ci): handle inline table in pyproject.toml for litellm-proxy-extras version check
* fix: bump litellm-proxy-extras to 0.4.50 in pyproject.toml, requirements.txt, and poetry.lock
* fix(tests): set status_code=200 on JWT mocks and pass pii_tokens through data in presidio test
* fix(migrations): add ensure_project_id_verification_token migration
Ensures project_id column exists on LiteLLM_VerificationToken. The original
migration (20251113000000_add_project_table) adds this column, but may have
been skipped if LiteLLM_ProjectTable already existed and the migration was
resolved as idempotent. Uses IF NOT EXISTS for safety.
* bump: litellm-proxy-extras 0.4.45 → 0.4.46
Changes were made to litellm_proxy_extras (schema.prisma, utils.py, migrations)
but version was not bumped, causing CI publish job to fail.
This commit bumps the version from 0.4.27 to 0.4.28 in all required files:
- litellm-proxy-extras/pyproject.toml
- requirements.txt
- pyproject.toml
Co-authored-by: shin-bot-litellm <shin-bot-litellm@users.noreply.github.com>
* fix(agentcore): simplify agentcore streaming
* fix(agentcore): move CustomStreamWrapper import to module level
The deferred imports inside streaming methods caused initialization delays
during health check requests, leading to timeouts in ECS deployments.
- Move CustomStreamWrapper import to module-level (line 19)
- Remove deferred imports from get_sync_custom_stream_wrapper (line 588)
- Remove deferred import from get_async_custom_stream_wrapper (line 747)
- Remove from TYPE_CHECKING block to use actual import
This ensures the import happens at module load time rather than during
first request processing, preventing health check endpoint blocking.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* test(agentcore): ensure sync response
* chore: upgrade boto3 to 1.40.76 in pyproject.toml
* chore: added taplo.toml
* fix(types): correct annotation type hint for MyPy compatibility
Update _convert_annotations_to_chat_format return type from
Dict[str, Any] to ChatCompletionAnnotation TypedDict to match
the Message class's expected type signature.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Benedikt Óskarsson <bensi94@hotmail.com>
