Addresses 3 recent npm & Python CVEs:
- CVE-2026-27903/27904 (minimatch regex DoS)
- GHSA-qffp-2rhf-9h96 (tar path traversal)
- CVE-2026-27888 (pypdf regex DoS)
Changes:
- Bump tar from 7.5.8 to 7.5.10 in all 5 Dockerfiles + package.json overrides
- Bump minimatch from 10.2.1 to 10.2.4 in all Dockerfiles + package.json overrides
- Bump pypdf from 6.6.2 to 6.7.3 in requirements.txt
- Remove apk npm after global install to eliminate stale SBOM metadata
Docker Scout verification: both litellm and litellm-non_root now report 0 CVEs.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
* fix(main.py): fix retries being multiplied when using openai sdk
Closes https://github.com/BerriAI/litellm/pull/7130
* docs(prompt_management.md): add langfuse prompt management doc
* feat(team_endpoints.py): allow teams to add their own models
Enables teams to call their own finetuned models via the proxy
* test: add better enforcement check testing for `/model/new` now that teams can add their own models
* docs(team_model_add.md): tutorial for allowing teams to add their own models
* test: fix test
