mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-12 23:01:41 +00:00
a519a37c56
* ci: add osv-scanner lockfile scan workflow Daily scheduled scan plus a pull_request scan scoped to uv.lock and the dashboard package-lock.json. The osv-scanner v2.3.8 binary is fetched by full release URL and verified against its official SHA-256 before use; the job needs no credentials and runs with contents: read only. osv-scanner.toml carries the single suppression for the diskcache advisory, which has no fixed release published * ci: temporary push trigger for runtime verification (will be dropped) * ci: harden osv-scan per review (RUNNER_TEMP, job-scoped permissions, suppression expiry) * ci: drop temporary push trigger after runtime verification * ci: suppress aiohttp advisories while vcrpy blocks the 3.14 bump Time-boxed like the diskcache entry: ignoreUntil forces a dated re-triage if no vcrpy release has shipped by then
14 lines
706 B
TOML
14 lines
706 B
TOML
[[IgnoredVulns]]
|
|
id = "GHSA-w8v5-vhqr-4h9v"
|
|
ignoreUntil = 2026-09-09
|
|
reason = "diskcache has no fixed release published; remove this entry once one exists"
|
|
|
|
[[IgnoredVulns]]
|
|
id = "GHSA-hg6j-4rv6-33pg"
|
|
ignoreUntil = 2026-08-15
|
|
reason = "aiohttp held at 3.13.5: vcrpy releases <= 8.1.1 cannot import aiohttp >= 3.14 and the merged upstream fix (vcrpy PR 996) is unreleased; bump aiohttp and drop this entry when a newer vcrpy ships"
|
|
|
|
[[IgnoredVulns]]
|
|
id = "GHSA-jg22-mg44-37j8"
|
|
ignoreUntil = 2026-08-15
|
|
reason = "aiohttp held at 3.13.5: vcrpy releases <= 8.1.1 cannot import aiohttp >= 3.14 and the merged upstream fix (vcrpy PR 996) is unreleased; bump aiohttp and drop this entry when a newer vcrpy ships"
|