mirror of
https://github.com/BerriAI/litellm.git
synced 2026-11-03 07:23:33 +00:00
ff22f3de06
* build(deps): suppress filelock Windows advisories and drop stale certifi entry to clear osv-scan Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * build(deps): suppress dev-only msal-node advisory in vscode-extension until azure identity allows 7.1 Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * build(deps): bump ddtrace and msgpack to clear osv-scan Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * build(deps): bump pylint to 4.0.9 to clear osv-scan Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * build(deps): lock dnspython 2.9.0 on Python 3.11+ and defer 3.10 to clear osv-scan Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * build(deps): bump qs in vscode-extension to clear osv-scan Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * build(deps): extend the pillow 12.3.0 override for Python 3.10 to 2026-11-27 Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * build(deps): extend the diskcache ignore, drop the withdrawn braces entry, and name the filelock cap in its reasons * build(deps): bump langgraph and add dated ignores for the 2026-10-28 filelock advisories * build(deps): move tornado to 6.6 on Python 3.11+, name huggingface_hub's filelock use, and scope a grype rule to the filelock High * build(deps): say which packages import tornado in its ignore reasons --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
22 lines
864 B
YAML
22 lines
864 B
YAML
# Wolfi's security database names zlib 1.3.3-r0 as the fix for CVE-2026-85091,
|
|
# but the newest zlib published to the Wolfi apk repo is 1.3.2-r7, so every
|
|
# wolfi-base digest reports it and no `apk upgrade` can clear it.
|
|
# Drop this once Wolfi ships zlib >= 1.3.3-r0; expected by 2026-10-15.
|
|
ignore:
|
|
- vulnerability: CVE-2026-85091
|
|
package:
|
|
name: zlib
|
|
type: apk
|
|
- vulnerability: GHSA-g5fp-32jq-cfw2
|
|
package:
|
|
name: zlib
|
|
type: apk
|
|
- vulnerability: GHSA-v4x8-3wr5-3wq8
|
|
reason: >-
|
|
filelock ReadWriteLock advisory, and no package in the image takes ReadWriteLock;
|
|
the fix (4.2.1) is blocked by litellm's own filelock<4.0 cap until #48635 or #48802 lifts it,
|
|
and the image then moves off 3.32.7, which retires this version-scoped rule
|
|
package:
|
|
name: filelock
|
|
version: 3.32.7
|
|
type: python
|