litellm

mirror of https://github.com/BerriAI/litellm.git synced 2026-10-05 02:41:56 +00:00

History

yucheng-berri 1a56faa750 fix(deps): bump osv-flagged dependencies to clear known CVEs (#31122 ) Bumps the 12 packages osv-scanner flags on litellm_internal_staging, taking the scan from 24 known vulnerabilities to zero. vcrpy goes to 8.2.1 first so aiohttp can move to 3.14.1 (vcrpy <= 8.1.1 cannot import aiohttp 3.14), then the two aiohttp ignore entries are dropped from osv-scanner.toml. The langchain stack moves together since langchain 1.3.9 requires langgraph 1.2.x. Runtime deps cryptography (48.0.1), starlette (1.3.1), python-multipart (0.0.32), pydantic-settings (2.14.2) and pypdf (6.13.3) are bumped via relock, and the dashboard's js-yaml, ws and form-data overrides are bumped too. Also removes the paths filter on the OSV workflow so it runs on every PR rather than only when a lockfile changes, which is why it never showed up on recent code-only PRs (cherry picked from commit `a8a1472428`)	2026-06-23 20:24:24 -07:00
..
litellm-dashboard	fix(deps): bump osv-flagged dependencies to clear known CVEs (#31122 )	2026-06-23 20:24:24 -07:00

fix(deps): bump osv-flagged dependencies to clear known CVEs (#31122 )

Bumps the 12 packages osv-scanner flags on litellm_internal_staging, taking
the scan from 24 known vulnerabilities to zero. vcrpy goes to 8.2.1 first so
aiohttp can move to 3.14.1 (vcrpy <= 8.1.1 cannot import aiohttp 3.14), then
the two aiohttp ignore entries are dropped from osv-scanner.toml. The
langchain stack moves together since langchain 1.3.9 requires langgraph 1.2.x.
Runtime deps cryptography (48.0.1), starlette (1.3.1), python-multipart
(0.0.32), pydantic-settings (2.14.2) and pypdf (6.13.3) are bumped via relock,
and the dashboard's js-yaml, ws and form-data overrides are bumped too.

Also removes the paths filter on the OSV workflow so it runs on every PR
rather than only when a lockfile changes, which is why it never showed up on
recent code-only PRs

(cherry picked from commit a8a1472428)

2026-06-23 20:24:24 -07:00

litellm-dashboard fix(deps): bump osv-flagged dependencies to clear known CVEs (#31122 ) 2026-06-23 20:24:24 -07:00