mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-12 23:01:41 +00:00
b02bb79185
The #31122 cherry-pick bumps the deps it pins (cryptography 48.0.1, aiohttp 3.14.1, vcrpy 8.2.1, the langchain/langgraph stack) and relocks, but this line's lock baseline kept several ranged runtime deps at versions the ranges still allow, so osv-scanner still flagged them. Pull them to their fixed releases so the scan is clean: - starlette 1.1.0 -> 1.3.1 (GHSA-82w8-qh3p-5jfq, GHSA-jp82-jpqv-5vv3) - python-multipart 0.0.27 -> 0.0.32 (GHSA-5rvq-cxj2-64vf and three others) - pydantic-settings 2.14.1 -> 2.14.2 (GHSA-4xgf-cpjx-pc3j) - pypdf 6.13.2 -> 6.13.3 (GHSA-jm82-fx9c-mx94) - pyjwt 2.12.0 -> 2.13.0 (PYSEC-2026-175/177/178/179) - langsmith 0.8.3 -> 0.8.18 (GHSA-f4xh-w4cj-qxq8) Dashboard build deps (not in the shipped bundle; lockfile hygiene, no UI rebuild): - vite 7.3.2 -> 7.3.5 (GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3) - esbuild override 0.28.1 (GHSA-g7r4-m6w7-qqqr) - form-data override 4.0.6 (GHSA-hmw2-7cc7-3qxx) After this the only osv-scanner finding is diskcache GHSA-w8v5-vhqr-4h9v, which has no fixed release and is the entry staging's osv-scanner.toml already ignores until a fix lands. |
||
|---|---|---|
| .. | ||
| litellm-dashboard | ||
| Dockerfile | ||
| nginx.conf | ||