mirror of
https://github.com/BerriAI/litellm.git
synced 2026-08-28 05:25:59 +00:00
2acc5cc457
* fix(security): fix CVE-2025-69873 and CVE-2026-26996 in docs dependencies Use npm overrides to pin patched versions: - ajv@6.12.6 → 6.14.0 (fixes ReDoS CVE-2025-69873) - ajv@8.17.1 → 8.18.0 (fixes ReDoS CVE-2025-69873) - minimatch@3.1.2 → 10.2.1 (fixes DoS CVE-2026-26996) serve-handler only calls minimatch(path, pattern) so the 3.x→10.x upgrade is safe. * fix(ruff): add missing Set and Dict imports to fix F821 errors * fix(security): scope ajv overrides to avoid top-level version conflict Replacing global 'ajv: 8.18.0' override with scoped 'schema-utils@4' override. The global override conflicted with the nested file-loader/ null-loader/url-loader overrides, causing npm to install ajv@6 at the top level where ajv-keywords@5.x requires ajv@8 (ajv/dist/compile/codegen). Now: - schema-utils@3 + loaders → ajv@6.14.0 (safe minor bump) - schema-utils@4 → ajv@8.18.0 (safe minor bump) - top-level ajv unmodified (stays at 8.x for ajv-keywords@5) * fix(security): allowlist minimatch and tar CVEs from nodejs_wheel, bump tar override to >=7.5.8 |
||
|---|---|---|
| .. | ||
| .grype.yaml | ||
| baseline_db.py | ||
| check_file_length.py | ||
| check_files_match.py | ||
| publish-proxy-extras.sh | ||
| run_migration.py | ||
| security_scans.sh | ||
| security_scans_readme.md | ||
| TEST_KEY_PATTERNS.md | ||