mirror of
https://github.com/BerriAI/litellm.git
synced 2026-10-29 06:33:28 +00:00
7c39dbfab8
Pillow 13.0.0 requires Python >= 3.11, so the ci group pin is split by Python version and the 3.10 resolution stays on 12.3.0 with a 7-day osv-scanner override. Dashboard vite moves from 7.3.5 to 7.3.7. The certifi fix (2026.10.19) is still inside the 3-day uv exclude-newer window, so its advisory is ignored until 2026-10-23
22 lines
921 B
TOML
22 lines
921 B
TOML
[[IgnoredVulns]]
|
|
id = "GHSA-w8v5-vhqr-4h9v"
|
|
ignoreUntil = 2026-11-01
|
|
reason = "diskcache has no fixed release published; remove this entry once one exists"
|
|
|
|
[[IgnoredVulns]]
|
|
id = "GHSA-vfj7-8cjw-p6xm"
|
|
ignoreUntil = 2026-11-03
|
|
reason = "braces has no fixed release published (3.0.3, 2024-05-21, is latest and last_affected); dev-only via knip > fast-glob > micromatch; remove this entry once one exists"
|
|
|
|
[[IgnoredVulns]]
|
|
id = "GHSA-6q48-6c7w-9gw2"
|
|
ignoreUntil = 2026-10-23
|
|
reason = "certifi 2026.10.19 (published 2026-10-20) is inside the 3-day uv exclude-newer window until 2026-10-23 02:24 UTC; bump certifi and remove this entry once it clears"
|
|
|
|
[[PackageOverrides]]
|
|
name = "pillow"
|
|
version = "12.3.0"
|
|
ecosystem = "PyPI"
|
|
vulnerability.ignore = true
|
|
effectiveUntil = 2026-10-27
|
|
reason = "pillow 13.0.0 requires Python >= 3.11, so the Python 3.10 resolution of the ci and dev groups stays on 12.3.0; 3.11+ is on 13.0.0"
|