mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-15 23:31:29 +00:00
4af58e1f97
- Narrow /root/.cache COPY in Dockerfile to /root/.cache/prisma{,-python}
only — drops ~660MB of uv build cache including a setuptools wheel
that surfaced as CVE-2024-6345 / CVE-2025-47273 even though it was
never on the runtime sys.path.
- DiskCache: switch to dc.JSONDisk to neutralize the pickle code path
(CVE-2025-69872, no upstream fix). Values must be JSON-serializable;
cleanup get_cache to skip the now-dead json.loads(dict) branch by
guarding on isinstance(str).
- pyproject.toml: drop diskcache pin from [caching] extra (no fixed
version exists). Stub kept so `pip install litellm[caching]` doesn't
warn; users who want disk caching install diskcache themselves.
- Bump black 24.10.0 → 26.3.1 (CVE-2026-32274) + apply 296-file mechanical
reformat. Black is dev-only (not in the runtime image), but bumping
clears the manifest-scan finding.
- Refresh ui/litellm-dashboard/package-lock.json to pick up next 16.2.4
(was 16.1.7, GHSA-q4gf-8mx6-v5v3), uuid 14.0.0, postcss 8.5.13.
- Refresh litellm-js/spend-logs/package-lock.json to pick up
hono 4.12.16 (GHSA-458j-xx4x-4375).
- uv lock: gitpython 3.1.46 → 3.1.49 (clears two High GHSAs),
langchain-text-splitters 1.1.1 → 1.1.2.
- Add tests/test_litellm/caching/test_disk_cache.py covering JSONDisk
enforcement, dict/string round-trip, TTL, increment, delete/flush.
Net delta on combined trivy + grype scans: 17 findings → 4 (all
remaining 4 are Wolfi system python-3.13 CVEs marked WONTFIX upstream
in CPython 3.14; CVE-2026-3298 is Windows-unreachable on Linux).
Existing on-disk caches written by the previous pickle-format Disk
will silently miss after upgrade — diskcache is intended to be
ephemeral so impact is recreate-on-next-write.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| gcs_pub_sub_body | ||
| langfuse_expected_request_body | ||
| base_test.py | ||
| conftest.py | ||
| create_mock_standard_logging_payload.py | ||
| gettysburg.wav | ||
| log.txt | ||
| test_alerting.py | ||
| test_amazing_s3_logs.py | ||
| test_assemble_streaming_responses.py | ||
| test_bedrock_knowledgebase_hook.py | ||
| test_built_in_tools_cost_tracking.py | ||
| test_custom_callback_router.py | ||
| test_datadog.py | ||
| test_datadog_llm_obs.py | ||
| test_dynamic_otel_keys.py | ||
| test_gcs_pub_sub.py | ||
| test_generic_api_callback.py | ||
| test_humanloop_unit_tests.py | ||
| test_langfuse_dynamic_credentials.py | ||
| test_langfuse_e2e_test.py | ||
| test_langfuse_unit_tests.py | ||
| test_langsmith_dynamic_credentials.py | ||
| test_langsmith_unit_test.py | ||
| test_log_db_redis_services.py | ||
| test_logging_redaction_e2e_test.py | ||
| test_moderations_api_logging.py | ||
| test_opentelemetry_unit_tests.py | ||
| test_otel_logging.py | ||
| test_pagerduty_alerting.py | ||
| test_posthog.py | ||
| test_spend_logs.py | ||
| test_sqs_logger.py | ||
| test_standard_logging_payload.py | ||
| test_standard_logging_payload_excluded_fields.py | ||
| test_token_counting.py | ||
| test_unit_test_litellm_logging.py | ||
| test_unit_tests_init_callbacks.py | ||
| test_view_request_resp_logs.py | ||