mirror of
https://github.com/BerriAI/litellm.git
synced 2026-08-28 05:25:59 +00:00
ae2f276d19
grype defaults match.python.using-cpes to false, so PyPI packages are matched only against the GitHub Advisory Database. When a CVE is published to NVD but its GHSA has not propagated to the global advisory database, the scan reports clean even though grype's own database already carries the NVD record with the correct version ranges. The pypdf CVEs (CVE-2026-59935 / 59936 / 59937 / 59938, analyzed in NVD since 2026-07-08) are the case that exposed this; their GHSA IDs are still repo-level and return 404 from the global advisory API, so the ecosystem matcher has nothing to match on. Enabling CPE matching for Python closes that gap. Measured against a v1.91.1 build the finding count goes from 28 to 38; the additions are mostly actionable, and the few cross-product CPE collisions cannot fail the build because --only-fixed drops the ones carrying no fix version and the remainder land below the --fail-on high threshold. |
||
|---|---|---|
| .. | ||
| actions | ||
| codeql | ||
| ISSUE_TEMPLATE | ||
| observatory | ||
| screenshots | ||
| scripts | ||
| workflows | ||
| CODEOWNERS | ||
| dependabot.yaml | ||
| deploy-on-aws.png | ||
| deploy-on-gcp.png | ||
| deploy-to-aws.png | ||
| FUNDING.yml | ||
| pull_request_template.md | ||
| template.yaml | ||
