mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-15 23:31:29 +00:00
cafc2cf86a
uv is pinned to `exclude-newer = "3 days"` and .npmrc to `min-release-age=3`, so a release published in the last three days cannot be resolved even if we want it. When osv-scanner points at such a release, the job failed with nothing anyone could do about it, and a check that fails for three days at a time stops being read. The scan now emits JSON and a filter step decides the verdict. For each finding it takes the lowest fix above the installed version, reads that version's publish date from PyPI or the npm registry, and compares its age against the window read from pyproject.toml and .npmrc. Findings still inside the window are printed with the timestamp they become installable and do not fail the job; everything else fails as before. Registry lookup failures, unparseable versions and unknown ecosystems all fail closed. |
||
|---|---|---|
| .. | ||
| actions | ||
| codeql | ||
| ISSUE_TEMPLATE | ||
| observatory | ||
| screenshots | ||
| scripts | ||
| workflows | ||
| CODEOWNERS | ||
| dependabot.yaml | ||
| deploy-on-aws.png | ||
| deploy-on-gcp.png | ||
| deploy-to-aws.png | ||
| FUNDING.yml | ||
| pull_request_template.md | ||
| template.yaml | ||
