litellm/ui
Joe Reyna 25ee2fb3f9
fix(security): bump tar to 7.5.11 and tornado to 6.5.5 (#23602)
* fix(security): bump tar to 7.5.11 and tornado to 6.5.5

- tar >=7.5.11: fixes CVE-2026-31802 (HIGH) in node-pkg
- tornado >=6.5.5: fixes CVE-2026-31958 (HIGH) and GHSA-78cv-mqj4-43f7 (MEDIUM) in python-pkg

Addresses vulnerabilities found in ghcr.io/berriai/litellm:main-v1.82.0-stable Trivy scan.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: document tar override is enforced via Dockerfile, not npm

* fix: revert invalid JSON comment in package.json tar override

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-13 23:08:14 -07:00
..
litellm-dashboard fix(security): bump tar to 7.5.11 and tornado to 6.5.5 (#23602) 2026-03-13 23:08:14 -07:00