scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-10 22:41:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 129
litellm/litellm-js/spend-logs
History
Exact
Harshit28j c6c85e1140 Fix CVEs: bump tar to 7.5.10, minimatch to 10.2.4, pypdf to 6.7.3 
Addresses 3 recent npm & Python CVEs:
- CVE-2026-27903/27904 (minimatch regex DoS)
- GHSA-qffp-2rhf-9h96 (tar path traversal)
- CVE-2026-27888 (pypdf regex DoS)

Changes:
- Bump tar from 7.5.8 to 7.5.10 in all 5 Dockerfiles + package.json overrides
- Bump minimatch from 10.2.1 to 10.2.4 in all Dockerfiles + package.json overrides
- Bump pypdf from 6.6.2 to 6.7.3 in requirements.txt
- Remove apk npm after global install to eliminate stale SBOM metadata

Docker Scout verification: both litellm and litellm-non_root now report 0 CVEs.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
2026-03-07 14:57:51 +05:30
..
src build(spend-logs): separate server for writing spend logs to db 2024-03-28 13:23:22 -07:00
Dockerfile (security fix) - update base image for all docker images to python:3.13.1-slim (#7388) 2024-12-23 16:20:47 -08:00
package-lock.json fix pkg lock 2025-11-22 11:52:57 -08:00
package.json Fix CVEs: bump tar to 7.5.10, minimatch to 10.2.4, pypdf to 6.7.3 2026-03-07 14:57:51 +05:30
README.md build(spend-logs): separate server for writing spend logs to db 2024-03-28 13:23:22 -07:00
schema.prisma build(spend-logs): separate server for writing spend logs to db 2024-03-28 13:23:22 -07:00
tsconfig.json build(spend-logs): separate server for writing spend logs to db 2024-03-28 13:23:22 -07:00

README.md 

npm install
npm run dev

open http://localhost:3000