scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-07 08:26:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 36
litellm/ui
History
Exact
Harshit28j c6c85e1140 Fix CVEs: bump tar to 7.5.10, minimatch to 10.2.4, pypdf to 6.7.3 
Addresses 3 recent npm & Python CVEs:
- CVE-2026-27903/27904 (minimatch regex DoS)
- GHSA-qffp-2rhf-9h96 (tar path traversal)
- CVE-2026-27888 (pypdf regex DoS)

Changes:
- Bump tar from 7.5.8 to 7.5.10 in all 5 Dockerfiles + package.json overrides
- Bump minimatch from 10.2.1 to 10.2.4 in all Dockerfiles + package.json overrides
- Bump pypdf from 6.6.2 to 6.7.3 in requirements.txt
- Remove apk npm after global install to eliminate stale SBOM metadata

Docker Scout verification: both litellm and litellm-non_root now report 0 CVEs.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
2026-03-07 14:57:51 +05:30
..
litellm-dashboard Fix CVEs: bump tar to 7.5.10, minimatch to 10.2.4, pypdf to 6.7.3 2026-03-07 14:57:51 +05:30