Add docs announcement bar for Trivy compromise resolution by krrish-berri-2 · Pull Request #25870 · BerriAI/litellm

krrish-berri-2 · 2026-04-16T16:16:39Z

Relevant issues

Adds a security notice to the top of the docs landing page and root page informing users the Trivy supply-chain compromise has been contained.

Pre-Submission checklist

My PR's scope is as isolated as possible, it only solves 1 specific problem

Note: This is a docs-only change (Markdown admonition), no code tests needed.

Screenshots / Proof of Fix

Root page (/):

Security Update note on root page

Docs page (/docs), note appears above the hero image:

Security Update note on docs page

security_note_both_pages.mp4

Type

📖 Documentation

Changes

Added a :::note Security Update admonition to docs/my-website/docs/index.md above the hero image
Added the same admonition to docs/my-website/src/pages/index.md (root page) above the heading
The note states the Trivy compromise has been contained, all affected packages deleted, and current releases are safe
Links to the Security Townhall and CI/CD v2 blog posts

_{To show artifacts inline, enable in settings.}

Slack Thread

Add a Docusaurus announcement bar to the top of the docs site informing users that the Trivy supply-chain compromise has been mitigated and resolved. The banner: - States all affected packages have been deleted and releases are safe - Links to the Security Townhall blog post for details - Links to the CI/CD v2 blog post for improvements made - Uses a green background with closeable dismiss button Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com>

vercel · 2026-04-16T16:16:45Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Apr 16, 2026 10:12pm

CLAassistant · 2026-04-16T16:16:46Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

codecov · 2026-04-16T16:19:52Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Replace the Docusaurus announcementBar with a :::note admonition on the docs index page. The note appears below the hero image with the title 'Security Update' and links to the Security Townhall and CI/CD v2 blog posts. Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com>

Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com>

- Move the security notice above the product screenshot on /docs - Add the same notice to the root page (src/pages/index.md) Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com>

greptile-apps · 2026-04-16T20:57:44Z

Greptile Summary

Adds a :::note Security Update Docusaurus admonition to both docs landing pages (docs/index.md and src/pages/index.md) announcing that the Trivy supply-chain compromise has been resolved. Both referenced blog slugs (security-townhall-updates, ci-cd-v2-improvements) are confirmed present in the repo and match the links in the notice.

Confidence Score: 5/5

Safe to merge — documentation-only change with verified blog links and correct admonition syntax.

Both blog slugs resolve correctly in the repository, the admonition syntax matches existing patterns used elsewhere in the docs, and no code is affected. All remaining findings (emoji shortcode) are P2 and already captured in prior review threads.

No files require special attention.

Important Files Changed

Filename	Overview
docs/my-website/docs/index.md	Adds a `:::note Security Update` Docusaurus admonition above the hero image; blog links resolve to correct slugs and admonition syntax matches existing patterns in the repo.
docs/my-website/src/pages/index.md	Adds the same `:::note Security Update` admonition above the root-page heading; identical content and same link targets as docs/index.md.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[User visits LiteLLM docs] --> B{Which page?}
    B -->|/docs| C[docs/index.md]
    B -->|/| D[src/pages/index.md]
    C --> E[:::note Security Update admonition]
    D --> F[:::note Security Update admonition]
    E --> G[Link: /blog/security-townhall-updates ✓]
    E --> H[Link: /blog/ci-cd-v2-improvements ✓]
    F --> G
    F --> H

_{Reviews (2): Last reviewed commit: "Update security notice wording" | Re-trigger Greptile}

greptile-apps · 2026-04-16T20:57:48Z

 import Image from '@theme/IdealImage';

+:::note Security Update
+The Trivy supply-chain compromise has been contained :tada:. All affected packages have been deleted and current releases are safe to use. Please refer to our [Security Townhall](/blog/security-townhall-updates) for a deeper understanding of the problem, and [CI/CD v2](/blog/ci-cd-v2-improvements) for how we're improving moving forward.


:tada: shortcode will render as literal text

No remark-emoji (or similar) plugin is configured in docusaurus.config.js and there is no emoji-related package in package.json. Without that plugin, MDX renders :tada: as plain text rather than 🎉. Replace the shortcode with the actual Unicode character.

Suggested change

The Trivy supply-chain compromise has been contained :tada:. All affected packages have been deleted and current releases are safe to use. Please refer to our [Security Townhall](/blog/security-townhall-updates) for a deeper understanding of the problem, and [CI/CD v2](/blog/ci-cd-v2-improvements) for how we're improving moving forward.

The Trivy supply-chain compromise has been contained 🎉. All affected packages have been deleted and current releases are safe to use. Please refer to our [Security Townhall](/blog/security-townhall-updates) for a deeper understanding of the problem, and [CI/CD v2](/blog/ci-cd-v2-improvements) for how we're improving moving forward.

greptile-apps · 2026-04-16T20:57:48Z


+:::note Security Update
+The Trivy supply-chain compromise has been contained :tada:. All affected packages have been deleted and current releases are safe to use. Please refer to our [Security Townhall](/blog/security-townhall-updates) for a deeper understanding of the problem, and [CI/CD v2](/blog/ci-cd-v2-improvements) for how we're improving moving forward.
+:::


:tada: shortcode will render as literal text

Same issue as in docs/index.md — no emoji plugin is configured, so :tada: appears verbatim. Use the Unicode character directly.

Suggested change

:::

The Trivy supply-chain compromise has been contained 🎉. All affected packages have been deleted and current releases are safe to use. Please refer to our [Security Townhall](/blog/security-townhall-updates) for a deeper understanding of the problem, and [CI/CD v2](/blog/ci-cd-v2-improvements) for how we're improving moving forward.

Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com>

) * Add announcement bar for Trivy compromise resolution notice Add a Docusaurus announcement bar to the top of the docs site informing users that the Trivy supply-chain compromise has been mitigated and resolved. The banner: - States all affected packages have been deleted and releases are safe - Links to the Security Townhall blog post for details - Links to the CI/CD v2 blog post for improvements made - Uses a green background with closeable dismiss button Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com> * Use :::note admonition instead of announcement bar Replace the Docusaurus announcementBar with a :::note admonition on the docs index page. The note appears below the hero image with the title 'Security Update' and links to the Security Townhall and CI/CD v2 blog posts. Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com> * Update security notice wording to 'contained' Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com> * Move note above hero image and add to root page - Move the security notice above the product screenshot on /docs - Add the same notice to the root page (src/pages/index.md) Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com> * Update security notice wording Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com>

vercel Bot deployed to Preview April 16, 2026 16:22 View deployment

vercel Bot deployed to Preview April 16, 2026 16:37 View deployment

Update security notice wording to 'contained'

78289d5

Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com>

vercel Bot deployed to Preview April 16, 2026 17:45 View deployment

Move note above hero image and add to root page

2553046

- Move the security notice above the product screenshot on /docs - Add the same notice to the root page (src/pages/index.md) Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com>

vercel Bot deployed to Preview April 16, 2026 17:52 View deployment

krrish-berri-2 marked this pull request as ready for review April 16, 2026 20:55

greptile-apps Bot reviewed Apr 16, 2026

View reviewed changes

ryan-crabbe-berri self-requested a review April 16, 2026 21:41

ryan-crabbe-berri approved these changes Apr 16, 2026

View reviewed changes

Update security notice wording

8a2610a

Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com>

vercel Bot deployed to Preview April 16, 2026 22:12 View deployment

krrish-berri-2 merged commit 13108f3 into litellm_internal_staging Apr 16, 2026
41 of 43 checks passed

krrish-berri-2 deleted the cursor/add-trivy-security-notice-2a80 branch April 16, 2026 22:15

Navigation Menu

Uh oh!

Uh oh!

Add docs announcement bar for Trivy compromise resolution - #25870

Add docs announcement bar for Trivy compromise resolution#25870
krrish-berri-2 merged 5 commits into
litellm_internal_stagingfrom
cursor/add-trivy-security-notice-2a80

krrish-berri-2 commented Apr 16, 2026 •

edited by cursor Bot

Loading

Uh oh!

vercel Bot commented Apr 16, 2026 •

edited

Loading

Uh oh!

CLAassistant commented Apr 16, 2026

Uh oh!

codecov Bot commented Apr 16, 2026

Uh oh!

greptile-apps Bot commented Apr 16, 2026 •

edited

Loading

Important Files Changed

Uh oh!

greptile-apps Bot Apr 16, 2026

Uh oh!

greptile-apps Bot Apr 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	The Trivy supply-chain compromise has been contained :tada:. All affected packages have been deleted and current releases are safe to use. Please refer to our [Security Townhall](/blog/security-townhall-updates) for a deeper understanding of the problem, and [CI/CD v2](/blog/ci-cd-v2-improvements) for how we're improving moving forward.
	The Trivy supply-chain compromise has been contained 🎉. All affected packages have been deleted and current releases are safe to use. Please refer to our [Security Townhall](/blog/security-townhall-updates) for a deeper understanding of the problem, and [CI/CD v2](/blog/ci-cd-v2-improvements) for how we're improving moving forward.

Uh oh!

Uh oh!

Conversation

krrish-berri-2 commented Apr 16, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Relevant issues

Pre-Submission checklist

Screenshots / Proof of Fix

Type

Changes

Uh oh!

vercel Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CLAassistant commented Apr 16, 2026

Uh oh!

codecov Bot commented Apr 16, 2026

Codecov Report

Uh oh!

greptile-apps Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

greptile-apps Bot Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

krrish-berri-2 commented Apr 16, 2026 •

edited by cursor Bot

Loading

vercel Bot commented Apr 16, 2026 •

edited

Loading

greptile-apps Bot commented Apr 16, 2026 •

edited

Loading