[Security] Clear AWS Inspector CVE findings on Docker image

[stuxf]

Relevant issues

N/A — driven by AWS Inspector v2 (ECR) findings on ghcr.io/berriai/litellm:v1.83.14-stable.patch.1.

Linear ticket

N/A

Pre-Submission checklist

• Added tests/test_litellm/caching/test_disk_cache.py covering JSONDisk enforcement, dict / string round-trip, TTL, increment, delete/flush.
• PR passes new tests locally (8/8 pass on pytest tests/test_litellm/caching/test_disk_cache.py).
• PR scope is isolated to clearing scanner findings on the published Docker image.
• Greptile review pending (will request after CI green).

CI (LiteLLM team)

• Branch creation CI run — Link:
• CI run for the last commit — Link:
• Merge / cherry-pick CI run — Links:

Screenshots / Proof of Fix

Combined trivy fs + grype dir scan against the patched worktree:

Scanner	Before	After
trivy fs	6 findings (1 High next, 5 Medium: diskcache, postcss×2, hono, uuid)	0 in shipped code (1 in tests/.../Gemfile.lock, doesn't ship)
grype	17 findings (setuptools×2, python-3.13×4, langchain-text-splitters, diskcache, postcss×2, black, langchain-openai, pytest, gitpython×2, next, hono, uuid)	4 (all Wolfi python-3.13 CVEs, see Notes)

JSONDisk smoke test:

$ pytest tests/test_litellm/caching/test_disk_cache.py -v
test_disk_cache_uses_jsondisk PASSED
test_disk_cache_dict_round_trip PASSED
test_disk_cache_string_round_trip_decodes_json PASSED
test_disk_cache_string_round_trip_returns_raw_when_not_json PASSED
test_disk_cache_increment PASSED
test_disk_cache_ttl_expiry PASSED
test_disk_cache_delete_and_flush PASSED
test_disk_cache_missing_key_returns_none PASSED
======== 8 passed in 2.09s ========

Type

🚄 Infrastructure

Changes

Real logic (5 files)

1. Dockerfile — Narrow COPY --from=builder /root/.cache /root/.cache to just /root/.cache/prisma and /root/.cache/prisma-python. Drops ~660 MB of uv build cache that was being copied into the runtime image and surfacing a cached setuptools-68.1.2.dist-info as CVE-2024-6345 / CVE-2025-47273 even though it was never on sys.path.

2. litellm/caching/disk_cache.py — Use dc.Cache(..., disk=dc.JSONDisk) instead of the default pickle-backed Disk to neutralize CVE-2025-69872 (no upstream fix exists for diskcache). Cleaned up the now-dead json.loads(dict) exception-fallthrough in get_cache by adding an isinstance(cached, str) guard. Updated the install hint to pip install diskcache directly.

3. pyproject.toml — Removed the diskcache==5.6.3 pin from the [caching] extra (CVE-2025-69872 has no fixed version). Kept caching = [] as a stub so pip install litellm[caching] doesn't emit a "no such extra" warning during the deprecation window. Bumped black==24.10.0 → 26.3.1 (CVE-2026-32274).

4. uv.lock — Regenerated with uv lock --upgrade-package black --upgrade-package GitPython --upgrade-package langchain-text-splitters --upgrade-package langchain-openai. Picks up gitpython 3.1.46 → 3.1.49 (clears two High GHSAs) and langchain-text-splitters 1.1.1 → 1.1.2.

5. ui/litellm-dashboard/package-lock.json + litellm-js/spend-logs/package-lock.json — Regenerated with npm install --package-lock-only. Picks up next 16.1.7 → 16.2.4, uuid 14.0.0, postcss 8.5.13, hono 4.12.16.

Mechanical churn (296 files)

• Black 26.3.1 reformat. Coupled to the version bump (CI's black --check would otherwise fail on the new style). No semantic changes.

New tests (1 file)

• tests/test_litellm/caching/test_disk_cache.py — Asserts JSONDisk is the active backend (regression guard for the CVE fix), exercises round-trip / TTL / counter / delete paths.

Notes

• Existing on-disk caches: Users with a populated .litellm_cache/ directory written by the previous pickle-backed Disk will see silent cache misses after upgrade (JSONDisk can't read pickle blobs). DiskCache is intended to be ephemeral so impact is "rebuild on next write." Worth calling out in release notes.
• litellm[caching] deprecation: Anyone with litellm[caching] in their requirements file will silently get the empty stub instead of diskcache. They'll see the friendlier ModuleNotFoundError (with pip install diskcache hint) on first Cache(type="disk") use.
• 4 remaining Wolfi findings (out of scope): python-3.13 CVE-2025-15366, CVE-2025-15367, CVE-2025-12781 are upstream WONTFIX in CPython 3.14; CVE-2026-3298 is Windows-only (asyncio.ProactorEventLoop) and unreachable on Linux. Migrating from wolfi-base + apk add python3 to Chainguard's continuously-remediated cgr.dev/chainguard/python image would clear them but is a separate Dockerfile-restructuring change.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[yuneng-berri]

@greptile

[greptile-apps]

Greptile Summary

This PR clears AWS Inspector CVE findings on the published Docker image through a combination of Dockerfile hardening, dependency version bumps, and a diskcache backend switch. The visible diff covers the Dockerfile narrowing, and regenerated package-lock.json files for the dashboard and spend-logs UI.

• Dockerfile: Replaces the broad COPY --from=builder /root/.cache /root/.cache with targeted copies of only /root/.cache/prisma and /root/.cache/prisma-python, eliminating ~660 MB of uv build cache (including a setuptools wheel that triggered CVE-2024-6345 / CVE-2025-47273) from the runtime image. The wolfi-base digest and npm version are also bumped.
• ui/litellm-dashboard/package-lock.json: Regenerated to pick up next, postcss, uuid, hono, and various CSS-tooling bumps that resolve the scanner findings.
• litellm-js/spend-logs/package-lock.json: Single get-tsconfig patch bump; otherwise unchanged.

Confidence Score: 5/5

Safe to merge; all changes in the visible diff are targeted security remediations with no logic modifications to production code paths.

The Dockerfile change is a straightforward scope reduction of an existing COPY instruction, and both targeted subdirectories are created unconditionally by prisma generate in the builder stage. The package-lock bumps are mechanical version upgrades with no production logic altered.

No files require special attention; the Dockerfile COPY narrowing carries a small build-fragility trade-off if prisma cache layout ever shifts.

Important Files Changed

Filename	Overview
Dockerfile	Narrows COPY from broad /root/.cache to specific prisma subdirs; bumps wolfi-base digest and npm version — clean security improvement with a minor build-fragility trade-off.
ui/litellm-dashboard/package-lock.json	Mechanical dependency bumps (next, postcss, uuid, csstools, esbuild, emnapi, etc.) to clear CVE findings; no logic changes.
litellm-js/spend-logs/package-lock.json	Single get-tsconfig version bump (4.13.0 → 4.14.0); purely mechanical.

_{Reviews (2): Last reviewed commit: "Drop liccheck black allowlist entry" | Re-trigger Greptile}

[yuneng-berri]

@greptile