fix(deps): bump osv-flagged dependencies to clear known CVEs by yucheng-berri · Pull Request #31122 · BerriAI/litellm

yucheng-berri · 2026-06-23T20:09:03Z

Relevant issues

Customer build pipelines (Wiz, JFrog Xray) are blocking LiteLLM proxy image imports on dependency CVEs that osv-scanner already flags. This clears the Python and npm findings at the source.

Linear ticket

N/A

Pre-Submission checklist

I have added meaningful tests
My PR passes all unit tests on make test-unit
My PR's scope is as isolated as possible; it only solves 1 specific problem
I have requested a Greptile review and received a Confidence Score of at least 4/5 before requesting a maintainer review

CI (LiteLLM team)

CI status guideline:

50-55 passing tests: main is stable with minor issues.

45-49 passing tests: acceptable but needs attention

<= 40 passing tests: unstable; be careful with your merges and assess the risk.

122 passing across CircleCI and GitHub Actions, the only non-passing checks are a SKIPPED fork-only dependency gate and informational bot statuses (CLA, Codecov). osv-scan passes.

Branch creation CI run
CircleCI: https://app.circleci.com/pipelines/github/BerriAI/litellm?branch=litellm_osv_cve_bumps
GitHub Actions: https://github.com/BerriAI/litellm/pull/31122/checks
CI run for the last commit
Same as branch creation; the PR is a single commit (6549205)
Merge / cherry-pick CI run
Pending merge into litellm_internal_staging

Changes

osv-scanner flagged 24 known vulnerabilities across 12 packages on litellm_internal_staging. This bumps every flagged package so a fresh scan reports zero issues.

The one ordering constraint is aiohttp. vcrpy <= 8.1.1 cannot import aiohttp >= 3.14, so aiohttp was pinned down in [tool.uv] constraint-dependencies with two matching ignore entries in osv-scanner.toml. vcrpy is bumped to 8.2.1 first, which lets aiohttp move to 3.14.1, and the two ignore entries are then removed. The diskcache ignore stays because no fixed release exists yet.

The langchain bump cascades. langchain 1.3.9 requires langgraph >=1.2.4,<1.3.0, so langgraph (1.2.6) and langgraph-prebuilt (1.1.0) move with it; the old comment pinning langgraph-prebuilt to 1.0.8 no longer applies once langgraph is past 1.1.0, so it was removed.

Runtime dependency bumps: cryptography 46.0.7 -> 48.0.1, starlette 1.1.0 -> 1.3.1, python-multipart 0.0.27 -> 0.0.32, pydantic-settings 2.14.1 -> 2.14.2, pypdf 6.13.1 -> 6.13.3. Test/CI-group bumps: vcrpy 8.2.1, langchain 1.3.9, langsmith 0.8.18. Dashboard overrides: js-yaml 4.2.0, ws 8.21.0, and form-data resolves to 4.0.6.

Beyond the 12 directly-flagged packages, the relock pulls a handful of transitive upgrades as a consequence (langchain-core 1.4.8, langgraph-sdk 0.4.2, mlflow 3.14.0), all within their existing allowed version ranges.

This also removes the paths filter on the OSV workflow. It previously ran only when a lockfile changed, so it never appeared on code-only PRs; running it on every PR is the prerequisite for making it a required status check once this lands and the scan is green.

Proof of fix

osv-scanner v2.3.8 run locally against this branch, same invocation as CI.

Before (on litellm_internal_staging):

Total 12 packages affected by 24 known vulnerabilities (0 Critical, 7 High, 9 Medium, 8 Low, 0 Unknown) from 2 ecosystems.
24 vulnerabilities can be fixed.
... EXIT CODE: 1

After (this branch):

GHSA-w8v5-vhqr-4h9v ... filtered out because: diskcache has no fixed release published
Filtered 1 vulnerability from output

No issues found
... EXIT CODE: 0

The osv-scan CI check on this PR also passes, confirming the same result on the pipeline. Functional verification (no breaking changes from the runtime bumps to cryptography, starlette, aiohttp, langchain) is delegated to the full CI run on this PR, which is green.

Bumps the 12 packages osv-scanner flags on litellm_internal_staging, taking the scan from 24 known vulnerabilities to zero. vcrpy goes to 8.2.1 first so aiohttp can move to 3.14.1 (vcrpy <= 8.1.1 cannot import aiohttp 3.14), then the two aiohttp ignore entries are dropped from osv-scanner.toml. The langchain stack moves together since langchain 1.3.9 requires langgraph 1.2.x. Runtime deps cryptography (48.0.1), starlette (1.3.1), python-multipart (0.0.32), pydantic-settings (2.14.2) and pypdf (6.13.3) are bumped via relock, and the dashboard's js-yaml, ws and form-data overrides are bumped too. Also removes the paths filter on the OSV workflow so it runs on every PR rather than only when a lockfile changes, which is why it never showed up on recent code-only PRs

CLAassistant · 2026-06-23T20:09:10Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

codecov · 2026-06-23T20:12:09Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

yucheng-berri · 2026-06-23T20:26:51Z

@greptileai

greptile-apps · 2026-06-23T20:30:20Z

Greptile Summary

This PR clears all 24 OSV-flagged CVEs across 12 packages by bumping the minimum-required versions in pyproject.toml, uv.lock, and the npm lockfile. The OSV workflow's paths filter is also removed so the scan runs on every PR, a prerequisite for making it a required status check.

Python bumps: cryptography 46→48 (CVE fix requires skipping 47.x), aiohttp constraint relaxed to >=3.14.1 once vcrpy 8.2.1 ships support, langchain/langgraph cascade updated with matching version ranges, plus minor bumps for vcrpy, pydantic-settings, pypdf, starlette, and python-multipart.
npm bumps: js-yaml 4.2.0, ws 8.21.0, and form-data 4.0.6 applied via overrides in package.json; the two removed aiohttp OSV ignores in osv-scanner.toml are now fixed upstream, and the diskcache ignore is correctly retained as no fix exists.

Confidence Score: 5/5

Safe to merge — all changes are dependency version bumps with no logic modifications, and the OSV scan on this branch passes cleanly.

Every change is a minimum-version floor raise driven directly by published CVE advisories. The ordering constraints (vcrpy before aiohttp, langchain cascading langgraph) are correctly sequenced and explained. The CI scan on this branch confirms zero unfixed vulnerabilities. No production logic was modified.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/osv-scan.yml	Removes the `paths` filter from the `pull_request` trigger so the OSV scan runs on every PR (not only when lockfiles change), enabling it to become a required status check.
osv-scanner.toml	Removes the two aiohttp CVE ignores (GHSA-hg6j-4rv6-33pg, GHSA-jg22-mg44-37j8) now that aiohttp is bumped past 3.14; retains the diskcache ignore since no fix is published.
pyproject.toml	Bumps cryptography (46→48), vcrpy (8.1.1→8.2.1), langchain (1.2.10→1.3.9), langgraph (exact pin→range >=1.2.4,<1.3.0), langgraph-prebuilt (exact pin→range >=1.1.0,<1.3.0), and relaxes the aiohttp constraint-dependency to >=3.14.1,<4.0.
ui/litellm-dashboard/package.json	Updates `overrides` for js-yaml (4.1.1→4.2.0) and ws (8.20.1→8.21.0) to resolve npm CVEs.
ui/litellm-dashboard/package-lock.json	Lockfile updates reflecting js-yaml 4.2.0, ws 8.21.0, form-data 4.0.6, and hasown 2.0.4 bumps.

_{Reviews (2): Last reviewed commit: "fix(deps): bump osv-flagged dependencies..." | Re-trigger Greptile}

…4x-0623 chore(release): backport #30787, #30788, #31035, #31122, #31133 to stable/1.84.x and cut 1.84.10

Scoped to the customer-shipped dependencies on this line: cryptography 48.0.1, python-multipart 0.0.32, pypdf 6.13.3, and semantic-router >=0.1.15,<1.0 (the pinned 0.1.12 is yanked, CVE-2026-42208); mlflow is loosened to >=3.11.1,<4.0 so cryptography can move, and the dashboard js-yaml 4.2.0 and ws 8.21.0 overrides are bumped. uv.lock and package-lock.json are regenerated on this line. The osv-scanner.toml and osv-scan.yml hunks are dropped (absent on 1.85.x), and the non-shipping CI/test stack (langchain, langgraph, vcrpy, aiohttp) is left out. semantic-router >=0.1.15,<1.0 is content-verified present on litellm_internal_staging (via aggregator f49707b) and matches the 1.84.x backport of this PR (1a56faa). (cherry picked from commit a8a1472)

chore(release): backport #30480, #30787, #30788, #31035, #31133, #31122 to stable/1.85.x and cut 1.85.7

…#31122) Bumps the 12 packages osv-scanner flags on litellm_internal_staging, taking the scan from 24 known vulnerabilities to zero. vcrpy goes to 8.2.1 first so aiohttp can move to 3.14.1 (vcrpy <= 8.1.1 cannot import aiohttp 3.14), then the two aiohttp ignore entries are dropped from osv-scanner.toml. The langchain stack moves together since langchain 1.3.9 requires langgraph 1.2.x. Runtime deps cryptography (48.0.1), starlette (1.3.1), python-multipart (0.0.32), pydantic-settings (2.14.2) and pypdf (6.13.3) are bumped via relock, and the dashboard's js-yaml, ws and form-data overrides are bumped too. Also removes the paths filter on the OSV workflow so it runs on every PR rather than only when a lockfile changes, which is why it never showed up on recent code-only PRs

…x-0624 chore(release): backport #30787, #30788, #31035, #31036, #31122, #31133 to stable/1.89.x (litellm-enterprise 0.1.42.post2)

….4) (#196) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/berriai/litellm](https://images.chainguard.dev/directory/image/wolfi-base/overview) ([source](https://github.com/BerriAI/litellm)) | patch | `v1.89.3` → `v1.89.4` | --- ### Release Notes <details> <summary>BerriAI/litellm (ghcr.io/berriai/litellm)</summary> ### [`v1.89.4`](https://github.com/BerriAI/litellm/releases/tag/v1.89.4) [Compare Source](BerriAI/litellm@v1.89.4...v1.89.4) ##### Verify Docker Image Signature All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](BerriAI/litellm@0112e53). **Verify using the pinned commit hash (recommended):** A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key: ```bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \ ghcr.io/berriai/litellm:v1.89.4 ``` **Verify using the release tag (convenience):** Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules: ```bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/v1.89.4/cosign.pub \ ghcr.io/berriai/litellm:v1.89.4 ``` Expected output: ``` The following checks were performed on each of these signatures: - The cosign claims were validated - The signatures were verified against the specified public key ``` *** ##### What's Changed - chore(release): backport [#31029](BerriAI/litellm#31029) to stable/1.89.x and cut 1.89.4 by [@yuneng-berri](https://github.com/yuneng-berri) in [#31168](BerriAI/litellm#31168) - chore(ui): rebuild dashboard artifacts for stable/1.89.x by [@yuneng-berri](https://github.com/yuneng-berri) in [#31170](BerriAI/litellm#31170) - chore(release): backport [#30787](BerriAI/litellm#30787), [#30788](BerriAI/litellm#30788), [#31035](BerriAI/litellm#31035), [#31036](BerriAI/litellm#31036), [#31122](BerriAI/litellm#31122), [#31133](BerriAI/litellm#31133) to stable/1.89.x (litellm-enterprise 0.1.42.post2) by [@yuneng-berri](https://github.com/yuneng-berri) in [#31259](BerriAI/litellm#31259) **Full Changelog**: <BerriAI/litellm@v1.89.3...v1.89.4> ### [`v1.89.4`](https://github.com/BerriAI/litellm/releases/tag/v1.89.4) [Compare Source](BerriAI/litellm@v1.89.3...v1.89.4) ##### Verify Docker Image Signature All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](BerriAI/litellm@0112e53). **Verify using the pinned commit hash (recommended):** A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key: ```bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \ ghcr.io/berriai/litellm:v1.89.4 ``` **Verify using the release tag (convenience):** Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules: ```bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/v1.89.4/cosign.pub \ ghcr.io/berriai/litellm:v1.89.4 ``` Expected output: ``` The following checks were performed on each of these signatures: - The cosign claims were validated - The signatures were verified against the specified public key ``` *** ##### What's Changed - chore(release): backport [#31029](BerriAI/litellm#31029) to stable/1.89.x and cut 1.89.4 by [@yuneng-berri](https://github.com/yuneng-berri) in [#31168](BerriAI/litellm#31168) - chore(ui): rebuild dashboard artifacts for stable/1.89.x by [@yuneng-berri](https://github.com/yuneng-berri) in [#31170](BerriAI/litellm#31170) - chore(release): backport [#30787](BerriAI/litellm#30787), [#30788](BerriAI/litellm#30788), [#31035](BerriAI/litellm#31035), [#31036](BerriAI/litellm#31036), [#31122](BerriAI/litellm#31122), [#31133](BerriAI/litellm#31133) to stable/1.89.x (litellm-enterprise 0.1.42.post2) by [@yuneng-berri](https://github.com/yuneng-berri) in [#31259](BerriAI/litellm#31259) **Full Changelog**: <BerriAI/litellm@v1.89.3...v1.89.4> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://forgejo.hayden.moe/hayden/phoebe/pulls/196

….4) (#386) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/berriai/litellm](https://images.chainguard.dev/directory/image/wolfi-base/overview) ([source](https://github.com/BerriAI/litellm)) | patch | `v1.89.3` → `v1.89.4` | --- ### Release Notes <details> <summary>BerriAI/litellm (ghcr.io/berriai/litellm)</summary> ### [`v1.89.4`](https://github.com/BerriAI/litellm/releases/tag/v1.89.4) [Compare Source](BerriAI/litellm@v1.89.4...v1.89.4) ##### Verify Docker Image Signature All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](BerriAI/litellm@0112e53). **Verify using the pinned commit hash (recommended):** A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key: ```bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \ ghcr.io/berriai/litellm:v1.89.4 ``` **Verify using the release tag (convenience):** Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules: ```bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/v1.89.4/cosign.pub \ ghcr.io/berriai/litellm:v1.89.4 ``` Expected output: ``` The following checks were performed on each of these signatures: - The cosign claims were validated - The signatures were verified against the specified public key ``` *** ##### What's Changed - chore(release): backport [#31029](BerriAI/litellm#31029) to stable/1.89.x and cut 1.89.4 by [@yuneng-berri](https://github.com/yuneng-berri) in [#31168](BerriAI/litellm#31168) - chore(ui): rebuild dashboard artifacts for stable/1.89.x by [@yuneng-berri](https://github.com/yuneng-berri) in [#31170](BerriAI/litellm#31170) - chore(release): backport [#30787](BerriAI/litellm#30787), [#30788](BerriAI/litellm#30788), [#31035](BerriAI/litellm#31035), [#31036](BerriAI/litellm#31036), [#31122](BerriAI/litellm#31122), [#31133](BerriAI/litellm#31133) to stable/1.89.x (litellm-enterprise 0.1.42.post2) by [@yuneng-berri](https://github.com/yuneng-berri) in [#31259](BerriAI/litellm#31259) **Full Changelog**: <BerriAI/litellm@v1.89.3...v1.89.4> ### [`v1.89.4`](https://github.com/BerriAI/litellm/releases/tag/v1.89.4) [Compare Source](BerriAI/litellm@v1.89.3...v1.89.4) ##### Verify Docker Image Signature All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](BerriAI/litellm@0112e53). **Verify using the pinned commit hash (recommended):** A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key: ```bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \ ghcr.io/berriai/litellm:v1.89.4 ``` **Verify using the release tag (convenience):** Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules: ```bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/v1.89.4/cosign.pub \ ghcr.io/berriai/litellm:v1.89.4 ``` Expected output: ``` The following checks were performed on each of these signatures: - The cosign claims were validated - The signatures were verified against the specified public key ``` *** ##### What's Changed - chore(release): backport [#31029](BerriAI/litellm#31029) to stable/1.89.x and cut 1.89.4 by [@yuneng-berri](https://github.com/yuneng-berri) in [#31168](BerriAI/litellm#31168) - chore(ui): rebuild dashboard artifacts for stable/1.89.x by [@yuneng-berri](https://github.com/yuneng-berri) in [#31170](BerriAI/litellm#31170) - chore(release): backport [#30787](BerriAI/litellm#30787), [#30788](BerriAI/litellm#30788), [#31035](BerriAI/litellm#31035), [#31036](BerriAI/litellm#31036), [#31122](BerriAI/litellm#31122), [#31133](BerriAI/litellm#31133) to stable/1.89.x (litellm-enterprise 0.1.42.post2) by [@yuneng-berri](https://github.com/yuneng-berri) in [#31259](BerriAI/litellm#31259) **Full Changelog**: <BerriAI/litellm@v1.89.3...v1.89.4> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.greyrock.io/greyrock-labs/home-ops/pulls/386

…#31122) Bumps the 12 packages osv-scanner flags on litellm_internal_staging, taking the scan from 24 known vulnerabilities to zero. vcrpy goes to 8.2.1 first so aiohttp can move to 3.14.1 (vcrpy <= 8.1.1 cannot import aiohttp 3.14), then the two aiohttp ignore entries are dropped from osv-scanner.toml. The langchain stack moves together since langchain 1.3.9 requires langgraph 1.2.x. Runtime deps cryptography (48.0.1), starlette (1.3.1), python-multipart (0.0.32), pydantic-settings (2.14.2) and pypdf (6.13.3) are bumped via relock, and the dashboard's js-yaml, ws and form-data overrides are bumped too. Also removes the paths filter on the OSV workflow so it runs on every PR rather than only when a lockfile changes, which is why it never showed up on recent code-only PRs (cherry picked from commit a8a1472)

…1.89.x The BerriAI#31122 cherry-pick bumps the deps it pins (cryptography 48.0.1, aiohttp 3.14.1, vcrpy 8.2.1, the langchain/langgraph stack) and relocks, but this line's lock baseline kept several ranged runtime deps at versions the ranges still allow, so osv-scanner still flagged them. Pull them to their fixed releases so the scan is clean: - starlette 1.1.0 -> 1.3.1 (GHSA-82w8-qh3p-5jfq, GHSA-jp82-jpqv-5vv3) - python-multipart 0.0.27 -> 0.0.32 (GHSA-5rvq-cxj2-64vf and three others) - pydantic-settings 2.14.1 -> 2.14.2 (GHSA-4xgf-cpjx-pc3j) - pypdf 6.13.2 -> 6.13.3 (GHSA-jm82-fx9c-mx94) - pyjwt 2.12.0 -> 2.13.0 (PYSEC-2026-175/177/178/179) - langsmith 0.8.3 -> 0.8.18 (GHSA-f4xh-w4cj-qxq8) Dashboard build deps (not in the shipped bundle; lockfile hygiene, no UI rebuild): - vite 7.3.2 -> 7.3.5 (GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3) - esbuild override 0.28.1 (GHSA-g7r4-m6w7-qqqr) - form-data override 4.0.6 (GHSA-hmw2-7cc7-3qxx) After this the only osv-scanner finding is diskcache GHSA-w8v5-vhqr-4h9v, which has no fixed release and is the entry staging's osv-scanner.toml already ignores until a fix lands.

…to v1.89.4 (#228) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [https://github.com/BerriAI/litellm.git](https://github.com/BerriAI/litellm) | patch | `v1.89.3` → `v1.89.4` | --- ### Release Notes <details> <summary>BerriAI/litellm (https://github.com/BerriAI/litellm.git)</summary> ### [`v1.89.4`](https://github.com/BerriAI/litellm/releases/tag/v1.89.4) [Compare Source](BerriAI/litellm@v1.89.3...v1.89.4) #### Verify Docker Image Signature All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](BerriAI/litellm@0112e53). **Verify using the pinned commit hash (recommended):** A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key: ```bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \ ghcr.io/berriai/litellm:v1.89.4 ``` **Verify using the release tag (convenience):** Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules: ```bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/v1.89.4/cosign.pub \ ghcr.io/berriai/litellm:v1.89.4 ``` Expected output: ``` The following checks were performed on each of these signatures: - The cosign claims were validated - The signatures were verified against the specified public key ``` *** #### What's Changed - chore(release): backport [#31029](BerriAI/litellm#31029) to stable/1.89.x and cut 1.89.4 by [@yuneng-berri](https://github.com/yuneng-berri) in [#31168](BerriAI/litellm#31168) - chore(ui): rebuild dashboard artifacts for stable/1.89.x by [@yuneng-berri](https://github.com/yuneng-berri) in [#31170](BerriAI/litellm#31170) - chore(release): backport [#30787](BerriAI/litellm#30787), [#30788](BerriAI/litellm#30788), [#31035](BerriAI/litellm#31035), [#31036](BerriAI/litellm#31036), [#31122](BerriAI/litellm#31122), [#31133](BerriAI/litellm#31133) to stable/1.89.x (litellm-enterprise 0.1.42.post2) by [@yuneng-berri](https://github.com/yuneng-berri) in [#31259](BerriAI/litellm#31259) **Full Changelog**: <BerriAI/litellm@v1.89.3...v1.89.4> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Co-authored-by: Renovate Bot <renovate@bhamm-lab.com> Reviewed-on: https://codeberg.org/blake-hamm/bhamm-lab/pulls/228

…#31122) Bumps the 12 packages osv-scanner flags on litellm_internal_staging, taking the scan from 24 known vulnerabilities to zero. vcrpy goes to 8.2.1 first so aiohttp can move to 3.14.1 (vcrpy <= 8.1.1 cannot import aiohttp 3.14), then the two aiohttp ignore entries are dropped from osv-scanner.toml. The langchain stack moves together since langchain 1.3.9 requires langgraph 1.2.x. Runtime deps cryptography (48.0.1), starlette (1.3.1), python-multipart (0.0.32), pydantic-settings (2.14.2) and pypdf (6.13.3) are bumped via relock, and the dashboard's js-yaml, ws and form-data overrides are bumped too. Also removes the paths filter on the OSV workflow so it runs on every PR rather than only when a lockfile changes, which is why it never showed up on recent code-only PRs (cherry picked from commit a8a1472)

…1.89.x The BerriAI#31122 cherry-pick bumps the deps it pins (cryptography 48.0.1, aiohttp 3.14.1, vcrpy 8.2.1, the langchain/langgraph stack) and relocks, but this line's lock baseline kept several ranged runtime deps at versions the ranges still allow, so osv-scanner still flagged them. Pull them to their fixed releases so the scan is clean: - starlette 1.1.0 -> 1.3.1 (GHSA-82w8-qh3p-5jfq, GHSA-jp82-jpqv-5vv3) - python-multipart 0.0.27 -> 0.0.32 (GHSA-5rvq-cxj2-64vf and three others) - pydantic-settings 2.14.1 -> 2.14.2 (GHSA-4xgf-cpjx-pc3j) - pypdf 6.13.2 -> 6.13.3 (GHSA-jm82-fx9c-mx94) - pyjwt 2.12.0 -> 2.13.0 (PYSEC-2026-175/177/178/179) - langsmith 0.8.3 -> 0.8.18 (GHSA-f4xh-w4cj-qxq8) Dashboard build deps (not in the shipped bundle; lockfile hygiene, no UI rebuild): - vite 7.3.2 -> 7.3.5 (GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3) - esbuild override 0.28.1 (GHSA-g7r4-m6w7-qqqr) - form-data override 4.0.6 (GHSA-hmw2-7cc7-3qxx) After this the only osv-scanner finding is diskcache GHSA-w8v5-vhqr-4h9v, which has no fixed release and is the entry staging's osv-scanner.toml already ignores until a fix lands.

greptile-apps Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread pyproject.toml

yucheng-berri marked this pull request as ready for review June 23, 2026 20:36

yucheng-berri requested a review from a team June 23, 2026 20:36

yuneng-berri approved these changes Jun 23, 2026

View reviewed changes

ryan-crabbe-berri approved these changes Jun 23, 2026

View reviewed changes

yuneng-berri merged commit a8a1472 into litellm_internal_staging Jun 23, 2026
127 checks passed

yuneng-berri deleted the litellm_osv_cve_bumps branch June 23, 2026 22:50

yuneng-berri mentioned this pull request Jun 24, 2026

chore(release): backport #30787, #30788, #31035, #31122, #31133 to stable/1.84.x and cut 1.84.10 #31169

Merged

yuneng-berri added a commit that referenced this pull request Jun 24, 2026

Merge pull request #31169 from BerriAI/litellm_backport_1_84_x_bp-1.8…

2b7dad2

…4x-0623 chore(release): backport #30787, #30788, #31035, #31122, #31133 to stable/1.84.x and cut 1.84.10

yuneng-berri mentioned this pull request Jun 24, 2026

chore(release): backport #30480, #30787, #30788, #31035, #31133, #31122 to stable/1.85.x and cut 1.85.7 #31173

Merged

yuneng-berri added a commit that referenced this pull request Jun 24, 2026

Merge pull request #31173 from BerriAI/litellm_backport_1_85_x_0623

f8a102e

chore(release): backport #30480, #30787, #30788, #31035, #31133, #31122 to stable/1.85.x and cut 1.85.7

yuneng-berri mentioned this pull request Jun 24, 2026

chore(release): backport #30480, #30787, #30788, #31035, #31133 to stable/1.86.x #31180

Merged

ishaan-berri mentioned this pull request Jun 25, 2026

LiteLLM Stability Sprint Roadmap #30484

Open

13 tasks

yuneng-berri mentioned this pull request Jun 25, 2026

chore(release): backport #30787, #30788, #31035, #31036, #31122, #31133 to stable/1.89.x (litellm-enterprise 0.1.42.post2) #31259

Merged

4 tasks

yuneng-berri added a commit that referenced this pull request Jun 25, 2026

Merge pull request #31259 from BerriAI/litellm_backport_1_89_x_bp-189…

7f77969

…x-0624 chore(release): backport #30787, #30788, #31035, #31036, #31122, #31133 to stable/1.89.x (litellm-enterprise 0.1.42.post2)

claude Bot mentioned this pull request Jun 25, 2026

fix(container): update image ghcr.io/berriai/litellm-non_root (v1.89.3 ➔ v1.89.4) drag0n141/home-ops#6535

Merged

1 task

devin-ai-integration Bot mentioned this pull request Jul 18, 2026

fix(http): harden aiohttp connector against 3.14.x keepalive pool poisoning #33828

Open

5 tasks

davesheffer mentioned this pull request Aug 4, 2026

fix(deps): bump cryptography to 49.0.0 to clear osv-flagged CVEs #35759

Open

5 tasks

Navigation Menu

Uh oh!

Uh oh!

fix(deps): bump osv-flagged dependencies to clear known CVEs - #31122

fix(deps): bump osv-flagged dependencies to clear known CVEs#31122
yuneng-berri merged 1 commit into
litellm_internal_stagingfrom
litellm_osv_cve_bumps

yucheng-berri commented Jun 23, 2026 •

edited

Loading

Uh oh!

CLAassistant commented Jun 23, 2026

Uh oh!

codecov Bot commented Jun 23, 2026

Uh oh!

yucheng-berri commented Jun 23, 2026

Uh oh!

greptile-apps Bot commented Jun 23, 2026 •

edited

Loading

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Uh oh!

Conversation

yucheng-berri commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Relevant issues

Linear ticket

Pre-Submission checklist

CI (LiteLLM team)

Changes

Proof of fix

Uh oh!

CLAassistant commented Jun 23, 2026

Uh oh!

codecov Bot commented Jun 23, 2026

Codecov Report

Uh oh!

yucheng-berri commented Jun 23, 2026

Uh oh!

greptile-apps Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

yucheng-berri commented Jun 23, 2026 •

edited

Loading

greptile-apps Bot commented Jun 23, 2026 •

edited

Loading