Commit Graph

4 Commits

Author SHA1 Message Date
Dr.Lt.Data
92e05fc767
fix(security): add litellm supply chain attack detection (PYSEC-2026-2) (#2732)
Some checks are pending
Publish to PyPI / build-and-publish (push) Waiting to run
Python Linting / Run Ruff (push) Waiting to run
Add litellm==1.82.7 and litellm==1.82.8 to pip_blacklist and remediation
guide in security_check.py to detect compromised packages that harvest
credentials and exfiltrate via attacker-controlled server.

Also fixes two pre-existing issues in pip_blacklist scanning:
- Remove `break` that caused only the first blacklist match to be
  detected, missing additional threats in multi-infection scenarios
- Replace substring matching with set-based exact matching to prevent
  false positives on similar version strings (e.g. 1.82.70 vs 1.82.7)

Bump version to 4.1.
2026-03-26 04:17:50 +09:00
Dr.Lt.Data
cf8029ecd4 Merge branch 'main' into draft-v4 2025-07-24 12:41:48 +09:00
Dr.Lt.Data
89530fc4e7 Merge branch 'main' into draft-v4 2025-06-25 12:58:50 +09:00
Dr.Lt.Data
05ceab68f8 restructuring
the existing cache-based implementation will be retained as a fallback under legacy/..., while glob/... will be updated to a cacheless implementation.
2025-04-13 09:26:02 +09:00