fix(deps): bump litellm to >=1.84.0 to resolve 7 CVEs (#277)

gaodan-fang · claude · web-flow · commit 2cae2fc8866d · 2026-07-01T22:35:13.000-04:00
* fix(deps): bump litellm to >=1.84.0 to resolve 7 CVEs Addresses CVE-2026-49468 (Critical), CVE-2026-42271 (Critical), CVE-2026-42208 (Critical), CVE-2026-47102 (High), CVE-2026-47101 (High), CVE-2026-40217 (High), CVE-2026-42203 (High). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat(ci): add automated CVE scanning with pip-audit and Dependabot - Add pip-audit job to check-code workflow to block PRs with known vulns - Add dependabot.yml for weekly dependency monitoring and auto-fix PRs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): only block PRs on critical CVEs, create issues for high+critical - pip-audit runs with JSON output and continue-on-error - Queries OSV API for CVSS severity of each finding - Fails build only for Critical (CVSS >= 9.0) vulnerabilities - Auto-creates/updates a GitHub issue listing High+Critical findings Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): make CVE scan informational only, never block PRs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): harden check-vulnerabilities permissions and credential handling - Add explicit contents: read permission (least privilege) - Disable persist-credentials on checkout to avoid token leakage Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      security-patches:
+        applies-to: security-updates
diff --git a/.github/workflows/check-code.yaml b/.github/workflows/check-code.yaml
@@ -103,6 +103,152 @@ jobs:
     - name: Verify platform-integrations matches a fresh render of plugin-source
       run: uv run python plugin-source/build_plugins.py check
 
+  check-vulnerabilities:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          python-version: '3.12'
+      - name: Export requirements from lockfile
+        run: uv export --no-hashes --frozen > /tmp/requirements.txt
+      - name: Install pip-audit
+        run: uv tool install pip-audit
+      - name: Run pip-audit
+        id: audit
+        continue-on-error: true
+        run: pip-audit -r /tmp/requirements.txt --format json --output /tmp/audit-results.json
+      - name: Process results and gate on critical CVEs
+        if: steps.audit.outcome == 'failure'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const results = JSON.parse(fs.readFileSync('/tmp/audit-results.json', 'utf8'));
+
+            const vulns = [];
+            for (const dep of results.dependencies || []) {
+              for (const vuln of dep.vulns || []) {
+                vulns.push({ name: dep.name, version: dep.version, id: vuln.id, fix_versions: vuln.fix_versions || [] });
+              }
+            }
+
+            if (vulns.length === 0) return;
+
+            // Query OSV API for severity of each unique vuln ID
+            const uniqueIds = [...new Set(vulns.map(v => v.id))];
+            const severityMap = {};
+
+            for (const id of uniqueIds) {
+              try {
+                const resp = await fetch(`https://api.osv.dev/v1/vulns/${id}`);
+                if (!resp.ok) continue;
+                const data = await resp.json();
+                // Extract CVSS score from severity or database_specific
+                let score = 0;
+                if (data.severity && data.severity.length > 0) {
+                  for (const s of data.severity) {
+                    if (s.type === 'CVSS_V3' || s.type === 'CVSS_V4') {
+                      // Parse base score from vector — last metric group
+                      const match = s.score?.match(/CVSS:\d\.\d\/(.+)/);
+                      if (match) {
+                        // Use database_specific for numeric score if available
+                      }
+                    }
+                  }
+                }
+                // Check database_specific for numeric CVSS
+                if (data.database_specific?.cvss_v3) {
+                  score = typeof data.database_specific.cvss_v3 === 'number'
+                    ? data.database_specific.cvss_v3
+                    : parseFloat(data.database_specific.cvss_v3) || 0;
+                }
+                if (data.database_specific?.severity) {
+                  const sev = data.database_specific.severity.toUpperCase();
+                  if (sev === 'CRITICAL') score = Math.max(score, 9.0);
+                  else if (sev === 'HIGH') score = Math.max(score, 7.0);
+                }
+                // Fallback: check affected[].ecosystem_specific or aliases for NVD
+                if (score === 0 && data.affected) {
+                  for (const a of data.affected) {
+                    if (a.database_specific?.cvss_v3) {
+                      score = Math.max(score, parseFloat(a.database_specific.cvss_v3) || 0);
+                    }
+                  }
+                }
+                severityMap[id] = score;
+              } catch (e) {
+                console.log(`Warning: could not fetch severity for ${id}`);
+                severityMap[id] = 0;
+              }
+            }
+
+            // Categorize
+            const critical = vulns.filter(v => (severityMap[v.id] || 0) >= 9.0);
+            const high = vulns.filter(v => {
+              const s = severityMap[v.id] || 0;
+              return s >= 7.0 && s < 9.0;
+            });
+
+            console.log(`Found ${critical.length} critical, ${high.length} high vulnerabilities`);
+
+            // Create/update GH issue for high+critical
+            if (critical.length > 0 || high.length > 0) {
+              const lines = ['## Automated CVE Scan Results\n', `_Last scanned: ${new Date().toISOString().split('T')[0]}_\n`];
+              if (critical.length) {
+                lines.push('### Critical (CVSS >= 9.0)\n');
+                critical.forEach(v => lines.push(`- **${v.id}** in \`${v.name}==${v.version}\` — fix: ${v.fix_versions.join(', ') || 'none available'}`));
+              }
+              if (high.length) {
+                lines.push('\n### High (CVSS >= 7.0)\n');
+                high.forEach(v => lines.push(`- **${v.id}** in \`${v.name}==${v.version}\` — fix: ${v.fix_versions.join(', ') || 'none available'}`));
+              }
+
+              const existing = await github.rest.issues.listForRepo({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                labels: 'security,automated',
+                state: 'open'
+              });
+
+              const title = `[Security] ${critical.length} critical, ${high.length} high vulnerabilities detected`;
+              const existingIssue = existing.data.find(i => i.labels.some(l => l.name === 'automated'));
+
+              if (existingIssue) {
+                await github.rest.issues.update({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: existingIssue.number,
+                  title,
+                  body: lines.join('\n')
+                });
+                console.log(`Updated issue #${existingIssue.number}`);
+              } else {
+                await github.rest.issues.create({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  title,
+                  body: lines.join('\n'),
+                  labels: ['security', 'automated']
+                });
+                console.log('Created new security issue');
+              }
+            }
+
+            // Report but never block the build
+            if (critical.length > 0) {
+              core.warning(`${critical.length} critical CVEs found: ${critical.map(v => v.id).join(', ')} — tracked in GitHub issue`);
+            } else {
+              console.log('No critical vulnerabilities. High-severity issues tracked in GitHub issue.');
+            }
+
   ui-tests:
     runs-on: ubuntu-latest
     steps:
diff --git a/explorations/claudecode/pyproject.toml b/explorations/claudecode/pyproject.toml
@@ -6,7 +6,7 @@ readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
     "arize-phoenix>=12.25.1",
-    "litellm[proxy]>=1.80.10",
+    "litellm[proxy]>=1.84.0",
     "opentelemetry-api>=1.39.1",
     "opentelemetry-exporter-otlp>=1.39.1",
     "opentelemetry-sdk>=1.39.1",
diff --git a/pyproject.toml b/pyproject.toml
@@ -8,7 +8,7 @@ dependencies = [
     "arize-phoenix>=12.30.0",
     "fastmcp",
     "jinja2",
-    "litellm",
+    "litellm>=1.84.0",
     "pydantic",
     "sentence-transformers",
     "typer>=0.9.0",
diff --git a/uv.lock b/uv.lock
