docs: minor updates to security update blog post by ishaan-berri · Pull Request #24540 · BerriAI/litellm

ishaan-berri · 2026-03-25T00:32:50Z

Relevant issues

N/A

Pre-Submission checklist

My PR's scope is as isolated as possible, it only solves 1 specific problem

Type

📖 Documentation

Changes

Added bold callout for LiteLLM AI Gateway/Proxy users clarifying they were not impacted
Fixed inconsistent capitalization in the audit version history bullet list

vercel · 2026-03-25T00:32:55Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Mar 25, 2026 0:59am

greptile-apps · 2026-03-25T00:34:19Z

Greptile Summary

This PR makes documentation-only edits to the March 2026 security incident blog post. It adds a bold callout clarifying that LiteLLM AI Gateway/Proxy Docker image users were not impacted, fixes inconsistent capitalization in the "Audit version history" checklist, renames several occurrences of "LiteLLM" to "LiteLLM AI Gateway", and removes the TLDR and Overview headings (promoting the overview paragraph to the top level).

Key changes:

Added **LiteLLM AI Gateway/Proxy users:** callout paragraph above the "not affected" bullet list for visibility.
Capitalised Local environments and Deployment logs in the audit checklist for consistency.
Replaced LiteLLM with LiteLLM AI Gateway in the opening paragraph, affected-version descriptions, and the "Response and remediation" section.
Removed the TLDR section — the release-pause statement it contained ("We are pausing new LiteLLM releases…") no longer appears anywhere in the document, which may leave readers without up-to-date guidance on release safety.

Confidence Score: 4/5

Safe to merge — documentation-only change with no code impact, though one informational gap should be addressed.
All changes are confined to a single Markdown blog post. The additions and capitalization fixes are correct and improve clarity. The only concern is the silent removal of the "pausing new releases" statement from the TLDR, which could leave readers without important status information. This warrants a fix before publishing but does not block the repository in any functional sense.
docs/my-website/blog/security_update_march_2026/index.md — verify the release-pause statement removal is intentional and, if so, add an explicit status update in its place.

Important Files Changed

Filename	Overview
docs/my-website/blog/security_update_march_2026/index.md	Documentation-only changes: adds a bold callout for proxy/gateway users, fixes capitalization in the audit checklist, renames "LiteLLM" → "LiteLLM AI Gateway" in several locations, and removes the TLDR + Overview sections. The removal silently drops the "pausing new releases" statement without replacement.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Reader visits security blog post] --> B{How do you run LiteLLM?}
    B --> C[Official Docker image\nghcr.io/berriai/litellm]
    B --> D[LiteLLM Cloud]
    B --> E[pip install litellm\nor transitive dependency]
    B --> F[Source install from GitHub]

    C --> G["✅ NOT affected\n(pins deps in requirements.txt,\ndoes not use PyPI packages)"]
    D --> G
    F --> G

    E --> H{Was v1.82.7 or v1.82.8\ninstalled between\n10:39–16:00 UTC Mar 24?}
    H -->|No| G
    H -->|Yes| I["⚠️ AFFECTED\nRotate secrets, remove\nlitellm_init.pth, audit logs"]

Comments Outside Diff (1)

docs/my-website/blog/security_update_march_2026/index.md, line 16-23 (link)

Removed release-pause statement not replaced

The TLDR section that was removed included the bullet: "We are pausing new LiteLLM releases until we complete a broader supply-chain review and confirm the release path is safe." This statement is no longer present anywhere in the document after the change.

For a security incident blog post, this is meaningful information. If the pause is still in effect, readers need to know. If the pause has been lifted, the document should explicitly say so (e.g., "Releases have resumed as of [date]"). Silently removing it leaves readers without guidance on whether new versions are safe to use.

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into worktree-tingly..." | Re-trigger Greptile}

greptile-apps · 2026-03-25T00:34:23Z


 You are **not** affected if any of the following are true:

+**LiteLLM AI Gateway/Proxy users:** Customers running the official LiteLLM Proxy Docker image were not impacted. That deployment path pins dependencies in requirements.txt and does not rely on the compromised PyPI packages.


Inconsistent naming between callout and bullet list

The newly added callout paragraph refers to the "official LiteLLM Proxy Docker image", while the bullet point directly below it (line 65) refers to the "official LiteLLM AI Gateway Docker image". Both refer to the same Docker image (ghcr.io/berriai/litellm), but the inconsistent naming may create confusion for readers trying to confirm whether they are affected.

Suggested change

**LiteLLM AI Gateway/Proxy users:** Customers running the official LiteLLM Proxy Docker image were not impacted. That deployment path pins dependencies in requirements.txt and does not rely on the compromised PyPI packages.

**LiteLLM AI Gateway/Proxy users:** Customers running the official LiteLLM AI Gateway Docker image were not impacted. That deployment path pins dependencies in requirements.txt and does not rely on the compromised PyPI packages.

greptile-apps · 2026-03-25T00:34:24Z

+
 - You are using **LiteLLM Cloud**
- You are using the official Docker image: `ghcr.io/berriai/litellm`
+- You are using the official LiteLLM AI Gateway Docker image: `ghcr.io/berriai/litellm`


Redundancy between callout and existing bullet point

The new callout on line 62 states that users running the official LiteLLM Proxy/AI Gateway Docker image were not impacted. However, the bullet point on this line already communicates the exact same thing as part of the "not affected" list. Having both may be repetitive. Consider either removing this bullet and keeping only the callout, or merging the callout into the bullet for a cleaner read.

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

CLAassistant · 2026-03-25T00:35:02Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ ishaan-jaff
❌ ishaan-berri
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

codspeed-hq · 2026-03-25T00:36:29Z

Merging this PR will not alter performance

✅ 16 untouched benchmarks

_{Comparing worktree-tingly-jumping-lovelace (e92edee) with main (4571f2a)¹}

No successful run was found on main (e92edee) during the generation of this report, so 4571f2a was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

docs: minor updates to security update blog post

f9d1f8c

greptile-apps bot reviewed Mar 25, 2026

View reviewed changes

vercel bot deployed to Preview March 25, 2026 00:34 View deployment

Merge branch 'main' into worktree-tingly-jumping-lovelace

e92edee

ishaan-berri merged commit b26bc5a into main Mar 25, 2026
33 of 36 checks passed

vercel bot deployed to Preview March 25, 2026 00:36 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

docs: minor updates to security update blog post#24540

docs: minor updates to security update blog post#24540
ishaan-berri merged 2 commits intomainfrom
worktree-tingly-jumping-lovelace

ishaan-berri commented Mar 25, 2026 •

edited

Loading

Uh oh!

vercel bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Mar 25, 2026 •

edited

Loading

Important Files Changed

Comments Outside Diff (1)

Uh oh!

greptile-apps bot Mar 25, 2026

Uh oh!

greptile-apps bot Mar 25, 2026

Uh oh!

Uh oh!

CLAassistant commented Mar 25, 2026

Uh oh!

codspeed-hq bot commented Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		You are not affected if any of the following are true:

		LiteLLM AI Gateway/Proxy users: Customers running the official LiteLLM Proxy Docker image were not impacted. That deployment path pins dependencies in requirements.txt and does not rely on the compromised PyPI packages.

Uh oh!

Conversation

ishaan-berri commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Relevant issues

Pre-Submission checklist

Type

Changes

Uh oh!

vercel bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Flowchart

Comments Outside Diff (1)

Uh oh!

greptile-apps bot Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

CLAassistant commented Mar 25, 2026

Uh oh!

codspeed-hq bot commented Mar 25, 2026

Merging this PR will not alter performance

Footnotes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ishaan-berri commented Mar 25, 2026 •

edited

Loading

vercel bot commented Mar 25, 2026 •

edited

Loading

greptile-apps bot commented Mar 25, 2026 •

edited

Loading