Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Greptile SummaryThis PR is a targeted security patch that pins Key observations:
Confidence Score: 5/5Safe to merge — changes are limited to npm overrides and address known axios security vulnerabilities with no production code impact. All six package.json files are updated consistently in the overrides section only. No source code is modified, no tests are altered, and [email protected] has no known vulnerabilities. The only finding is a P2 style suggestion to use >= instead of an exact pin, which does not block merge. No files require special attention.
|
| Filename | Overview |
|---|---|
| package.json | Pins axios override from >=0.30.2 to exactly 1.13.6 to address security vulnerabilities (prototype pollution, DoS via mergeConfig) |
| ui/litellm-dashboard/package.json | Pins axios override to exactly 1.13.6; all other security overrides in this file continue to use >= ranges, so future axios patches will require a manual pin update |
| docs/my-website/package.json | Pins axios override to exactly 1.13.6 in the documentation site's package.json |
| litellm-js/spend-logs/package.json | Pins axios override to exactly 1.13.6 in the spend-logs JS package |
| tests/proxy_admin_ui_tests/package.json | Pins axios override to exactly 1.13.6 in the proxy admin UI tests package |
| tests/proxy_admin_ui_tests/ui_unit_tests/package.json | Pins axios override to exactly 1.13.6 in the UI unit tests package |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A["npm install / npm ci"] --> B["npm resolves overrides"]
B --> C{"axios version\nrequested by\ntransitive dep"}
C -->|"any version"| D["Override: axios = 1.13.6"]
D --> E["[email protected] installed\n✅ No known CVEs"]
subgraph "Before this PR"
F["Override: axios ≥ 0.30.2"]
F --> G["Could resolve to\nvulnerable version\n❌ Prototype Pollution\n❌ CVE-2026-25639"]
end
Reviews (1): Last reviewed commit: "pin axios" | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| "webpack-dev-middleware": ">=5.3.4", | ||
| "braces": ">=3.0.3", | ||
| "axios": ">=0.30.2", | ||
| "axios": "1.13.6", |
There was a problem hiding this comment.
>= pattern used for all other overrides
Every other security override in all six package.json files uses a >= lower-bound (e.g. "webpack": ">=5.94.0"), so a future security patch is picked up automatically. Pinning axios to an exact version means that when 1.13.7 or later ships with another fix, these overrides must each be manually updated again.
Consider using >=1.13.6 to stay consistent with the project's pattern and to allow future patch releases to flow through automatically:
| "axios": "1.13.6", | |
| "axios": ">=1.13.6", |
This same suggestion applies to the equivalent line in package.json, docs/my-website/package.json, litellm-js/spend-logs/package.json, tests/proxy_admin_ui_tests/package.json, and tests/proxy_admin_ui_tests/ui_unit_tests/package.json.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
2 participants
[Security] - Pin
axios=1.13.6Pins axios to 1.13.6 across all 6 package.json files in the repo. Malicious versions [email protected] and [email protected] were published to npm https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
Our previous override of >=0.30.2 could have resolved to a compromised version on a fresh install without a lock file.
We are not impacted -- the lock file already resolved to 1.13.6 -- but this pin prevents future accidental upgrades to a malicious release.
Pre-Submission checklist
Please complete all items before asking a LiteLLM maintainer to review your PR
tests/test_litellm/directory, Adding at least 1 test is a hard requirement - see detailsmake test-unit@greptileaiand received a Confidence Score of at least 4/5 before requesting a maintainer reviewDelays in PR merge?
If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).
CI (LiteLLM team)
Branch creation CI run
Link:
CI run for the last commit
Link:
Merge / cherry-pick CI run
Links:
Type
🚄 Infrastructure
✅ Test
Changes