chore(deps): bump gitpython, brace-expansion, postcss to clear osv-scan CVEs

[cursor]

TLDR

Problem this solves:

• osv-scan is red on every open PR against litellm_internal_staging because newly disclosed CVEs land on gitpython, brace-expansion, and postcss

How it solves it:

• Bump gitpython in uv.lock from 3.1.52 to 3.1.55 (fixes GHSA-3rp5-jjmw-4wv2, GHSA-6p8h-3wgx-97gf, GHSA-94p4-4cq8-9g67, GHSA-fjr4-x663-mwxc, GHSA-r9mr-m37c-5fr3)
• Bump the dashboard brace-expansion override from 5.0.7 to 5.0.8 (fixes GHSA-mh99-v99m-4gvg)
• Bump the dashboard postcss devDependency and override from 8.5.13 to 8.5.18 (fixes GHSA-r28c-9q8g-f849)

Relevant issues

Linear ticket

Pre-Submission checklist

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review

Dependency bumps are their own regression signal; the OSV Scan CI job is the test that would fail before this change and pass after

Screenshots / Proof of Fix

Before (commit fc5ab31, staging tip; matches the failing job on every open PR, e.g. https://github.com/BerriAI/litellm/actions/runs/30138037343/job/89625768222):

$ /tmp/osv-scanner scan source --config osv-scanner.toml -L uv.lock -L ui/litellm-dashboard/package-lock.json
...
Total 3 packages affected by 7 known vulnerabilities (0 Critical, 7 High, 0 Medium, 0 Low, 0 Unknown) from 2 ecosystems.
7 vulnerabilities can be fixed.
+-------------------------------------+------+-----------+-----------------------+---------+---------------+----------------------------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE               | VERSION | FIXED VERSION | SOURCE                                 |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+----------------------------------------+
| https://osv.dev/GHSA-3rp5-jjmw-4wv2 | 7.0  | PyPI      | gitpython             | 3.1.52  | 3.1.53        | uv.lock                                |
| https://osv.dev/GHSA-6p8h-3wgx-97gf | 7.5  | PyPI      | gitpython             | 3.1.52  | 3.1.54        | uv.lock                                |
| https://osv.dev/GHSA-94p4-4cq8-9g67 | 7.5  | PyPI      | gitpython             | 3.1.52  | 3.1.55        | uv.lock                                |
| https://osv.dev/GHSA-fjr4-x663-mwxc | 8.1  | PyPI      | gitpython             | 3.1.52  | 3.1.54        | uv.lock                                |
| https://osv.dev/GHSA-r9mr-m37c-5fr3 | 8.8  | PyPI      | gitpython             | 3.1.52  | 3.1.54        | uv.lock                                |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev) | 5.0.7   | 5.0.8         | ui/litellm-dashboard/package-lock.json |
| https://osv.dev/GHSA-r28c-9q8g-f849 | 7.5  | npm       | postcss               | 8.5.13  | 8.5.18        | ui/litellm-dashboard/package-lock.json |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+----------------------------------------+

After (this branch, 5169de1):

$ /tmp/osv-scanner scan source --config osv-scanner.toml -L uv.lock -L ui/litellm-dashboard/package-lock.json
Starting filesystem walk for root: /
Scanned /workspace/uv.lock file and found 447 packages
Scanned /workspace/ui/litellm-dashboard/package-lock.json file and found 969 packages
End status: 0 dirs visited, 2 inodes visited, 2 Extract calls, 56.387211ms elapsed, 56.387281ms wall time
GHSA-w8v5-vhqr-4h9v and 2 aliases have been filtered out because: diskcache has no fixed release published; remove this entry once one exists
Filtered 2 vulnerabilities from output

No issues found

Type

🐛 Bug Fix
🚄 Infrastructure

Changes

• uv.lock: gitpython 3.1.52 -> 3.1.55 (surgical hand edit; uv lock --check passes)
• ui/litellm-dashboard/package.json: postcss dev pin and overrides.postcss bumped 8.5.13 -> 8.5.18; overrides.brace-expansion bumped 5.0.7 -> 5.0.8
• ui/litellm-dashboard/package-lock.json: regenerated via npm install --package-lock-only

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing cursor/ci-autofix-automation-6631 (5169de1) with litellm_internal_staging (7b019cf)}