TPTBusiness c5df30482e chore: Document vLLM CVE-2026-22807 is already fixed ...

- Add comment explaining vLLM >=0.18.0 is already safe (CVE fixed in >=0.14.0)
- Dependabot alert #44 is false positive due to missing lockfile
- Translate all comments to English (project language policy)
- No version change needed - current specification is already secure

Security Status:
- CVE-2026-22807: Fixed in vLLM >=0.14.0, current spec >=0.18.0 ✓
- CVE-2026-22778: Fixed in current version ✓
- CVE-2026-27893: Fixed in current version ✓

Note: Without a lockfile (pip-tools/uv/poetry), Dependabot cannot determine
the installed version and raises alerts based on the requirement spec alone.

2026-04-02 22:54:58 +02:00

..

app

feat: Add model loader system (same as prompts)

2026-04-02 22:40:46 +02:00

components

feat: Add model loader system (same as prompts)

2026-04-02 22:40:46 +02:00

core

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00

oai

feat: add LLM-finetune scenario (#1314)

2026-03-02 19:04:10 +08:00

scenarios

chore: Document vLLM CVE-2026-22807 is already fixed

2026-04-02 22:54:58 +02:00

utils

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00