scriptoriumadmin/OpenSpace
1
0
Fork 0
mirror of https://github.com/HKUDS/OpenSpace.git synced 2026-08-28 05:15:00 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #32 from mvonrenteln/fix/pin-litellm-safe-version

Browse source 
fix: pin litellm to <1.82.7 to mitigate PYSEC-2026-2 supply-chain attack
This commit is contained in:
Dennis-yxchen 2026-03-30 21:04:23 +08:00 • committed by GitHub
commit 90b2ffab6a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
pyproject.toml
View file

@ -14,7 +14,7 @@ authors = [
]
dependencies = [
"litellm>=1.70.0",
"litellm>=1.70.0,<1.82.7", # pinned to avoid PYSEC-2026-2 supply-chain compromise (1.82.7/1.82.8 were malicious)
"python-dotenv>=1.0.0",
"openai>=1.0.0",
"jsonschema>=4.25.0",

2
requirements.txt
View file

@ -1,5 +1,5 @@
# OpenSpace core dependencies
litellm>=1.70.0
litellm>=1.70.0,<1.82.7 # pinned to avoid PYSEC-2026-2 supply-chain compromise (1.82.7/1.82.8 were malicious)
python-dotenv>=1.0.0
openai>=1.0.0
jsonschema>=4.25.0