scriptoriumadmin/OpenSpace
1
0
Fork 0
mirror of https://github.com/HKUDS/OpenSpace.git synced 2026-09-11 22:51:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(deps): relax litellm security pin window

Browse source
This commit is contained in:
gujishh 2026-06-03 15:26:03 +09:00
parent d1e367d0ed
commit a9d4f71ccd
3 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
pyproject.toml
View file

@ -14,7 +14,7 @@ authors = [
]
dependencies = [
"litellm>=1.70.0,<1.82.7", # pinned to avoid PYSEC-2026-2 supply-chain compromise (1.82.7/1.82.8 were malicious)
"litellm>=1.70.0,!=1.82.7,!=1.82.8", # pinned to avoid PYSEC-2026-2 supply-chain compromise (1.82.7/1.82.8 were malicious)
"python-dotenv>=1.0.0",
"openai>=1.0.0",
"jsonschema>=4.25.0",

2
requirements.txt
View file

@ -1,5 +1,5 @@
# OpenSpace core dependencies
litellm>=1.70.0,<1.82.7 # pinned to avoid PYSEC-2026-2 supply-chain compromise (1.82.7/1.82.8 were malicious)
litellm>=1.70.0,!=1.82.7,!=1.82.8 # pinned to avoid PYSEC-2026-2 supply-chain compromise (1.82.7/1.82.8 were malicious)
python-dotenv>=1.0.0
openai>=1.0.0
jsonschema>=4.25.0

12
tests/test_litellm_pin_window.py Normal file
View file

@ -0,0 +1,12 @@
from pathlib import Path
def test_litellm_pin_window_matches_safe_versions() -> None:
pyproject = Path("pyproject.toml").read_text()
requirements = Path("requirements.txt").read_text()
expected = "litellm>=1.70.0,!=1.82.7,!=1.82.8"
assert expected in pyproject
assert expected in requirements
assert "litellm>=1.70.0,<1.82.7" not in pyproject
assert "litellm>=1.70.0,<1.82.7" not in requirements