From a9d4f71ccdd92c40b14b96de9738ff6f80ab7e78 Mon Sep 17 00:00:00 2001 From: gujishh Date: Wed, 3 Jun 2026 15:26:03 +0900 Subject: [PATCH] fix(deps): relax litellm security pin window --- pyproject.toml | 2 +- requirements.txt | 2 +- tests/test_litellm_pin_window.py | 12 ++++++++++++ 3 files changed, 14 insertions(+), 2 deletions(-) create mode 100644 tests/test_litellm_pin_window.py diff --git a/pyproject.toml b/pyproject.toml index b7c6fc9..2ae6fea 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -14,7 +14,7 @@ authors = [ ] dependencies = [ - "litellm>=1.70.0,<1.82.7", # pinned to avoid PYSEC-2026-2 supply-chain compromise (1.82.7/1.82.8 were malicious) + "litellm>=1.70.0,!=1.82.7,!=1.82.8", # pinned to avoid PYSEC-2026-2 supply-chain compromise (1.82.7/1.82.8 were malicious) "python-dotenv>=1.0.0", "openai>=1.0.0", "jsonschema>=4.25.0", diff --git a/requirements.txt b/requirements.txt index c53814c..0f6b6a0 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,5 +1,5 @@ # OpenSpace core dependencies -litellm>=1.70.0,<1.82.7 # pinned to avoid PYSEC-2026-2 supply-chain compromise (1.82.7/1.82.8 were malicious) +litellm>=1.70.0,!=1.82.7,!=1.82.8 # pinned to avoid PYSEC-2026-2 supply-chain compromise (1.82.7/1.82.8 were malicious) python-dotenv>=1.0.0 openai>=1.0.0 jsonschema>=4.25.0 diff --git a/tests/test_litellm_pin_window.py b/tests/test_litellm_pin_window.py new file mode 100644 index 0000000..d16ea9d --- /dev/null +++ b/tests/test_litellm_pin_window.py @@ -0,0 +1,12 @@ +from pathlib import Path + + +def test_litellm_pin_window_matches_safe_versions() -> None: + pyproject = Path("pyproject.toml").read_text() + requirements = Path("requirements.txt").read_text() + expected = "litellm>=1.70.0,!=1.82.7,!=1.82.8" + + assert expected in pyproject + assert expected in requirements + assert "litellm>=1.70.0,<1.82.7" not in pyproject + assert "litellm>=1.70.0,<1.82.7" not in requirements