Commit graph

5 commits

Author SHA1 Message Date
Xu Lingrui
21fb98bb36 fix: resolve macOS dependency conflict (#78)
fix: resolve macOS dependency conflict in extras
2026-04-16 20:33:10 +08:00
liyikradlee
874badae69 Fix macOS dependency conflict 2026-04-12 14:12:16 +08:00
Xu Lingrui
f01d408ac4
feat: add communication adapters and agent refactoring (#74) 2026-04-09 22:06:38 +08:00
Marc von Renteln
4f61cb2fa1 fix: pin litellm to <1.82.7 to avoid PYSEC-2026-2 supply-chain attack
Versions 1.82.7 and 1.82.8 of litellm were published on March 24, 2026
and contained malicious code that exfiltrated credentials (SSH keys,
cloud credentials, .env files, API keys) to an attacker-controlled domain.

Pin the dependency to >=1.70.0,<1.82.7 in both pyproject.toml and
requirements.txt as a stopgap until litellm can be replaced with direct
provider SDK calls.

See: https://github.com/HKUDS/OpenSpace/issues/31
Ref: PYSEC-2026-2, BerriAI/litellm#24521
2026-03-29 11:16:10 +02:00
spidercatfly
6ff4861f88 initial commit 2026-03-24 16:03:22 +08:00