fix(deps): relax core runtime dependency pins from exact == to ranges

When litellm migrated from Poetry to uv (PR #24905, v1.83.1), the core
dependency specifications in pyproject.toml changed from Poetry bare-version
strings (e.g. openai = "2.30.0") to PEP 621 exact pins (openai==2.24.0).

Poetry bare-version strings are actually caret ranges (^X.Y.Z == >=X.Y.Z,<X+1),
but PEP 621 == is exact. This means every downstream package that installs
litellm as a library dependency is now forced to downgrade aiohttp, pydantic,
openai, click, and 8 other common packages to exact old versions.

Fix: restore range specifiers for the 12 core runtime dependencies. The
optional extras (proxy, proxy-runtime, etc.) are consumed primarily by
Docker images where exact pins are appropriate and are left unchanged.
The uv.lock file continues to provide exact reproducibility for Docker
builds and CI.

Fixes: #26154
This commit is contained in:
Tai An 2026-04-21 00:15:01 -07:00 committed by Sameer Kankute
parent f862ca00cd
commit 48821b523d
No known key found for this signature in database

View file

@ -29,8 +29,9 @@ Homepage = "https://litellm.ai"
Repository = "https://github.com/BerriAI/litellm"
Documentation = "https://docs.litellm.ai"
# Dependencies pinned from the published `litellm[proxy]==1.83.0` resolution.
# Docker and CI should prefer `uv.lock` rather than maintaining parallel installers.
# Optional extras retain exact pins because they are consumed by Docker images
# where exact reproducibility matters. The core SDK uses ranges so downstream
# consumers can coexist with other packages without forced downgrades.
[project.optional-dependencies]
proxy = [
"gunicorn==23.0.0",
@ -208,7 +209,7 @@ build-backend = "uv_build"
[tool.uv]
default-groups = ["dev"]
required-version = ">=0.10.9"
required-version = "==0.10.9"
exclude-newer = "3 days"
[tool.uv.sources]
@ -264,3 +265,4 @@ filterwarnings = [
[tool.coverage.run]
source = ["litellm"]
relative_files = true