diff --git a/.github/osv-scanner.toml b/.github/osv-scanner.toml index 7097188c3c7..7f0272627a5 100644 --- a/.github/osv-scanner.toml +++ b/.github/osv-scanner.toml @@ -28,6 +28,11 @@ id = "GHSA-45c3-73f7-pv4m" ignoreUntil = 2027-02-01 reason = "dnspython 2.9.0 (published 2026-10-09) is the only fix and requires Python >= 3.11, so the Python 3.10 resolution stays on 2.8.0 while 3.11+ locks 2.9.0; the advisory is CPU use in dns.name.from_wire_parser and litellm only reaches dnspython through pydantic EmailStr, which never does DNS lookups; remove this entry once 3.10 is dropped or a 3.10-compatible fix ships" +[[IgnoredVulns]] +id = "GHSA-mmhr-3c5m-f64f" +ignoreUntil = 2027-02-01 +reason = "soupsieve 4.0 is the first fix and requires Python >= 3.11.5, so Python 3.10 and 3.11.0-3.11.4 resolve 2.10 while newer Python versions resolve 4.1. litellm declares beautifulsoup4 in its ci dependency group and uses BeautifulSoup in tests/code_coverage_tests/bedrock_pricing.py to parse AWS pricing HTML with html.parser and find table rows and cells, not CSS selectors; no runtime litellm code imports soupsieve or beautifulsoup4. Remove once 3.10 is dropped and the minimum Python version is at least 3.11.5" + [[PackageOverrides]] name = "pillow" version = "12.3.0" diff --git a/pyproject.toml b/pyproject.toml index 3b7e3e154b9..5d011d31d62 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -409,7 +409,8 @@ constraint-dependencies = [ "tornado>=6.6; python_version >= '3.11'", "aiohttp>=3.14.2,<4.0", "packaging>=24.0", - "soupsieve>=2.8.4", + "soupsieve>=2.10", + "soupsieve>=4.0; python_full_version >= '3.11.5'", "httplib2>=0.32.0", "setuptools>=84.1.0", "dnspython>=2.9.0; python_version >= '3.11'", diff --git a/uv.lock b/uv.lock index 9c23d77ea3b..0e868f8c203 100644 --- a/uv.lock +++ b/uv.lock @@ -6,7 +6,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", "python_full_version < '3.11'", ] @@ -33,7 +34,8 @@ constraints = [ { name = "httplib2", specifier = ">=0.32.0" }, { name = "packaging", specifier = ">=24.0" }, { name = "setuptools", specifier = ">=84.1.0" }, - { name = "soupsieve", specifier = ">=2.8.4" }, + { name = "soupsieve", specifier = ">=2.10" }, + { name = "soupsieve", marker = "python_full_version >= '3.11.5'", specifier = ">=4.0" }, { name = "tornado", specifier = ">=6.5.8" }, { name = "tornado", marker = "python_full_version >= '3.11'", specifier = ">=6.6" }, ] @@ -905,7 +907,8 @@ name = "beautifulsoup4" version = "4.14.3" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "soupsieve" }, + { name = "soupsieve", version = "2.10", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11.5'" }, + { name = "soupsieve", version = "4.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11.5'" }, { name = "typing-extensions", version = "4.15.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.15'" }, { name = "typing-extensions", version = "4.16.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.15'" }, ] @@ -1088,7 +1091,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", "python_full_version < '3.11'", ] sdist = { url = "https://files.pythonhosted.org/packages/98/c4/4818b392104bd426171fc2ce9c79c8edb4019ba6505747626d0f7107766c/bytecode-0.17.0.tar.gz", hash = "sha256:0c37efa5bd158b1b873f530cceea2c645611d55bd2dc2a4758b09f185749b6fd", size = 105863, upload-time = "2025-09-03T19:55:45.703Z" } @@ -1536,7 +1540,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", ] dependencies = [ { name = "numpy", version = "1.26.4", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.12'" }, @@ -2001,7 +2006,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", ] sdist = { url = "https://files.pythonhosted.org/packages/ef/4a/50822184bd67cc6493f0fb6a880749158fcd31ab3fa07409acfd91f9fc85/dnspython-2.9.0.tar.gz", hash = "sha256:b44dc6b18f07a8b1c56676a19fbfdb5209415b046a9cece286baafa87ff3f7f1", size = 423560, upload-time = "2026-10-09T00:07:24.352Z" } wheels = [ @@ -2052,7 +2058,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", ] sdist = { url = "https://files.pythonhosted.org/packages/ae/b6/03bb70946330e88ffec97aefd3ea75ba575cb2e762061e0e62a213befee8/docutils-0.22.4.tar.gz", hash = "sha256:4db53b1fde9abecbb74d91230d32ab626d94f6badfc575d6db9194a49df29968", size = 2291750, upload-time = "2025-12-18T19:00:26.443Z" } wheels = [ @@ -2271,7 +2278,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", ] sdist = { url = "https://files.pythonhosted.org/packages/d8/28/3893324bcadf8f89b1616637468d766af3f625008c0735bf704fdfa86617/filelock-4.2.4.tar.gz", hash = "sha256:c6d8663535e1650ee430507b4ffbac7b464dd64b7647ea0112a9f406499d163d", size = 652444, upload-time = "2026-10-19T01:57:51.001Z" } wheels = [ @@ -2719,7 +2727,8 @@ source = { registry = "https://pypi.org/simple" } resolution-markers = [ "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", "python_full_version < '3.11'", ] dependencies = [ @@ -2945,7 +2954,8 @@ source = { registry = "https://pypi.org/simple" } resolution-markers = [ "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", "python_full_version < '3.11'", ] dependencies = [ @@ -3488,7 +3498,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", "python_full_version < '3.11'", ] sdist = { url = "https://files.pythonhosted.org/packages/1f/e2/1654d65851f39fd94e91a77a5655d09d4b64901fdc594020d8348db697b2/hiredis-3.4.0.tar.gz", hash = "sha256:da19331354433af6a2c54c21f2d70ba084933c0d7d2c43578ec5c5b446674ad5", size = 137169, upload-time = "2026-06-03T16:23:46.226Z" } @@ -4668,7 +4679,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", ] dependencies = [ { name = "aiohttp" }, @@ -5691,7 +5703,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", ] dependencies = [ { name = "aiohttp" }, @@ -6647,7 +6660,8 @@ name = "numpy" version = "1.26.4" source = { registry = "https://pypi.org/simple" } resolution-markers = [ - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", "python_full_version < '3.11'", ] sdist = { url = "https://files.pythonhosted.org/packages/65/6e/09db70a523a96d25e115e71cc56a6f9031e7b8cd166c1ac8438307c14058/numpy-1.26.4.tar.gz", hash = "sha256:2a02aba9ed12e4ac4eb3ea9421c420301a0c6460d9830d74a9df87efa4912010", size = 15786129, upload-time = "2024-02-06T00:26:44.495Z" } @@ -7872,7 +7886,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", ] sdist = { url = "https://files.pythonhosted.org/packages/ce/a4/9cc30690a394a8305e8be4c9036aa16d0dfddadd09079860b582f562496d/pillow-13.0.0.tar.gz", hash = "sha256:cdcd1ba258178f7356d74170c9a81ba4eab6a5d55748bc402a5a2a6fe6be3510", size = 47058631, upload-time = "2026-10-16T22:18:09.718Z" } wheels = [ @@ -8531,7 +8546,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", "python_full_version < '3.11'", ] dependencies = [ @@ -8581,7 +8597,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", "python_full_version < '3.11'", ] dependencies = [ @@ -9886,7 +9903,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", ] sdist = { url = "https://files.pythonhosted.org/packages/42/68/3bd46b8a5e01d3c2ebdf9c5e9497912e3fe0cde02bac21a7130ca866e403/rpds_py-2026.9.1.tar.gz", hash = "sha256:4793ef7f78268b124b73fa933440f01d258bbae01de9fa53e9080c9ab0425a12", size = 63948, upload-time = "2026-10-04T16:32:36.469Z" } wheels = [ @@ -10126,7 +10144,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", ] dependencies = [ { name = "joblib" }, @@ -10243,7 +10262,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", ] dependencies = [ { name = "numpy", version = "1.26.4", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.12'" }, @@ -10565,11 +10585,31 @@ wheels = [ [[package]] name = "soupsieve" -version = "2.9.2" +version = "2.10" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/69/99/a6ca3beb3ccacb41fb3321d8a60e5566f9e6467601ef8eba6a17e1b89778/soupsieve-2.9.2.tar.gz", hash = "sha256:4a55d8cf158a9c2e587fa4922f1bbb91d68ac829e2d6f25403a85747c71daf74", size = 122445, upload-time = "2026-08-07T00:57:24.801Z" } +resolution-markers = [ + "python_full_version >= '3.11' and python_full_version < '3.11.5'", + "python_full_version < '3.11'", +] +sdist = { url = "https://files.pythonhosted.org/packages/71/c3/1b817965ac12dc002d7c9cd7dfffdd7d4fbf9b45763ef2ffe7b86ee94670/soupsieve-2.10.tar.gz", hash = "sha256:49e9380d7d2905463583bafe285e818c7366a9ed7b3aee221c1ac79c905d8bc0", size = 124337, upload-time = "2026-09-24T02:36:35.048Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/eb/dc/ad025c1ee131eba60c69f4dd5779b18fcf1e6b21a343e2162a84d5d133c7/soupsieve-2.9.2-py3-none-any.whl", hash = "sha256:8089a26fd974ca7a1f30276d3d8492ab266ab15af581642dfe8aa162e0c1c823", size = 37370, upload-time = "2026-08-07T00:57:23.524Z" }, + { url = "https://files.pythonhosted.org/packages/66/87/5ed59e1d0290564e2027ed066c52b059892c4637741337fc0967183c8d4d/soupsieve-2.10-py3-none-any.whl", hash = "sha256:8596eb8967d744174820280fa62b4542a2e955bfaccca73ed8a13c6eb8e9b502", size = 38019, upload-time = "2026-09-24T02:36:33.709Z" }, +] + +[[package]] +name = "soupsieve" +version = "4.1" +source = { registry = "https://pypi.org/simple" } +resolution-markers = [ + "python_full_version >= '3.15'", + "python_full_version == '3.14.*'", + "python_full_version == '3.13.*'", + "python_full_version == '3.12.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", +] +sdist = { url = "https://files.pythonhosted.org/packages/95/48/21a393ff731b8f928fa4f8176f9a7ceba2252ee60a5149f25b45c292aa5c/soupsieve-4.1.tar.gz", hash = "sha256:ca9abf7126667010d8f6e9b39bfc1bc3b23c8aed9bcb0f54a754dde969bb8aab", size = 161955, upload-time = "2026-11-10T01:59:50.399Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/88/73/6a2087c72975cfc07394623bca8d17654342ea4055ae368deafe5a81a542/soupsieve-4.1-py3-none-any.whl", hash = "sha256:e4d667b3974ce6e038e7390486b8093369854a1d345ffdd4c121dfc4a782e809", size = 52302, upload-time = "2026-11-10T01:59:48.571Z" }, ] [[package]] @@ -10608,7 +10648,8 @@ name = "sphinx" version = "9.0.4" source = { registry = "https://pypi.org/simple" } resolution-markers = [ - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", ] dependencies = [ { name = "alabaster" }, @@ -11077,7 +11118,8 @@ source = { registry = "https://pypi.org/simple" } resolution-markers = [ "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", ] sdist = { url = "https://files.pythonhosted.org/packages/d0/02/5f549b1ad5da6267ed1e1fac2eef69257b1979cc812497002499b7895ff9/tornado-6.6.tar.gz", hash = "sha256:34c4aa916d7f2b2d5cadee2c6850f5a4a7f3d688cbf58399ea9bd3057af4abd5", size = 617998, upload-time = "2026-10-21T15:31:04.733Z" } wheels = [ @@ -11415,7 +11457,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", "python_full_version < '3.11'", ] sdist = { url = "https://files.pythonhosted.org/packages/72/94/1a15dd82efb362ac84269196e94cf00f187f7ed21c242792a923cdb1c61f/typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466", size = 109391, upload-time = "2025-08-25T13:49:26.313Z" } @@ -11457,7 +11500,8 @@ resolution-markers = [ "python_full_version == '3.14.*'", "python_full_version == '3.13.*'", "python_full_version == '3.12.*'", - "python_full_version == '3.11.*'", + "python_full_version >= '3.11.5' and python_full_version < '3.12'", + "python_full_version >= '3.11' and python_full_version < '3.11.5'", "python_full_version < '3.11'", ] dependencies = [