mirror of
https://github.com/BerriAI/litellm.git
synced 2026-11-03 07:23:33 +00:00
dacaaad72e
* build: allow filelock 4.x filelock 3.x is the only line the current cap permits, and three CVEs (CVE-2026-112940, CVE-2026-112913, CVE-2026-112907) are fixed only in 4.2.1+. The cap means every downstream that depends on litellm is held on a vulnerable filelock with no way out, since pip has no override. litellm uses FileLock(path, timeout=..., mode=...) and Timeout, in litellm/proxy/client/cli/commands/configure_profiles.py and claude_settings.py. Both keyword arguments still exist in 4.2.4 and Timeout is still exported, so the two call sites are unaffected. The CVEs are in the SQLite-backed ReadWriteLock / AsyncReadWriteLock, which litellm does not use. <5 rather than a floor bump because litellm supports Python 3.10 and filelock 4.x requires >=3.11: widening the cap lets 3.11+ resolve 4.x while 3.10 keeps a 3.x filelock automatically, through filelock's own requires_python. * build: sync core filelock bound and dependency lock --------- Co-authored-by: Speculator55005 <50082482+fas89@users.noreply.github.com>
79 lines
2.6 KiB
TOML
79 lines
2.6 KiB
TOML
[project]
|
|
name = "litellm-core"
|
|
version = "1.105.0"
|
|
description = "Library to easily interface with LLM API providers"
|
|
readme = "README.md"
|
|
requires-python = ">=3.10, <3.16"
|
|
license = "MIT"
|
|
license-files = ["LICENSE"]
|
|
authors = [
|
|
{ name = "BerriAI" },
|
|
]
|
|
dependencies = [
|
|
"fastuuid>=0.14.0,<1.0; python_version < '3.15'",
|
|
"filelock>=3.16.1,<5",
|
|
"httpx[http2]>=0.28.0,<1.0",
|
|
"openai>=2.20.0,<4.0.0",
|
|
"python-dateutil>=2.8.2,<3.0",
|
|
"python-dotenv>=1.0.0,<2.0",
|
|
"pyyaml>=6.0.3,<7.0",
|
|
"packaging>=24.0",
|
|
"importlib-metadata>=8.0.0,<9.0",
|
|
"tiktoken>=0.8.0,<1.0; python_version < '3.14'",
|
|
"tiktoken>=0.12.0,<1.0; python_version == '3.14'",
|
|
"tiktoken>=0.14.0,<1.0; python_version >= '3.15'",
|
|
"click>=8.0.0,<9.0",
|
|
"jinja2>=3.1.6,<4.0",
|
|
"aiohttp>=3.14.2,<4.0",
|
|
"anyio>=4.14.0,<5.0",
|
|
"async-timeout>=4.0.3,<6.0; python_version < '3.11'",
|
|
"pydantic>=2.11.0,<3.0.0; python_version < '3.14'",
|
|
"pydantic>=2.12.0,<3.0.0; python_version == '3.14'",
|
|
"pydantic>=2.14.0,<3.0.0; python_version >= '3.15'",
|
|
"pydantic-settings>=2.14.1,<3.0",
|
|
"jsonschema>=4.0.0,<5.0",
|
|
"certifi>=2026.10.19",
|
|
"typing-extensions>=4.13.0,<5.0",
|
|
]
|
|
|
|
[project.urls]
|
|
Homepage = "https://litellm.ai"
|
|
Repository = "https://github.com/BerriAI/litellm"
|
|
Documentation = "https://docs.litellm.ai"
|
|
|
|
[build-system]
|
|
requires = ["maturin==1.15.0"]
|
|
build-backend = "maturin"
|
|
|
|
[tool.maturin]
|
|
manifest-path = "litellm-rust/crates/python-bridge/Cargo.toml"
|
|
module-name = "litellm.rust_bridge._native"
|
|
python-source = "."
|
|
bindings = "pyo3"
|
|
features = ["extension-module"]
|
|
profile = "release"
|
|
editable-profile = "dev"
|
|
include = [
|
|
{ path = "rust-toolchain.toml", format = "sdist" },
|
|
{ path = ".cargo/config.toml", format = "sdist" },
|
|
{ path = "model_prices_and_context_window.json", format = "sdist" },
|
|
"litellm/router_strategy/complexity_router/artifacts/*.json",
|
|
"litellm/router_strategy/complexity_router/fuse_presets.json",
|
|
"litellm/proxy/model_insights_tasks.json",
|
|
"litellm/proxy/common_utils/codex_base_instructions.md",
|
|
"litellm/proxy/common_utils/codex_bundled_models_0.159.3.json",
|
|
]
|
|
exclude = [
|
|
"litellm/proxy/_experimental/out",
|
|
"litellm/proxy/_experimental/out/**",
|
|
"litellm/proxy/enterprise",
|
|
"litellm/proxy/enterprise/**",
|
|
"litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/guardrail_benchmarks",
|
|
"litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/guardrail_benchmarks/**",
|
|
"**/__pycache__",
|
|
"**/__pycache__/**",
|
|
"**/.pytest_cache",
|
|
"**/.pytest_cache/**",
|
|
"**/.ruff_cache",
|
|
"**/.ruff_cache/**",
|
|
]
|