Merge pull request #23 from SharedIntellect/security/pin-litellm-1.82.0

dacervera · web-flow · commit bf88ddf2d324 · 2026-03-24T17:43:14.000-07:00
SECURITY: Pin litellm==1.82.0 — v1.82.8 supply chain compromise
diff --git a/reference-implementation/pyproject.toml b/reference-implementation/pyproject.toml
@@ -14,7 +14,7 @@ readme = "README.md"
 license = {text = "MIT"}
 requires-python = ">=3.10"
 dependencies = [
-    "litellm>=1.40.0",
+    "litellm==1.82.0",  # PINNED: 1.82.8 confirmed compromised (2026-03-24),
     "pydantic>=2.0.0",
     "pyyaml>=6.0.0",
     "click>=8.0.0",
diff --git a/reference-implementation/requirements.txt b/reference-implementation/requirements.txt
@@ -1,5 +1,5 @@
 # Core dependencies
-litellm>=1.40.0
+litellm==1.82.0  # PINNED: 1.82.8 confirmed compromised (2026-03-24)
 pydantic>=2.0.0
 pyyaml>=6.0.0
 click>=8.0.0
