Commit 1692ca7
authored
fix(security): pin litellm<1.82.6 to mitigate supply chain attack (#356)
Versions >=1.82.6 are compromised via supply chain attack
(BerriAI/litellm#21971). The previous spec (^1.67.2) had no upper bound
protection.
---
## Generated Summary
- Updated litellm dependency from "^1.67.2" to "==1.79.3" to target a
specific release version.
- Added an optional dependency for logfire with version "^3.20.0",
expanding logging capabilities.
This summary was generated with ❤️ by
[rigging](https://docs.dreadnode.io/rigging/)2 files changed
+33
-18
lines changedSome generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
15 | 15 | | |
16 | 16 | | |
17 | 17 | | |
18 | | - | |
| 18 | + | |
19 | 19 | | |
20 | 20 | | |
21 | 21 | | |
| |||
36 | 36 | | |
37 | 37 | | |
38 | 38 | | |
| 39 | + | |
39 | 40 | | |
40 | 41 | | |
41 | 42 | | |
| |||
0 commit comments