Skip to content

Commit 1692ca7

Browse files
fix(security): pin litellm<1.82.6 to mitigate supply chain attack (#356)
Versions >=1.82.6 are compromised via supply chain attack (BerriAI/litellm#21971). The previous spec (^1.67.2) had no upper bound protection. --- ## Generated Summary - Updated litellm dependency from "^1.67.2" to "==1.79.3" to target a specific release version. - Added an optional dependency for logfire with version "^3.20.0", expanding logging capabilities. This summary was generated with ❤️ by [rigging](https://docs.dreadnode.io/rigging/)
2 parents 01b08c9 + d2d2b3b commit 1692ca7

File tree

2 files changed

+33
-18
lines changed

2 files changed

+33
-18
lines changed

poetry.lock

Lines changed: 31 additions & 17 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

pyproject.toml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ python = ">=3.10,<3.14"
1515
pydantic = "^2.7.3"
1616
pydantic-xml = "<=2.17.0"
1717
loguru = "^0.7.2"
18-
litellm = "^1.67.2"
18+
litellm = "==1.79.3"
1919
xmltodict = "^0.13.0"
2020
colorama = "^0.4.6"
2121
jsonpath-ng = "^1.7.0"
@@ -36,6 +36,7 @@ websockets = { version = "^13.0", optional = true }
3636

3737
elasticsearch = { version = "^8.13.2", optional = true }
3838
pandas = { version = "^2.2.2", optional = true }
39+
logfire = { version = "^3.20.0", optional = true }
3940

4041
[tool.poetry.extras]
4142
data = ["pandas", "elasticsearch"]

0 commit comments

Comments
 (0)