Repository navigation
fix(security): exclude compromised litellm 1.107.0 - #992
Conversation
LiteLLM 1.107.0 was published to PyPI with a credential-stealing payload (https://research.jfrog.com/post/litellm-hijacked-again/). Our lockfile and the uv exclude-newer cutoff already keep it out, but the lint group's open-ended spec and the unpinned examples could pick it up from a mirror or cache that still serves it. - Exclude 1.107.0 from the lint group's litellm spec. - Pin the litellm and dspy examples to litellm==1.106.0 (matrix latest). - Re-lock with uv 0.13.4; the resolved package set is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 461cc3ce09
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".
| "braintrust", | ||
| "dspy", | ||
| "litellm", | ||
| "litellm==1.106.0", |
There was a problem hiding this comment.
In a Python 3.10 environment, which this example still declares supported, this exact pin selects a version the repository already identifies as broken due to unresolved Pydantic forward references: test_dspy preinstalls the same matrix pin and py/nox_session_constraints.py excludes that combination below Python 3.11. The identical pin in examples/litellm/pyproject.toml has the same problem, so either use a safe Python-3.10-compatible constraint or raise the examples' requires-python floor.
AGENTS.md reference: AGENTS.md:L17-L21
Useful? React with 👍 / 👎.
Summary
LiteLLM
1.107.0was published to PyPI with a credential-stealing payload (JFrog writeup). Our normal install paths already avoid it:py/uv.lockresolves1.106.0/1.88.6, and theexclude-newercutoff (2026-10-20T19:24:36Z) predates the release. PyPI has also removed1.107.0. This PR closes the remaining gaps in case a mirror or cache still serves the bad wheel:1.107.0from thelintgroup's open-endedlitellm>=1.104.2spec. This was the only open-ended LiteLLM spec underpy/.examples/litellmandexamples/dspytolitellm==1.106.0(matrixlatest). These were unpinned and outside thepy/cutoff.uv0.13.4. The largeuv.lockdiff is format-only (lock revision 3 → 5, simplified markers).Note:
update-matrix-latest.pydoesn't touch the examples, so their pins need a manual bump when matrixlatestmoves past1.106.0.Validation
uv.lockresolve to the same 355 packages at the same versions; the only real change is the LiteLLM spec.uv lock --checkpasses.litellm==1.106.0(plusdspy==3.4.1for the DSPy example).litellmandbraintrustimport cleanly, and none of the payload files (cook.pth,cook.py,sitecustomize.py) are present.🤖 Generated with Claude Code