build(packaging): raise jinja2 floor to 3.1.6 (rc2 backport of #27552)#27554
Conversation
Our `uv.lock` already resolves jinja2 to 3.1.6, so Docker / CI installs get that version. The `pyproject.toml` floor was lagging at 3.1.0, which means downstream consumers using `--resolution=lowest-direct` or older constraint files can land on 3.1.0-3.1.5 instead of the version we actually test against. Aligns the declared floor with the resolved version so external installers see the same baseline our test matrix exercises. `uv lock` diff is metadata-only (no resolved-version drift).
Greptile SummaryThis backport raises the declared
Confidence Score: 5/5Safe to merge — two-line packaging change with no logic, API, or behavior impact. The change is a minimal, well-motivated version floor bump that closes a known sandbox-bypass vulnerability for downstream consumers. The lockfile already resolved to 3.1.6 before this PR, so there is zero resolved-version drift and no risk of unexpected dependency changes. No files require special attention.
|
| Filename | Overview |
|---|---|
| pyproject.toml | Raises jinja2 minimum version from 3.1.0 to 3.1.6 to enforce the security-patched release (CVE-2025-27516) for downstream consumers |
| uv.lock | Mirrors the pyproject.toml jinja2 constraint update in the requires-dist entry; resolved version is unchanged |
Reviews (1): Last reviewed commit: "build(packaging): raise jinja2 floor to ..." | Re-trigger Greptile
Summary
Backport of #27552 onto
litellm_1.84.0rc2.Bumps the declared
jinja2floor in[project.dependencies]from>=3.1.0to>=3.1.6.uv.lockalready resolvesjinja2to3.1.6, so Docker images and CI installs already pick it up. Thepyproject.tomlfloor was lagging at3.1.0, which means downstream consumers using--resolution=lowest-director older constraint files can land on3.1.0–3.1.5instead of the version our test matrix exercises.Scope
pyproject.toml: 1 line changed (jinja2>=3.1.0,<4.0→jinja2>=3.1.6,<4.0)uv.lock: 1 line changed (mirroredrequires-distentry; no resolved-version drift)Test plan
uv lock --checkpasses (392 packages, no resolved-version drift)