Skip to content

fix(security): restore litellm integrations below 1.82.6#966

Merged
chenjw merged 1 commit intomainfrom
fix/restore-litellm-below-1-82-6
Mar 25, 2026
Merged

fix(security): restore litellm integrations below 1.82.6#966
chenjw merged 1 commit intomainfrom
fix/restore-litellm-below-1-82-6

Conversation

@qin-ctx
Copy link
Copy Markdown
Collaborator

@qin-ctx qin-ctx commented Mar 25, 2026

Description

Restore LiteLLM-backed integrations that were temporarily hard-disabled, while constraining the Python dependency to stay below 1.82.6 so installs do not resolve into the compromised release window.

Related Issue

  • N/A

Type of Change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update
  • Refactoring (no functional changes)
  • Performance improvement
  • Test update

Changes Made

  • Reverted the temporary LiteLLM hard-disable across bot tools, VLM/embedder/rerank config entry points, and provider exports.
  • Resolved the CLI provider conflict introduced after #937 so the LiteLLM-backed path is restored cleanly.
  • Pinned litellm to >=1.0.0,<1.82.6 in project metadata and lockfile to avoid the compromised versions and newer unconfirmed releases.

Testing

  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • I have tested this on the following platforms:
    • Linux
    • macOS
    • Windows

Checklist

  • My code follows the project's coding style
  • I have performed a self-review of my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • Any dependent changes have been merged and published

Screenshots (if applicable)

  • N/A

Additional Notes

  • Local verification run: python -m pytest --override-ini addopts='' tests/unit/test_litellm_embedder.py
  • This PR intentionally keeps LiteLLM below 1.82.6 until the upstream incident is fully closed and a clearly safe version is communicated.

Re-enable LiteLLM-backed providers and tools after the temporary hard-disable,
while pinning the dependency below 1.82.6 to avoid the compromised release window.
@chenjw chenjw merged commit 51a1e60 into main Mar 25, 2026
5 of 11 checks passed
@chenjw chenjw deleted the fix/restore-litellm-below-1-82-6 branch March 25, 2026 10:11
@github-project-automation github-project-automation bot moved this from Backlog to Done in OpenViking project Mar 25, 2026
@github-actions
Copy link
Copy Markdown

Failed to generate code suggestions for PR

zhoujh01 added a commit that referenced this pull request Mar 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

2 participants