fix: move litellm uv override to workspace root

This commit is contained in:
Eric Hare
2026-06-24 12:26:59 -07:00
parent f44331d9ed
commit 490cc019e6
3 changed files with 4 additions and 10 deletions

View File

@ -167,6 +167,9 @@ override-dependencies = [
"dynaconf>=3.2.13",
"pillow>=12.1.1", # Force Pillow 12.1.1+ to prevent CVE-vulnerable versions
"playwright>=1.59.0", # Latest available on PyPI; ensures updated Chromium with CVE fixes
# Keep uv workspace resolution on the supported LiteLLM floor without forcing
# an upstream package that declares Requires-Python <3.14 onto Python 3.14.
"litellm>=1.85.1,<2.0.0; python_version < '3.14'",
# Transitive dependency CVE fixes
"lxml>=6.1.0,<7.0.0", # CVE-2026-41066
"mako>=1.3.12,<2.0.0", # CVE-2026-44307

View File

@ -110,16 +110,6 @@ dependencies = [
"transformers>=5.6.0,<6.0.0",
]
[tool.uv]
# Workspace-resolution override for litellm, gated to <3.14 to match the
# litellm/opik/toolguard extras. litellm has no 3.14-compatible release, so an
# unconditional override would force the resolver to select an uninstallable
# litellm on 3.14 (pulled transitively by opik/toolguard before they too were
# gated). Drop the marker once upstream litellm supports 3.14.
override-dependencies = [
"litellm>=1.85.1,<2.0.0; python_version < '3.14'"
]
[dependency-groups]
dev = [
"asgi-lifespan>=2.1.0",

1
uv.lock generated
View File

@ -39,6 +39,7 @@ members = [
overrides = [
{ name = "dynaconf", specifier = ">=3.2.13" },
{ name = "gunicorn", specifier = ">=25.3.0" },
{ name = "litellm", marker = "python_full_version < '3.14'", specifier = ">=1.85.1,<2.0.0" },
{ name = "lxml", specifier = ">=6.1.0,<7.0.0" },
{ name = "mako", specifier = ">=1.3.12,<2.0.0" },
{ name = "markdown", specifier = ">=3.8.0" },