build(packaging): relax core runtime pins to ranges (rc2 backport of #27241)

[yuneng-berri]

Summary

Backport of #27241 onto litellm_1.84.0rc2.

The 12 entries in [project.dependencies] are exact == pins, a side effect of the Poetry → uv migration. This forces every downstream package that lists litellm as a dependency to downgrade common runtime libraries (openai, pydantic, aiohttp, click, jsonschema, python-dotenv, …) to the exact versions we ship.

Switches to lower-bounded ranges with upper bounds on packages that are pre-1.0 or follow a breaking-major-version policy. Reproducibility for our Docker proxy and CI continues to come from uv.lock, which is regenerated here as a metadata-only diff (no resolved versions or hashes change).

See #27241 for full motivation, floor table, and validation methodology.

Conflict resolution vs upstream

git cherry-pick -m 1 40a490ae produced two uv.lock conflicts. Both were caused by entries that exist in staging but not in rc2 — they were unchanged context in the source PR, not part of #27241's intent:

• nvidia-riva-client (stt-nvidia-riva extra)
• soundfile (stt-nvidia-riva extra)

Those lines were dropped from the resolution; rc2's existing requires-dist entry set is preserved. Only the 12 specifier strings changed.

Test plan

• uv lock --check after pyproject change — passes (392 packages, no resolved-version drift)
• Diff vs rc2 limited to the 12 specifier rewrites in both pyproject.toml and uv.lock
• CI green

[greptile-apps]

Greptile Summary

This backport relaxes all 12 core runtime == pins in pyproject.toml to lower-bounded ranges, fixing a regression introduced during the Poetry → uv migration that forced downstream consumers to downgrade common libraries. The uv.lock update is metadata-only — resolved versions and hashes are unchanged, so Docker/CI reproducibility is unaffected.

• pyproject.toml: 12 exact specifiers replaced with >=floor,<upper ranges; floors are set well below the previously-pinned versions to maximize downstream flexibility.
• uv.lock: Only the requires-dist metadata section is updated to mirror the new specifiers; no resolved package versions or hashes changed.
• CI is marked as pending in the test plan; the uv pip install --resolution=lowest-direct . validation claimed in the description should ideally be complemented by a functional smoke test against each floor before this ships.

Confidence Score: 4/5

Safe to merge for Docker/CI consumers since uv.lock hashes are unchanged; downstream SDK consumers picking up the lowest allowed versions of openai or jsonschema could hit runtime incompatibilities.

The lock file is unchanged in its resolved graph, so the proxy/Docker path is unaffected. The two observations — the openai floor being 13 minor versions below the last pin, and the jsonschema floor spanning a major referencing-subsystem rewrite — are real compatibility risks for downstream SDK consumers who resolve to the floor. Neither is a blocking issue for the project's own CI since uv.lock still dictates exact versions there.

The floor versions in pyproject.toml for openai and jsonschema deserve a second look, particularly whether a functional test at those exact floor versions has been run.

Important Files Changed

Filename	Overview
pyproject.toml	Switches 12 core runtime dependencies from exact == pins to lower-bounded ranges; floors are intentionally set below the previously-pinned versions to allow downstream consumers flexibility.
uv.lock	Metadata-only update to requires-dist entries mirroring the pyproject.toml specifier rewrites; resolved versions and hashes are unchanged.

_{Reviews (1): Last reviewed commit: "build(packaging): relax core runtime pin..." | Re-trigger Greptile}

[greptile-apps]

openai floor is 13 minor versions below the previously pinned release

The floor >=2.20.0 is significantly below the formerly-pinned ==2.33.0. The openai Python v2 SDK adds new streaming types, response models, and client methods across minor versions. If litellm calls any method or reads any field introduced after 2.20.0, a downstream consumer installing at the floor will get a runtime AttributeError or ImportError. The PR description mentions uv pip install --resolution=lowest-direct . as validation — it would be worth confirming that a full litellm.completion() call (not just an import) succeeds against openai==2.20.0 before merging.

[greptile-apps]

jsonschema floor drops from 4.23.0 to 4.0.0 — referencing subsystem changed significantly mid-range

Between jsonschema 4.0.0 and 4.23.0, the library split out referencing as a separate dependency and rewired how $ref resolution works. Any schema validation code in litellm that relies on the post-split behavior (e.g., jsonschema.validate with cross-document $ref) may fail silently or raise an unexpected exception when resolved against 4.0.0–4.17.x. The floor could safely be raised to >=4.17.0 (when the referencing integration landed) or at minimum >=4.21.1 to narrow this window.

[veria-ai]

High: Sandbox escape in user-submitted prompt templates

Lowering this floor admits Jinja2 3.1.0 through 3.1.5, which contain the sandbox attr filter bypass fixed in 3.1.6. LiteLLM renders caller-supplied dotprompt_content through ImmutableSandboxedEnvironment in /prompts/test, so an authenticated user on an install resolved to those versions can submit a template that escapes the sandbox instead of being limited to prompt variables.

Suggested change

	"jinja2>=3.1.0,<4.0",
	"jinja2>=3.1.6,<4.0",

[veria-ai]

High: Vulnerable Jinja2 versions allowed for prompt rendering

This PR relaxes core runtime dependency pins for package consumers. The new Jinja2 lower bound permits versions with a known sandbox bypass while LiteLLM renders caller-supplied dotprompt templates in a sandboxed Jinja environment.

---

Status: 1 new · 1 open
Risk: 7/10