chore(deps): pin httplib2 and setuptools transitive floors

[yuneng-berri]

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review

There is nothing unit-testable here; a floor pin is enforced by the resolver, and the existing install/test jobs in CI exercise the resolved versions. Verification is the resolution and import evidence below

Screenshots / Proof of Fix

This is a dependency-constraint change with no runtime behavior delta, so there is no proxy call to demo; the proof is that resolution moves the two transitive deps to their latest maintenance releases and the runtime still imports cleanly. Captured at commit ddf1676896

uv lock moves exactly the two packages:

$ uv lock
Resolved 417 packages in 665ms
Updated httplib2 v0.31.2 -> v0.32.0
Updated setuptools v82.0.1 -> v83.0.0

Import smoke against the updated lock:

$ .venv/bin/python -c "import setuptools, grpc_tools, litellm; print('setuptools', setuptools.__version__)"
setuptools 83.0.0

$ uv run --isolated --no-project --with "httplib2==0.32.0" \
    python -c "import httplib2; print('httplib2', httplib2.__version__); httplib2.Http()"
httplib2 0.32.0

import litellm succeeds, and a default install does not pull either package in; both arrive only through optional integrations

Type

🚄 Infrastructure

Changes

Two floor pins are added to the existing [tool.uv] constraint-dependencies list in pyproject.toml, alongside the current tornado, aiohttp, and soupsieve floors: httplib2>=0.32.0 (was resolving to 0.31.2) and setuptools>=83.0.0 (was resolving to 82.0.1). This keeps two transitive dependencies on their latest maintenance releases as ordinary dependency hygiene

Both packages are transitive-only. httplib2 comes in through google-api-python-client and google-auth-httplib2, which both cap httplib2<1.0.0,>=0.19.0, so 0.32.0 is in range. setuptools comes in through grpcio-tools, lunary, and nvidia-riva-client, all lower-bound only, so 83.0.0 is in range as well. Because every requirer already allows the newer version, uv lock moves only these two packages and nothing else drifts; exclude-newer already covers both releases (httplib2 0.32.0 and setuptools 83.0.0 predate the window). setuptools is a major bump, but it is only a runtime dependency of those optional integrations (grpc tooling, lunary observability, the nvidia-riva STT extra), so a default proxy or SDK install is unaffected

[greptile-apps]

Greptile Summary

This PR adds floor constraints for two transitive dependencies (httplib2>=0.32.0 and setuptools>=83.0.0) to the [tool.uv] constraint-dependencies list in pyproject.toml, and updates uv.lock to match. Both packages are optional-integration-only transitive dependencies, so the default proxy/SDK install is unaffected.

• pyproject.toml: Two new entries added alongside the existing tornado, aiohttp, and soupsieve floors — the style and approach are consistent with what is already there.
• uv.lock: Exactly the two targeted packages updated; no other packages shifted, and all hashes match published PyPI artifacts.

Confidence Score: 5/5

Safe to merge — the change is two floor-pin additions that affect only optional transitive dependencies and do not touch any runtime code paths.

Both constraints fit cleanly within the version ranges already allowed by every downstream requirer, the lock file moves only the two targeted packages with no collateral drift, and the import litellm smoke test confirmed the updated environment is healthy. The setuptools major-version bump is contained to optional extras (grpc tooling, lunary, nvidia-riva STT) and does not affect a default install.

No files require special attention.

Important Files Changed

Filename	Overview
pyproject.toml	Adds httplib2>=0.32.0 and setuptools>=83.0.0 floor constraints to [tool.uv] constraint-dependencies, consistent with the existing pattern for tornado, aiohttp, and soupsieve
uv.lock	Lock file updated to reflect httplib2 0.31.2→0.32.0 and setuptools 82.0.1→83.0.0; hashes and URLs are consistent with PyPI, and no other packages shifted

_{Reviews (1): Last reviewed commit: "chore(deps): pin httplib2 and setuptools..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_/adoring-mirzakhani-fc069f (ddf1676) with litellm_internal_staging (93b5ca9)}