fix(deps): correct minimum versions for supported Python releases

[joshua-berri]

TLDR

Problem this solves:

• Advertised minimum dependencies fail to import or install

How it solves it:

• Require compatible Pydantic and tiktoken minimums per Python version
• Exercise minimum base installations on Python 3.10–3.14
• Preserve every existing locked package version and artifact

User Flow

Before: a developer installing the declared minimum dependencies cannot use LiteLLM

1. They create a fresh Python environment and install the built LiteLLM wheel with minimum direct dependencies
2. Python 3.12 installs successfully, but importing LiteLLM raises PydanticSchemaGenerationError
3. Python 3.14 fails while building an unsupported native dependency

After: the same installation selects compatible minimums

1. They create a fresh Python environment and install the built LiteLLM wheel with minimum direct dependencies
2. Python 3.12 imports LiteLLM successfully with Pydantic 2.11.0
3. Python 3.14 installs and imports successfully with Pydantic 2.12.0 and tiktoken 0.12.0

Relevant issues

A prerequisite discovered while testing LIT-7737. Related #39718 raises tiktoken globally to 0.14.0; this change preserves the existing 0.8 minimum below Python 3.14 and does not include that PR's model-mapping changes or replace it

Affected release

Linear ticket

Related to LIT-7737. This prerequisite fixes core dependency metadata; SDK2 isolation and eventual runtime activation are separate work

Pre-Submission checklist

• I have added meaningful tests
• The handful of test files covering my change pass locally
• My PR passes all required CI/CD checks
• My PR's scope is as isolated as possible
• I have received a Greptile Confidence Score of at least 4/5

GitHub Actions builds one wheel and shares its artifact across six jobs. The existing seven-check base SDK runner now runs against lowest-direct installs on Python 3.10–3.14, alongside a highest-resolution control. Declaring dependencies directly with -r pyproject.toml is necessary: passing only the wheel to lowest-direct does not minimize its dependencies

Local make lint passed all applicable Ruff, formatting, test-tree, strict-rule, type-discipline, test-quality and basedpyright gates against deb9d8ae. The mapped type and token-counter files passed 172 tests; one existing test is explicitly skipped because its implementation is being removed

Independent Devin verification through MCP passed at c19b5c584708be8ed72e13e3add043b4fb3bc0eb: fresh source builds, five minimum installations, frozen-lock and highest-resolution controls, seven base SDK checks per environment, unsupported-pin rejection, and serialization/token comparisons against baseline. The structured lock comparison found 458 packages with no version or artifact changes

Current commit c19b5c584708be8ed72e13e3add043b4fb3bc0eb adds only action-version comments. Parsed workflow behavior is unchanged. Fresh local and independent source-wheel checks pass. All required CI passes; the transient image-download failure passed on retry. Greptile is currently 4/5 with a later Rustup pin/checksum finding awaiting reassessment. The repository pins Rust 1.98.0, and Rustup verifies distribution checksums; evidence is provided in the review thread. Bugbot is clean, and Veria reports no security issues. Codecov is complete with no coverable changed lines; repository-wide coverage is 81.17%

Screenshots / Proof of Fix

Use uv 0.10.9 and Rust to build each source revision with uv build --wheel --out-dir dist. Run each case in a fresh environment from its matching checkout, with WHEEL set to its built wheel's absolute path. These are actual wheel installations, not mocked tests

Before (deb9d8a)

Python 3.12 minimum

1. uv venv /tmp/base-before-312 --python 3.12
2. uv pip install --python /tmp/base-before-312/bin/python --resolution lowest-direct --no-sources -r pyproject.toml "$WHEEL": succeeds, selecting Pydantic 2.10.0 and tiktoken 0.8.0
3. /tmp/base-before-312/bin/python -I tests/base_sdk_tests/check_base_sdk_install.py: exits 1, including PydanticSchemaGenerationError importing LiteLLM

Python 3.14 minimum

1. uv venv /tmp/base-before-314 --python 3.14
2. uv pip install --python /tmp/base-before-314/bin/python --resolution lowest-direct --no-sources -r pyproject.toml "$WHEEL": exits 1 building an unsupported native dependency; local macOS reports tiktoken's PyO3 Python-version limit, independent Linux verification reports pydantic-core's build failure first

Locked-version control

1. uv venv /tmp/base-before-control --python 3.12
2. uv pip install --python /tmp/base-before-control/bin/python "$WHEEL" pydantic==2.13.4 tiktoken==0.12.0: succeeds
3. /tmp/base-before-control/bin/python -I tests/base_sdk_tests/check_base_sdk_install.py: all seven checks pass

After (c19b5c5)

Python 3.12 minimum

1. uv venv /tmp/base-after-312 --python 3.12
2. uv pip install --python /tmp/base-after-312/bin/python --resolution lowest-direct --no-sources -r pyproject.toml "$WHEEL": succeeds, selecting Pydantic 2.11.0 and tiktoken 0.8.0
3. /tmp/base-after-312/bin/python -I tests/base_sdk_tests/check_base_sdk_install.py: all seven checks pass

Python 3.14 minimum

1. uv venv /tmp/base-after-314 --python 3.14
2. uv pip install --python /tmp/base-after-314/bin/python --resolution lowest-direct --no-sources -r pyproject.toml "$WHEEL": succeeds with Pydantic 2.12.0 and tiktoken 0.12.0; the same seven-check base SDK command passes

Locked-version control

1. uv venv /tmp/base-after-control --python 3.12
2. uv pip install --python /tmp/base-after-control/bin/python "$WHEEL" pydantic==2.13.4 tiktoken==0.12.0: succeeds
3. /tmp/base-after-control/bin/python -I tests/base_sdk_tests/check_base_sdk_install.py: all seven checks pass

Type

Bug Fix, Test

Caveats (if any)

Low

• MCP SDK1 remains the production dependency
• Minimum-resolution transitives float; the existing frozen lock remains unchanged
• Realtime JSON-schema generation already fails on baseline and remains unverified
• Configuration-only diff has no changed executable-line coverage denominator
• New installation job names need repository ruleset enforcement after merge

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[codspeed]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_fix_python_dependency_floors_7737 (c19b5c5) with main (03ba563)}

[joshua-berri]

bugbot run Please review commit eebc76c for dependency-marker compatibility and regressions across the supported Python versions

[joshua-berri]

@greptileai Please review draft commit eebc76c for dependency-marker correctness and the minimum-install matrix before readiness is considered

[joshua-berri]

@veria-ai Please review commit eebc76c for compatibility regressions in the Python dependency minimums and base installation checks

[greptile-apps]

Confidence Score: 4/5

The dependency corrections appear sound, but the explicit CI supply-chain requirement must be satisfied before merging.

Findings

1.  Rust Toolchain Is Unpinned ▶

Summary

This PR corrects Python-version-specific minimum dependency metadata and adds installation coverage across supported Python releases.

• Raises the Pydantic minimum to 2.11 below Python 3.14 and 2.12 on Python 3.14+
• Raises the tiktoken minimum to 0.12 on Python 3.14+ while preserving 0.8 below it
• Adds lowest-direct installation checks for Python 3.10–3.14 and a highest-resolution control
• Updates lockfile package metadata without changing resolved versions or artifacts
• Adds the required version comments to SHA-pinned GitHub Actions, fully resolving the previous review finding

_{Reviews (4) · Last reviewed commit: "ci(deps): document pinned action version..."}

[cursor]

Stale Bugbot comment from a previous run.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[joshua-berri]

bugbot run Please review current commit 0a87dc6, including the GitHub Actions installation matrix replacing the unexecuted CircleCI additions

[joshua-berri]

@greptileai Please review current commit 0a87dc6, including the GitHub Actions installation matrix and compatibility of the dependency minimums

[joshua-berri]

@veria-ai Please review current commit 0a87dc6, including artifact handling and permissions in the GitHub Actions installation workflow

[cursor]

Stale Bugbot comment from a previous run.

[joshua-berri]

@greptileai Added exact version comments for every pinned action in c19b5c5; parsed workflow behavior is unchanged. Please confirm resolution

[joshua-berri]

bugbot run Please review c19b5c5, which adds pinned-action version comments without changing parsed workflow behavior or dependency requirements

[joshua-berri]

@veria-ai Please review c19b5c5, which adds pinned-action version comments without changing parsed workflow behavior or dependency requirements

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c19b5c5. Configure here.}

[greptile-apps]

Rust toolchain is unpinned

The new workflow runs rustup toolchain install without pinning a specific Rust toolchain or verifying the downloaded artifact's checksum. This violates the repository directive that external tools downloaded in CI must be version-pinned and checksum-verified, so this requirement must be satisfied before merging.

Context Used: CLAUDE.md (source)

[joshua-berri]

rust-toolchain.toml pins 1.98.0; Rustup verifies SHA-256. Self-updates are disabled. Please reassess, as with the withdrawn finding on #41718

[greptile-apps]

You're right. rust-toolchain.toml pins Rust 1.98.0, and rustup verifies downloaded components. I withdraw this finding; no workflow change is needed.

[joshua-berri]

Closing without merging; core dependency findings are preserved in LIT-8117, assigned to Ryan Crabbe for separate compatibility assessment.