Skip to content

chore: bump litellm to 1.95.0 - #711

Merged
surajshetty3416 merged 1 commit into
frappe:developfrom
surajshetty3416:bump-litellm
Aug 3, 2026
Merged

chore: bump litellm to 1.95.0#711
surajshetty3416 merged 1 commit into
frappe:developfrom
surajshetty3416:bump-litellm

Conversation

@surajshetty3416

@surajshetty3416 surajshetty3416 commented Aug 3, 2026

Copy link
Copy Markdown
Member

Clears the open litellm security advisories flagged by Dependabot.

Advisories cleared

Advisory Severity Fixed in
GHSA-4xpc-pv4p-pm3w (auth bypass via Host header injection) critical 1.84.0
GHSA-7488-6r32-c95q (MCP auth bypass via OAuth2 passthrough fallback) high 1.84.0
GHSA-qrc4-49gv-mv9m (internal_user can create over-privileged API keys) high 1.83.14
GHSA-wpfp-gwwc-vwq6 (user can modify own user_role via /user/update) high 1.83.10

gh api /advisories?ecosystem=pip&affects=litellm@1.95.0 returns nothing, so 1.95.0 is clean.

Why this was blocked until now

Every release from 1.84.0 through 1.92.x caps requires-python at <3.14, so none of them install on a Python 3.14 bench. BerriAI/litellm#33438 raised the cap to <3.15 and first shipped in 1.93.0, which is what unblocks this.

version requires-python
1.83.7 (current pin) >=3.9,<4.0
1.84.0 to 1.92.x >=3.10,<3.14
1.93.0 to 1.95.0 >=3.10,<3.15

Click conflict, also fixed

1.83.7 hard-pinned click==8.1.8, while frappe requires Click~=8.4.1. That conflict was already present on develop:

$ pip check
frappe 17.0.0.dev0 has requirement Click~=8.3.1, but you have click 8.1.8.

1.95.0 relaxes to click>=8.0.0,<9.0, so click can move to 8.4.x and satisfy frappe.

Clears four Dependabot advisories, the highest being GHSA-4xpc-pv4p-pm3w
(critical, auth bypass via Host header injection, fixed in 1.84.0).

1.84.0 through 1.92.x cap requires-python at <3.14, so none of them could
be installed on a Python 3.14 bench. BerriAI/litellm#33438 raised the cap
to <3.15 and shipped in 1.93.0, which unblocks the upgrade.

Also resolves a pre-existing conflict with frappe: 1.83.7 hard-pinned
click==8.1.8 while frappe requires Click~=8.4.1. 1.95.0 relaxes to
click>=8.0.0,<9.0, letting click satisfy both.

Co-Authored-By: Claude <noreply@anthropic.com>
@greptile-apps

greptile-apps Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Confidence Score: 5/5

The dependency bump appears safe to merge.

The supported Python range and repository-used LiteLLM APIs remain compatible, and no lockfile requires synchronization.

Reviews (1): Last reviewed commit: "chore: bump litellm to 1.95.0" | Re-trigger Greptile

@codecov

codecov Bot commented Aug 3, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.59%. Comparing base (7c07876) to head (51caf19).

Additional details and impacted files
@@           Coverage Diff            @@
##           develop     #711   +/-   ##
========================================
  Coverage    59.59%   59.59%           
========================================
  Files           35       35           
  Lines         4413     4413           
========================================
  Hits          2630     2630           
  Misses        1783     1783           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@surajshetty3416
surajshetty3416 merged commit c26a2a4 into frappe:develop Aug 3, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant