chore: sync upstream 2026-06-23 - #80
Merged
shudonglin merged 20 commits intoJun 23, 2026
Merged
Conversation
chore(ci): promote internal staging to main
- revert uv.lock to upstream (pypdf 6.13.1); pypdf 6.13.3 fix is within the P3D exclude-newer window so add GHSA-jm82-fx9c-mx94 ignore until 2026-06-26 - remove now-resolved P3D ignores for GHSA-f4xh-w4cj-qxq8 and GHSA-4xgf-cpjx-pc3j (langsmith and pydantic-settings were updated) - bump js-yaml override 4.1.1 -> 4.2.0 (GHSA-h67p-54hq-rp68) - add form-data override 4.0.5 -> 4.0.6 (GHSA-hmw2-7cc7-3qxx) - regenerate package-lock.json under node 20; npm audit now reports 0 vulnerabilities
upstream removed the plugin_router variable in the plugin architecture refactor but the include_router call survived the -X theirs merge, causing NameError on import
pyproject.toml constraint aiohttp>=3.14.1 (vs upstream aiohttp>=3.13.5,<3.14) required a full lock regeneration. All 21 osv-scan findings are now fixed: - aiohttp 3.13.5 -> 3.14.1 (11 CVEs resolved) - cryptography 46.0.7 -> 48.0.1 (GHSA-537c-gmf6-5ccf) - langsmith 0.8.3 -> 0.9.0 (GHSA-f4xh-w4cj-qxq8) - pydantic-settings 2.14.1 -> 2.14.2 (GHSA-4xgf-cpjx-pc3j) - python-multipart 0.0.27 -> 0.0.32 (multiple CVEs) - starlette 1.1.0 -> 1.3.1 (GHSA-82w8-qh3p-5jfq, GHSA-jp82-jpqv-5vv3) - vcrpy 8.1.1 -> 8.2.1 (GHSA-rpj2-4hq8-938g) - pypdf 6.13.1 -> 6.14.0 (GHSA-jm82-fx9c-mx94; remove now-unused ignore) remove the temporary pypdf P3D ignore from osv-scanner.toml
previous lock was generated with uv 0.8.17 which uses a different lock format and resolution algorithm; CI requires >=0.10.9. regenerating with the correct version fixes the uv lock --check mismatch
The -X theirs sync merge corrupted exception_mapping_utils.py by keeping the refactored helper-dispatch calls in exception_type() but dropping all the _map_*_exception definitions (24 ruff F821/F401 errors). Upstream made no changes to this file, so restoring from the pre-merge refactoring commit is correct and loses nothing. Also remove the unused LlmProviders import from streaming_handler.py and add missing useEffect/useRef to the React import in layout.tsx (both are merge artifacts).
…tchet lint budgets Use X | None instead of Optional[X] in the restored helper functions to fix the 5 UP045/F401 ruff regressions introduced by the restore commit. Update lint budgets to reflect the correct baselines for the refactored file (the restore brings back ~2000 lines of previously deleted helpers, which shifts the basedpyright counts back to their pre-sync values).
The upstream sync merge dropped the plugin_router import (accbd7e, our fork feature). ce90499 then removed the include_router call treating it as an orphan; restoring both here. The gen:api script only iterated top-level app.routes, which are mostly _IncludedRouter objects (not APIRoute). Routes registered via app.include_router() live on _IncludedRouter.original_router.routes and were invisible to the include_in_schema=True override. Switch to BFS traversal that also walks original_router, exposing all 478 routes instead of just 8. Regenerated schema.d.ts reflects: upstream-removed endpoints deleted, plugin-proxy route added.
The method was extracted from chunk_creator by upstream BerriAI#30793 (commit 6437b81 in our tree). The sync merge took upstream's version of the file for conflicting sections, dropping the 370-line method body while keeping the call site in chunk_creator. Also restores LlmProviders import that the body needs but was removed as 'unused' when the body was absent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Full -X theirs sync of BerriAI/litellm main (12 commits). All fork patches verified intact: digest-pinned Dockerfiles, codeql.yml timeout-minutes:90, py/log-injection exclude, alert-bridge.yml, cookbook paths-ignore.
Additional fixes on top of the merge:
Dependency fixes: ws 8.21.0 (GHSA-96hv-2xvq-fx4p), js-yaml 4.2.0 (GHSA-h67p-54hq-rp68), form-data 4.0.6 (GHSA-hmw2-7cc7-3qxx), pypdf to 6.14.0 (GHSA-jm82-fx9c-mx94). Added osv-scanner.toml P3D ignore for pypdf (fix released within exclude-newer window; expires 2026-06-26). Removed stale P3D ignores for langsmith and pydantic-settings.
Restored Tuple import in litellm/llms/anthropic/cost_calculation.py (dropped by auto-merge).
Restored all 17 map*_exception helper functions in litellm/litellm_core_utils/exception_mapping_utils.py. The auto-merge truncated the file to 932 lines; upstream made zero changes to this file so restoring the pre-merge version is lossless. Also removed the now-unused Optional import and modernized 5 Optional[X] -> X | None annotations. Updated ruff/basedpyright budgets accordingly.
Restored _dispatch_provider_chunk method (370 lines) in litellm/litellm_core_utils/streaming_handler.py. The method was extracted from chunk_creator by upstream PR BerriAI#30793 (our commit 6437b81). The -X theirs merge dropped the method body while keeping the call site in chunk_creator. Also restores LlmProviders import required by the method body.
Restored plugin_router import and include_router call in litellm/proxy/proxy_server.py. The auto-merge dropped the import (our fork feature accbd7e); an earlier fix commit incorrectly removed the include_router call treating it as an orphan.
Fixed gen:api deep route traversal: the script only iterated top-level app.routes (8 APIRoute objects), missing the 470 routes inside _IncludedRouter.original_router added by include_router() calls. Switched to BFS that also walks original_router. Regenerated schema.d.ts: upstream-removed endpoints deleted, plugin-proxy route added.
Removed oxc config block from ui/litellm-dashboard/vitest.config.ts - the field is not in vitest 3.2.6 types and was causing a build-ui type error; esbuild handles JSX automatically.