Repository navigation
evaluation extra caps litellm below 1.86.0 on Python < 3.14, so litellm 1.88.6 (GHSA-3cv6-jpf6-8222 fix) cannot be installed #7201
Description
The evaluation extra declares, in both 1.165.1 (latest 1.x) and 2.4.0 (latest):
litellm<1.86.0,>=1.83.7; python_version < "3.14" and extra == "evaluation"
litellm<1.97.0,>=1.93.0; python_version >= "3.14" and extra == "evaluation"
litellm GHSA-3cv6-jpf6-8222 / CVE-2026-84377 (published 2026-09-30, medium) is fixed in 1.88.6 and later series, so on Python < 3.14 the extra cannot be installed with a patched litellm. google-adk[eval] requires google-cloud-aiplatform[evaluation]<2,>=1.148, so its users get 1.165.1 and litellm 1.85.7.
Repro (Python 3.11, pip 26.2.1):
$ pip install --dry-run "google-adk[eval]==2.11.0" | grep -o "google-cloud-aiplatform-[0-9.]*\|litellm-[0-9.]*" | sort -u
google-cloud-aiplatform-1.165.1
litellm-1.85.7
$ pip install "google-cloud-aiplatform[evaluation]==1.165.1" "litellm>=1.88.6"
The conflict is caused by:
The user requested litellm>=1.88.6
google-cloud-aiplatform[evaluation] 1.165.1 depends on litellm<1.86.0 and >=1.83.7; python_version < "3.14" and extra == "evaluation"
ERROR: ResolutionImpossible
Could the < 3.14 bound move to a range containing a patched release, as in #6598 and #6827? If something blocks it, what is it? I am not claiming the advisory is reachable through the evaluation client; it describes the LiteLLM proxy server.
Activity
chore(deps): document why litellm has no Dependabot ignore (#116)
chore: Relax litellm upper bound to <1.97.0 for Python < 3.14.