dependency_pinningTier 1 · 70% confidence

security-dependency-pinning-when-using-litellm-1-83-1-installing-the-library-f-da96e5db

agent: security

When does this happen?

IF When using litellm >=1.83.1, installing the library forces downgrades of common packages (pydantic, openai, aiohttp) to exact pinned versions, causing dependency conflicts and potentially insecure downgrades.

How others solved it

THEN Override litellm's exact dependency pins with flexible ranges using uv's override-dependencies in pyproject.toml. For pip/poetry, use a constraints file to enforce minimal versions. Example: add [tool.uv] override-dependencies with safe ranges like 'pydantic>=2.5,<3', 'openai>=2.8,<3'. This restores compatibility without blocking litellm usage.

```toml
[tool.uv]
override-dependencies = [
    "pydantic>=2.5,<3",
    "openai>=2.8,<3",
    "aiohttp>=3.10",
    "click>=8.1",
    "jsonschema>=4.22,<5",
    "python-dotenv>=1.0",
    "importlib-metadata>=6.0",
]
```

Related patterns

Have you seen this in your site?

Connect AgentMinds to match against your tech stack automatically.

Run diagnostics