Pin litellm to an exact version (unpinned top-level spec + stale 1.37.16 pin)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
Research direction
Read requirements.txt and compare its litellm entry with devops/requirements.txt and devops-cli/requirements.txt. Choose a vetted exact version and make the three declarations consistent; check the relevant install or dependency checks, if available, to confirm the pins are accepted.
Written by the indexing model from the issue text.
Description
Summary
The dependency on litellm is inconsistently pinned in this repo, which exposes installs to supply-chain risk.
requirements.txt:6declareslitellmunpinned — anypip install -r requirements.txtresolves to whatever the latest release is at install time.devops/requirements.txt:138(anddevops-cli/requirements.txt:154) pinlitellm==1.37.16, which is now very old and far behind the current release line, with dozens of advisories published since.
Why it matters
During the March 2026 litellm 1.82.7 / 1.82.8 supply-chain attack, malicious versions were live on PyPI for ~40 minutes before being quarantined. Anyone resolving with an unpinned spec pulled the malicious wheel automatically (see https://docs.litellm.ai/blog/security-update-march-2026). An exact == pin would have skipped the bad release entirely.
Suggested fix
- Replace the bare
litellmin the top-levelrequirements.txtwith an exact pin (e.g.litellm==1.106.2or a vetted recent version). - Keep the vendored aider requirements in sync with the same version rather than the stale
1.37.16. - Optionally move to hash-locked installs (
pip-compile --generate-hashes+pip install --require-hashes) so a republished malicious wheel at the same version string is also refused.
- Dominant language
- Python
- Stars
- 55
- Forks
- 29
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ruvnet/agentic-devops
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
ruvnet/agentic-devops#3 · 2 comments ·
All issues in ruvnet/agentic-devops
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
CLIMADA-project/climada_python#1337 ·
Maintainers usually reply within 3 days
-
tail without reverseOpen
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
8go/matrix-commander#233 ·
-
documentation
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
-
documentation enhancement priority:high size:M
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Validate non-divisible effective batch sizes in the Unsloth LoRA backendPossibly taken @debesh-biswas claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100