fix: bump litellm to 1.84.0 to resolve python-dotenv install conflict - #342
Merged
Conversation
litellm 1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with python-dotenv==1.2.2 in requirements.txt and makes a fresh install fail (ResolutionImpossible under both pip 25.2 and uv). Downgrading dotenv to 1.0.1 is not an option: python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate). litellm 1.84.0 relaxed its pin to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to remain. Full requirements.txt resolves cleanly under both pip and uv. Closes #286
BukeLy
approved these changes
Jul 3, 2026
Closed
KylinMountain
added a commit
that referenced
this pull request
Jul 7, 2026
main advanced (litellm 1.84.0 #342, #188 TOC fixes, #281, README) while dev turned pageindex/page_index.py and utils.py into deprecation shims over pageindex/index/*. Both sides touched those two files, hence the conflict. Resolution: - Keep dev's shims for the two top-level modules (the real implementation lives in pageindex/index/*). requirements.txt auto-merged to litellm==1.84.0. - #188 ("prevent KeyError crash and context exhaustion in TOC processing") landed on main's top-level page_index.py, which is now a shim on dev — so its fixes were NOT in dev's index/page_index.py. Ported them into pageindex/index/page_index.py (preserving dev's IndexConfig/bool integration): .get() on the TOC check functions + detect_page_index, incremental-chat_history retry loops in extract_toc_content and toc_transformer, truncation moved before the loop, .get('table_of_contents', []) and the single_toc_item_index_fixer None guard. - Repoint #188's merged test (tests/test_issue_163.py) at pageindex.index.page_index so its patches hit the module where the code now lives (they were silently hitting the shim → real LLM calls). Full suite: 158 passed, 2 skipped. Claude-Session: https://claude.ai/code/session_01Kx5DgKbhK1N8autqXH8SmS
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Fresh installs from
mainfail.litellm==1.83.7hard-pinspython-dotenv==1.0.1, which conflicts with thepython-dotenv==1.2.2inrequirements.txt:Reproduced with both
pip25.2 anduv.Why not just pin
python-dotenv==1.0.1(as in #291)python-dotenv < 1.2.2is affected by GHSA-mf9w-mj56-hr94 (moderate: symlink following inset_keyallows arbitrary file overwrite), fixed in1.2.2. Downgrading makes the install resolve but reintroduces the vulnerability and trips the Dependency Review check.Fix
Bump
litellm1.83.7 → 1.84.0. litellm 1.84.0 relaxed its pin frompython-dotenv==1.0.1topython-dotenv<2.0,>=1.0.0, allowing the patchedpython-dotenv==1.2.2to stay.Verified the full
requirements.txtresolves cleanly under bothpipanduv, withpython-dotenvstaying at1.2.2.Closes #286. Supersedes #291.