fleet-memory/hindsight-integrations
Nicolò Boschi f0f0d554f2
security: exclude litellm 1.82.8 (supply chain compromise) (#673)
* security: exclude litellm 1.82.8 (supply chain compromise)

litellm 1.82.8 on PyPI contains a malicious .pth file that
automatically steals credentials on Python startup (no import needed).
See: https://github.com/BerriAI/litellm/issues/24512

Our Docker images ship 1.82.6 and are unaffected, but the open version
constraints (>=1.0.0, >=1.40.0) would allow resolving to 1.82.8 on
fresh installs or lockfile refreshes.

* security: cap litellm at <=1.82.6 (1.82.7 also compromised)

* chore: regenerate uv.lock and openapi spec

* fix: update test to match claude-haiku-4-5 default model name and regenerate docs skill

* chore: fix ruff formatting in generate_changelog.py
2026-03-25 10:21:02 +01:00
..
agno fix: add readme field to integration pyproject.toml files for PyPI (#634) 2026-03-20 17:11:20 +01:00
ai-sdk Release v0.4.19 2026-03-18 14:29:15 +01:00
chat Release v0.4.19 2026-03-18 14:29:15 +01:00
claude-code feat: remove hardcoded default models from integrations (#670) 2026-03-24 17:20:15 +01:00
crewai fix(security): address all Dependabot vulnerability alerts (#617) 2026-03-19 14:27:52 +01:00
hermes fix: add readme field to integration pyproject.toml files for PyPI (#634) 2026-03-20 17:11:20 +01:00
langgraph fix: add readme field to integration pyproject.toml files for PyPI (#634) 2026-03-20 17:11:20 +01:00
litellm security: exclude litellm 1.82.8 (supply chain compromise) (#673) 2026-03-25 10:21:02 +01:00
nemoclaw release(nemoclaw): v0.1.1 2026-03-20 15:21:26 +01:00
openclaw feat: remove hardcoded default models from integrations (#670) 2026-03-24 17:20:15 +01:00
pydantic-ai fix: add readme field to integration pyproject.toml files for PyPI (#634) 2026-03-20 17:11:20 +01:00
strands release(strands): v0.1.1 2026-03-24 17:42:52 +01:00