fleet-memory/hindsight-dev/hindsight_dev
Nicolò Boschi f0f0d554f2
security: exclude litellm 1.82.8 (supply chain compromise) (#673)
* security: exclude litellm 1.82.8 (supply chain compromise)

litellm 1.82.8 on PyPI contains a malicious .pth file that
automatically steals credentials on Python startup (no import needed).
See: https://github.com/BerriAI/litellm/issues/24512

Our Docker images ship 1.82.6 and are unaffected, but the open version
constraints (>=1.0.0, >=1.40.0) would allow resolving to 1.82.8 on
fresh installs or lockfile refreshes.

* security: cap litellm at <=1.82.6 (1.82.7 also compromised)

* chore: regenerate uv.lock and openapi spec

* fix: update test to match claude-haiku-4-5 default model name and regenerate docs skill

* chore: fix ruff formatting in generate_changelog.py
2026-03-25 10:21:02 +01:00
..
__init__.py rename to hindsight (#2) 2025-11-25 19:28:26 +01:00
check_openapi_compatibility.py ci: ensure backwards/forward compatibility of the API (#306) 2026-02-05 18:43:05 +01:00
generate_changelog.py security: exclude litellm 1.82.8 (supply chain compromise) (#673) 2026-03-25 10:21:02 +01:00
generate_llms_full.py bump pg0 0.11.x and improve documentation (#33) 2025-12-16 13:33:01 +01:00
generate_openapi.py doc: changelog for 0.2.0 (and regenerate clients) (#99) 2026-01-05 12:36:29 +01:00
sync_cookbook.py doc: update cookbook (#479) 2026-03-03 18:46:59 +01:00