2025-02-19 02:40:00 +08:00
# Authorized and unauthorized licenses in LOWER CASE
[Licenses]
authorized_licenses:
######################
# Permissive Licenses
######################
# Apache-2.0
apache
apache 2.0
apache-2.0
apache software license
apache software
apache license v2.0
apache license 2.0
apache license, version 2.0
# BSD
bsd
new bsd
bsd license
new bsd license
simplified bsd
3-clause bsd
freebsd
bsd 3-clause
# MIT
mit
mit license
# ISC
isc license
isc license (iscl)
# The Unlicense
the unlicense (unlicense)
# HPND
historical permission notice and disclaimer (hpnd)
#########################
# Weak Copy Left Licenses
#########################
# MPL-2.0
mozilla public license 2.0 (mpl 2.0)
# LGPL
gnu lesser general public license v2 or later (lgplv2+)
gnu lgpl
lgpl with exceptions or zpl
gnu library or lesser general public license (lgpl)
gnu lesser general public license v3 (lgplv3)
gnu general public license v2 (gplv2)
# PSF-2.0
python software foundation
python software foundation license
unauthorized_licenses:
###########################
# Strong Copy Left Licenses
###########################
gpl v3
[Authorized Packages]
# Apache-2.0 https://github.com/chroma-core/hnswlib#Apache-2.0-1-ov-file
chroma-hnswlib: > = 0.7.3
# MIT https://github.com/facebookresearch/iopath?tab=MIT-1-ov-file#readme
iopath: > = 0.1.10
# BSD https://github.com/PDFium/PDFium?tab=BSD-3-Clause-1-ov-file#readme
pypdfium2: > = 4.30.0
# MIT https://github.com/voyage-ai/voyageai-python?tab=MIT-1-ov-file#readme
voyageai: > = 0.2.3
# OpenLDAP Public License, which is a permissive BSD style license
# https://github.com/jnwatson/py-lmdb/?tab=License-1-ov-file#readme
lmdb: > = 1.5.1
openai: > = 1.1.0 # APACHE 2.0 License
httpx: > = 0.25.0 # BSD 3-Clause License
fastapi: > = 0.115.5 # MIT License
2025-09-09 08:18:42 +08:00
starlette: > = 0.47.2 # MIT License
2025-02-19 02:40:00 +08:00
uvicorn: > = 0.29.0 # BSD 3-Clause License
anthropic: > = 0.21.3 # MIT License
detect-secrets: > = 1.5.0 # MIT License
importlib-metadata: > = 6.8.0 # Apache 2.0 License
tokenizers: > = 0.20.2 # Apache 2.0 License
2025-03-30 06:27:09 +08:00
jinja2: > = 3.1.4 # BSD 3-Clause License
2025-05-10 08:18:48 +08:00
litellm-proxy-extras: > = 0.1.1 # MIT License
2025-05-25 10:27:30 +08:00
litellm-enterprise: > = 0.1.1 # LiteLLM Enterprise License
2026-01-19 20:48:24 +08:00
a2a-sdk: > = 0.3.22 # Apache 2.0 license
feat: add componentized proxy deployment with gateway, backend, ui, and migrations (#27557)
Split the monolithic LiteLLM proxy into independently scalable Kubernetes components to allow separate horizontal scaling of the LLM data plane and management API surfaces
- Add DatabaseURLSettings pydantic-settings model that assembles DATABASE_URL (and optional DATABASE_URL_READ_REPLICA) from discrete DATABASE_* env vars before Prisma initializes, supporting both IAM token auth (minting short-lived RDS tokens) and password auth; replaces the CLI-only path that componentized entrypoints bypass
- Add gateway component (port 4000) that trims the proxy route table to the LLM data-plane surface (chat, embeddings, completions, audio, realtime, provider passthroughs, health/metrics) via an allowlist applied inside the lifespan context so plugin-registered routes are captured
- Add backend component (port 4001) that exposes the management/admin surface (keys, users, teams, orgs, spend analytics, model management, SSO, audit logs) with a complementary allowlist
- Add ui component — Next.js static export served by nginx (port 3000) with RSC payload routing, asset prefix aliasing, and SPA fallback for dashboard routes
- Add migrations component with dedicated Dockerfile that runs prisma migrate deploy via a Helm pre-install/pre-upgrade Job, eliminating per-pod schema contention on the Prisma advisory lock
- Add Helm chart (helm/litellm) with separate Deployments, Services, HPAs, and ConfigMap for each component; shared _helpers.tpl emits DATABASE_*, IAM_TOKEN_DB_AUTH, REDIS_*, and DISABLE_SCHEMA_UPDATE env vars from chart values; ingress template routes traffic to the correct component by path prefix
- Add comprehensive tests for DatabaseURLSettings covering IAM auth, password auth, read replica fallbacks, operator-pinned URL preservation, and percent-encoding; add coverage test asserting gateway + backend allowlist union equals the full proxy route set
- Add pydantic-settings>=2.14.1 as a proxy extra dependency and update liccheck allowlist
Co-authored-by: Yassin Kortam <yassinkortam@g.ucla.edu>
2026-05-17 00:25:17 +08:00
pydantic-settings: > = 2.14.1 # MIT License manually verified (uses PEP 639 License-Expression: MIT, not the legacy License field, so liccheck reports it as unknown)
2025-05-25 10:27:30 +08:00
anyio: > = 4.5.0 # Unknown license
httpx-aiohttp: > = 0.1.4 # Unknown license
backoff: > = 2.2.1 # Unknown license
pyyaml: > = 6.0.2 # Unknown license
gunicorn: > = 23.0.0 # Unknown license
uvloop: > = 0.21.0 # Unknown license
boto3: > = 1.34.34 # Unknown license
redis: > = 5.2.1 # Unknown license
prisma: > = 0.11.0 # Unknown license
mangum: > = 0.17.0 # Unknown license
pynacl: > = 1.5.0 # Unknown license
google-cloud-aiplatform: > = 1.47.0 # Unknown license
mcp: > = 1.5.0 # Unknown license
google-generativeai: > = 0.5.0 # Unknown license
async_generator: > = 1.10.0 # Unknown license
2026-02-26 14:38:40 +08:00
wheel: > = 0.40.0 # MIT License - https://github.com/pypa/wheel/blob/main/LICENSE.txt
2025-05-25 10:27:30 +08:00
langfuse: > = 2.45.0 # Unknown license
prometheus_client: > = 0.20.0 # Unknown license
ddtrace: > = 2.19.0 # Unknown license
orjson: > = 3.10.12 # Unknown license
apscheduler: > = 3.10.4 # Unknown license
fastapi-sso: > = 0.16.0 # Unknown license
2026-02-11 08:26:30 +08:00
filelock: > = 3.20.0 # Unlicense (public domain) - https://unlicense.org / https://github.com/tox-dev/filelock
2025-05-25 10:27:30 +08:00
pyjwt: > = 2.9.0 # Unknown license
2026-03-03 07:25:22 +08:00
python-multipart: > = 0.0.20 # Unknown license
2025-05-25 10:27:30 +08:00
pillow: > = 11.0.0 # Unknown license
azure-ai-contentsafety: > = 1.0.0 # Unknown license
azure-identity: > = 1.16.1 # Unknown license
azure-storage-file-datalake: > = 12.20.0 # Unknown license
opentelemetry-api: > = 1.25.0 # Unknown license
opentelemetry-sdk: > = 1.25.0 # Unknown license
opentelemetry-exporter-otlp: > = 1.25.0 # Unknown license
sentry_sdk: > = 2.21.0 # Unknown license
cryptography: > = 43.0.1 # Unknown license
tzdata: > = 2025.1 # Unknown license
2026-02-11 08:26:30 +08:00
urllib3: > = 2.0.0 # MIT license - https://github.com/urllib3/urllib3
feat(audio_transcription): add NVIDIA Riva STT provider (#27185)
* feat(audio_transcription): add NVIDIA Riva STT provider
Adds nvidia_riva as a new audio transcription provider, supporting both
NVCF-hosted and self-hosted Riva ASR deployments via gRPC streaming.
- Auto-resamples input audio to 16 kHz mono LINEAR_PCM (soundfile + numpy,
audioread fallback) so callers can send any common format.
- Maps OpenAI params: language (en -> en-US), response_format (text/json/
verbose_json), timestamp_granularities=["word"] -> enable_word_time_offsets,
word offsets converted ms -> s for verbose_json.
- Auth: NVCF when nvcf_function_id is set (SSL on by default), self-hosted
otherwise (SSL off by default), with explicit use_ssl override.
- gRPC errors wrapped via NvidiaRivaException -> litellm exception classes.
- Optional deps gated behind [stt-nvidia-riva] extra (nvidia-riva-client,
soundfile, audioread, numpy).
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(nvidia_riva): address PR review feedback
- handler: forward call-level `timeout` to streaming_response_generator
(kwarg-detected via inspect for older riva-client compat) so a stalled
Riva server cannot block the caller indefinitely.
- audio_utils: spill bytes to a tempfile before audioread.audio_open;
most audioread backends (FFmpeg, GStreamer) require a real filesystem
path and previously raised TypeError on BytesIO, breaking the mp3/m4a
fallback path.
- audio_utils: prefer soxr / scipy.signal.resample_poly for resampling
(anti-aliased polyphase) when installed, falling back to linear only
as a last resort. Avoids aliasing on 44.1/48 kHz -> 16 kHz downsamples.
- transformation: bare `es` now maps to es-ES (Castilian) instead of
es-US, matching BCP-47 conventions.
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: trigger CI re-run [stabilize loop 1/3]
* Update litellm/llms/nvidia_riva/audio_transcription/transformation.py
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* chore: trigger CI re-run [stabilize loop 1/3]
* fix code qa
* fix lint
* fix mypy
* fix mypy
* Fix NVIDIA Riva ASR service lookup
* Fix NVIDIA Riva transcription payload logging
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: oss-pr-review-agent-shin[bot] <281797381+oss-pr-review-agent-shin[bot]@users.noreply.github.com>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Co-authored-by: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
2026-05-06 08:17:51 +08:00
audioread: > = 3.0.1 # MIT license manually verified - https://github.com/beetbox/audioread
2025-05-25 10:27:30 +08:00
python-dotenv: > = 1.0.0 # Unknown license
tiktoken: > = 0.8.0 # Unknown license
click: > = 8.1.7 # Unknown license
rich: > = 13.7.1 # Unknown license
aiohttp: > = 3.10.2 # Unknown license
tenacity: > = 8.2.3 # Unknown license
pydantic: > = 2.10.2 # Unknown license
jsonschema: > = 4.22.0 # Unknown license
websockets: > = 13.1.0 # Unknown license
2025-07-24 04:00:58 +08:00
polars: > = 1.31.0 # Unknown license, the license.md allows free of charge use
build: migrate packaging, CI, and Docker from Poetry to uv (#25007)
* build: migrate packaging metadata to uv
* ci: move automation and local tooling to uv
* docker: migrate image builds and runtime setup to uv
* docs: update install and deployment guidance for uv
* chore: align auxiliary scripts and tests with uv
* test: harden test_litellm isolation
* fix: keep release and health check images self-contained
* build: pin uv tooling and health check deps
* test: isolate bedrock image request formatting from suite state
* test: cover sandbox executor requirements flow
* ci: fix circleci no-op command steps
* ci: fix circleci publish workflow parsing
* fix: stabilize remaining uv migration CI checks
* ci: increase matrix test timeout headroom
* fix: restore published docker and license coverage
* fix: restore proxy runtime build parity
* fix: restore proxy extras parity and venv migrations
* ci: persist uv path across circleci steps
* fix: keep psycopg binary in default test env
* docker: preserve prisma cache across stages
* test: run local proxy checks through uv python
* build: restore runtime deps moved into ci
* build: refresh uv lock after upstream merge
* fix: restore module import in test_check_migration after merge
The conflict resolution imported only the function but the test body
references check_migration as a module throughout.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: revert dependency promotions, remove nodejs-wheel-binaries, fix Docker layer caching
- Move google-generativeai, Pillow, tenacity back to ci group (they are
lazily imported and bloat the base SDK install needlessly)
- Remove nodejs-wheel-binaries from extra_proxy and proxy-dev (redundant
in Docker where system Node.js is already installed via apk)
- Remove all nodejs-wheel node replacement and venv npm patching blocks
from Dockerfiles since the wheel is no longer installed
- Add --no-default-groups to CodSpeed benchmark workflow so the benchmark
environment matches the old minimal pip install footprint
- Apply standard uv two-phase Docker pattern: copy metadata first, install
deps (cached layer), then copy source and install project
- Replace CircleCI enterprise no-op with proper uv sync command
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate uv.lock after removing nodejs-wheel-binaries
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): use cache/restore instead of cache to prevent cache poisoning
The old workflow used actions/cache/restore (read-only). The uv migration
changed it to actions/cache (read-write), which zizmor flags as a cache
poisoning risk. Restore the safer read-only variant.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv built-in cache to silence cache-poisoning alert
The setup-uv action enables caching by default, which zizmor flags as a
cache poisoning risk. Disable it since we already use a read-only
cache/restore step.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv cache in publish workflow
Silences zizmor cache-poisoning alert. Publishing workflow runs
infrequently on protected branches so caching adds no real benefit.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(test): remove duplicate verbose_logger mock in test_check_migration
The logger was patched twice — first via mocker.patch() then via
mocker.patch.object(autospec=True). The second call fails because
autospec cannot inspect an already-mocked attribute. Remove the
redundant first patch.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): free disk space before Docker build in test-server-root-path
The Dockerfile.non_root build ran out of disk on the CI runner. Remove
Android SDK, .NET, Boost, and GHC toolchains (~12GB) to free space.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-10 02:46:23 +08:00
rq: > = 2.7.0 # BSD-2-Clause License
resend: > = 2.23.0 # MIT License
semantic_router: > = 0.1.10 # MIT License
aurelio-sdk: > = 0.0.19 # MIT License
2025-09-19 10:28:07 +08:00
pondpond: > = 1.4.1 # Apache 2.0 License
2025-09-27 09:20:32 +08:00
fastuuid: > = 0.13.0 # BSD-3-Clause license
2025-12-19 21:30:44 +08:00
llm-sandbox: > = 0.3.31 # MIT License - https://github.com/vndee/llm-sandbox
2026-04-16 12:20:40 +08:00
RestrictedPython: > = 8.1 # ZPL-2.1 (Zope Public License, BSD-style permissive) - https://github.com/zopefoundation/RestrictedPython/blob/master/LICENSE.txt
2025-12-21 09:34:08 +08:00
nodejs-wheel-binaries: > = 24.12.0 # MIT license manually verified
2026-01-07 17:24:00 +08:00
grpcio: > = 1.69.0 # Apache License 2.0
2026-01-16 13:55:14 +08:00
jaraco.context: > = 6.1.0 # Unknown license
2026-01-29 06:54:58 +08:00
pypdf: > = 6.6.2 # BSD-3-Clause license - https://github.com/py-pdf/pypdf/blob/main/LICENSE
2026-04-02 00:51:29 +08:00
hf-xet: > = 1.4.2 # Apache 2.0 License - https://github.com/huggingface/xet-tools/blob/main/LICENSE
build: migrate packaging, CI, and Docker from Poetry to uv (#25007)
* build: migrate packaging metadata to uv
* ci: move automation and local tooling to uv
* docker: migrate image builds and runtime setup to uv
* docs: update install and deployment guidance for uv
* chore: align auxiliary scripts and tests with uv
* test: harden test_litellm isolation
* fix: keep release and health check images self-contained
* build: pin uv tooling and health check deps
* test: isolate bedrock image request formatting from suite state
* test: cover sandbox executor requirements flow
* ci: fix circleci no-op command steps
* ci: fix circleci publish workflow parsing
* fix: stabilize remaining uv migration CI checks
* ci: increase matrix test timeout headroom
* fix: restore published docker and license coverage
* fix: restore proxy runtime build parity
* fix: restore proxy extras parity and venv migrations
* ci: persist uv path across circleci steps
* fix: keep psycopg binary in default test env
* docker: preserve prisma cache across stages
* test: run local proxy checks through uv python
* build: restore runtime deps moved into ci
* build: refresh uv lock after upstream merge
* fix: restore module import in test_check_migration after merge
The conflict resolution imported only the function but the test body
references check_migration as a module throughout.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: revert dependency promotions, remove nodejs-wheel-binaries, fix Docker layer caching
- Move google-generativeai, Pillow, tenacity back to ci group (they are
lazily imported and bloat the base SDK install needlessly)
- Remove nodejs-wheel-binaries from extra_proxy and proxy-dev (redundant
in Docker where system Node.js is already installed via apk)
- Remove all nodejs-wheel node replacement and venv npm patching blocks
from Dockerfiles since the wheel is no longer installed
- Add --no-default-groups to CodSpeed benchmark workflow so the benchmark
environment matches the old minimal pip install footprint
- Apply standard uv two-phase Docker pattern: copy metadata first, install
deps (cached layer), then copy source and install project
- Replace CircleCI enterprise no-op with proper uv sync command
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate uv.lock after removing nodejs-wheel-binaries
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): use cache/restore instead of cache to prevent cache poisoning
The old workflow used actions/cache/restore (read-only). The uv migration
changed it to actions/cache (read-write), which zizmor flags as a cache
poisoning risk. Restore the safer read-only variant.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv built-in cache to silence cache-poisoning alert
The setup-uv action enables caching by default, which zizmor flags as a
cache poisoning risk. Disable it since we already use a read-only
cache/restore step.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv cache in publish workflow
Silences zizmor cache-poisoning alert. Publishing workflow runs
infrequently on protected branches so caching adds no real benefit.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(test): remove duplicate verbose_logger mock in test_check_migration
The logger was patched twice — first via mocker.patch() then via
mocker.patch.object(autospec=True). The second call fails because
autospec cannot inspect an already-mocked attribute. Remove the
redundant first patch.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): free disk space before Docker build in test-server-root-path
The Dockerfile.non_root build ran out of disk on the CI runner. Remove
Android SDK, .NET, Boost, and GHC toolchains (~12GB) to free space.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-10 02:46:23 +08:00
pytest-asyncio: > = 1.2.0 # Apache 2.0 license
2026-05-05 02:39:46 +08:00
pytest: > = 9.0.3 # MIT license
build: migrate packaging, CI, and Docker from Poetry to uv (#25007)
* build: migrate packaging metadata to uv
* ci: move automation and local tooling to uv
* docker: migrate image builds and runtime setup to uv
* docs: update install and deployment guidance for uv
* chore: align auxiliary scripts and tests with uv
* test: harden test_litellm isolation
* fix: keep release and health check images self-contained
* build: pin uv tooling and health check deps
* test: isolate bedrock image request formatting from suite state
* test: cover sandbox executor requirements flow
* ci: fix circleci no-op command steps
* ci: fix circleci publish workflow parsing
* fix: stabilize remaining uv migration CI checks
* ci: increase matrix test timeout headroom
* fix: restore published docker and license coverage
* fix: restore proxy runtime build parity
* fix: restore proxy extras parity and venv migrations
* ci: persist uv path across circleci steps
* fix: keep psycopg binary in default test env
* docker: preserve prisma cache across stages
* test: run local proxy checks through uv python
* build: restore runtime deps moved into ci
* build: refresh uv lock after upstream merge
* fix: restore module import in test_check_migration after merge
The conflict resolution imported only the function but the test body
references check_migration as a module throughout.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: revert dependency promotions, remove nodejs-wheel-binaries, fix Docker layer caching
- Move google-generativeai, Pillow, tenacity back to ci group (they are
lazily imported and bloat the base SDK install needlessly)
- Remove nodejs-wheel-binaries from extra_proxy and proxy-dev (redundant
in Docker where system Node.js is already installed via apk)
- Remove all nodejs-wheel node replacement and venv npm patching blocks
from Dockerfiles since the wheel is no longer installed
- Add --no-default-groups to CodSpeed benchmark workflow so the benchmark
environment matches the old minimal pip install footprint
- Apply standard uv two-phase Docker pattern: copy metadata first, install
deps (cached layer), then copy source and install project
- Replace CircleCI enterprise no-op with proper uv sync command
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate uv.lock after removing nodejs-wheel-binaries
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): use cache/restore instead of cache to prevent cache poisoning
The old workflow used actions/cache/restore (read-only). The uv migration
changed it to actions/cache (read-write), which zizmor flags as a cache
poisoning risk. Restore the safer read-only variant.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv built-in cache to silence cache-poisoning alert
The setup-uv action enables caching by default, which zizmor flags as a
cache poisoning risk. Disable it since we already use a read-only
cache/restore step.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv cache in publish workflow
Silences zizmor cache-poisoning alert. Publishing workflow runs
infrequently on protected branches so caching adds no real benefit.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(test): remove duplicate verbose_logger mock in test_check_migration
The logger was patched twice — first via mocker.patch() then via
mocker.patch.object(autospec=True). The second call fails because
autospec cannot inspect an already-mocked attribute. Remove the
redundant first patch.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): free disk space before Docker build in test-server-root-path
The Dockerfile.non_root build ran out of disk on the CI runner. Remove
Android SDK, .NET, Boost, and GHC toolchains (~12GB) to free space.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-10 02:46:23 +08:00
pytest-postgresql: > = 7.0.2 # LGPLv3+ license
pytest-xdist: > = 3.8.0 # MIT License
ruff: > = 0.15.3 # MIT License
types-requests: > = 2.32.4.20260107 # Apache 2.0 license (typeshed)
types-pyyaml: > = 6.0.12.20250915 # Apache 2.0 license (typeshed)
fakeredis: > = 2.34.1 # BSD license
psycopg: > = 3.2.13 # LGPL-3.0 license
psycopg-binary: > = 3.2.13 # LGPL-3.0 license
psycopg2-binary: > = 2.9.11 # LGPL with exceptions
lunary: > = 1.0.36 # Unknown license manually verified
logfire: > = 4.6.0 # MIT License
pygithub: > = 2.8.1 # LGPL license
argon2-cffi: > = 25.1.0 # MIT License
blockbuster: > = 1.5.26 # Apache 2.0 license
pylint: > = 3.3.9 # GPLv2 license
langchain-mcp-adapters: > = 0.2.1 # MIT License
langgraph: > = 1.0.10 # MIT License
2026-04-17 00:41:51 +08:00
langgraph-prebuilt: > = 1.0.8 # MIT License - https://github.com/langchain-ai/langgraph/blob/main/LICENSE
build: migrate packaging, CI, and Docker from Poetry to uv (#25007)
* build: migrate packaging metadata to uv
* ci: move automation and local tooling to uv
* docker: migrate image builds and runtime setup to uv
* docs: update install and deployment guidance for uv
* chore: align auxiliary scripts and tests with uv
* test: harden test_litellm isolation
* fix: keep release and health check images self-contained
* build: pin uv tooling and health check deps
* test: isolate bedrock image request formatting from suite state
* test: cover sandbox executor requirements flow
* ci: fix circleci no-op command steps
* ci: fix circleci publish workflow parsing
* fix: stabilize remaining uv migration CI checks
* ci: increase matrix test timeout headroom
* fix: restore published docker and license coverage
* fix: restore proxy runtime build parity
* fix: restore proxy extras parity and venv migrations
* ci: persist uv path across circleci steps
* fix: keep psycopg binary in default test env
* docker: preserve prisma cache across stages
* test: run local proxy checks through uv python
* build: restore runtime deps moved into ci
* build: refresh uv lock after upstream merge
* fix: restore module import in test_check_migration after merge
The conflict resolution imported only the function but the test body
references check_migration as a module throughout.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: revert dependency promotions, remove nodejs-wheel-binaries, fix Docker layer caching
- Move google-generativeai, Pillow, tenacity back to ci group (they are
lazily imported and bloat the base SDK install needlessly)
- Remove nodejs-wheel-binaries from extra_proxy and proxy-dev (redundant
in Docker where system Node.js is already installed via apk)
- Remove all nodejs-wheel node replacement and venv npm patching blocks
from Dockerfiles since the wheel is no longer installed
- Add --no-default-groups to CodSpeed benchmark workflow so the benchmark
environment matches the old minimal pip install footprint
- Apply standard uv two-phase Docker pattern: copy metadata first, install
deps (cached layer), then copy source and install project
- Replace CircleCI enterprise no-op with proper uv sync command
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate uv.lock after removing nodejs-wheel-binaries
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): use cache/restore instead of cache to prevent cache poisoning
The old workflow used actions/cache/restore (read-only). The uv migration
changed it to actions/cache (read-write), which zizmor flags as a cache
poisoning risk. Restore the safer read-only variant.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv built-in cache to silence cache-poisoning alert
The setup-uv action enables caching by default, which zizmor flags as a
cache poisoning risk. Disable it since we already use a read-only
cache/restore step.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv cache in publish workflow
Silences zizmor cache-poisoning alert. Publishing workflow runs
infrequently on protected branches so caching adds no real benefit.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(test): remove duplicate verbose_logger mock in test_check_migration
The logger was patched twice — first via mocker.patch() then via
mocker.patch.object(autospec=True). The second call fails because
autospec cannot inspect an already-mocked attribute. Remove the
redundant first patch.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): free disk space before Docker build in test-server-root-path
The Dockerfile.non_root build ran out of disk on the CI runner. Remove
Android SDK, .NET, Boost, and GHC toolchains (~12GB) to free space.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-10 02:46:23 +08:00
pytest-rerunfailures: > = 15.1 # MPL 2.0 license
2026-05-01 02:11:44 +08:00
pytest-recording: > = 0.13.4 # MIT license
