2025-02-19 02:40:00 +08:00
|
|
|
# Authorized and unauthorized licenses in LOWER CASE
|
|
|
|
|
[Licenses]
|
|
|
|
|
authorized_licenses:
|
|
|
|
|
######################
|
|
|
|
|
# Permissive Licenses
|
|
|
|
|
######################
|
|
|
|
|
|
|
|
|
|
# Apache-2.0
|
|
|
|
|
apache
|
|
|
|
|
apache 2.0
|
|
|
|
|
apache-2.0
|
|
|
|
|
apache software license
|
|
|
|
|
apache software
|
|
|
|
|
apache license v2.0
|
|
|
|
|
apache license 2.0
|
|
|
|
|
apache license, version 2.0
|
|
|
|
|
|
|
|
|
|
# BSD
|
|
|
|
|
bsd
|
|
|
|
|
new bsd
|
|
|
|
|
bsd license
|
|
|
|
|
new bsd license
|
|
|
|
|
simplified bsd
|
|
|
|
|
3-clause bsd
|
|
|
|
|
freebsd
|
|
|
|
|
bsd 3-clause
|
|
|
|
|
|
|
|
|
|
# MIT
|
|
|
|
|
mit
|
|
|
|
|
mit license
|
|
|
|
|
|
|
|
|
|
# ISC
|
|
|
|
|
isc license
|
|
|
|
|
isc license (iscl)
|
|
|
|
|
|
|
|
|
|
# The Unlicense
|
|
|
|
|
the unlicense (unlicense)
|
|
|
|
|
|
|
|
|
|
# HPND
|
|
|
|
|
historical permission notice and disclaimer (hpnd)
|
|
|
|
|
|
|
|
|
|
#########################
|
|
|
|
|
# Weak Copy Left Licenses
|
|
|
|
|
#########################
|
|
|
|
|
|
|
|
|
|
# MPL-2.0
|
|
|
|
|
mozilla public license 2.0 (mpl 2.0)
|
|
|
|
|
|
|
|
|
|
# LGPL
|
|
|
|
|
gnu lesser general public license v2 or later (lgplv2+)
|
|
|
|
|
gnu lgpl
|
|
|
|
|
lgpl with exceptions or zpl
|
|
|
|
|
gnu library or lesser general public license (lgpl)
|
|
|
|
|
gnu lesser general public license v3 (lgplv3)
|
|
|
|
|
gnu general public license v2 (gplv2)
|
|
|
|
|
|
|
|
|
|
# PSF-2.0
|
|
|
|
|
python software foundation
|
|
|
|
|
python software foundation license
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
unauthorized_licenses:
|
|
|
|
|
###########################
|
|
|
|
|
# Strong Copy Left Licenses
|
|
|
|
|
###########################
|
|
|
|
|
gpl v3
|
|
|
|
|
|
|
|
|
|
[Authorized Packages]
|
|
|
|
|
# Apache-2.0 https://github.com/chroma-core/hnswlib#Apache-2.0-1-ov-file
|
|
|
|
|
chroma-hnswlib: >=0.7.3
|
|
|
|
|
# MIT https://github.com/facebookresearch/iopath?tab=MIT-1-ov-file#readme
|
|
|
|
|
iopath: >=0.1.10
|
|
|
|
|
# BSD https://github.com/PDFium/PDFium?tab=BSD-3-Clause-1-ov-file#readme
|
|
|
|
|
pypdfium2: >=4.30.0
|
|
|
|
|
# MIT https://github.com/voyage-ai/voyageai-python?tab=MIT-1-ov-file#readme
|
|
|
|
|
voyageai: >=0.2.3
|
|
|
|
|
# OpenLDAP Public License, which is a permissive BSD style license
|
|
|
|
|
# https://github.com/jnwatson/py-lmdb/?tab=License-1-ov-file#readme
|
|
|
|
|
lmdb: >=1.5.1
|
|
|
|
|
openai: >=1.1.0 # APACHE 2.0 License
|
|
|
|
|
httpx: >=0.25.0 # BSD 3-Clause License
|
|
|
|
|
fastapi: >=0.115.5 # MIT License
|
2025-09-09 08:18:42 +08:00
|
|
|
starlette: >=0.47.2 # MIT License
|
2025-02-19 02:40:00 +08:00
|
|
|
uvicorn: >=0.29.0 # BSD 3-Clause License
|
|
|
|
|
anthropic: >=0.21.3 # MIT License
|
|
|
|
|
detect-secrets: >=1.5.0 # MIT License
|
|
|
|
|
importlib-metadata: >=6.8.0 # Apache 2.0 License
|
|
|
|
|
tokenizers: >=0.20.2 # Apache 2.0 License
|
2025-03-30 06:27:09 +08:00
|
|
|
jinja2: >=3.1.4 # BSD 3-Clause License
|
2025-05-10 08:18:48 +08:00
|
|
|
litellm-proxy-extras: >=0.1.1 # MIT License
|
2025-05-25 10:27:30 +08:00
|
|
|
litellm-enterprise: >=0.1.1 # LiteLLM Enterprise License
|
2026-01-19 20:48:24 +08:00
|
|
|
a2a-sdk: >=0.3.22 # Apache 2.0 license
|
2025-05-25 10:27:30 +08:00
|
|
|
anyio: >=4.5.0 # Unknown license
|
|
|
|
|
httpx-aiohttp: >=0.1.4 # Unknown license
|
|
|
|
|
backoff: >=2.2.1 # Unknown license
|
|
|
|
|
pyyaml: >=6.0.2 # Unknown license
|
|
|
|
|
gunicorn: >=23.0.0 # Unknown license
|
|
|
|
|
uvloop: >=0.21.0 # Unknown license
|
|
|
|
|
boto3: >=1.34.34 # Unknown license
|
|
|
|
|
redis: >=5.2.1 # Unknown license
|
|
|
|
|
prisma: >=0.11.0 # Unknown license
|
|
|
|
|
mangum: >=0.17.0 # Unknown license
|
|
|
|
|
pynacl: >=1.5.0 # Unknown license
|
|
|
|
|
google-cloud-aiplatform: >=1.47.0 # Unknown license
|
|
|
|
|
mcp: >=1.5.0 # Unknown license
|
|
|
|
|
google-generativeai: >=0.5.0 # Unknown license
|
|
|
|
|
async_generator: >=1.10.0 # Unknown license
|
2026-02-26 14:38:40 +08:00
|
|
|
wheel: >=0.40.0 # MIT License - https://github.com/pypa/wheel/blob/main/LICENSE.txt
|
2025-05-25 10:27:30 +08:00
|
|
|
langfuse: >=2.45.0 # Unknown license
|
|
|
|
|
prometheus_client: >=0.20.0 # Unknown license
|
|
|
|
|
ddtrace: >=2.19.0 # Unknown license
|
|
|
|
|
orjson: >=3.10.12 # Unknown license
|
|
|
|
|
apscheduler: >=3.10.4 # Unknown license
|
|
|
|
|
fastapi-sso: >=0.16.0 # Unknown license
|
2026-02-11 08:26:30 +08:00
|
|
|
filelock: >=3.20.0 # Unlicense (public domain) - https://unlicense.org / https://github.com/tox-dev/filelock
|
2025-05-25 10:27:30 +08:00
|
|
|
pyjwt: >=2.9.0 # Unknown license
|
2026-03-03 07:25:22 +08:00
|
|
|
python-multipart: >=0.0.20 # Unknown license
|
2025-05-25 10:27:30 +08:00
|
|
|
pillow: >=11.0.0 # Unknown license
|
|
|
|
|
azure-ai-contentsafety: >=1.0.0 # Unknown license
|
|
|
|
|
azure-identity: >=1.16.1 # Unknown license
|
|
|
|
|
azure-storage-file-datalake: >=12.20.0 # Unknown license
|
|
|
|
|
opentelemetry-api: >=1.25.0 # Unknown license
|
|
|
|
|
opentelemetry-sdk: >=1.25.0 # Unknown license
|
|
|
|
|
opentelemetry-exporter-otlp: >=1.25.0 # Unknown license
|
|
|
|
|
sentry_sdk: >=2.21.0 # Unknown license
|
|
|
|
|
cryptography: >=43.0.1 # Unknown license
|
|
|
|
|
tzdata: >=2025.1 # Unknown license
|
2026-02-11 08:26:30 +08:00
|
|
|
urllib3: >=2.0.0 # MIT license - https://github.com/urllib3/urllib3
|
feat(audio_transcription): add NVIDIA Riva STT provider (#27185)
* feat(audio_transcription): add NVIDIA Riva STT provider
Adds nvidia_riva as a new audio transcription provider, supporting both
NVCF-hosted and self-hosted Riva ASR deployments via gRPC streaming.
- Auto-resamples input audio to 16 kHz mono LINEAR_PCM (soundfile + numpy,
audioread fallback) so callers can send any common format.
- Maps OpenAI params: language (en -> en-US), response_format (text/json/
verbose_json), timestamp_granularities=["word"] -> enable_word_time_offsets,
word offsets converted ms -> s for verbose_json.
- Auth: NVCF when nvcf_function_id is set (SSL on by default), self-hosted
otherwise (SSL off by default), with explicit use_ssl override.
- gRPC errors wrapped via NvidiaRivaException -> litellm exception classes.
- Optional deps gated behind [stt-nvidia-riva] extra (nvidia-riva-client,
soundfile, audioread, numpy).
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(nvidia_riva): address PR review feedback
- handler: forward call-level `timeout` to streaming_response_generator
(kwarg-detected via inspect for older riva-client compat) so a stalled
Riva server cannot block the caller indefinitely.
- audio_utils: spill bytes to a tempfile before audioread.audio_open;
most audioread backends (FFmpeg, GStreamer) require a real filesystem
path and previously raised TypeError on BytesIO, breaking the mp3/m4a
fallback path.
- audio_utils: prefer soxr / scipy.signal.resample_poly for resampling
(anti-aliased polyphase) when installed, falling back to linear only
as a last resort. Avoids aliasing on 44.1/48 kHz -> 16 kHz downsamples.
- transformation: bare `es` now maps to es-ES (Castilian) instead of
es-US, matching BCP-47 conventions.
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: trigger CI re-run [stabilize loop 1/3]
* Update litellm/llms/nvidia_riva/audio_transcription/transformation.py
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* chore: trigger CI re-run [stabilize loop 1/3]
* fix code qa
* fix lint
* fix mypy
* fix mypy
* Fix NVIDIA Riva ASR service lookup
* Fix NVIDIA Riva transcription payload logging
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: oss-pr-review-agent-shin[bot] <281797381+oss-pr-review-agent-shin[bot]@users.noreply.github.com>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Co-authored-by: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
2026-05-06 08:17:51 +08:00
|
|
|
audioread: >=3.0.1 # MIT license manually verified - https://github.com/beetbox/audioread
|
2025-05-25 10:27:30 +08:00
|
|
|
python-dotenv: >=1.0.0 # Unknown license
|
|
|
|
|
tiktoken: >=0.8.0 # Unknown license
|
|
|
|
|
click: >=8.1.7 # Unknown license
|
|
|
|
|
rich: >=13.7.1 # Unknown license
|
|
|
|
|
aiohttp: >=3.10.2 # Unknown license
|
|
|
|
|
tenacity: >=8.2.3 # Unknown license
|
|
|
|
|
pydantic: >=2.10.2 # Unknown license
|
|
|
|
|
jsonschema: >=4.22.0 # Unknown license
|
|
|
|
|
websockets: >=13.1.0 # Unknown license
|
2025-07-24 04:00:58 +08:00
|
|
|
polars: >=1.31.0 # Unknown license, the license.md allows free of charge use
|
build: migrate packaging, CI, and Docker from Poetry to uv (#25007)
* build: migrate packaging metadata to uv
* ci: move automation and local tooling to uv
* docker: migrate image builds and runtime setup to uv
* docs: update install and deployment guidance for uv
* chore: align auxiliary scripts and tests with uv
* test: harden test_litellm isolation
* fix: keep release and health check images self-contained
* build: pin uv tooling and health check deps
* test: isolate bedrock image request formatting from suite state
* test: cover sandbox executor requirements flow
* ci: fix circleci no-op command steps
* ci: fix circleci publish workflow parsing
* fix: stabilize remaining uv migration CI checks
* ci: increase matrix test timeout headroom
* fix: restore published docker and license coverage
* fix: restore proxy runtime build parity
* fix: restore proxy extras parity and venv migrations
* ci: persist uv path across circleci steps
* fix: keep psycopg binary in default test env
* docker: preserve prisma cache across stages
* test: run local proxy checks through uv python
* build: restore runtime deps moved into ci
* build: refresh uv lock after upstream merge
* fix: restore module import in test_check_migration after merge
The conflict resolution imported only the function but the test body
references check_migration as a module throughout.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: revert dependency promotions, remove nodejs-wheel-binaries, fix Docker layer caching
- Move google-generativeai, Pillow, tenacity back to ci group (they are
lazily imported and bloat the base SDK install needlessly)
- Remove nodejs-wheel-binaries from extra_proxy and proxy-dev (redundant
in Docker where system Node.js is already installed via apk)
- Remove all nodejs-wheel node replacement and venv npm patching blocks
from Dockerfiles since the wheel is no longer installed
- Add --no-default-groups to CodSpeed benchmark workflow so the benchmark
environment matches the old minimal pip install footprint
- Apply standard uv two-phase Docker pattern: copy metadata first, install
deps (cached layer), then copy source and install project
- Replace CircleCI enterprise no-op with proper uv sync command
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate uv.lock after removing nodejs-wheel-binaries
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): use cache/restore instead of cache to prevent cache poisoning
The old workflow used actions/cache/restore (read-only). The uv migration
changed it to actions/cache (read-write), which zizmor flags as a cache
poisoning risk. Restore the safer read-only variant.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv built-in cache to silence cache-poisoning alert
The setup-uv action enables caching by default, which zizmor flags as a
cache poisoning risk. Disable it since we already use a read-only
cache/restore step.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv cache in publish workflow
Silences zizmor cache-poisoning alert. Publishing workflow runs
infrequently on protected branches so caching adds no real benefit.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(test): remove duplicate verbose_logger mock in test_check_migration
The logger was patched twice — first via mocker.patch() then via
mocker.patch.object(autospec=True). The second call fails because
autospec cannot inspect an already-mocked attribute. Remove the
redundant first patch.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): free disk space before Docker build in test-server-root-path
The Dockerfile.non_root build ran out of disk on the CI runner. Remove
Android SDK, .NET, Boost, and GHC toolchains (~12GB) to free space.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-10 02:46:23 +08:00
|
|
|
rq: >=2.7.0 # BSD-2-Clause License
|
|
|
|
|
resend: >=2.23.0 # MIT License
|
|
|
|
|
semantic_router: >=0.1.10 # MIT License
|
|
|
|
|
aurelio-sdk: >=0.0.19 # MIT License
|
2025-09-19 10:28:07 +08:00
|
|
|
pondpond: >=1.4.1 # Apache 2.0 License
|
2025-09-27 09:20:32 +08:00
|
|
|
fastuuid: >=0.13.0 # BSD-3-Clause license
|
2025-12-19 21:30:44 +08:00
|
|
|
llm-sandbox: >=0.3.31 # MIT License - https://github.com/vndee/llm-sandbox
|
2026-04-16 12:20:40 +08:00
|
|
|
RestrictedPython: >=8.1 # ZPL-2.1 (Zope Public License, BSD-style permissive) - https://github.com/zopefoundation/RestrictedPython/blob/master/LICENSE.txt
|
2025-12-21 09:34:08 +08:00
|
|
|
nodejs-wheel-binaries: >=24.12.0 # MIT license manually verified
|
2026-01-07 17:24:00 +08:00
|
|
|
grpcio: >=1.69.0 # Apache License 2.0
|
2026-01-16 13:55:14 +08:00
|
|
|
jaraco.context: >=6.1.0 # Unknown license
|
2026-01-29 06:54:58 +08:00
|
|
|
pypdf: >=6.6.2 # BSD-3-Clause license - https://github.com/py-pdf/pypdf/blob/main/LICENSE
|
2026-04-02 00:51:29 +08:00
|
|
|
hf-xet: >=1.4.2 # Apache 2.0 License - https://github.com/huggingface/xet-tools/blob/main/LICENSE
|
build: migrate packaging, CI, and Docker from Poetry to uv (#25007)
* build: migrate packaging metadata to uv
* ci: move automation and local tooling to uv
* docker: migrate image builds and runtime setup to uv
* docs: update install and deployment guidance for uv
* chore: align auxiliary scripts and tests with uv
* test: harden test_litellm isolation
* fix: keep release and health check images self-contained
* build: pin uv tooling and health check deps
* test: isolate bedrock image request formatting from suite state
* test: cover sandbox executor requirements flow
* ci: fix circleci no-op command steps
* ci: fix circleci publish workflow parsing
* fix: stabilize remaining uv migration CI checks
* ci: increase matrix test timeout headroom
* fix: restore published docker and license coverage
* fix: restore proxy runtime build parity
* fix: restore proxy extras parity and venv migrations
* ci: persist uv path across circleci steps
* fix: keep psycopg binary in default test env
* docker: preserve prisma cache across stages
* test: run local proxy checks through uv python
* build: restore runtime deps moved into ci
* build: refresh uv lock after upstream merge
* fix: restore module import in test_check_migration after merge
The conflict resolution imported only the function but the test body
references check_migration as a module throughout.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: revert dependency promotions, remove nodejs-wheel-binaries, fix Docker layer caching
- Move google-generativeai, Pillow, tenacity back to ci group (they are
lazily imported and bloat the base SDK install needlessly)
- Remove nodejs-wheel-binaries from extra_proxy and proxy-dev (redundant
in Docker where system Node.js is already installed via apk)
- Remove all nodejs-wheel node replacement and venv npm patching blocks
from Dockerfiles since the wheel is no longer installed
- Add --no-default-groups to CodSpeed benchmark workflow so the benchmark
environment matches the old minimal pip install footprint
- Apply standard uv two-phase Docker pattern: copy metadata first, install
deps (cached layer), then copy source and install project
- Replace CircleCI enterprise no-op with proper uv sync command
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate uv.lock after removing nodejs-wheel-binaries
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): use cache/restore instead of cache to prevent cache poisoning
The old workflow used actions/cache/restore (read-only). The uv migration
changed it to actions/cache (read-write), which zizmor flags as a cache
poisoning risk. Restore the safer read-only variant.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv built-in cache to silence cache-poisoning alert
The setup-uv action enables caching by default, which zizmor flags as a
cache poisoning risk. Disable it since we already use a read-only
cache/restore step.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv cache in publish workflow
Silences zizmor cache-poisoning alert. Publishing workflow runs
infrequently on protected branches so caching adds no real benefit.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(test): remove duplicate verbose_logger mock in test_check_migration
The logger was patched twice — first via mocker.patch() then via
mocker.patch.object(autospec=True). The second call fails because
autospec cannot inspect an already-mocked attribute. Remove the
redundant first patch.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): free disk space before Docker build in test-server-root-path
The Dockerfile.non_root build ran out of disk on the CI runner. Remove
Android SDK, .NET, Boost, and GHC toolchains (~12GB) to free space.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-10 02:46:23 +08:00
|
|
|
pytest-asyncio: >=1.2.0 # Apache 2.0 license
|
2026-05-05 02:39:46 +08:00
|
|
|
pytest: >=9.0.3 # MIT license
|
build: migrate packaging, CI, and Docker from Poetry to uv (#25007)
* build: migrate packaging metadata to uv
* ci: move automation and local tooling to uv
* docker: migrate image builds and runtime setup to uv
* docs: update install and deployment guidance for uv
* chore: align auxiliary scripts and tests with uv
* test: harden test_litellm isolation
* fix: keep release and health check images self-contained
* build: pin uv tooling and health check deps
* test: isolate bedrock image request formatting from suite state
* test: cover sandbox executor requirements flow
* ci: fix circleci no-op command steps
* ci: fix circleci publish workflow parsing
* fix: stabilize remaining uv migration CI checks
* ci: increase matrix test timeout headroom
* fix: restore published docker and license coverage
* fix: restore proxy runtime build parity
* fix: restore proxy extras parity and venv migrations
* ci: persist uv path across circleci steps
* fix: keep psycopg binary in default test env
* docker: preserve prisma cache across stages
* test: run local proxy checks through uv python
* build: restore runtime deps moved into ci
* build: refresh uv lock after upstream merge
* fix: restore module import in test_check_migration after merge
The conflict resolution imported only the function but the test body
references check_migration as a module throughout.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: revert dependency promotions, remove nodejs-wheel-binaries, fix Docker layer caching
- Move google-generativeai, Pillow, tenacity back to ci group (they are
lazily imported and bloat the base SDK install needlessly)
- Remove nodejs-wheel-binaries from extra_proxy and proxy-dev (redundant
in Docker where system Node.js is already installed via apk)
- Remove all nodejs-wheel node replacement and venv npm patching blocks
from Dockerfiles since the wheel is no longer installed
- Add --no-default-groups to CodSpeed benchmark workflow so the benchmark
environment matches the old minimal pip install footprint
- Apply standard uv two-phase Docker pattern: copy metadata first, install
deps (cached layer), then copy source and install project
- Replace CircleCI enterprise no-op with proper uv sync command
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate uv.lock after removing nodejs-wheel-binaries
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): use cache/restore instead of cache to prevent cache poisoning
The old workflow used actions/cache/restore (read-only). The uv migration
changed it to actions/cache (read-write), which zizmor flags as a cache
poisoning risk. Restore the safer read-only variant.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv built-in cache to silence cache-poisoning alert
The setup-uv action enables caching by default, which zizmor flags as a
cache poisoning risk. Disable it since we already use a read-only
cache/restore step.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv cache in publish workflow
Silences zizmor cache-poisoning alert. Publishing workflow runs
infrequently on protected branches so caching adds no real benefit.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(test): remove duplicate verbose_logger mock in test_check_migration
The logger was patched twice — first via mocker.patch() then via
mocker.patch.object(autospec=True). The second call fails because
autospec cannot inspect an already-mocked attribute. Remove the
redundant first patch.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): free disk space before Docker build in test-server-root-path
The Dockerfile.non_root build ran out of disk on the CI runner. Remove
Android SDK, .NET, Boost, and GHC toolchains (~12GB) to free space.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-10 02:46:23 +08:00
|
|
|
pytest-postgresql: >=7.0.2 # LGPLv3+ license
|
|
|
|
|
pytest-xdist: >=3.8.0 # MIT License
|
|
|
|
|
ruff: >=0.15.3 # MIT License
|
|
|
|
|
types-requests: >=2.32.4.20260107 # Apache 2.0 license (typeshed)
|
|
|
|
|
types-pyyaml: >=6.0.12.20250915 # Apache 2.0 license (typeshed)
|
|
|
|
|
fakeredis: >=2.34.1 # BSD license
|
|
|
|
|
psycopg: >=3.2.13 # LGPL-3.0 license
|
|
|
|
|
psycopg-binary: >=3.2.13 # LGPL-3.0 license
|
|
|
|
|
psycopg2-binary: >=2.9.11 # LGPL with exceptions
|
|
|
|
|
lunary: >=1.0.36 # Unknown license manually verified
|
|
|
|
|
logfire: >=4.6.0 # MIT License
|
|
|
|
|
pygithub: >=2.8.1 # LGPL license
|
|
|
|
|
argon2-cffi: >=25.1.0 # MIT License
|
|
|
|
|
blockbuster: >=1.5.26 # Apache 2.0 license
|
|
|
|
|
pylint: >=3.3.9 # GPLv2 license
|
|
|
|
|
langchain-mcp-adapters: >=0.2.1 # MIT License
|
|
|
|
|
langgraph: >=1.0.10 # MIT License
|
2026-04-17 00:41:51 +08:00
|
|
|
langgraph-prebuilt: >=1.0.8 # MIT License - https://github.com/langchain-ai/langgraph/blob/main/LICENSE
|
build: migrate packaging, CI, and Docker from Poetry to uv (#25007)
* build: migrate packaging metadata to uv
* ci: move automation and local tooling to uv
* docker: migrate image builds and runtime setup to uv
* docs: update install and deployment guidance for uv
* chore: align auxiliary scripts and tests with uv
* test: harden test_litellm isolation
* fix: keep release and health check images self-contained
* build: pin uv tooling and health check deps
* test: isolate bedrock image request formatting from suite state
* test: cover sandbox executor requirements flow
* ci: fix circleci no-op command steps
* ci: fix circleci publish workflow parsing
* fix: stabilize remaining uv migration CI checks
* ci: increase matrix test timeout headroom
* fix: restore published docker and license coverage
* fix: restore proxy runtime build parity
* fix: restore proxy extras parity and venv migrations
* ci: persist uv path across circleci steps
* fix: keep psycopg binary in default test env
* docker: preserve prisma cache across stages
* test: run local proxy checks through uv python
* build: restore runtime deps moved into ci
* build: refresh uv lock after upstream merge
* fix: restore module import in test_check_migration after merge
The conflict resolution imported only the function but the test body
references check_migration as a module throughout.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: revert dependency promotions, remove nodejs-wheel-binaries, fix Docker layer caching
- Move google-generativeai, Pillow, tenacity back to ci group (they are
lazily imported and bloat the base SDK install needlessly)
- Remove nodejs-wheel-binaries from extra_proxy and proxy-dev (redundant
in Docker where system Node.js is already installed via apk)
- Remove all nodejs-wheel node replacement and venv npm patching blocks
from Dockerfiles since the wheel is no longer installed
- Add --no-default-groups to CodSpeed benchmark workflow so the benchmark
environment matches the old minimal pip install footprint
- Apply standard uv two-phase Docker pattern: copy metadata first, install
deps (cached layer), then copy source and install project
- Replace CircleCI enterprise no-op with proper uv sync command
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate uv.lock after removing nodejs-wheel-binaries
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): use cache/restore instead of cache to prevent cache poisoning
The old workflow used actions/cache/restore (read-only). The uv migration
changed it to actions/cache (read-write), which zizmor flags as a cache
poisoning risk. Restore the safer read-only variant.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv built-in cache to silence cache-poisoning alert
The setup-uv action enables caching by default, which zizmor flags as a
cache poisoning risk. Disable it since we already use a read-only
cache/restore step.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): disable setup-uv cache in publish workflow
Silences zizmor cache-poisoning alert. Publishing workflow runs
infrequently on protected branches so caching adds no real benefit.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(test): remove duplicate verbose_logger mock in test_check_migration
The logger was patched twice — first via mocker.patch() then via
mocker.patch.object(autospec=True). The second call fails because
autospec cannot inspect an already-mocked attribute. Remove the
redundant first patch.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): free disk space before Docker build in test-server-root-path
The Dockerfile.non_root build ran out of disk on the CI runner. Remove
Android SDK, .NET, Boost, and GHC toolchains (~12GB) to free space.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-10 02:46:23 +08:00
|
|
|
pytest-rerunfailures: >=15.1 # MPL 2.0 license
|
2026-05-01 02:11:44 +08:00
|
|
|
pytest-recording: >=0.13.4 # MIT license
|