Timothy
3b4d6e4602
litellm>=1.82.7 contains a malicious .pth file that auto-executes at Python startup and exfiltrates env vars, SSH keys, cloud credentials, and CI/CD secrets to an attacker-controlled domain. Pin to last known-safe version (currently installed). Unpin once a verified-clean upstream release is available. Closes #6783 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
78 lines
1.5 KiB
TOML
78 lines
1.5 KiB
TOML
[project]
|
|
name = "framework"
|
|
version = "0.7.1"
|
|
description = "Goal-driven agent runtime with Builder-friendly observability"
|
|
readme = "README.md"
|
|
requires-python = ">=3.11"
|
|
dependencies = [
|
|
"pydantic>=2.0",
|
|
"anthropic>=0.40.0",
|
|
"httpx>=0.27.0",
|
|
"litellm==1.81.7", # pinned: supply chain attack in >=1.82.7 (adenhq/hive#6783)
|
|
"mcp>=1.0.0",
|
|
"fastmcp>=2.0.0",
|
|
"croniter>=1.4.0",
|
|
"tools",
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
webhook = ["aiohttp>=3.9.0"]
|
|
server = ["aiohttp>=3.9.0"]
|
|
testing = [
|
|
"pytest>=8.0",
|
|
"pytest-asyncio>=0.23",
|
|
"pytest-xdist>=3.0",
|
|
]
|
|
|
|
[project.scripts]
|
|
hive = "framework.cli:main"
|
|
|
|
[tool.uv.sources]
|
|
tools = { workspace = true }
|
|
|
|
[build-system]
|
|
requires = ["hatchling"]
|
|
build-backend = "hatchling.build"
|
|
|
|
[tool.hatch.build.targets.wheel]
|
|
packages = ["framework"]
|
|
|
|
[tool.ruff]
|
|
target-version = "py311"
|
|
line-length = 100
|
|
|
|
lint.select = [
|
|
"B", # bugbear errors
|
|
"C4", # flake8-comprehensions errors
|
|
"E", # pycodestyle errors
|
|
"F", # pyflakes errors
|
|
"I", # import sorting
|
|
"Q", # flake8-quotes errors
|
|
"UP", # py-upgrade
|
|
"W", # pycodestyle warnings
|
|
]
|
|
|
|
lint.per-file-ignores."demos/*" = ["E501"]
|
|
lint.isort.combine-as-imports = true
|
|
lint.isort.known-first-party = ["framework"]
|
|
lint.isort.section-order = [
|
|
"future",
|
|
"standard-library",
|
|
"third-party",
|
|
"first-party",
|
|
"local-folder",
|
|
]
|
|
[tool.pytest.ini_options]
|
|
filterwarnings = [
|
|
"ignore::DeprecationWarning:litellm.*"
|
|
]
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"ty>=0.0.13",
|
|
"ruff>=0.14.14",
|
|
"pytest>=8.0",
|
|
"pytest-asyncio>=0.23",
|
|
"pytest-xdist>=3.0",
|
|
]
|