[kaihackney-scale]

What and why

Closes #470.

litellm>=1.96.0,<1.97 left no way to install a release outside GHSA-7hp6-4w63-5g45. That advisory is about the LiteLLM proxy server; this package only uses the client, in _prompt_llm_judge, and never imports litellm.proxy. The range is now >=1.104.0,<1.107. The floor moves as well as the cap, so a resolver can't pick an affected release. uv.lock moves to 1.106.6.

Moving up exposed two changes in litellm. Each one was failing a unit test (the same tests that fail on #467):

• The import is no longer safe with sockets blocked. import litellm fetches its model cost map from GitHub. 1.96 swallowed any error there; newer releases only catch httpx errors, so pytest-socket's SocketBlockedError now fails the import. tst/unit/conftest.py sets LITELLM_LOCAL_MODEL_COST_MAP=True, so the suite reads litellm's bundled copy.
• litellm now requires boto3 (from 1.104). A core install therefore brings everything the aws extra names, and _only_in("aws") came back empty, failing 13 tests in test_optional_extras_stay_optional.py. A distribution an extra names directly now stays that extra's when computing core. The tests still prove core code imports without boto3, which the code still does. No other extra's block list changes.

Nothing called the real litellm before: the one judge test replaces acompletion. test_rubrics_verifier_litellm_contract.py runs _prompt_llm_judge against the installed litellm.acompletion with only mock_response added. It covers the strict json_schema call, text-plus-image content, and the retry without response_format.

For review:

• Runtime still fetches the cost map on import. In an egress-blocked sandbox, 1.106 now retries with backoff before it falls back. Setting LITELLM_LOCAL_MODEL_COST_MAP at runtime would avoid that but would freeze pricing to the bundled table, so it's left out here.
• Core installs now pull boto3/botocore through litellm. The aws extra stays, since it states what the AWS backends need.
• The lock also moves boto3/botocore 1.43.38 → 1.43.123 and certifi 2026.6.17 → 2026.10.23, which litellm 1.106.6 requires.

How it was tested

• On main's lock, ran uv pip install --dry-run agentenv-framework==0.9.1428 'litellm>=1.100.4': unsatisfiable.
• Before the fixes, on 1.106.6: test_prompt_llm_judge_base_url_precedence failed with SocketBlockedError, and 13 test_optional_extras_stay_optional.py tests failed. Afterwards all pass.
• Full unit tier as CI runs it (uv sync --locked --extra dev, py3.12, pytest tst/unit packages/agentenv-protocol/tests -n auto) on 1.106.6: 12,766 passed, 66 skipped, 8 failed. None of the 8 involve litellm. Rerun alone, the Ctrl-C teardown and gateway-trigger tests pass. The other 4 fail only on my Mac: generated MCP CLI scripts run a system python3 without click, and the Docker clone tests time out. CI decides those.
• The floor, through uv run --with litellm==1.104.0: tst/unit/task_step/verifiers/ plus test_optional_extras_stay_optional.py, 500 passed.
• uv lock --check and ruff check: clean.
• Built the wheel. Its metadata has Requires-Dist: litellm<1.107,>=1.104.0, and it installs into clean py3.12 and py3.14 venvs, resolving litellm 1.106.6 and importing the rubrics verifier.
• Import probe with a non-OSError socket block, the way pytest-socket blocks: 1.96.0 and 1.100.4 fall back; 1.103.1, 1.104.0 and 1.106.6 raise; all of them import cleanly with LITELLM_LOCAL_MODEL_COST_MAP=True.

Not checked: lockfiles in downstream repos that pin agentenv-framework.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​botocore@​1.43.38 ⏵ 1.43.123	+1
	pypi/​litellm@​1.96.0 ⏵ 1.106.6	+1	+18
	pypi/​boto3@​1.43.38 ⏵ 1.43.123

View full report