Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-litellm for openSUSE:Factory
checked in at 2026-09-16 17:44:16
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-litellm (Old)
and /work/SRC/openSUSE:Factory/.python-litellm.new.383539 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-litellm"
Wed Sep 16 17:44:16 2026 rev:2 rq:1378206 version:1.101.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/python-litellm/python-litellm.changes
2026-07-01 16:37:49.663545432 +0200
+++
/work/SRC/openSUSE:Factory/.python-litellm.new.383539/python-litellm.changes
2026-09-16 17:48:19.258998523 +0200
@@ -1,0 +2,12 @@
+Tue Sep 15 15:16:24 UTC 2026 - Christian Goll <[email protected]>
+
+- Update to version 1.101.0i fix bsc#1278303 (CVE-2026-84377):
+ * New core runtime dependencies:
+ - python-boto3 >= 1.43.1 (new in 1.101.0, non-optional)
+ - python-pydantic-settings >= 2.14.1
+ * Bumped runtime floors to match the 1.101.0
+ * 1.101.0 switched the PEP 517 backend to maturin to build a new Rust
+ extension (litellm.rust_bridge._native) which is opt-in.
+ keep the pure-Python noarch wheel and build it with uv_build
+
+-------------------------------------------------------------------
Old:
----
python-litellm-1.89.1.tar.gz
New:
----
python-litellm-1.101.0.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-litellm.spec ++++++
--- /var/tmp/diff_new_pack.vGAPZV/_old 2026-09-16 17:48:22.999154732 +0200
+++ /var/tmp/diff_new_pack.vGAPZV/_new 2026-09-16 17:48:23.005154983 +0200
@@ -16,16 +16,14 @@
#
+%define skip_python314 1
%if 0%{?suse_version} > 1500
%bcond_without libalternatives
%else
%bcond_with libalternatives
%endif
-
-%define skip_python314 1
-
Name: python-litellm
-Version: 1.89.1
+Version: 1.101.0
Release: 0
Summary: Library to easily interface with LLM API providers
License: MIT
@@ -38,27 +36,28 @@
BuildRequires: %{python_module wheel}
BuildRequires: fdupes
BuildRequires: python-rpm-macros
+Requires: python-aiohttp >= 3.14.2
+Requires: python-boto3 >= 1.43.1
+Requires: python-click >= 8.0
+Requires: python-fastuuid >= 0.14.0
+Requires: python-httpx >= 0.28.0
+Requires: python-importlib-metadata >= 8.0
+Requires: python-jinja2 >= 3.1.6
+Requires: python-jsonschema >= 4.22.0
+Requires: python-openai >= 2.20.0
+Requires: python-pydantic >= 2.10.0
+Requires: python-pydantic-settings >= 2.14.1
+Requires: python-python-dotenv >= 1.0
+Requires: python-tiktoken >= 0.8
+Requires: python-tokenizers >= 0.21
+BuildArch: noarch
%if %{with libalternatives}
-Requires: alts
BuildRequires: alts
+Requires: alts
%else
Requires(post): update-alternatives
Requires(postun): update-alternatives
%endif
-Requires: python-aiohttp >= 3.10
-Requires: python-click
-Requires: python-fastuuid >= 0.13.0
-Requires: python-httpx >= 0.23.0
-Requires: python-importlib-metadata >= 6.8.0
-Requires: python-jinja2 >= 3.1.2
-Requires: python-jsonschema >= 4.22.0
-Requires: python-openai >= 2.8.0
-Requires: python-pydantic >= 2.5.0
-Requires: python-python-dotenv >= 0.2.0
-Requires: python-tiktoken >= 0.7.0
-Requires: python-tokenizers
-
-BuildArch: noarch
%python_subpackages
%description
@@ -71,6 +70,36 @@
%prep
%autosetup -p1 -n litellm-%{version}
+# 1.101.0 switched the PEP 517 backend to maturin to build a new Rust extension
+# (litellm.rust_bridge._native). That bridge is opt-in at runtime
+# (LITELLM_RUST, default off) and falls back to the pure-Python path when the
+# native module is absent, so we keep the pure-Python noarch wheel and build it
+# with uv_build, the backend this package used up to 1.89.1 and that is present
+# in the build environment.
+#
+# 1.101.0 also moved its flat-layout ("module-root = """) and
enterprise-exclude
+# configuration into [tool.maturin], so a bare build-backend swap is not
enough:
+# left on its defaults, uv_build assumes the src/ layout and fails with
"Expected
+# a Python module at: src/litellm/__init__.py", and it would no longer exclude
the
+# litellm/proxy/enterprise symlink. Restore the block 1.89.1's build relied on.
+sed -i -e 's/^requires = \[[^]]*\]$/requires = ["uv_build"]/' \
+ -e 's/^build-backend = .*$/build-backend = "uv_build"/' pyproject.toml
+cat >> pyproject.toml <<'PYPROJECT_UV_BACKEND'
+
+[tool.uv.build-backend]
+module-root = ""
+source-exclude = [
+ "litellm/proxy/enterprise",
+ "**/__pycache__",
+ "**/__pycache__/**",
+ "**/.mypy_cache",
+ "**/.mypy_cache/**",
+ "**/.pytest_cache",
+ "**/.pytest_cache/**",
+ "**/.ruff_cache",
+ "**/.ruff_cache/**",
+]
+PYPROJECT_UV_BACKEND
# Remove shebangs from non-executable Python modules
sed -i '1{/^#!.*python/d}'
litellm/proxy/guardrails/guardrail_hooks/azure/prompt_shield.py
sed -i '1{/^#!.*python/d}'
litellm/proxy/guardrails/guardrail_hooks/azure/text_moderation.py
@@ -86,16 +115,19 @@
%pyproject_install
%python_expand %fdupes %{buildroot}%{$python_sitelib}
%python_clone -a %{buildroot}%{_bindir}/litellm
+%python_clone -a %{buildroot}%{_bindir}/lite
%python_clone -a %{buildroot}%{_bindir}/litellm-proxy
%pre
%python_libalternatives_reset_alternative litellm
+%python_libalternatives_reset_alternative lite
%python_libalternatives_reset_alternative litellm-proxy
%files %{python_files}
%doc README.md
%license LICENSE
%python_alternative %{_bindir}/litellm
+%python_alternative %{_bindir}/lite
%python_alternative %{_bindir}/litellm-proxy
%{python_sitelib}/litellm
%{python_sitelib}/litellm-%{version}.dist-info
++++++ python-litellm-1.89.1.tar.gz -> python-litellm-1.101.0.tar.gz ++++++
/work/SRC/openSUSE:Factory/python-litellm/python-litellm-1.89.1.tar.gz
/work/SRC/openSUSE:Factory/.python-litellm.new.383539/python-litellm-1.101.0.tar.gz
differ: char 12, line 1
