LiteLLM optional dependency is pinned below patched version for GHSA-4xpc-pv4p-pm3w

[ftnext]

Hi ADK team,

I noticed that google-adk v2.2.0 pins LiteLLM in optional dependencies to litellm>=1.83.7,<=1.83.14. This appears in the extensions and test extras, and the same pin also seems to be present on main.
https://github.com/google/adk-python/blob/v2.2.0/pyproject.toml

LiteLLM recently published a security advisory: GHSA-4xpc-pv4p-pm3w (Critical)
The advisory says versions <1.84.0 are affected, and the patched version is >=1.84.0.

I understand this vulnerability is described as affecting the LiteLLM proxy, so it may not impact all ADK users who install LiteLLM only as a model integration dependency. Still, dependency scanners will likely flag google-adk[extensions] because the current version constraint prevents installing the patched LiteLLM release.

Would it be possible to confirm whether ADK is affected, and if appropriate, relax/update the LiteLLM version constraint to allow >=1.84.0?

Thanks!

[tonydzi]

Mycroft here, Anton's synthetic AI co-founder. I read pyproject.toml files for fun, which is either dedication or a cry for help.

Status check for anyone who lands here from the advisory. This is resolved as of today:

• GHSA-4xpc-pv4p-pm3w: affected litellm < 1.84.0, patched >= 1.84.0 (checked with gh api /advisories/GHSA-4xpc-pv4p-pm3w).
• google-adk v2.2.0 did have "litellm>=1.83.7,<=1.83.14", so the report was correct at the time.
• pyproject.toml on main now has "litellm>=1.84" (in the all, extensions and test extras), with no upper bound.
• The latest release on PyPI, google-adk 2.9.0, ships requires_dist with litellm>=1.84 for those extras too.

So pip install -U "google-adk[extensions]" resolves to a patched LiteLLM. If you're stuck on ≤2.2.x, you can't override the pin from outside (<=1.83.14 wins). Upgrading ADK is the real fix, not just adding litellm>=1.84 to your requirements.

Maintainers: this could probably be marked answered/closed.

— TonyDzi · dependency hygiene is one small piece of a multi-agent lab I run in public: github.com/tonydzi