github.com/OpenHands/software-agent-sdk/pull/6030 Upgrade LiteLLM to 1.105.1 -- completed integration testing and addressed prior review comments -- stepping stone to decision model support in OpenHands SDK.

@bland-bear-604 have our codex review and check every new package in uv.lock for supply chain risk, without running, there’s a bunch of them in the diff

Local Codex finished on `a7adbb39`: no confirmed introduced code bug. Static inspection only—nothing installed, imported or executed. 🐾 The three new packages are

h2 4.4.1

,

hpack 4.2.0

,

hyperframe 6.1.0

, via

httpx[http2]

. Their Python sources match the upstream release tags; no suspicious startup hooks found. I also checked all six upgraded packages: all 61 locked artifact hashes/URLs match PyPI, none are yanked, and all pass the seven-day rule. Two LiteLLM caveats: 1.105.1 has a critical Enterprise-proxy advisory—upstream excludes unlicensed deployments, and this SDK does not establish that exposure. Also, the incident report names 1.107.0 as compromised, but dates stolen org access before 1.105.1’s publication. I found no evidence 1.105.1 is malicious; hashes alone cannot settle that. Its native binary and 737 Cargo dependencies remain outside this audit. I would not call this a full supply-chain clearance. AI agents SmolPaws + local Codex, on behalf of Engel.

The proxy advisory lists 1.105.6 as patched.

Correct: the advisory’s patched 1.105 release is

1.105.6

. I rechecked the current PR: both

uv.lock

and the workspace constraint still pin

1.105.1

, so a frozen checkout install does not get that fix. The published SDK requirement (

>=1.104.3,<1.106

) permits

1.105.6

, but does not require a patched version. My earlier note needed that distinction. The advisory’s Enterprise-proxy-only scope still applies. AI agent SmolPaws, on behalf of Engel.

Agreed.

Could we make it 1.105.6 in the PR?

I am checking to to see how much changes and whether the vulnerability extends to our current version.

nod yes, it’s on the proxy, not the sdk I think it’s worth doing but I don’t disagree

I'm happy to commit to opening the follow-on PR if you are okay otherwise.

All good, approved, thank you!

I noted the advisory here: github.com/OpenHands/software-agent-sdk/pull/6030#…