Patch LiteLLM security pins
Upgrade LiteLLM to 1.88.1 so Agent Zero is above the CVE-2026-42271 patched floor, and move the OpenAI SDK pin to 2.41.1 to satisfy LiteLLM's new dependency range. Pin Starlette to the patched 1.0.1 release for the Host-header request.url.path advisory. Fold requirements2.txt back into requirements.txt now that browser-use is no longer part of the repo dependency set, and update installer and setup docs to use a single requirements file.
Alessandro committed
Jun 11, 2026 at 03:47 UTC
b3b5e44cc32359c28c35b485b671a191e90fd759
5 files changed
+4
-10
AGENTS.md
-2
@@ -41,7 +41,6 @@ Primary Language(s): Python, JavaScript (ES Modules)
41
Do not combine these commands; run them individually:
42
```bash
43
pip install -r requirements.txt
44
-pip install -r requirements2.txt
44
```
45
- Start WebUI: python run_ui.py
46
@@ -241,7 +240,6 @@ If pip install fails, try running in a clean virtual environment:
240
python -m venv .venv
241
source .venv/bin/activate
242
pip install -r requirements.txt
244
-pip install -r requirements2.txt
243
```
244
245
### WebSocket Connection Failures
docker/run/fs/ins/install_A0.sh
-2
@@ -36,8 +36,6 @@ fi
36
37
# Install remaining A0 python packages
38
uv pip install -r /git/agent-zero/requirements.txt
39
-# override for packages that have unnecessarily strict dependencies
40
-uv pip install -r /git/agent-zero/requirements2.txt
39
40
# install playwright
41
bash /ins/install_playwright.sh "$@"
knowledge/main/about/setup-and-deployment.md
-1
@@ -21,7 +21,6 @@ For local development:
21
python -m venv .venv
22
source .venv/bin/activate
23
pip install -r requirements.txt
24
-pip install -r requirements2.txt
24
python run_ui.py
25
```
26
requirements.txt
+4
@@ -18,6 +18,8 @@ langchain-core==0.3.49
18
langchain-community==0.3.19
19
langchain-unstructured==0.1.6
20
liteparse==2.0.3
21
+litellm==1.88.1 # CVE-2026-42271 fix: patched floor is 1.83.7
22
+openai==2.41.1
23
openai-whisper==20250625
24
lxml_html_clean>=0.4.0 # CVE-2024-52595 fix: XSS CWE-79 CVSS 8.4
25
markdown==3.7
@@ -48,6 +50,7 @@ imapclient>=3.0.1
50
html2text>=2024.2.26
51
beautifulsoup4>=4.12.3
52
boto3>=1.35.0
53
+chardet<6 # unstructured may pull chardet; requests warns when chardet>=6 is present
54
exchangelib>=5.4.3
55
pywinpty==3.0.2; sys_platform == "win32"
56
python-socketio>=5.14.2
@@ -62,3 +65,4 @@ h11>=0.16.0 # security floor: HTTP request smuggling CWE-444
65
urllib3>=2.6.0 # security floor: resource exhaustion CWE-770, data amplification CWE-409
66
cryptography>=46.0.0 # security floor: insufficient data authenticity CWE-345
67
werkzeug>=3.0.3 # security floor: RCE CWE-94
68
+starlette==1.0.1 # security fix: Host header validation bypass GHSA-86qp-5c8j-p5mr
requirements2.txt
deleted
-5
@@ -1,5 +0,0 @@
1
-litellm==1.79.3
2
-openai==1.99.5
3
-# `unstructured` pulls `chardet` without an upper bound, but `requests`
4
-# warns on import when chardet>=6 is present in the same environment.
5
-chardet<6