github-featured / browser-use--browser-use

发布

0 发布 148 Git 标签

RSS 订阅源
  • 0.12.5 45f3dc5593
    比较

    Remove litellm from dependencies (supply chain attack) (#4515)

    frostbyte_neo 发布于 2026-03-25 03:36:50 +00:00

    Summary

    Remove litellm from pyproject.toml dependencies entirely.
    ChatLiteLLM wrapper is kept but requires manual installation:

    pip install litellm

    What changed

    • pyproject.toml: litellm==1.82.2 removed from core dependencies
    • browser_use/llm/litellm/chat.py: Added docstring noting manual
      install requirement, added # type: ignore for pyright since litellm is
      no longer in the environment
    • ChatLiteLLM stays in the public API — it already lazy-imports
      litellm inside methods, so users who don't use it are never affected

    Context

    litellm versions 1.82.7 and 1.82.8 were backdoored on March 24, 2026 by
    TeamPCP via a compromised Trivy CI/CD pipeline. browser-use==0.12.3
    shipped litellm>=1.82.2 (unpinned) as a core dependency, and BigQuery
    analysis shows ~6,900 installs pulled the backdoored litellm during the
    4-hour attack window.

    By removing it from dependencies entirely, pip install browser-use no
    longer pulls litellm, and browser-use will not appear in litellm's
    dependency graph.

    References

    Note

    Medium Risk
    Medium risk because removing litellm from required dependencies can
    break existing installs that relied on ChatLiteLLM working
    out-of-the-box; runtime imports now require manual installation.

    Overview
    Stops installing litellm as a core dependency (and bumps the package
    version to 0.12.5), requiring users to install it explicitly when
    using the LiteLLM integration.

    Keeps ChatLiteLLM but adds a module docstring documenting the manual
    install and updates litellm imports with # type: ignore to avoid
    type-check failures when litellm is absent.

    Written by Cursor
    Bugbot     for commit
    d4b9e30188. This will update automatically
    on new commits. Configure
    here.

    下载附件