fix: bump litellm to 1.84.0 to resolve python-dotenv install conflict by KylinMountain · Pull Request #342 · VectifyAI/PageIndex

KylinMountain · 2026-07-03T08:37:11Z

Problem

Fresh installs from main fail. litellm==1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with the python-dotenv==1.2.2 in requirements.txt:

ERROR: Cannot install ... and python-dotenv==1.2.2 because these package versions have conflicting dependencies.
The user requested python-dotenv==1.2.2
litellm 1.83.7 depends on python-dotenv==1.0.1
ERROR: ResolutionImpossible

Reproduced with both pip 25.2 and uv.

Why not just pin `python-dotenv==1.0.1` (as in #291)

python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate: symlink following in set_key allows arbitrary file overwrite), fixed in 1.2.2. Downgrading makes the install resolve but reintroduces the vulnerability and trips the Dependency Review check.

Fix

Bump litellm1.83.7 → 1.84.0. litellm 1.84.0 relaxed its pin from python-dotenv==1.0.1 to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to stay.

Verified the full requirements.txt resolves cleanly under both pip and uv, with python-dotenv staying at 1.2.2.

Closes#286. Supersedes #291.

litellm 1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with python-dotenv==1.2.2 in requirements.txt and makes a fresh install fail (ResolutionImpossible under both pip 25.2 and uv). Downgrading dotenv to 1.0.1 is not an option: python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate). litellm 1.84.0 relaxed its pin to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to remain. Full requirements.txt resolves cleanly under both pip and uv. Closes#286

main advanced (litellm 1.84.0 #342, #188 TOC fixes, #281, README) while dev turned pageindex/page_index.py and utils.py into deprecation shims over pageindex/index/*. Both sides touched those two files, hence the conflict. Resolution: - Keep dev's shims for the two top-level modules (the real implementation lives in pageindex/index/*). requirements.txt auto-merged to litellm==1.84.0. - #188 ("prevent KeyError crash and context exhaustion in TOC processing") landed on main's top-level page_index.py, which is now a shim on dev — so its fixes were NOT in dev's index/page_index.py. Ported them into pageindex/index/page_index.py (preserving dev's IndexConfig/bool integration): .get() on the TOC check functions + detect_page_index, incremental-chat_history retry loops in extract_toc_content and toc_transformer, truncation moved before the loop, .get('table_of_contents', []) and the single_toc_item_index_fixer None guard. - Repoint #188's merged test (tests/test_issue_163.py) at pageindex.index.page_index so its patches hit the module where the code now lives (they were silently hitting the shim → real LLM calls). Full suite: 158 passed, 2 skipped. Claude-Session: https://claude.ai/code/session_01Kx5DgKbhK1N8autqXH8SmS

KylinMountain · 2026-07-03T08:37:11Z

Problem

Fresh installs from main fail. litellm==1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with the python-dotenv==1.2.2 in requirements.txt:

ERROR: Cannot install ... and python-dotenv==1.2.2 because these package versions have conflicting dependencies.
The user requested python-dotenv==1.2.2
litellm 1.83.7 depends on python-dotenv==1.0.1
ERROR: ResolutionImpossible

Reproduced with both pip 25.2 and uv.

Why not just pin `python-dotenv==1.0.1` (as in #291)

python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate: symlink following in set_key allows arbitrary file overwrite), fixed in 1.2.2. Downgrading makes the install resolve but reintroduces the vulnerability and trips the Dependency Review check.

Fix

Bump litellm1.83.7 → 1.84.0. litellm 1.84.0 relaxed its pin from python-dotenv==1.0.1 to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to stay.

Verified the full requirements.txt resolves cleanly under both pip and uv, with python-dotenv staying at 1.2.2.

Closes#286. Supersedes #291.

litellm 1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with python-dotenv==1.2.2 in requirements.txt and makes a fresh install fail (ResolutionImpossible under both pip 25.2 and uv). Downgrading dotenv to 1.0.1 is not an option: python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate). litellm 1.84.0 relaxed its pin to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to remain. Full requirements.txt resolves cleanly under both pip and uv. Closes#286

main advanced (litellm 1.84.0 #342, #188 TOC fixes, #281, README) while dev turned pageindex/page_index.py and utils.py into deprecation shims over pageindex/index/*. Both sides touched those two files, hence the conflict. Resolution: - Keep dev's shims for the two top-level modules (the real implementation lives in pageindex/index/*). requirements.txt auto-merged to litellm==1.84.0. - #188 ("prevent KeyError crash and context exhaustion in TOC processing") landed on main's top-level page_index.py, which is now a shim on dev — so its fixes were NOT in dev's index/page_index.py. Ported them into pageindex/index/page_index.py (preserving dev's IndexConfig/bool integration): .get() on the TOC check functions + detect_page_index, incremental-chat_history retry loops in extract_toc_content and toc_transformer, truncation moved before the loop, .get('table_of_contents', []) and the single_toc_item_index_fixer None guard. - Repoint #188's merged test (tests/test_issue_163.py) at pageindex.index.page_index so its patches hit the module where the code now lives (they were silently hitting the shim → real LLM calls). Full suite: 158 passed, 2 skipped. Claude-Session: https://claude.ai/code/session_01Kx5DgKbhK1N8autqXH8SmS

KylinMountain · 2026-07-03T08:37:11Z

Problem

Fresh installs from main fail. litellm==1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with the python-dotenv==1.2.2 in requirements.txt:

ERROR: Cannot install ... and python-dotenv==1.2.2 because these package versions have conflicting dependencies.
The user requested python-dotenv==1.2.2
litellm 1.83.7 depends on python-dotenv==1.0.1
ERROR: ResolutionImpossible

Reproduced with both pip 25.2 and uv.

Why not just pin `python-dotenv==1.0.1` (as in #291)

python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate: symlink following in set_key allows arbitrary file overwrite), fixed in 1.2.2. Downgrading makes the install resolve but reintroduces the vulnerability and trips the Dependency Review check.

Fix

Bump litellm1.83.7 → 1.84.0. litellm 1.84.0 relaxed its pin from python-dotenv==1.0.1 to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to stay.

Verified the full requirements.txt resolves cleanly under both pip and uv, with python-dotenv staying at 1.2.2.

Closes#286. Supersedes #291.

litellm 1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with python-dotenv==1.2.2 in requirements.txt and makes a fresh install fail (ResolutionImpossible under both pip 25.2 and uv). Downgrading dotenv to 1.0.1 is not an option: python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate). litellm 1.84.0 relaxed its pin to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to remain. Full requirements.txt resolves cleanly under both pip and uv. Closes#286

main advanced (litellm 1.84.0 #342, #188 TOC fixes, #281, README) while dev turned pageindex/page_index.py and utils.py into deprecation shims over pageindex/index/*. Both sides touched those two files, hence the conflict. Resolution: - Keep dev's shims for the two top-level modules (the real implementation lives in pageindex/index/*). requirements.txt auto-merged to litellm==1.84.0. - #188 ("prevent KeyError crash and context exhaustion in TOC processing") landed on main's top-level page_index.py, which is now a shim on dev — so its fixes were NOT in dev's index/page_index.py. Ported them into pageindex/index/page_index.py (preserving dev's IndexConfig/bool integration): .get() on the TOC check functions + detect_page_index, incremental-chat_history retry loops in extract_toc_content and toc_transformer, truncation moved before the loop, .get('table_of_contents', []) and the single_toc_item_index_fixer None guard. - Repoint #188's merged test (tests/test_issue_163.py) at pageindex.index.page_index so its patches hit the module where the code now lives (they were silently hitting the shim → real LLM calls). Full suite: 158 passed, 2 skipped. Claude-Session: https://claude.ai/code/session_01Kx5DgKbhK1N8autqXH8SmS

KylinMountain · 2026-07-03T08:37:11Z

Problem

Fresh installs from main fail. litellm==1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with the python-dotenv==1.2.2 in requirements.txt:

ERROR: Cannot install ... and python-dotenv==1.2.2 because these package versions have conflicting dependencies.
The user requested python-dotenv==1.2.2
litellm 1.83.7 depends on python-dotenv==1.0.1
ERROR: ResolutionImpossible

Reproduced with both pip 25.2 and uv.

Why not just pin `python-dotenv==1.0.1` (as in #291)

python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate: symlink following in set_key allows arbitrary file overwrite), fixed in 1.2.2. Downgrading makes the install resolve but reintroduces the vulnerability and trips the Dependency Review check.

Fix

Bump litellm1.83.7 → 1.84.0. litellm 1.84.0 relaxed its pin from python-dotenv==1.0.1 to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to stay.

Verified the full requirements.txt resolves cleanly under both pip and uv, with python-dotenv staying at 1.2.2.

Closes#286. Supersedes #291.

litellm 1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with python-dotenv==1.2.2 in requirements.txt and makes a fresh install fail (ResolutionImpossible under both pip 25.2 and uv). Downgrading dotenv to 1.0.1 is not an option: python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate). litellm 1.84.0 relaxed its pin to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to remain. Full requirements.txt resolves cleanly under both pip and uv. Closes#286

main advanced (litellm 1.84.0 #342, #188 TOC fixes, #281, README) while dev turned pageindex/page_index.py and utils.py into deprecation shims over pageindex/index/*. Both sides touched those two files, hence the conflict. Resolution: - Keep dev's shims for the two top-level modules (the real implementation lives in pageindex/index/*). requirements.txt auto-merged to litellm==1.84.0. - #188 ("prevent KeyError crash and context exhaustion in TOC processing") landed on main's top-level page_index.py, which is now a shim on dev — so its fixes were NOT in dev's index/page_index.py. Ported them into pageindex/index/page_index.py (preserving dev's IndexConfig/bool integration): .get() on the TOC check functions + detect_page_index, incremental-chat_history retry loops in extract_toc_content and toc_transformer, truncation moved before the loop, .get('table_of_contents', []) and the single_toc_item_index_fixer None guard. - Repoint #188's merged test (tests/test_issue_163.py) at pageindex.index.page_index so its patches hit the module where the code now lives (they were silently hitting the shim → real LLM calls). Full suite: 158 passed, 2 skipped. Claude-Session: https://claude.ai/code/session_01Kx5DgKbhK1N8autqXH8SmS

KylinMountain · 2026-07-03T08:37:11Z

Problem

Fresh installs from main fail. litellm==1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with the python-dotenv==1.2.2 in requirements.txt:

ERROR: Cannot install ... and python-dotenv==1.2.2 because these package versions have conflicting dependencies.
The user requested python-dotenv==1.2.2
litellm 1.83.7 depends on python-dotenv==1.0.1
ERROR: ResolutionImpossible

Reproduced with both pip 25.2 and uv.

Why not just pin `python-dotenv==1.0.1` (as in #291)

python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate: symlink following in set_key allows arbitrary file overwrite), fixed in 1.2.2. Downgrading makes the install resolve but reintroduces the vulnerability and trips the Dependency Review check.

Fix

Bump litellm1.83.7 → 1.84.0. litellm 1.84.0 relaxed its pin from python-dotenv==1.0.1 to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to stay.

Verified the full requirements.txt resolves cleanly under both pip and uv, with python-dotenv staying at 1.2.2.

Closes#286. Supersedes #291.

litellm 1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with python-dotenv==1.2.2 in requirements.txt and makes a fresh install fail (ResolutionImpossible under both pip 25.2 and uv). Downgrading dotenv to 1.0.1 is not an option: python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate). litellm 1.84.0 relaxed its pin to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to remain. Full requirements.txt resolves cleanly under both pip and uv. Closes#286

main advanced (litellm 1.84.0 #342, #188 TOC fixes, #281, README) while dev turned pageindex/page_index.py and utils.py into deprecation shims over pageindex/index/*. Both sides touched those two files, hence the conflict. Resolution: - Keep dev's shims for the two top-level modules (the real implementation lives in pageindex/index/*). requirements.txt auto-merged to litellm==1.84.0. - #188 ("prevent KeyError crash and context exhaustion in TOC processing") landed on main's top-level page_index.py, which is now a shim on dev — so its fixes were NOT in dev's index/page_index.py. Ported them into pageindex/index/page_index.py (preserving dev's IndexConfig/bool integration): .get() on the TOC check functions + detect_page_index, incremental-chat_history retry loops in extract_toc_content and toc_transformer, truncation moved before the loop, .get('table_of_contents', []) and the single_toc_item_index_fixer None guard. - Repoint #188's merged test (tests/test_issue_163.py) at pageindex.index.page_index so its patches hit the module where the code now lives (they were silently hitting the shim → real LLM calls). Full suite: 158 passed, 2 skipped. Claude-Session: https://claude.ai/code/session_01Kx5DgKbhK1N8autqXH8SmS

KylinMountain · 2026-07-03T08:37:11Z

Problem

Fresh installs from main fail. litellm==1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with the python-dotenv==1.2.2 in requirements.txt:

ERROR: Cannot install ... and python-dotenv==1.2.2 because these package versions have conflicting dependencies.
The user requested python-dotenv==1.2.2
litellm 1.83.7 depends on python-dotenv==1.0.1
ERROR: ResolutionImpossible

Reproduced with both pip 25.2 and uv.

Why not just pin `python-dotenv==1.0.1` (as in #291)

python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate: symlink following in set_key allows arbitrary file overwrite), fixed in 1.2.2. Downgrading makes the install resolve but reintroduces the vulnerability and trips the Dependency Review check.

Fix

Bump litellm1.83.7 → 1.84.0. litellm 1.84.0 relaxed its pin from python-dotenv==1.0.1 to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to stay.

Verified the full requirements.txt resolves cleanly under both pip and uv, with python-dotenv staying at 1.2.2.

Closes#286. Supersedes #291.

litellm 1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with python-dotenv==1.2.2 in requirements.txt and makes a fresh install fail (ResolutionImpossible under both pip 25.2 and uv). Downgrading dotenv to 1.0.1 is not an option: python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate). litellm 1.84.0 relaxed its pin to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to remain. Full requirements.txt resolves cleanly under both pip and uv. Closes#286

main advanced (litellm 1.84.0 #342, #188 TOC fixes, #281, README) while dev turned pageindex/page_index.py and utils.py into deprecation shims over pageindex/index/*. Both sides touched those two files, hence the conflict. Resolution: - Keep dev's shims for the two top-level modules (the real implementation lives in pageindex/index/*). requirements.txt auto-merged to litellm==1.84.0. - #188 ("prevent KeyError crash and context exhaustion in TOC processing") landed on main's top-level page_index.py, which is now a shim on dev — so its fixes were NOT in dev's index/page_index.py. Ported them into pageindex/index/page_index.py (preserving dev's IndexConfig/bool integration): .get() on the TOC check functions + detect_page_index, incremental-chat_history retry loops in extract_toc_content and toc_transformer, truncation moved before the loop, .get('table_of_contents', []) and the single_toc_item_index_fixer None guard. - Repoint #188's merged test (tests/test_issue_163.py) at pageindex.index.page_index so its patches hit the module where the code now lives (they were silently hitting the shim → real LLM calls). Full suite: 158 passed, 2 skipped. Claude-Session: https://claude.ai/code/session_01Kx5DgKbhK1N8autqXH8SmS

KylinMountain · 2026-07-03T08:37:11Z

Problem

Fresh installs from main fail. litellm==1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with the python-dotenv==1.2.2 in requirements.txt:

ERROR: Cannot install ... and python-dotenv==1.2.2 because these package versions have conflicting dependencies.
The user requested python-dotenv==1.2.2
litellm 1.83.7 depends on python-dotenv==1.0.1
ERROR: ResolutionImpossible

Reproduced with both pip 25.2 and uv.

Why not just pin `python-dotenv==1.0.1` (as in #291)

python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate: symlink following in set_key allows arbitrary file overwrite), fixed in 1.2.2. Downgrading makes the install resolve but reintroduces the vulnerability and trips the Dependency Review check.

Fix

Bump litellm1.83.7 → 1.84.0. litellm 1.84.0 relaxed its pin from python-dotenv==1.0.1 to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to stay.

Verified the full requirements.txt resolves cleanly under both pip and uv, with python-dotenv staying at 1.2.2.

Closes#286. Supersedes #291.

litellm 1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with python-dotenv==1.2.2 in requirements.txt and makes a fresh install fail (ResolutionImpossible under both pip 25.2 and uv). Downgrading dotenv to 1.0.1 is not an option: python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate). litellm 1.84.0 relaxed its pin to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to remain. Full requirements.txt resolves cleanly under both pip and uv. Closes#286

main advanced (litellm 1.84.0 #342, #188 TOC fixes, #281, README) while dev turned pageindex/page_index.py and utils.py into deprecation shims over pageindex/index/*. Both sides touched those two files, hence the conflict. Resolution: - Keep dev's shims for the two top-level modules (the real implementation lives in pageindex/index/*). requirements.txt auto-merged to litellm==1.84.0. - #188 ("prevent KeyError crash and context exhaustion in TOC processing") landed on main's top-level page_index.py, which is now a shim on dev — so its fixes were NOT in dev's index/page_index.py. Ported them into pageindex/index/page_index.py (preserving dev's IndexConfig/bool integration): .get() on the TOC check functions + detect_page_index, incremental-chat_history retry loops in extract_toc_content and toc_transformer, truncation moved before the loop, .get('table_of_contents', []) and the single_toc_item_index_fixer None guard. - Repoint #188's merged test (tests/test_issue_163.py) at pageindex.index.page_index so its patches hit the module where the code now lives (they were silently hitting the shim → real LLM calls). Full suite: 158 passed, 2 skipped. Claude-Session: https://claude.ai/code/session_01Kx5DgKbhK1N8autqXH8SmS

KylinMountain · 2026-07-03T08:37:11Z

Problem

Fresh installs from main fail. litellm==1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with the python-dotenv==1.2.2 in requirements.txt:

ERROR: Cannot install ... and python-dotenv==1.2.2 because these package versions have conflicting dependencies.
The user requested python-dotenv==1.2.2
litellm 1.83.7 depends on python-dotenv==1.0.1
ERROR: ResolutionImpossible

Reproduced with both pip 25.2 and uv.

Why not just pin `python-dotenv==1.0.1` (as in #291)

python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate: symlink following in set_key allows arbitrary file overwrite), fixed in 1.2.2. Downgrading makes the install resolve but reintroduces the vulnerability and trips the Dependency Review check.

Fix

Bump litellm1.83.7 → 1.84.0. litellm 1.84.0 relaxed its pin from python-dotenv==1.0.1 to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to stay.

Verified the full requirements.txt resolves cleanly under both pip and uv, with python-dotenv staying at 1.2.2.

Closes#286. Supersedes #291.

litellm 1.83.7 hard-pins python-dotenv==1.0.1, which conflicts with python-dotenv==1.2.2 in requirements.txt and makes a fresh install fail (ResolutionImpossible under both pip 25.2 and uv). Downgrading dotenv to 1.0.1 is not an option: python-dotenv < 1.2.2 is affected by GHSA-mf9w-mj56-hr94 (moderate). litellm 1.84.0 relaxed its pin to python-dotenv<2.0,>=1.0.0, allowing the patched python-dotenv==1.2.2 to remain. Full requirements.txt resolves cleanly under both pip and uv. Closes#286

main advanced (litellm 1.84.0 #342, #188 TOC fixes, #281, README) while dev turned pageindex/page_index.py and utils.py into deprecation shims over pageindex/index/*. Both sides touched those two files, hence the conflict. Resolution: - Keep dev's shims for the two top-level modules (the real implementation lives in pageindex/index/*). requirements.txt auto-merged to litellm==1.84.0. - #188 ("prevent KeyError crash and context exhaustion in TOC processing") landed on main's top-level page_index.py, which is now a shim on dev — so its fixes were NOT in dev's index/page_index.py. Ported them into pageindex/index/page_index.py (preserving dev's IndexConfig/bool integration): .get() on the TOC check functions + detect_page_index, incremental-chat_history retry loops in extract_toc_content and toc_transformer, truncation moved before the loop, .get('table_of_contents', []) and the single_toc_item_index_fixer None guard. - Repoint #188's merged test (tests/test_issue_163.py) at pageindex.index.page_index so its patches hit the module where the code now lives (they were silently hitting the shim → real LLM calls). Full suite: 158 passed, 2 skipped. Claude-Session: https://claude.ai/code/session_01Kx5DgKbhK1N8autqXH8SmS

BukeLy approved these changes Jul 3, 2026
View reviewed changes

KylinMountain merged commit 27f01e9 into mainJul 3, 2026
4 checks passed

KylinMountain mentioned this pull request Jul 3, 2026
litellm compromise #196
Closed