From eb2362276a03c588a3d7e0d488dee0d922daaba1 Mon Sep 17 00:00:00 2001 From: shuningc Date: Mon, 27 Jul 2026 14:27:43 -0700 Subject: [PATCH 01/11] fix(ci): require uv >=0.8.6 for VULN-95456 Pin uv to the patched floor in CI workflows and enforce required-version in splunk-ao-adk/a2a pyproject.toml. Fixes CVE-2025-54368 (ZIP parsing differentials allowing malicious package extraction). Co-authored-by: Cursor --- .github/workflows/ci-tests-splunk-ao-a2a.yaml | 1 + .github/workflows/ci-tests-splunk-ao-adk.yaml | 1 + splunk-ao-a2a/pyproject.toml | 1 + splunk-ao-adk/pyproject.toml | 1 + 4 files changed, 4 insertions(+) diff --git a/.github/workflows/ci-tests-splunk-ao-a2a.yaml b/.github/workflows/ci-tests-splunk-ao-a2a.yaml index 88498159..0d671d23 100644 --- a/.github/workflows/ci-tests-splunk-ao-a2a.yaml +++ b/.github/workflows/ci-tests-splunk-ao-a2a.yaml @@ -43,6 +43,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6 with: + version: ">=0.8.6" enable-cache: true cache-dependency-glob: "**/splunk-ao-a2a/pyproject.toml" diff --git a/.github/workflows/ci-tests-splunk-ao-adk.yaml b/.github/workflows/ci-tests-splunk-ao-adk.yaml index 43985065..241f9a23 100644 --- a/.github/workflows/ci-tests-splunk-ao-adk.yaml +++ b/.github/workflows/ci-tests-splunk-ao-adk.yaml @@ -43,6 +43,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6 with: + version: ">=0.8.6" enable-cache: true cache-dependency-glob: "**/splunk-ao-adk/pyproject.toml" diff --git a/splunk-ao-a2a/pyproject.toml b/splunk-ao-a2a/pyproject.toml index 4f9bed12..123a47ee 100644 --- a/splunk-ao-a2a/pyproject.toml +++ b/splunk-ao-a2a/pyproject.toml @@ -25,6 +25,7 @@ Repository = "https://github.com/splunk/splunk-ao-python" # UV-specific configuration (path for dev, ignored when installed from PyPI) [tool.uv] +required-version = ">=0.8.6" sources = { "splunk-ao" = { path = "../", editable = true } } [dependency-groups] diff --git a/splunk-ao-adk/pyproject.toml b/splunk-ao-adk/pyproject.toml index 1b597ef9..a91b9587 100644 --- a/splunk-ao-adk/pyproject.toml +++ b/splunk-ao-adk/pyproject.toml @@ -23,6 +23,7 @@ Repository = "https://github.com/splunk/splunk-ao-python" # UV-specific configuration (path for dev, ignored when installed from PyPI) [tool.uv] +required-version = ">=0.8.6" sources = { "splunk-ao" = { path = "../", editable = true } } [tool.hatch.build.targets.wheel] From d672edb9cd1afc057ec426e291cd59a66bc4188e Mon Sep 17 00:00:00 2001 From: shuningc Date: Thu, 30 Jul 2026 11:36:16 -0700 Subject: [PATCH 02/11] Update splunk-ao-a2a/pyproject.toml Co-authored-by: Fernando Correia --- splunk-ao-a2a/pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/splunk-ao-a2a/pyproject.toml b/splunk-ao-a2a/pyproject.toml index 123a47ee..64006c86 100644 --- a/splunk-ao-a2a/pyproject.toml +++ b/splunk-ao-a2a/pyproject.toml @@ -23,7 +23,7 @@ dependencies = [ [project.urls] Repository = "https://github.com/splunk/splunk-ao-python" -# UV-specific configuration (path for dev, ignored when installed from PyPI) +required-version = ">=0.9.6" [tool.uv] required-version = ">=0.8.6" sources = { "splunk-ao" = { path = "../", editable = true } } From 523873c8d78fa7da7d5441465ca8885db156cebc Mon Sep 17 00:00:00 2001 From: shuningc Date: Thu, 30 Jul 2026 11:36:23 -0700 Subject: [PATCH 03/11] Update .github/workflows/ci-tests-splunk-ao-a2a.yaml Co-authored-by: Fernando Correia --- .github/workflows/ci-tests-splunk-ao-a2a.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-tests-splunk-ao-a2a.yaml b/.github/workflows/ci-tests-splunk-ao-a2a.yaml index 0d671d23..1c3f017d 100644 --- a/.github/workflows/ci-tests-splunk-ao-a2a.yaml +++ b/.github/workflows/ci-tests-splunk-ao-a2a.yaml @@ -43,7 +43,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6 with: - version: ">=0.8.6" + version: ">=0.9.6" enable-cache: true cache-dependency-glob: "**/splunk-ao-a2a/pyproject.toml" From e79ae7e8e255f4d82e869a4f1e20eb240521ad32 Mon Sep 17 00:00:00 2001 From: shuningc Date: Thu, 30 Jul 2026 11:36:29 -0700 Subject: [PATCH 04/11] Update .github/workflows/ci-tests-splunk-ao-adk.yaml Co-authored-by: Fernando Correia --- .github/workflows/ci-tests-splunk-ao-adk.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-tests-splunk-ao-adk.yaml b/.github/workflows/ci-tests-splunk-ao-adk.yaml index 241f9a23..b7b93a13 100644 --- a/.github/workflows/ci-tests-splunk-ao-adk.yaml +++ b/.github/workflows/ci-tests-splunk-ao-adk.yaml @@ -43,7 +43,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6 with: - version: ">=0.8.6" + version: ">=0.9.6" enable-cache: true cache-dependency-glob: "**/splunk-ao-adk/pyproject.toml" From 8b97ad657f61ea85b046af55eb6c4145df178b24 Mon Sep 17 00:00:00 2001 From: shuningc Date: Mon, 3 Aug 2026 14:09:40 -0700 Subject: [PATCH 05/11] Update splunk-ao-a2a/pyproject.toml Co-authored-by: Fernando Correia --- splunk-ao-a2a/pyproject.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/splunk-ao-a2a/pyproject.toml b/splunk-ao-a2a/pyproject.toml index 64006c86..437aad31 100644 --- a/splunk-ao-a2a/pyproject.toml +++ b/splunk-ao-a2a/pyproject.toml @@ -23,9 +23,9 @@ dependencies = [ [project.urls] Repository = "https://github.com/splunk/splunk-ao-python" -required-version = ">=0.9.6" +# UV-specific configuration (path for dev, ignored when installed from PyPI) [tool.uv] -required-version = ">=0.8.6" +required-version = ">=0.9.6" sources = { "splunk-ao" = { path = "../", editable = true } } [dependency-groups] From 114fc0c97731374d6733b34fed9c18ae56081550 Mon Sep 17 00:00:00 2001 From: shuningc Date: Mon, 3 Aug 2026 14:09:46 -0700 Subject: [PATCH 06/11] Update splunk-ao-adk/pyproject.toml Co-authored-by: Fernando Correia --- splunk-ao-adk/pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/splunk-ao-adk/pyproject.toml b/splunk-ao-adk/pyproject.toml index a91b9587..3408b819 100644 --- a/splunk-ao-adk/pyproject.toml +++ b/splunk-ao-adk/pyproject.toml @@ -23,7 +23,7 @@ Repository = "https://github.com/splunk/splunk-ao-python" # UV-specific configuration (path for dev, ignored when installed from PyPI) [tool.uv] -required-version = ">=0.8.6" +required-version = ">=0.9.6" sources = { "splunk-ao" = { path = "../", editable = true } } [tool.hatch.build.targets.wheel] From fb454b6db8b2469ae7d80e76efa78ec011d05466 Mon Sep 17 00:00:00 2001 From: shuningc Date: Tue, 4 Aug 2026 00:12:44 -0700 Subject: [PATCH 07/11] fix(VULN-95456): bump locked uv package and export floor via crewai/all extras Regenerate poetry.lock so the crewai transitive uv resolves to >=0.9.6 (0.12.1), and wire the constraint into crewai/all extras for downstream pip installs. CI setup-uv changes only affect the CLI, not this finding. Co-authored-by: Cursor --- poetry.lock | 50 +++++++++++++++++++++++++------------------------- pyproject.toml | 5 +++-- 2 files changed, 28 insertions(+), 27 deletions(-) diff --git a/poetry.lock b/poetry.lock index e74dbf74..c79a3508 100644 --- a/poetry.lock +++ b/poetry.lock @@ -5645,32 +5645,32 @@ markers = {main = "extra == \"langchain\" or extra == \"all\""} [[package]] name = "uv" -version = "0.8.9" +version = "0.12.1" description = "An extremely fast Python package and project manager, written in Rust." optional = true python-versions = ">=3.8" groups = ["main"] -markers = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\")" -files = [ - {file = "uv-0.8.9-py3-none-linux_armv6l.whl", hash = "sha256:4633c693c79c57a77c52608cbca8a6bb17801bfa223326fbc5c5142654c23cc3"}, - {file = "uv-0.8.9-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:1cdc11cbc81824e51ebb1bac35745a79048557e869ef9da458e99f1c3a96c7f9"}, - {file = "uv-0.8.9-py3-none-macosx_11_0_arm64.whl", hash = "sha256:7b20ee83e3bf294e0b1347d0b27c56ea1a4fa7eeff4361fbf1f39587d4273059"}, - {file = "uv-0.8.9-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.musllinux_1_1_aarch64.whl", hash = "sha256:3418315e624f60a1c4ed37987b35d5ff0d03961d380e7e7946a3378499d5d779"}, - {file = "uv-0.8.9-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:7efe01b3ed9816e07e6cd4e088472a558a1d2946177f31002b4c42cd55cb4604"}, - {file = "uv-0.8.9-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e571132495d7ab24d2f0270c559d6facd4224745d9db7dff8c20ec0c71ae105a"}, - {file = "uv-0.8.9-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:67507c66837d8465daaad9f2ccd7da7af981d8c94eb8e32798f62a98c28de82d"}, - {file = "uv-0.8.9-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:a3162f495805a26fba5aacbee49c8650e1e74313c7a2e6df6aec5de9d1299087"}, - {file = "uv-0.8.9-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:60eb70afeb1c66180e12a15afd706bcc0968dbefccf7ef6e5d27a1aaa765419b"}, - {file = "uv-0.8.9-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:011d2b2d4781555f7f7d29d2f0d6b2638fc60eeff479406ed570052664589e6a"}, - {file = "uv-0.8.9-py3-none-manylinux_2_28_aarch64.whl", hash = "sha256:97621843e087a68c0b4969676367d757e1de43c00a9f554eb7da35641bdff8a2"}, - {file = "uv-0.8.9-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:b1be6a7b49d23b75d598691cc5c065a9e3cdf5e6e75d7b7f42f24d758ceef3c4"}, - {file = "uv-0.8.9-py3-none-musllinux_1_1_armv7l.whl", hash = "sha256:91598361309c3601382c552dc22256f70b2491ad03357b66caa4be6fdf1111dd"}, - {file = "uv-0.8.9-py3-none-musllinux_1_1_i686.whl", hash = "sha256:dc81df9dd7571756e34255592caab92821652face35c3f52ad05efaa4bcc39d3"}, - {file = "uv-0.8.9-py3-none-musllinux_1_1_x86_64.whl", hash = "sha256:9ef728e0a5caa2bb129c009a68b30819552e7addf934916a466116e302748bed"}, - {file = "uv-0.8.9-py3-none-win32.whl", hash = "sha256:a347c2f2630a45a3b7ceae28a78a528137edfec4847bb29da1561bd8d1f7d254"}, - {file = "uv-0.8.9-py3-none-win_amd64.whl", hash = "sha256:dc12048cdb53210d0c7218bb403ad30118b1fe8eeff3fbcc184c13c26fcc47d4"}, - {file = "uv-0.8.9-py3-none-win_arm64.whl", hash = "sha256:53332de28e9ee00effb695a15cdc70b2455d6b5f6b596d556076b5dd1fd3aa26"}, - {file = "uv-0.8.9.tar.gz", hash = "sha256:54d76faf5338d1e5643a32b048c600de0cdaa7084e5909106103df04f3306615"}, +markers = "extra == \"crewai\" or extra == \"all\"" +files = [ + {file = "uv-0.12.1-py3-none-linux_armv6l.whl", hash = "sha256:71f86410264c69a3e8acd18171897dd8ab1a13350cf40f718e4def5db2b724be"}, + {file = "uv-0.12.1-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:41b8fc2335f682312a1ca39a7b4abfd6af800992065c663582ca3e4d51cf9258"}, + {file = "uv-0.12.1-py3-none-macosx_11_0_arm64.whl", hash = "sha256:2e9b0b86e180abc5968b979c6e25203b32e85969abb5083ee1e8b88a5aa98a76"}, + {file = "uv-0.12.1-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.musllinux_1_1_aarch64.whl", hash = "sha256:9331dda0dc4990512c232f86e1d3a7b83c13f459777fcc2bd46030911b40eaaa"}, + {file = "uv-0.12.1-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.musllinux_1_1_armv7l.whl", hash = "sha256:1e8fd95fe98768e29436ad57f9ef7b68dc294b7b9862ef63396af8b15ab85e6c"}, + {file = "uv-0.12.1-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:04290ea4001dca31ac8a8324113a4930dccad69ce35dbf6eaae307d54880890d"}, + {file = "uv-0.12.1-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:29399e1e73b67ed24abe82bc971aa4eb8419c4de804784290f39cf681f0b51ce"}, + {file = "uv-0.12.1-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:5bd04849dd5346517cc4e57b4b3aa0b01c67c423878260c04f5893a038fe25b6"}, + {file = "uv-0.12.1-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e35e0030480a8c3bf8ecd87ae4a6f6a224009e15e96a6fbb3634ac11ab75d582"}, + {file = "uv-0.12.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:27211df9b277f440dea438a4e525ba40250fb721ad39b8927eefc2d91f9aea15"}, + {file = "uv-0.12.1-py3-none-manylinux_2_28_aarch64.whl", hash = "sha256:b255ac23958e45f39f9c7a4cd65890df5ef46f539a3b14de03bd296bbba9cb60"}, + {file = "uv-0.12.1-py3-none-manylinux_2_31_riscv64.musllinux_1_1_riscv64.whl", hash = "sha256:1de49d9b04438f1ad2f41a1441dbbe19e230b94fca56d632818cfaed69e03bfc"}, + {file = "uv-0.12.1-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:6f7e72543264d2420ebb2ddc84696a751af2d6c5910046b7666589118f47292b"}, + {file = "uv-0.12.1-py3-none-musllinux_1_1_i686.whl", hash = "sha256:3bd5db002adc763aa8d277f5b44f8d6e3fd82d20f2e51225b0bbdae1badc7259"}, + {file = "uv-0.12.1-py3-none-musllinux_1_1_x86_64.whl", hash = "sha256:153ec0959a15397514438aefc1d7cd04235f335dd6bb53ea0f9e6e82c5a49f03"}, + {file = "uv-0.12.1-py3-none-win32.whl", hash = "sha256:173ee216f17d89fc39f65339d311a53584fc7de4918d27c0f3c7edafabc6b54d"}, + {file = "uv-0.12.1-py3-none-win_amd64.whl", hash = "sha256:bd02f2da212e6a983115dc64a6fc94e9256c2d60e056d6b669de0a6025aaec05"}, + {file = "uv-0.12.1-py3-none-win_arm64.whl", hash = "sha256:ead7ad064f291a5df358c3ffa8ffab347a32bd5a75a6a068ca22254c2539a829"}, + {file = "uv-0.12.1.tar.gz", hash = "sha256:76d87de420213ca92fa403e87023c4c7c6956c6726c6b96d91c42cfe620173a3"}, ] [[package]] @@ -6546,8 +6546,8 @@ cffi = {version = ">=1.11", markers = "platform_python_implementation == \"PyPy\ cffi = ["cffi (>=1.11)"] [extras] -all = ["crewai", "langchain", "langchain-core", "langsmith", "litellm", "openai", "openai-agents", "packaging", "starlette"] -crewai = ["crewai", "litellm"] +all = ["crewai", "langchain", "langchain-core", "langsmith", "litellm", "openai", "openai-agents", "packaging", "starlette", "uv"] +crewai = ["crewai", "litellm", "uv"] langchain = ["langchain", "langchain-core", "langsmith"] middleware = ["starlette"] openai = ["openai", "openai-agents", "packaging"] @@ -6555,4 +6555,4 @@ openai = ["openai", "openai-agents", "packaging"] [metadata] lock-version = "2.1" python-versions = "^3.11,<3.15" -content-hash = "4950d00a9f12051ef8e6e5146df4803d06e8780b3ba7ee0184e6cb83f125873b" +content-hash = "bc235c6071dbdc7607a911699794834065d847dbd767f597c6db470915e557f4" diff --git a/pyproject.toml b/pyproject.toml index 131860a9..8b900be3 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -28,9 +28,9 @@ packages = [ [project.optional-dependencies] langchain = ["langchain-core", "langchain", "langsmith (>=0.8.0)"] openai = ["openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)"] -crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'"] +crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6)"] middleware = ["starlette"] -all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'"] +all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6)"] @@ -59,6 +59,7 @@ opentelemetry-api = "^1.38.0" opentelemetry-exporter-otlp-proto-http = "^1.38.0" filelock = ">=3.20.1" idna = ">=3.15,<4" +uv = { version = ">=0.9.6", optional = true } [tool.poetry.group.test.dependencies] pytest = ">=9.0.3" From f176ebd14793985ddcd5156dc1b90bb61a6e75f2 Mon Sep 17 00:00:00 2001 From: shuningc Date: Tue, 4 Aug 2026 23:26:37 -0700 Subject: [PATCH 08/11] Update pyproject.toml Co-authored-by: Fernando Correia --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index ac0799d3..8de49249 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -28,7 +28,7 @@ packages = [ [project.optional-dependencies] langchain = ["langchain-core", "langchain", "langsmith (>=0.8.0)"] openai = ["openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)"] -crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6)"] +crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6); python_version < '3.14'"] middleware = ["starlette"] all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6)"] From 3eb94aff49b50a3cb84864e4bf67a7d5cf151fe9 Mon Sep 17 00:00:00 2001 From: shuningc Date: Tue, 4 Aug 2026 23:26:50 -0700 Subject: [PATCH 09/11] Update .github/workflows/ci-tests-splunk-ao-a2a.yaml Co-authored-by: Fernando Correia --- .github/workflows/ci-tests-splunk-ao-a2a.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-tests-splunk-ao-a2a.yaml b/.github/workflows/ci-tests-splunk-ao-a2a.yaml index 1c3f017d..6addb969 100644 --- a/.github/workflows/ci-tests-splunk-ao-a2a.yaml +++ b/.github/workflows/ci-tests-splunk-ao-a2a.yaml @@ -43,7 +43,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6 with: - version: ">=0.9.6" + version: "0.12.1" enable-cache: true cache-dependency-glob: "**/splunk-ao-a2a/pyproject.toml" From 2be0c286e49fc9dddfefb548c192e755c9bad8b6 Mon Sep 17 00:00:00 2001 From: shuningc Date: Tue, 4 Aug 2026 23:27:13 -0700 Subject: [PATCH 10/11] Update pyproject.toml Co-authored-by: Fernando Correia --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 8de49249..4cceffa0 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -60,7 +60,7 @@ opentelemetry-exporter-otlp-proto-http = "^1.38.0" filelock = ">=3.20.1" idna = ">=3.15,<4" requests = ">=2.33.0" -uv = { version = ">=0.9.6", optional = true } +uv = { version = ">=0.9.6", optional = true, python = ">=3.11,<3.14" } [tool.poetry.group.test.dependencies] pytest = ">=9.0.3" From a9d034821468624519a4212bf6febdfc21c4945c Mon Sep 17 00:00:00 2001 From: shuningc Date: Tue, 4 Aug 2026 23:27:27 -0700 Subject: [PATCH 11/11] Update pyproject.toml Co-authored-by: Fernando Correia --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 4cceffa0..9f9453ca 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -30,7 +30,7 @@ langchain = ["langchain-core", "langchain", "langsmith (>=0.8.0)"] openai = ["openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)"] crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6); python_version < '3.14'"] middleware = ["starlette"] -all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6)"] +all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6); python_version < '3.14'"]