feat(llm): support litellm LLM provider by coderzc · Pull Request #178 · apache/hugegraph-ai

coderzc · 2025-02-25T12:34:30Z

Add litellm to support more LLM providers

package update

openai~=1.61.0
...
litellm~=1.61.13

github-actions · 2025-02-25T12:34:50Z

Dependency Review

The following issues were found:

❌ 1 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 2 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

hugegraph-llm/poetry.lock

Name	Version	Vulnerability	Severity
litellm	1.30.7	LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint	critical
		litellm vulnerable to remote code execution based on using eval unsafely	critical
		Arbitrary file deletion in litellm	high
		LiteLLM Server-Side Request Forgery (SSRF) vulnerability	high
		SQL injection in litellm	moderate
		litellm vulnerable to improper access control in team management	moderate

License Issues

hugegraph-llm/pyproject.toml

Package	Version	License	Issue Type
litellm	~ 1.61.13	Null	Unknown License

hugegraph-llm/requirements.txt

Package	Version	License	Issue Type
litellm	~> 1.61.13	Null	Unknown License

Denied Licenses: GPL-3.0, AGPL-1.0, AGPL-3.0, LGPL-2.0, CC-BY-3.0

OpenSSF Scorecard

Package

Version

Score

Details

pip/litellm

1.30.7

Unknown

pip/importlib-metadata

8.6.1

🟢 6.1

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 1	Found 4/24 approved changesets -- score normalized to 1
Binary-Artifacts	🟢 8	binaries present in source code
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Maintained	🟢 6	5 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 6
Security-Policy	🟢 10	security policy file detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	🟢 10	project is fuzzed
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

pip/tokenizers

0.21.0

🟢 5.1

Details

Check	Score	Reason
Code-Review	🟢 7	Found 21/29 approved changesets -- score normalized to 7
Maintained	🟢 10	15 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	🟢 10	packaging workflow detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities	⚠️ 2	8 existing vulnerabilities detected

pip/zipp

3.21.0

🟢 5.6

Details

Check	Score	Reason
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Code-Review	⚠️ 0	Found 1/28 approved changesets -- score normalized to 0
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	🟢 10	project is fuzzed
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

pip/litellm

~ 1.61.13

Unknown

pip/openai

~ 1.61.0

🟢 6.2

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Maintained	🟢 10	30 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ -1	Found no human activity in the last 8 changesets
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
License	🟢 10	license file detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

pip/litellm

~> 1.61.13

Unknown

pip/openai

~> 1.61.0

🟢 6.2

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Maintained	🟢 10	30 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ -1	Found no human activity in the last 8 changesets
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
License	🟢 10	license file detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

Scanned Files

hugegraph-llm/poetry.lock
hugegraph-llm/pyproject.toml
hugegraph-llm/requirements.txt

imbajin · 2025-02-26T04:33:21Z

hugegraph-llm/src/hugegraph_llm/models/llms/litellm.py

+        return 4096  # Default to 4096 if model not found
+
+    def get_llm_type(self) -> str:
+        return "litellm" 


Suggested change

return "litellm"

return "litellm"

imbajin · 2025-02-26T04:33:52Z

hugegraph-llm/src/hugegraph_llm/models/embeddings/litellm.py

+        if np.all(emb1 == 0) or np.all(emb2 == 0):
+            return 0.0
+        # Calculate cosine similarity
+        return float(np.dot(emb1, emb2) / (np.linalg.norm(emb1) * np.linalg.norm(emb2))) 


Suggested change

return float(np.dot(emb1, emb2) / (np.linalg.norm(emb1) * np.linalg.norm(emb2)))

return float(np.dot(emb1, emb2) / (np.linalg.norm(emb1) * np.linalg.norm(emb2)))

imbajin · 2025-02-26T04:34:18Z

hugegraph-llm/.gitignore

 src/hugegraph_llm/resources/demo/questions.xlsx
 src/hugegraph_llm/resources/backup-graph-data-4020/
+
+uv.lock


Suggested change

uv.lock

uv.lock

…ph-ai into support_litellm

test_litellm_chat

…-hugegraph-ai into support_litellm

imbajin

TODO: we could unity LLM configs to one

support litellm

12c0b23

dosubot bot added the size:L This PR changes 100-499 lines, ignoring generated files. label Feb 25, 2025

github-actions bot added the llm label Feb 25, 2025

dosubot bot added the enhancement New feature or request label Feb 25, 2025

coderzc added 2 commits February 25, 2025 20:37

delete uv.lock

92f3602

fix

b39822f

coderzc changed the title ~~feat: support litellm LLM provider~~ feat(llm): support litellm LLM provider Feb 25, 2025

coderzc and others added 3 commits February 25, 2025 20:55

fix embedding

1ecf587

fix code

ff43254

Merge branch 'main' into support_litellm

425844d

imbajin reviewed Feb 26, 2025

View reviewed changes

coderzc and others added 15 commits February 26, 2025 15:02

fix lint

1c6ea28

Merge branch 'support_litellm' of github.com:apache/incubator-hugegra…

04e4ac2

…ph-ai into support_litellm

fix lint

59b0036

fix lint

52876ee

fix lint

237c674

Add litellm config on UI

d080d1b

Improve the configuration and testing functions of LiteLLM.

bd85aed

fix doc

9974088

fix lint

5d3cfd4

fix max_tokens type for

181c997

test_litellm_chat

fix code

1f76135

some improve

f7a1fbd

Merge branch 'support_litellm' of https://github.com/apache/incubator…

9ecae4e

…-hugegraph-ai into support_litellm

Update configs_block.py

243832f

Update README.md

4c19c74

imbajin approved these changes Feb 27, 2025

View reviewed changes

dosubot bot added the lgtm This PR has been approved by a maintainer label Feb 27, 2025

imbajin merged commit 3e0bf46 into main Feb 27, 2025
11 checks passed

imbajin deleted the support_litellm branch February 27, 2025 08:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(llm): support litellm LLM provider#178

feat(llm): support litellm LLM provider#178
imbajin merged 21 commits intomainfrom
support_litellm

coderzc commented Feb 25, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Feb 25, 2025 •

edited

Loading

Uh oh!

imbajin Feb 26, 2025

Uh oh!

imbajin Feb 26, 2025

Uh oh!

imbajin Feb 26, 2025

Uh oh!

imbajin left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	return float(np.dot(emb1, emb2) / (np.linalg.norm(emb1) * np.linalg.norm(emb2)))
	return float(np.dot(emb1, emb2) / (np.linalg.norm(emb1) * np.linalg.norm(emb2)))

Conversation

coderzc commented Feb 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

package update

Uh oh!

github-actions bot commented Feb 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Vulnerabilities

hugegraph-llm/poetry.lock

License Issues

hugegraph-llm/pyproject.toml

hugegraph-llm/requirements.txt

OpenSSF Scorecard

Scanned Files

Uh oh!

imbajin Feb 26, 2025

Choose a reason for hiding this comment

Uh oh!

imbajin Feb 26, 2025

Choose a reason for hiding this comment

Uh oh!

imbajin Feb 26, 2025

Choose a reason for hiding this comment

Uh oh!

imbajin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderzc commented Feb 25, 2025 •

edited

Loading

github-actions bot commented Feb 25, 2025 •

edited

Loading