PR Review action fails: uv cannot resolve litellm pre-release dependency

[jpshackelford]

Problem

The pr-review plugin fails when resolving dependencies because openhands-sdk depends on litellm>=1.80.10, but litellm has pre-release markers that uv doesn't resolve by default.

Error

× No solution found when resolving `--with` dependencies:
╰─▶ Because there are no versions of litellm and openhands-sdk<=1.3.0
    depends on litellm>=1.77.7.dev9, we can conclude that
    openhands-sdk<=1.3.0 cannot be used.
    ...
    hint: Pre-releases are available for `openhands-sdk` in the requested
    range (e.g., 1.0.0a6), but pre-releases weren't enabled (try:
    `--prerelease=allow`)

    hint: `litellm` was requested with a pre-release marker (e.g.,
    litellm>=1.77.7.dev9), but pre-releases weren't enabled (try:
    `--prerelease=allow`)

Location

plugins/pr-review/action.yml line ~100:

uv run --with openhands-sdk --with openhands-tools --with lmnr \
  python ../extensions/plugins/pr-review/scripts/agent_script.py

Proposed Fix

Add --prerelease=allow to the uv run command:

uv run --prerelease=allow --with openhands-sdk --with openhands-tools --with lmnr \
  python ../extensions/plugins/pr-review/scripts/agent_script.py

Reproduction

Any repository using the pr-review action will fail. Example:
https://github.com/jpshackelford/demorec/actions/runs/23491703065/job/68361406358

[jpshackelford]

Update: The root cause appears to be that the litellm package is currently not available on PyPI at all:

$ pip install litellm
ERROR: Could not find a version that satisfies the requirement litellm (from versions: none)
ERROR: No matching distribution found for litellm

This is a transient issue with PyPI or the litellm package itself, not just a pre-release resolution issue. The workaround of --prerelease=allow won't help if the package doesn't exist.

Consumers should use continue-on-error: true on the pr-review job until this is resolved.

[jpshackelford]

Security Context: There's a security advisory for litellm (March 24, 2026):

Versions 1.82.7 and 1.82.8 on PyPI were flagged as potentially compromised.

This likely explains why the package is currently unavailable on PyPI - it may have been yanked pending investigation. The pr-review action will need to wait until safe versions are restored to PyPI, or pin to a known-good version once available.

[enyst]

We just pinned in the repo

[enyst]

https://github.com/OpenHands/software-agent-sdk/blob/823d2ffaed5f2e2549590ee721304e0be2585cdb/openhands-sdk/pyproject.toml#L14