AG-FRAMEWORK-PIN: Unpinned Agent Framework Dependency

What this rule means

An agent framework package is not pinned to an exact version. An upgrade — manual, or via a CI rebuild — can silently change tool behavior between development and production, or install a compromised release.

Why it matters

The LiteLLM PyPI supply-chain compromise (24 Mar 2026): versions 1.82.7/1.82.8, live for roughly 40 minutes, shipped a `.pth` autorun payload to a package with 95M monthly downloads. An unpinned `litellm` dependency is exactly the pattern this rule exists to catch.

How to fix it

Pin agent framework packages to exact versions, or use a lock file (`pip-compile requirements.in`).

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-FRAMEWORK-PIN          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules