llm 0.37.2

Simon Willison released llm 0.37.2, fixing a security issue reported by Daniel de Araujo in advisories GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w that could send a user's configured OpenAI API key to third-party OpenAI-compatible providers. The flaw affected the extra-openai-models.yaml mechanism, now managed by the llm openai endpoint add command introduced in 0.37, and triggered when the key named by api_key_name had never been stored or when a responses: true model was run with -o chat_completions 1.

Release: llm 0.37.2 https://github.com/simonw/llm/releases/tag/0.37.2 Fixes a security issue reported by Daniel de Araujo https://github.com/BluePlexus in GHSA-v9h7-jj4g-f862 https://github.com/simonw/llm/security/advisories/GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w https://github.com/simonw/llm/security/advisories/GHSA-r639-rr7r-x72w . LLM has a mechanism called extra-openai-models.yaml https://llm.datasette.io/en/stable/other-models.html configure-an-openai-compatible-model - now managed by the new-in-0.37 llm openai endpoint add https://llm.datasette.io/en/stable/other-models.html openai-endpoint-add command - for using LLM with OpenAI-compatible API endpoints from other providers. Daniel reported two ways this could accidentally send your configured OpenAI API key to one of those providers: if the key named by api key name had never been stored, or if a responses: true model was run with -o chat completions 1 .