fix(deps): upgrade litellm to >=1.88.1 and python-dotenv to 1.2.2 (CVE-2026-28684)

litellm 1.83.7 hard-pinned python-dotenv==1.0.1 (vulnerable). litellm 1.88.1 relaxed this to python-dotenv>=1.0.0,<2.0, unblocking the upgrade to 1.2.2. Updates pyproject.toml constraint and manually patches poetry.lock entries with verified PyPI hashes. The lock file content-hash will need a full poetry lock regeneration on Python 3.10-3.13 (litellm does not yet support Python 3.14, which is the local system Python). Resolves Dependabot alert #760.
2026-06-12 20:08:58 +05:30
parent fbf6b8c0db
commit 884e056853
2 changed files with 10 additions and 10 deletions
@@ -55,7 +55,7 @@ vector_stores = [
 llms = [
    "groq>=0.3.0",
    "together>=0.2.10",
-    "litellm>=1.83.7",
+    "litellm>=1.88.1",
    "openai>=1.90.0",
    "ollama>=0.3.0",
    "vertexai>=0.1.0",