litellm 1.83.7 hard-pinned python-dotenv==1.0.1 (vulnerable). litellm 1.88.1
relaxed this to python-dotenv>=1.0.0,<2.0, unblocking the upgrade to 1.2.2.
Updates pyproject.toml constraint and manually patches poetry.lock entries
with verified PyPI hashes. The lock file content-hash will need a full
poetry lock regeneration on Python 3.10-3.13 (litellm does not yet support
Python 3.14, which is the local system Python).
Resolves Dependabot alert #760.
Bumps @langchain/community from ^0.3.36 to ^1.1.18 and @langchain/core from
^0.3.42 to ^1.1.27 to resolve two SSRF CVEs in RecursiveUrlLoader.
Resolves Dependabot alerts #496 and #538.
harshgupta-mem0