rayhan 8b793ee148 fix: remediate litellm CVEs by upgrading from 1.82.5 to 1.84.0 (#17448) ...

## Summary
  
Remediates nine litellm CVEs (3 CRITICAL, 6 HIGH) by upgrading the exact
pin from `==1.82.5` to `==1.84.0` in `pyproject.toml`.
  
  | CVE | Severity | Fixed in |
  |---|---|---|
  | CVE-2026-35030 | CRITICAL | 1.83.0 |
  | CVE-2026-42208 | CRITICAL | 1.83.7 |
  | CVE-2026-49468 | CRITICAL | 1.84.0 |
  | CVE-2026-35029 | HIGH | 1.83.0 |
  | CVE-2026-40217 | HIGH | 1.83.10 |
  | CVE-2026-42203 | HIGH | 1.83.7 |
  | CVE-2026-42271 | HIGH | 1.83.7 |
  | CVE-2026-47101 | HIGH | 1.83.14 |
  | CVE-2026-47102 | HIGH | 1.83.10 |
  
`litellm` was pinned to `==1.82.5` because versions 1.82.6 - 1.82.8 had
a broken `litellm.caching.caching` import chain, and 1.88.0 had a broken
`litellm.integrations.custom_logger` import.
  Both issues are resolved in 1.84.0.
The exact pin is retained (rather than a range) due to litellm's history
of introducing regressions on minor bumps.

2026-07-28 00:25:05 +08:00

12 KiB

Raw Blame History

View Raw