PR #41: build(deps): bump the pip group across 4 directories with 14 updates

• Repository: HYOSUNG-ITX-AI-Business-Department/litellm
• Author: dependabot[bot]
• State: closed | merged: False
• Link: https://github.com/HYOSUNG-ITX-AI-Business-Department/litellm/pull/41

Description (problem / solution / changelog)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Changed files

• .circleci/requirements.txt (modified, +3/-3)
• cookbook/litellm-ollama-docker-image/requirements.txt (modified, +1/-1)
• docker/build_from_pip/requirements.txt (modified, +1/-1)
• poetry.lock (modified, +241/-306)
• pyproject.toml (modified, +1/-1)
• requirements.txt (modified, +1/-1)

---

PR #42: build(deps): bump the uv group across 2 directories with 4 updates

• Repository: HYOSUNG-ITX-AI-Business-Department/litellm
• Author: dependabot[bot]
• State: closed | merged: False
• Link: https://github.com/HYOSUNG-ITX-AI-Business-Department/litellm/pull/42

Description (problem / solution / changelog)

Bumps the uv group with 3 updates in the /.circleci directory: orjson, fastapi-sso and google-cloud-aiplatform. Bumps the uv group with 1 update in the /cookbook/litellm-ollama-docker-image directory: litellm.

Updates orjson from 3.10.12 to 3.11.6

<details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ijl/orjson/releases">orjson's releases</a>.</em></p> <blockquote> <h2>3.11.6</h2> <h3>Changed</h3> <ul> <li>orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).</li> <li>Drop support for Python 3.9.</li> <li>ABI compatibility with CPython 3.15 alpha 5.</li> <li>Build now depends on Rust 1.89 or later instead of 1.85.</li> </ul> <h3>Fixed</h3> <ul> <li>Fix sporadic crash serializing deeply nested <code>list</code> of <code>dict</code>.</li> </ul> <h2>3.11.5</h2> <h3>Changed</h3> <ul> <li>Show simple error message instead of traceback when attempting to build on unsupported Python versions.</li> </ul> <h2>3.11.4</h2> <h3>Changed</h3> <ul> <li>ABI compatibility with CPython 3.15 alpha 1.</li> <li>Publish PyPI wheels for 3.14 and manylinux i686, manylinux arm7, manylinux ppc64le, manylinux s390x.</li> <li>Build now requires a C compiler.</li> </ul> <h2>3.11.3</h2> <h3>Fixed</h3> <ul> <li>Fix PyPI project metadata when using maturin 1.9.2 or later.</li> </ul> <h2>3.11.2</h2> <h3>Fixed</h3> <ul> <li>Fix build using Rust 1.89 on amd64.</li> </ul> <h3>Changed</h3> <ul> <li>Build now depends on Rust 1.85 or later instead of 1.82.</li> </ul> <h2>3.11.1</h2> <h3>Changed</h3> <ul> <li>Publish PyPI wheels for CPython 3.14.</li> </ul> <h3>Fixed</h3> <ul> <li>Fix <code>str</code> on big-endian architectures.</li> </ul> <h2>3.11.0</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ijl/orjson/blob/master/CHANGELOG.md">orjson's changelog</a>.</em></p> <blockquote> <h2>3.11.6 - 2026-01-29</h2> <h3>Changed</h3> <ul> <li>orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).</li> <li>Drop support for Python 3.9.</li> <li>ABI compatibility with CPython 3.15 alpha 5.</li> <li>Build now depends on Rust 1.89 or later instead of 1.85.</li> </ul> <h3>Fixed</h3> <ul> <li>Fix sporadic crash serializing deeply nested <code>list</code> of <code>dict</code>.</li> </ul> <h2>3.11.5 - 2025-12-06</h2> <h3>Changed</h3> <ul> <li>Show simple error message instead of traceback when attempting to build on unsupported Python versions.</li> </ul> <h2>3.11.4 - 2025-10-24</h2> <h3>Changed</h3> <ul> <li>ABI compatibility with CPython 3.15 alpha 1.</li> <li>Publish PyPI wheels for 3.14 and manylinux i686, manylinux arm7, manylinux ppc64le, manylinux s390x.</li> <li>Build now requires a C compiler.</li> </ul> <h2>3.11.3 - 2025-08-26</h2> <h3>Fixed</h3> <ul> <li>Fix PyPI project metadata when using maturin 1.9.2 or later.</li> </ul> <h2>3.11.2 - 2025-08-12</h2> <h3>Fixed</h3> <ul> <li>Fix build using Rust 1.89 on amd64.</li> </ul> <h3>Changed</h3> <ul> <li>Build now depends on Rust 1.85 or later instead of 1.82.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ijl/orjson/commit/ec02024c3837255064f248c0d2d331319b75e9ad"><code>ec02024</code></a> 3.11.6</li> <li><a href="https://github.com/ijl/orjson/commit/d58168733189f82b3fd0c058dff73e05d09202e6"><code>d581687</code></a> build, clippy misc</li> <li><a href="https://github.com/ijl/orjson/commit/4105b29b2275f200f6fae01349bef02ccf1bc2e2"><code>4105b29</code></a> writer::num</li> <li><a href="https://github.com/ijl/orjson/commit/62bb185b70785ded49c79c26f8c9781f1e6fe370"><code>62bb185</code></a> Fix sporadic crash on serializing object close</li> <li><a href="https://github.com/ijl/orjson/commit/d860078a973f44401265c5c4ad12a7dbe4f839ad"><code>d860078</code></a> PyRef idiom refactors</li> <li><a href="https://github.com/ijl/orjson/commit/343ae2f148197918aba9f8562db42c364620e4b8"><code>343ae2f</code></a> Deserializer, Utf8Buffer</li> <li><a href="https://github.com/ijl/orjson/commit/7835f58d1c56947d1cf7a18acdfc07a2bca9b0f2"><code>7835f58</code></a> PyBytesRef and other input refactor</li> <li><a href="https://github.com/ijl/orjson/commit/71e0516424ce1e11613eb1780f18e8cde83989fd"><code>71e0516</code></a> PyStrRef</li> <li><a href="https://github.com/ijl/orjson/commit/1096df42dc585fde837ed0c930a346f5ef7dbb94"><code>1096df4</code></a> MSRV 1.89</li> <li><a href="https://github.com/ijl/orjson/commit/b718e75b8ba18a707c2b44b6de14d52547573771"><code>b718e75</code></a> Drop support for python3.9</li> <li>Additional commits viewable in <a href="https://github.com/ijl/orjson/compare/3.10.12...3.11.6">compare view</a></li> </ul> </details> <br />

Updates fastapi-sso from 0.16.0 to 0.19.0

<details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tomasvotava/fastapi-sso/releases">fastapi-sso's releases</a>.</em></p> <blockquote> <h2>0.19.0</h2> <p>️⚠️ A critical OAuth login CSRF vulnerability caused by missing <code>state</code> validation was reported by <a href="https://github.com/davidbors-snyk"><code>@​davidbors-snyk</code></a> (Snyk Security Labs) in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/issues/266">#266</a> and has been resolved in version <code>0.19.0</code>.</p> <p>Starting with <code>fastapi-sso==1.0.0</code>, OAuth <code>state</code> will be backed by a pluggable server-side store (in-memory by default, with support for external stores such as <code>Redis</code>).</p> <h2>What's Changed</h2> <ul> <li>chore(deps): bump the all group with 11 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/230">tomasvotava/fastapi-sso#230</a></li> <li>chore(deps): bump the all group with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/231">tomasvotava/fastapi-sso#231</a></li> <li>chore(deps): bump the all group with 6 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/232">tomasvotava/fastapi-sso#232</a></li> <li>chore(deps): bump the all group with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/233">tomasvotava/fastapi-sso#233</a></li> <li>chore(deps-dev): bump the all group with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/234">tomasvotava/fastapi-sso#234</a></li> <li>chore(deps-dev): bump the all group with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/235">tomasvotava/fastapi-sso#235</a></li> <li>chore(deps): bump the all group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/237">tomasvotava/fastapi-sso#237</a></li> <li>chore(deps): bump the all group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/239">tomasvotava/fastapi-sso#239</a></li> <li>chore(deps-dev): bump the all group across 1 directory with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/241">tomasvotava/fastapi-sso#241</a></li> <li>chore(deps): bump the all group with 5 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/242">tomasvotava/fastapi-sso#242</a></li> <li>chore(deps): bump the all group across 1 directory with 10 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/247">tomasvotava/fastapi-sso#247</a></li> <li>chore(deps-dev): bump the all group with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/248">tomasvotava/fastapi-sso#248</a></li> <li>chore(deps-dev): bump the all group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/251">tomasvotava/fastapi-sso#251</a></li> <li>chore(deps-dev): bump the all group with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/252">tomasvotava/fastapi-sso#252</a></li> <li>chore(deps-dev): bump the all group with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/253">tomasvotava/fastapi-sso#253</a></li> <li>chore(deps): bump the all group with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/254">tomasvotava/fastapi-sso#254</a></li> <li>chore(deps): bump the all group across 1 directory with 12 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/259">tomasvotava/fastapi-sso#259</a></li> <li>fix: enforce state validation by <a href="https://github.com/davidbors-snyk"><code>@​davidbors-snyk</code></a> in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/267">tomasvotava/fastapi-sso#267</a></li> <li>chore(deps): bump the all group across 1 directory with 7 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/265">tomasvotava/fastapi-sso#265</a></li> <li>docs(<a href="https://redirect.github.com/tomasvotava/fastapi-sso/issues/266">#266</a>): warn against using state as an arbitrary data transport by <a href="https://github.com/tomasvotava"><code>@​tomasvotava</code></a> in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/269">tomasvotava/fastapi-sso#269</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/davidbors-snyk"><code>@​davidbors-snyk</code></a> made their first contribution in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/267">tomasvotava/fastapi-sso#267</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tomasvotava/fastapi-sso/compare/0.18.0...0.19.0">https://github.com/tomasvotava/fastapi-sso/compare/0.18.0...0.19.0</a></p> <h2>0.18.0</h2> <h2>What's Changed</h2> <p><em>Removed support for python 3.8</em></p> <ul> <li>chore: add Python 3.13 to testing and linting workflows by <a href="https://github.com/tomasvotava"><code>@​tomasvotava</code></a> in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/226">tomasvotava/fastapi-sso#226</a></li> <li>chore: update Python version to 3.12 and improve documentation workflow by <a href="https://github.com/tomasvotava"><code>@​tomasvotava</code></a> in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/227">tomasvotava/fastapi-sso#227</a></li> <li>chore(deps-dev): bump the all group across 1 directory with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/228">tomasvotava/fastapi-sso#228</a></li> <li>feat:use id token for linkedin userinfo by <a href="https://github.com/tomasvotava"><code>@​tomasvotava</code></a> in <a href="https://redirect.github.com/tomasvotava/fastapi-sso/pull/229">tomasvotava/fastapi-sso#229</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tomasvotava/fastapi-sso/compare/0.17.0...0.18.0">https://github.com/tomasvotava/fastapi-sso/compare/0.17.0...0.18.0</a></p> <h2>0.17.0</h2> <h2>What's Changed</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tomasvotava/fastapi-sso/commit/c905eafe2d6d7aab5d2b929e53ba98f238fdb21d"><code>c905eaf</code></a> chore: 0.18.0 =&gt; 0.19.0</li> <li><a href="https://github.com/tomasvotava/fastapi-sso/commit/94343bf276bed9df0ed0b11fe00661fc65ac57e0"><code>94343bf</code></a> docs(<a href="https://redirect.github.com/tomasvotava/fastapi-sso/issues/266">#266</a>): warn against using state as an arbitrary data transport (<a href="https://redirect.github.com/tomasvotava/fastapi-sso/issues/269">#269</a>)</li> <li><a href="https://github.com/tomasvotava/fastapi-sso/commit/d057c1d4db151a180668a03784250315cdb0b1e9"><code>d057c1d</code></a> chore(deps): bump the all group across 1 directory with 7 updates (<a href="https://redirect.github.com/tomasvotava/fastapi-sso/issues/265">#265</a>)</li> <li><a href="https://github.com/tomasvotava/fastapi-sso/commit/6117d1a5ad498ba57d671e8a059ebe20db5abe02"><code>6117d1a</code></a> fix: enforce state validation (<a href="https://redirect.github.com/tomasvotava/fastapi-sso/issues/267">#267</a>)</li> <li><a href="https://github.com/tomasvotava/fastapi-sso/commit/da63c19bca7db0fe8a7e66d03fdf07154ec7182a"><code>da63c19</code></a> chore(deps): bump the all group across 1 directory with 12 updates (<a href="https://redirect.github.com/tomasvotava/fastapi-sso/issues/259">#259</a>)</li> <li><a href="https://github.com/tomasvotava/fastapi-sso/commit/0ccaeddf9e95a997a370ec312dc073f8f9920f38"><code>0ccaedd</code></a> chore(deps): bump the all group with 2 updates (<a href="https://redirect.github.com/tomasvotava/fastapi-sso/issues/254">#254</a>)</li> <li><a href="https://github.com/tomasvotava/fastapi-sso/commit/a43e62e67dfc40a2f9634bd932a2dfd02fe9e5b8"><code>a43e62e</code></a> chore(deps-dev): bump the all group with 2 updates (<a href="https://redirect.github.com/tomasvotava/fastapi-sso/issues/253">#253</a>)</li> <li><a href="https://github.com/tomasvotava/fastapi-sso/commit/8cd706d335e134504be46eab3404ff0ca3bdf6f9"><code>8cd706d</code></a> chore(deps-dev): bump the all group with 3 updates (<a href="https://redirect.github.com/tomasvotava/fastapi-sso/issues/252">#252</a>)</li> <li><a href="https://github.com/tomasvotava/fastapi-sso/commit/ea769fa223f5b665eb37b9cee998b19d49d52427"><code>ea769fa</code></a> chore(deps-dev): bump the all group across 1 directory with 3 updates (<a href="https://redirect.github.com/tomasvotava/fastapi-sso/issues/251">#251</a>)</li> <li><a href="https://github.com/tomasvotava/fastapi-sso/commit/7aba1e6ea408be1bce282fce7c3ba3da89e5e7b1"><code>7aba1e6</code></a> chore(deps-dev): bump the all group with 3 updates (<a href="https://redirect.github.com/tomasvotava/fastapi-sso/issues/248">#248</a>)</li> <li>Additional commits viewable in <a href="https://github.com/tomasvotava/fastapi-sso/compare/0.16.0...0.19.0">compare view</a></li> </ul> </details> <br />

Updates google-cloud-aiplatform from 1.43.0 to 1.133.0

<details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/python-aiplatform/releases">google-cloud-aiplatform's releases</a>.</em></p> <blockquote> <h2>v1.133.0</h2> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.132.0...v1.133.0">1.133.0</a> (2026-01-08)</h2> <h3>Features</h3> <ul> <li>Deprecate tuning public preview SDK in favor of tuning SDK (<a href="https://github.com/googleapis/python-aiplatform/commit/35d362ce8f6c50498f781857e0d8cabd327284be">35d362c</a>)</li> <li>GenAI SDK client - Enabling Few-shot Prompt Optimization by passing either &quot;OPTIMIZATION_TARGET_FEW_SHOT_RUBRICS&quot; or &quot;OPTIMIZATION_TARGET_FEW_SHOT_TARGET_RESPONSE&quot; to the <code>optimize_prompt</code> method (<a href="https://github.com/googleapis/python-aiplatform/commit/715cc5b71b996eecde2d97bad71a617274739dcc">715cc5b</a>)</li> <li>GenAI SDK client(memory): Add enable_third_person_memories (<a href="https://github.com/googleapis/python-aiplatform/commit/65717fa0c3d9b8c3105638cf9c75ee415f36b6e0">65717fa</a>)</li> <li>Support Developer Connect in AE (<a href="https://github.com/googleapis/python-aiplatform/commit/04f1771e16f54a0627ecac1266764ca77f833694">04f1771</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Add None check for agent_info in evals.py (<a href="https://github.com/googleapis/python-aiplatform/commit/c8c0f0f7eb67696c2e91902af7e6dca20cea2040">c8c0f0f</a>)</li> <li>GenAI client(evals) - Fix TypeError in _build_generate_content_config (<a href="https://github.com/googleapis/python-aiplatform/commit/be2eaaa30dbf13a86f6856771eeacd2a51a97806">be2eaaa</a>)</li> <li>Make project_number to project_id mapping fail-open. (<a href="https://github.com/googleapis/python-aiplatform/commit/f1c8458dd5e4641cb03ff175f0837b6d6017c131">f1c8458</a>)</li> <li>Replace asyncio.run with create_task in ADK async thread mains. (<a href="https://github.com/googleapis/python-aiplatform/commit/83f4076706d808dcc0e1784219856846540e10da">83f4076</a>)</li> <li>Replace asyncio.run with create_task in ADK async thread mains. (<a href="https://github.com/googleapis/python-aiplatform/commit/8c876ef069d0fe6942790ede41e203196cd4a390">8c876ef</a>)</li> <li>Require uri or staging bucket configuration for saving model to Vertex Experiment. (<a href="https://github.com/googleapis/python-aiplatform/commit/5448f065fa30d77c2ee0868249ec0bea6a93a4c0">5448f06</a>)</li> <li>Return embedding metadata if available (<a href="https://github.com/googleapis/python-aiplatform/commit/d9c6eb199b6ccc1fae417463e1b374574f2ae2f8">d9c6eb1</a>)</li> <li>Update <code>examples_dataframe</code> type to <code>PandasDataFrame</code> in Prompt Optimizer. (<a href="https://github.com/googleapis/python-aiplatform/commit/a2564cc3ea5c4860ee732f14cea9db2c10b52420">a2564cc</a>)</li> </ul> <h2>v1.132.0</h2> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.131.0...v1.132.0">1.132.0</a> (2025-12-17)</h2> <h3>Features</h3> <ul> <li>Add Lustre support to the Vertex Training Custom Job API (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>A comment for field <code>restart_job_on_worker_restart</code> in message <code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is changed (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> <li>A comment for field <code>timeout</code> in message <code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is changed (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> </ul> <h2>v1.131.0</h2> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.130.0...v1.131.0">1.131.0</a> (2025-12-16)</h2> <h3>Features</h3> <ul> <li>Allow list of events to be passed to AdkApp.async_stream_query (<a href="https://github.com/googleapis/python-aiplatform/commit/dd8840a5012b2762f8b8971b6cea4302ac5c648d">dd8840a</a>)</li> <li>GenAI Client(evals) - Support CustomCodeExecution metric in Vertex Gen AI Eval Service (<a href="https://github.com/googleapis/python-aiplatform/commit/4114728750b5b12f991a18df87c1f1a570d1b29d">4114728</a>)</li> <li>Updates the ADK template to direct structured JSON logs to standard output. (<a href="https://github.com/googleapis/python-aiplatform/commit/a65ec297c5b8d99e4d2dfb49473c189197198f97">a65ec29</a>)</li> </ul> <h3>Bug Fixes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/python-aiplatform/blob/main/CHANGELOG.md">google-cloud-aiplatform's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.132.0...v1.133.0">1.133.0</a> (2026-01-08)</h2> <h3>Features</h3> <ul> <li>Deprecate tuning public preview SDK in favor of tuning SDK (<a href="https://github.com/googleapis/python-aiplatform/commit/35d362ce8f6c50498f781857e0d8cabd327284be">35d362c</a>)</li> <li>GenAI SDK client - Enabling Few-shot Prompt Optimization by passing either &quot;OPTIMIZATION_TARGET_FEW_SHOT_RUBRICS&quot; or &quot;OPTIMIZATION_TARGET_FEW_SHOT_TARGET_RESPONSE&quot; to the <code>optimize_prompt</code> method (<a href="https://github.com/googleapis/python-aiplatform/commit/715cc5b71b996eecde2d97bad71a617274739dcc">715cc5b</a>)</li> <li>GenAI SDK client(memory): Add enable_third_person_memories (<a href="https://github.com/googleapis/python-aiplatform/commit/65717fa0c3d9b8c3105638cf9c75ee415f36b6e0">65717fa</a>)</li> <li>Support Developer Connect in AE (<a href="https://github.com/googleapis/python-aiplatform/commit/04f1771e16f54a0627ecac1266764ca77f833694">04f1771</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Add None check for agent_info in evals.py (<a href="https://github.com/googleapis/python-aiplatform/commit/c8c0f0f7eb67696c2e91902af7e6dca20cea2040">c8c0f0f</a>)</li> <li>GenAI client(evals) - Fix TypeError in _build_generate_content_config (<a href="https://github.com/googleapis/python-aiplatform/commit/be2eaaa30dbf13a86f6856771eeacd2a51a97806">be2eaaa</a>)</li> <li>Make project_number to project_id mapping fail-open. (<a href="https://github.com/googleapis/python-aiplatform/commit/f1c8458dd5e4641cb03ff175f0837b6d6017c131">f1c8458</a>)</li> <li>Replace asyncio.run with create_task in ADK async thread mains. (<a href="https://github.com/googleapis/python-aiplatform/commit/83f4076706d808dcc0e1784219856846540e10da">83f4076</a>)</li> <li>Replace asyncio.run with create_task in ADK async thread mains. (<a href="https://github.com/googleapis/python-aiplatform/commit/8c876ef069d0fe6942790ede41e203196cd4a390">8c876ef</a>)</li> <li>Require uri or staging bucket configuration for saving model to Vertex Experiment. (<a href="https://github.com/googleapis/python-aiplatform/commit/5448f065fa30d77c2ee0868249ec0bea6a93a4c0">5448f06</a>)</li> <li>Return embedding metadata if available (<a href="https://github.com/googleapis/python-aiplatform/commit/d9c6eb199b6ccc1fae417463e1b374574f2ae2f8">d9c6eb1</a>)</li> <li>Update <code>examples_dataframe</code> type to <code>PandasDataFrame</code> in Prompt Optimizer. (<a href="https://github.com/googleapis/python-aiplatform/commit/a2564cc3ea5c4860ee732f14cea9db2c10b52420">a2564cc</a>)</li> </ul> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.131.0...v1.132.0">1.132.0</a> (2025-12-17)</h2> <h3>Features</h3> <ul> <li>Add Lustre support to the Vertex Training Custom Job API (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> <li>Add Lustre support to the Vertex Training Custom Job API (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>A comment for field <code>restart_job_on_worker_restart</code> in message <code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is changed (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> <li>A comment for field <code>timeout</code> in message <code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is changed (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> </ul> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.130.0...v1.131.0">1.131.0</a> (2025-12-16)</h2> <h3>Features</h3> <ul> <li>Allow list of events to be passed to AdkApp.async_stream_query (<a href="https://github.com/googleapis/python-aiplatform/commit/dd8840a5012b2762f8b8971b6cea4302ac5c648d">dd8840a</a>)</li> <li>GenAI Client(evals) - Support CustomCodeExecution metric in Vertex Gen AI Eval Service (<a href="https://github.com/googleapis/python-aiplatform/commit/4114728750b5b12f991a18df87c1f1a570d1b29d">4114728</a>)</li> <li>Updates the ADK template to direct structured JSON logs to standard output. (<a href="https://github.com/googleapis/python-aiplatform/commit/a65ec297c5b8d99e4d2dfb49473c189197198f97">a65ec29</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Fix RagManagedVertexVectorSearch when using backend_config (<a href="https://github.com/googleapis/python-aiplatform/commit/df0976ed3195dc8313f4728bc5ecb29dda55d467">df0976e</a>)</li> <li>GenAI Client(evals) - patch for vulnerability in visualization (<a href="https://github.com/googleapis/python-aiplatform/commit/8a00d43dbd24e95dbab6ea32c63ce0a5a1849480">8a00d43</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/python-aiplatform/commit/78f2bdd08bae0696923e61ab73080b5846c67ae0"><code>78f2bdd</code></a> chore(main): release 1.133.0 (<a href="https://redirect.github.com/googleapis/python-aiplatform/issues/6211">#6211</a>)</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/c8c0f0f7eb67696c2e91902af7e6dca20cea2040"><code>c8c0f0f</code></a> fix: Add None check for agent_info in evals.py</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/9952b970b73cfe38e68c48b3699ee4e1df0264df"><code>9952b97</code></a> chore: rollback</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/83f4076706d808dcc0e1784219856846540e10da"><code>83f4076</code></a> fix: Replace asyncio.run with create_task in ADK async thread mains.</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/937d5af6b9bdbbe3b50181745c99550f124ad8b4"><code>937d5af</code></a> Copybara import of the project:</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/aaaf902be02747cd2281196aad6278df0fd11f7e"><code>aaaf902</code></a> chore: bump google-auth lower bound to 2.47.0 in GenAI and Vertex SDKs</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/8c876ef069d0fe6942790ede41e203196cd4a390"><code>8c876ef</code></a> fix: Replace asyncio.run with create_task in ADK async thread mains.</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/5448f065fa30d77c2ee0868249ec0bea6a93a4c0"><code>5448f06</code></a> fix: Require uri or staging bucket configuration for saving model to Vertex E...</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/65717fa0c3d9b8c3105638cf9c75ee415f36b6e0"><code>65717fa</code></a> feat: GenAI SDK client(memory): Add enable_third_person_memories</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/be2eaaa30dbf13a86f6856771eeacd2a51a97806"><code>be2eaaa</code></a> fix: GenAI client(evals) - Fix TypeError in _build_generate_content_config</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/python-aiplatform/compare/v1.43.0...v1.133.0">compare view</a></li> </ul> </details> <br />

Updates litellm from 1.61.15 to 1.83.0

<details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/BerriAI/litellm/releases">litellm's releases</a>.</em></p> <blockquote> <h2>litellm-trace-dev-v1.81.16</h2> <h2>What's Changed</h2> <ul> <li>feat(vertex): add gemini-3.1-flash-image-preview to model DB by <a href="https://github.com/emerzon"><code>@​emerzon</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22223">BerriAI/litellm#22223</a></li> <li>perf(spendlogs): optimize old spendlog deletion cron job by <a href="https://github.com/Harshit28j"><code>@​Harshit28j</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/21930">BerriAI/litellm#21930</a></li> <li>Fix converse handling for parallel_tool_calls by <a href="https://github.com/Sameerlite"><code>@​Sameerlite</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22267">BerriAI/litellm#22267</a></li> <li>[Fix]Preserve forwarding server side called tools by <a href="https://github.com/Sameerlite"><code>@​Sameerlite</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22260">BerriAI/litellm#22260</a></li> <li>Fix free models working from UI by <a href="https://github.com/Sameerlite"><code>@​Sameerlite</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22258">BerriAI/litellm#22258</a></li> <li>Add v1 for anthropic responses transformation by <a href="https://github.com/Sameerlite"><code>@​Sameerlite</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22087">BerriAI/litellm#22087</a></li> <li>[Bug]Add ChatCompletionImageObject in OpenAIChatCompletionAssistantMessage by <a href="https://github.com/Sameerlite"><code>@​Sameerlite</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22155">BerriAI/litellm#22155</a></li> <li>Fix: poetry lock by <a href="https://github.com/Sameerlite"><code>@​Sameerlite</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22293">BerriAI/litellm#22293</a></li> <li>Enable local file support for OCR by <a href="https://github.com/noahnistler"><code>@​noahnistler</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22133">BerriAI/litellm#22133</a></li> <li>fix(mcp): Strip stale mcp-session-id to prevent 400 errors across proxy workers by <a href="https://github.com/gavksingh"><code>@​gavksingh</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/21417">BerriAI/litellm#21417</a></li> <li>[Feature] Access group CRUD: Bidirectional team/key sync by <a href="https://github.com/yuneng-jiang"><code>@​yuneng-jiang</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22253">BerriAI/litellm#22253</a></li> <li>Add LLMClientCache regression tests for httpx client eviction safety by <a href="https://github.com/ryan-crabbe"><code>@​ryan-crabbe</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22306">BerriAI/litellm#22306</a></li> <li>feat(models): add gpt-audio-1.5 to model cost map by <a href="https://github.com/Chesars"><code>@​Chesars</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22303">BerriAI/litellm#22303</a></li> <li>feat(models): add gpt-realtime-1.5 to model cost map by <a href="https://github.com/Chesars"><code>@​Chesars</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22304">BerriAI/litellm#22304</a></li> <li>fix(models): function calling for PublicAI Apertus models by <a href="https://github.com/Chesars"><code>@​Chesars</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/21582">BerriAI/litellm#21582</a></li> <li>Tests: add llmclientcache regression tests by <a href="https://github.com/ryan-crabbe"><code>@​ryan-crabbe</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22313">BerriAI/litellm#22313</a></li> <li>Add deprecation dates for xAI grok-2-vision-1212 and grok-3-mini models by <a href="https://github.com/Chesars"><code>@​Chesars</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/20102">BerriAI/litellm#20102</a></li> <li>feat(model_prices): add OpenRouter native models to model cost map by <a href="https://github.com/Chesars"><code>@​Chesars</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/20520">BerriAI/litellm#20520</a></li> <li>docs: add OpenRouter Opus 4.6 to model map and update Claude Opus 4.6 docs by <a href="https://github.com/Chesars"><code>@​Chesars</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/20525">BerriAI/litellm#20525</a></li> <li>[Fix] Include timestamps in /project/list response by <a href="https://github.com/yuneng-jiang"><code>@​yuneng-jiang</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22323">BerriAI/litellm#22323</a></li> <li>[Feature] UI - Projects: Add Projects page with list and create flows by <a href="https://github.com/yuneng-jiang"><code>@​yuneng-jiang</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22315">BerriAI/litellm#22315</a></li> <li>Fix/claude code plugin schema by <a href="https://github.com/rahulrd25"><code>@​rahulrd25</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22271">BerriAI/litellm#22271</a></li> <li>Add Prometheus child_exit cleanup for gunicorn workers by <a href="https://github.com/ryan-crabbe"><code>@​ryan-crabbe</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22324">BerriAI/litellm#22324</a></li> <li>docs: update AssemblyAI docs with Universal-3 Pro, Speech Understanding, and LLM Gateway by <a href="https://github.com/dylan-duan-aai"><code>@​dylan-duan-aai</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/21130">BerriAI/litellm#21130</a></li> <li>feat: add in_flight_requests metric to /health/backlog + prometheus by <a href="https://github.com/ishaan-jaff"><code>@​ishaan-jaff</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22319">BerriAI/litellm#22319</a></li> <li>fix(test): update realtime guardrail test assertions for voice violation behavior by <a href="https://github.com/jquinter"><code>@​jquinter</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22332">BerriAI/litellm#22332</a></li> <li>fix(test): update Azure pass-through test after Responses API routing change by <a href="https://github.com/jquinter"><code>@​jquinter</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22334">BerriAI/litellm#22334</a></li> <li>fix(db): add missing migration for LiteLLM_ClaudeCodePluginTable by <a href="https://github.com/jquinter"><code>@​jquinter</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22335">BerriAI/litellm#22335</a></li> <li>fix(bedrock): restore parallel_tool_calls mapping in map_openai_params by <a href="https://github.com/jquinter"><code>@​jquinter</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22333">BerriAI/litellm#22333</a></li> <li>[Feat] Agent RBAC Permission Fix - Ensure Internal Users cannot create agents by <a href="https://github.com/ishaan-jaff"><code>@​ishaan-jaff</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22329">BerriAI/litellm#22329</a></li> <li>fix(mcp): update test mocks for renamed filter_server_ids_by_ip_with_info by <a href="https://github.com/jquinter"><code>@​jquinter</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22327">BerriAI/litellm#22327</a></li> <li>fix: Add PROXY_ADMIN role to system user for key rotation by <a href="https://github.com/milan-berri"><code>@​milan-berri</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/21896">BerriAI/litellm#21896</a></li> <li>fix: populate user_id and user_info for admin users in /user/info by <a href="https://github.com/milan-berri"><code>@​milan-berri</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22239">BerriAI/litellm#22239</a></li> <li>fix(caching): store task references in LLMClientCache._remove_key by <a href="https://github.com/shivaaang"><code>@​shivaaang</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22143">BerriAI/litellm#22143</a></li> <li>fix(image_generation): propagate extra_headers to Upstream by <a href="https://github.com/ZeroClover"><code>@​ZeroClover</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22026">BerriAI/litellm#22026</a></li> <li>[Fix] Pass MCP auth headers from request into tool fetch for /v1/responses and chat completions by <a href="https://github.com/shivamrawat1"><code>@​shivamrawat1</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22291">BerriAI/litellm#22291</a></li> <li>fix: shorten guardrail benchmark result filenames for Windows long path support by <a href="https://github.com/demoray"><code>@​demoray</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22039">BerriAI/litellm#22039</a></li> <li>Remove Apache 2 license from SKILL.md by <a href="https://github.com/rasmi"><code>@​rasmi</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22322">BerriAI/litellm#22322</a></li> <li>fix(mcp): default available_on_public_internet to true by <a href="https://github.com/ishaan-jaff"><code>@​ishaan-jaff</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22331">BerriAI/litellm#22331</a></li> <li>fix(bedrock): filter internal json_tool_call when mixed with real tools by <a href="https://github.com/jquinter"><code>@​jquinter</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/21107">BerriAI/litellm#21107</a></li> <li>fix(jwt): OIDC discovery URLs, roles array handling, dot-notation error hints by <a href="https://github.com/ishaan-jaff"><code>@​ishaan-jaff</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22336">BerriAI/litellm#22336</a></li> <li>perf: streaming latency improvements — 4 targeted hot-path fixes by <a href="https://github.com/ishaan-jaff"><code>@​ishaan-jaff</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22346">BerriAI/litellm#22346</a></li> <li>[Test] UI - CostTrackingSettings: Add comprehensive Vitest coverage by <a href="https://github.com/yuneng-jiang"><code>@​yuneng-jiang</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22354">BerriAI/litellm#22354</a></li> <li>[Feature] Key list endpoint: Add project_id and access_group_id filters by <a href="https://github.com/yuneng-jiang"><code>@​yuneng-jiang</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22356">BerriAI/litellm#22356</a></li> <li>[Feature] UI - Projects: Add Project Details Page by <a href="https://github.com/yuneng-jiang"><code>@​yuneng-jiang</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22360">BerriAI/litellm#22360</a></li> <li>[Feature] UI - Projects: Add project keys table and project dropdown to key create/edit by <a href="https://github.com/yuneng-jiang"><code>@​yuneng-jiang</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22373">BerriAI/litellm#22373</a></li> <li>Litellm health check tokens by <a href="https://github.com/Harshit28j"><code>@​Harshit28j</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22299">BerriAI/litellm#22299</a></li> <li>Doc: security vulnerability scan report to v1.81.14 release notes by <a href="https://github.com/Harshit28j"><code>@​Harshit28j</code></a> in <a href="https://redirect.github.com/BerriAI/litellm/pull/22385">BerriAI/litellm#22385</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/BerriAI/litellm/commits">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Changed files

• .circleci/requirements.txt (modified, +3/-3)
• cookbook/litellm-ollama-docker-image/requirements.txt (modified, +1/-1)

---

PR #13819: Fix CVE-2026-35030: Update litellm to 1.83.0

• Repository: OpenHands/OpenHands
• Author: aivong-openhands
• State: closed | merged: False
• Link: https://github.com/OpenHands/OpenHands/pull/13819

Description (problem / solution / changelog)

Security Fix for CVE-2026-35030

This PR updates the litellm package from version 1.80.10 to 1.83.0 to address the security vulnerability CVE-2026-35030.

Changes Made

• Added [tool.uv] section in pyproject.toml with override-dependencies to force litellm>=1.83.0
• This overrides the transitive dependency constraint from openhands-sdk==1.16.1
• Updated comment in pyproject.toml to document the CVE fix
• uv.lock updated to use litellm 1.83.0

Technical Notes

The openhands-sdk==1.16.1 package has a hard pin on litellm==1.80.10. This PR uses uv's override-dependencies feature to force the upgraded version in environments using uv.

Poetry lockfiles cannot be updated due to this hard constraint in openhands-sdk. Once openhands-sdk is updated to support litellm>=1.83.0, the Poetry lockfiles can be updated as well.

Testing

• uv.lock properly resolves to litellm 1.83.0

---

This PR was created by an AI assistant (OpenHands) to address a security vulnerability.

---

To run this PR locally, use the following command:

GUI with Docker:

Changed files

• pyproject.toml (modified, +5/-1)
• uv.lock (modified, +7/-5)