fix(security): pin litellm<=1.82.6 to mitigate supply chain attack

[drewdrewthis]

Summary

• Pins litellm<=1.82.6 in python/pyproject.toml to block compromised versions 1.82.7–1.82.8
• litellm was compromised via PyPI account takeover by TeamPCP (same group behind the Trivy compromise)
• Malicious versions contain .pth auto-execution payload targeting crypto wallets and API keys
• Our lockfile already pins 1.81.13 (safe), but the open >=1.49.0 range would pull malicious versions on a fresh resolve

Impact assessment

This project was NOT compromised. Our uv.lock pins litellm at 1.81.13, which predates the malicious versions (1.82.7–1.82.8). This pin is a preventive measure to ensure no future resolve can pull the affected versions.

CI status

CI failure is expected. PyPI has quarantined the entire litellm package (all versions, not just the malicious ones). Since this PR changes pyproject.toml, uv run tries to re-resolve against PyPI and fails. This is transient — once PyPI restores the safe versions, the lockfile can be regenerated and CI will pass. Note: main would also fail if any change triggered python-ci.yml right now.

To merge: regenerate uv.lock after PyPI restores litellm, then push.

Test plan

• Regenerate uv.lock once PyPI restores litellm (run uv lock in python/)
• Verify CI passes after lockfile update
• Remove <=1.82.6 pin once litellm publishes a verified clean release

Ref: https://news.ycombinator.com/item?id=47501729

🤖 Generated with Claude Code

[github-actions]

Automated low-risk assessment

This PR was evaluated against the repository's Low-Risk Pull Requests procedure and does not qualify as low risk.

This PR tightens a third‑party dependency constraint in python/pyproject.toml by pinning litellm<=1.82.6 to avoid compromised versions 1.82.7–1.82.8. Because it changes how we resolve and integrate an external package (a supply‑chain/security‑sensitive dependency), it falls under changes to integrations with third‑party systems and does not meet the low‑risk criteria. Please route this through the normal review/security process or use the firefighting label if this is an urgent emergency fix.

This PR requires a manual review before merging.