fix: pin liteLLM upper bound to 1.82.6 to mitigate supply chain attack

[gn00295120]

Summary

liteLLM versions 1.82.7 and 1.82.8 were compromised by the TeamPCP group via a supply chain attack through Trivy. The current dependency constraint allows these malicious versions to be installed.

Impact

The compromised versions steal sensitive credentials including SSH keys, AWS/GCP/K8s credentials, CI/CD tokens, and environment variables. Version 1.82.8 installs a .pth persistence mechanism that executes on every Python startup — even after liteLLM is uninstalled.

Fix

This PR pins the upper bound of the liteLLM dependency to <=1.82.6, which is the last known safe version before the compromise. Once BerriAI publishes a verified clean release, this upper bound can be raised.

References

• BerriAI/litellm#24512 — Incident report
• Wiz.io Analysis — Attack chain analysis
• OSV: MAL-2026-2144 — Advisory

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gn00295120]

CLA done