[pierlj]

Description

Exclude litellm 1.107.0 version.
https://www.litellm.ai/blog?post=security-incident-oct-21-2026

Related Issue

Type of Change

• 📚 Examples / docs / tutorials / dependencies update
• 🔧 Bug fix (non-breaking change which fixes an issue)
• 🥂 Improvement (non-breaking change which improves an existing feature)
• 🚀 New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• 🔐 Security fix

Coding agents

Autonomous agents with no human in the loop must read AUTONOMOUS.md before opening a PR.

PR title: agent-opened PRs must end the title with 🤖🤖🤖🤖 (exactly four robot emojis). Do not omit — that suffix is how the expedited agent PR workflow picks up the PR.

Checklist

• I've read the CODE_OF_CONDUCT.md document.
• I've read the CONTRIBUTING.md guide.
• I've written tests for all new methods and classes that I created.
• I've written the docstring in NumPy format for all the methods and classes that I created or modified.
• I've updated the uv.lock running uv lock (only applicable when pyproject.toml has been
  modified)

[Inokinoki]

Good catch, oss users do not have renovate rule and might be affected

LGTM, let's see if CI passes

[Inokinoki]

Let's fix the certificate-related fix as well:

Found 1 known vulnerability, ignored 1 in 1 package
Name    Version   ID              Fix Versions
------- --------- --------------- ------------
certifi 2026.6.17 PYSEC-2026-4320 2026.10.19

This should be related to the eMudhra certificates incident and could affect the PYPI deps

[Inokinoki]

Adding a restriction for certifi here should work

[kevinmessiaen]

Excludes litellm 1.107.0, the only version compromised on Oct 21 (removed from PyPI); >=1.83.0 already covers the March 1.82.7/1.82.8 incident. Lock stays on 1.89.7 and uv lock --check passes. LGTM.

---

Generated by Claude Code