fix(deps): bump litellm to >=1.83.7 (CVE-2026-35029, CVE-2026-35030, CVE-2026-40217, CVE-2026-42271)

GHSA-53mr-6c8q-9789
GHSA-jjhc-v7c2-5hh6
GHSA-wxxx-gvqv-xp7p
GHSA-v4p8-mg3p-g94g

Only applies to release-0.4.x; litellm removed on main and release-0.7.x.

Signed-off-by: Matthew F Leader <mleader@redhat.com>

Author: mfleader

src/llama_stack/providers/registry/inference.py

@@ -279,7 +279,7 @@ def available_providers() -> list[ProviderSpec]:
             api=Api.inference,
             adapter_type="watsonx",
             provider_type="remote::watsonx",
-            pip_packages=["litellm"],
+            pip_packages=["litellm>=1.83.7"],
             module="llama_stack.providers.remote.inference.watsonx",
             config_class="llama_stack.providers.remote.inference.watsonx.WatsonXConfig",
             provider_data_validator="llama_stack.providers.remote.inference.watsonx.config.WatsonXProviderDataValidator",

src/llama_stack/providers/registry/safety.py

@@ -69,7 +69,7 @@ def available_providers() -> list[ProviderSpec]:
             api=Api.safety,
             adapter_type="sambanova",
             provider_type="remote::sambanova",
-            pip_packages=["litellm", "requests"],
+            pip_packages=["litellm>=1.83.7", "requests"],
             module="llama_stack.providers.remote.safety.sambanova",
             config_class="llama_stack.providers.remote.safety.sambanova.SambaNovaSafetyConfig",
             provider_data_validator="llama_stack.providers.remote.safety.sambanova.config.SambaNovaProviderDataValidator",