Update Litellm dependencies to avoid supply chain attacks (#47)

* feat: add uv tool configuration to manage dependency cooldowns and constraints for litellm

* fix: update litellm dependency to exclude vulnerable versions and update google-adk version

Author: myui

pyproject.toml

@@ -12,7 +12,7 @@ dependencies = [
     "cachetools>=5.3.2",
     "jinja2>=3.1.6",
     "python-dotenv>=1.1.1",
-    "litellm>=1.79.1", # 1.72.6+ required for langfuse_otel callback
+    "litellm>=1.79.1,!=1.82.7,!=1.82.8", # 1.72.6+ required for langfuse_otel callback, excluded 1.82.(7|8) to avoid supply chain attack
     "pydantic>=2.10.0",
     "pyyaml>=6.0.3",
 ]
@@ -66,7 +66,7 @@ visualization = [
     "pygraphviz>=1.14",
 ]
 adk = [
-    "google-adk>=1.17.0",
+    "google-adk>=v1.28.0",  # see https://github.com/google/adk-python/commit/77f1c41be61eed017b008d7ab311923e30b46643
     "nest-asyncio>=1.6.0",  # required by google-adk for nested event loops
     "wrapt>=1.17.3",        # required for ADK monkey patches
     "openinference-instrumentation-google-adk>=0.1.0",
@@ -103,6 +103,11 @@ all = [
 ]
 
 
+[tool.uv]
+# https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns
+exclude-newer = "1 week"
+exclude-newer-package = { setuptools = "30 days" }
+
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"