LCORE-2036: Fixed CVE in LiteLLM

[tisnik]

Description

LCORE-2036: Fixed CVE in LiteLLM

Type of change

• Refactor
• New feature
• Bug fix
• CVE fix
• Optimization
• Documentation Update
• Configuration Update
• Bump-up service version
• Bump-up dependent library
• Bump-up library or tool used for development (does not change the final image)
• CI configuration change
• Konflux configuration change
• Unit tests improvement
• Integration tests improvement
• End to end tests improvement
• Benchmarks improvement

Tools used to create PR

• Assisted-by: N/A
• Generated by: N/A

Related Tickets & Documents

• Related Issue #LCORE-2036

Summary by CodeRabbit

• Chores
  • Updated pinned dependencies to the latest patch versions for improved stability and security.

[coderabbitai]

Warning

Rate limit exceeded

@tisnik has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 34 minutes and 40 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: b60e35f3-6625-4ecd-82f9-e0d440a03e6e

📥 Commits

Reviewing files that changed from the base of the PR and between 713819c and 0116fc9.

📒 Files selected for processing (1)

• .konflux/requirements.hashes.source.txt

Walkthrough

Updated the litellm dependency pin from version 1.83.7 to 1.83.10 in .konflux/requirements.hashes.source.txt, with the lock file hash set regenerated by uv pip compile.

Changes

litellm version bump

Layer / File(s)	Summary
litellm version pin update .konflux/requirements.hashes.source.txt	litellm pinned version and hash updated from 1.83.7 to 1.83.10 in the autogenerated Konflux requirements lock file.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• lightspeed-core/lightspeed-stack#1477: Both PRs regenerate litellm entries in the Konflux requirements hash file for different litellm versions.
• lightspeed-core/lightspeed-stack#1585: Both PRs update the pinned litellm version, with this PR bumping to 1.83.10 and the related PR to 1.83.7.
• lightspeed-core/lightspeed-stack#1466: Both PRs update the pinned litellm dependency to a newer version.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly indicates a CVE fix in LiteLLM, which aligns with the PR's stated objective to address LCORE-2036 by fixing a CVE in LiteLLM.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.konflux/requirements.hashes.source.txt:
- Around line 512-514: The pinned dependency line for litellm (the literal entry
"litellm==1.83.10") must be updated to a patched release (at least 1.83.11,
preferably 1.83.14) to address the sandbox escape CVE (CVE-2026-40217); update
the version specifier from "litellm==1.83.10" to "litellm==1.83.11" (or latest
1.83.14) and replace the accompanying --hash values with the correct SHA256
hashes for that chosen version so the lock file reflects the patched release and
its integrity hashes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 224aa88e-b5f2-4af8-b332-86fe29fe11b3

📥 Commits

Reviewing files that changed from the base of the PR and between 5493bec and 713819c.

📒 Files selected for processing (1)

• .konflux/requirements.hashes.source.txt

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (17)

• GitHub Check: spectral
• GitHub Check: Pylinter
• GitHub Check: radon
• GitHub Check: bandit
• GitHub Check: unit_tests (3.13)
• GitHub Check: build-pr
• GitHub Check: integration_tests (3.12)
• GitHub Check: integration_tests (3.13)
• GitHub Check: Pyright
• GitHub Check: Konflux kflux-prd-rh02 / lightspeed-stack-on-pull-request
• GitHub Check: E2E: library mode / ci / group 3
• GitHub Check: E2E: server mode / ci / group 2
• GitHub Check: E2E: server mode / ci / group 1
• GitHub Check: E2E: library mode / ci / group 1
• GitHub Check: E2E: server mode / ci / group 3
• GitHub Check: E2E: library mode / ci / group 2
• GitHub Check: E2E Tests for Lightspeed Evaluation job

[tisnik]

/retest