From 877ce7e4305ba15705bd8661f65e4bf0fa2421ce Mon Sep 17 00:00:00 2001
From: ameobius <ameobius@local>
Date: Wed, 5 Aug 2026 21:16:40 +0300
Subject: [PATCH 1/2] pin litellm>=1.83.7,<2.0.0: CVE-2026-42271 fixed in
 1.83.7; the range also excludes the PYSEC-2026-2 compromised 1.82.7/1.82.8
 releases

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 8370ec6..676d177 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -14,7 +14,7 @@ authors = [
 ]
 
 dependencies = [
-    "litellm>=1.70.0,<1.82.7",  # pinned to avoid PYSEC-2026-2 supply-chain compromise (1.82.7/1.82.8 were malicious)
+    "litellm>=1.83.7,<2.0.0",  # CVE-2026-42271 fixed in 1.83.7; also excludes PYSEC-2026-2 malicious 1.82.7/1.82.8
     "python-dotenv>=1.0.0",
     "openai>=1.0.0",
     "jsonschema>=4.25.0",

From 99e1b0f173083677081b535bda56463275dd9fe5 Mon Sep 17 00:00:00 2001
From: ameobius <ameobius@local>
Date: Wed, 5 Aug 2026 21:20:10 +0300
Subject: [PATCH 2/2] pin mcp<2: 2.0 removed mcp.server.fastmcp

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 676d177..f198f49 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -19,7 +19,7 @@ dependencies = [
     "openai>=1.0.0",
     "jsonschema>=4.25.0",
     "bashlex>=0.18",
-    "mcp>=1.0.0",
+    "mcp>=1.0.0,<2.0.0",  # 2.0 removed mcp.server.fastmcp which server.py imports
     "anthropic>=0.71.0",
     "pillow>=12.0.0",
     "numpy>=1.24.0",