fix(security): upgrade python-multipart from 0.0.18 to 0.0.22

Addresses GHSA-wp53-j4wj-2cfg (CVE with CVSS 8.6) - Arbitrary File Write vulnerability. Updated python-multipart to version 0.0.22 which includes the security fix.

.github/workflows/test-litellm.yml

@@ -34,7 +34,7 @@ jobs:
         poetry run pip install "google-genai==1.22.0"
         poetry run pip install "google-cloud-aiplatform>=1.38"
         poetry run pip install "fastapi-offline==1.7.3"
-        poetry run pip install "python-multipart==0.0.18"
+        poetry run pip install "python-multipart==0.0.22"
         poetry run pip install "openapi-core"
     - name: Setup litellm-enterprise as local package
       run: |

poetry.lock

@@ -5719,15 +5719,15 @@ cli = ["click (>=5.0)"]
 
 [[package]]
 name = "python-multipart"
-version = "0.0.18"
+version = "0.0.22"
 description = "A streaming multipart parser for Python"
 optional = true
 python-versions = ">=3.8"
 groups = ["main"]
 markers = "extra == \"proxy\""
 files = [
-    {file = "python_multipart-0.0.18-py3-none-any.whl", hash = "sha256:efe91480f485f6a361427a541db4796f9e1591afc0fb8e7a4ba06bfbc6708996"},
-    {file = "python_multipart-0.0.18.tar.gz", hash = "sha256:7a68db60c8bfb82e460637fa4750727b45af1d5e2ed215593f917f64694d34fe"},
+    {file = "python_multipart-0.0.22-py3-none-any.whl", hash = "sha256:2b2cd894c83d21bf49d702499531c7bafd057d730c201782048f7945d82de155"},
+    {file = "python_multipart-0.0.22.tar.gz", hash = "sha256:7340bef99a7e0032613f56dc36027b959fd3b30a787ed62d310e951f7c3a3a58"},
 ]
 
 [[package]]

pyproject.toml

@@ -45,7 +45,7 @@ orjson = {version = "^3.9.7", optional = true}
 apscheduler = {version = "^3.10.4", optional = true}
 fastapi-sso = { version = "^0.16.0", optional = true }
 PyJWT = { version = "^2.10.1", optional = true, python = ">=3.9" }
-python-multipart = { version = "^0.0.18", optional = true}
+python-multipart = { version = "^0.0.22", optional = true}
 cryptography = {version = "*", optional = true}
 prisma = {version = "0.11.0", optional = true}
 azure-identity = {version = "^1.15.0", optional = true, python = ">=3.9"}

requirements.txt

@@ -32,7 +32,7 @@ polars==1.31.0 # for data processing
 apscheduler==3.10.4 # for resetting budget in background
 fastapi-sso==0.19.0 # admin UI, SSO
 pyjwt[crypto]==2.10.1 ; python_version >= "3.9"
-python-multipart==0.0.18 # admin UI
+python-multipart==0.0.22 # admin UI
 Pillow==11.0.0
 jaraco.context>=6.1.0
 azure-ai-contentsafety==1.0.0 # for azure content safety

tests/code_coverage_tests/license_cache.json

@@ -20,7 +20,7 @@
   "apscheduler:3.10.4": "MIT",
   "fastapi-sso:0.16.0": "MIT",
   "pyjwt:2.9.0": "MIT",
-  "python-multipart:0.0.18": "Apache-2.0",
+  "python-multipart:0.0.22": "Apache-2.0",
   "Pillow:11.0.0": "MIT-CMU",
   "azure-ai-contentsafety:1.0.0": "MIT License",
   "azure-identity:1.16.1": "MIT License",