[Security]: litellm PyPI package (v1.82.7 + v1.82.8) compromised

[super-qua]

litellm packages have been compromised as per BerriAI/litellm#24518

As custom-conversation has litellm as dependency, it would be good if the litellm version could be pinned to a specific version.

On my system, I currently see 1.81.4.

[michelle-avery]

Yeah, 1.81.4 is what I'm running too, so I'll pin it to that for now.

[michelle-avery]

Fixed with #97 and released in 1.6.1.

[super-qua]

awesome, thank you!

btw: during the recent trivy compromise, I read the attackers were also able to compromise older tags. Apparently pinning to the hash should help with that.