fix(deps): bump litellm for SSTI fix; ignore unfixable pip CVE

lib/crewai-tools/pyproject.toml

@@ -11,7 +11,7 @@ dependencies = [
     "pytube~=15.0.0",
     "requests>=2.33.0,<3",
     "crewai==1.14.3",
-    "tiktoken~=0.8.0",
+    "tiktoken>=0.8.0,<0.13",
     "beautifulsoup4~=4.13.4",
     "python-docx~=1.2.0",
     "youtube-transcript-api~=1.2.2",

lib/crewai/pyproject.toml

@@ -9,8 +9,8 @@ authors = [
 requires-python = ">=3.10, <3.14"
 dependencies = [
     # Core Dependencies
-    "pydantic~=2.11.9",
-    "openai>=2.0.0,<3",
+    "pydantic>=2.11.9,<2.13",
+    "openai>=2.30.0,<3",
     "instructor>=1.3.3",
     # Text Processing
     "pdfplumber~=0.11.4",
@@ -58,7 +58,7 @@ tools = [
     "crewai-tools==1.14.3",
 ]
 embeddings = [
-    "tiktoken~=0.8.0"
+    "tiktoken>=0.8.0,<0.13"
 ]
 pandas = [
     "pandas~=2.2.3",
@@ -84,7 +84,7 @@ voyageai = [
     "voyageai~=0.3.5",
 ]
 litellm = [
-    "litellm~=1.83.0",
+    "litellm>=1.83.7,<1.84",
 ]
 bedrock = [
     "boto3~=1.42.79",

lib/crewai/src/crewai/experimental/agent_executor.py

@@ -153,7 +153,7 @@ class AgentExecutorState(BaseModel):
     )
 
 
-class AgentExecutor(Flow[AgentExecutorState], BaseAgentExecutor):  # type: ignore[pydantic-unexpected]
+class AgentExecutor(Flow[AgentExecutorState], BaseAgentExecutor):
     """Agent Executor for both standalone agents and crew-bound agents.
 
     _skip_auto_memory prevents Flow from eagerly allocating a Memory

lib/crewai/tests/test_llm.py

@@ -648,7 +648,7 @@ def test_handle_streaming_tool_calls_no_tools(mock_emit):
 
     assert_event_count(
         mock_emit=mock_emit,
-        expected_stream_chunk=46,
+        expected_stream_chunk=47,
         expected_completed_llm_call=1,
         expected_final_chunk_result=response,
     )