fix: pin liteLLM upper bound to <=1.82.6 to mitigate supply chain attack

liteLLM versions 1.82.7 and 1.82.8 were compromised via a supply chain
attack. Pin the upper bound across all 9 affected pyproject.toml files
to the last known safe version.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: gn00295120

demo/ui/pyproject.toml

@@ -16,7 +16,7 @@ dependencies = [
     "pandas>=2.2.0",
     "google-genai>=1.9.0",
     "google-adk[a2a]>=1.7.0",
-    "litellm",
+    "litellm<=1.82.6",
     "a2a-sample-client-multiagent",
 ]
 

samples/python/agents/a2a_mcp/pyproject.toml

@@ -21,7 +21,7 @@ dependencies = [
     "numpy>=2.2.5",
     "pandas>=2.2.3",
     "pydantic>=2.11.4",
-    "litellm",
+    "litellm<=1.82.6",
 ]
 
 [project.scripts]

samples/python/agents/a2a_telemetry/pyproject.toml

@@ -13,5 +13,5 @@ dependencies = [
     "opentelemetry-instrumentation-requests>=0.54b1",
     "opentelemetry-instrumentation-starlette>=0.54b1",
     "opentelemetry-sdk>=1.33.1",
-    "litellm",
+    "litellm<=1.82.6",
 ]

samples/python/agents/adk_cloud_run/pyproject.toml

@@ -13,5 +13,5 @@ dependencies = [
     "python-dotenv>=1.1.0",
     "asyncpg>=0.30.0",
     "google-cloud-alloydb-connector[asyncpg]>=1.9.0",
-    "litellm>=1.40.0",
+    "litellm>=1.40.0, <=1.82.6",
 ]

samples/python/agents/adk_expense_reimbursement/pyproject.toml

@@ -10,7 +10,7 @@ dependencies = [
     "google-adk>=1.8.0",
     "google-genai>=1.27.0",
     "python-dotenv>=1.1.0",
-    "litellm",
+    "litellm<=1.82.6",
     "timestamp_ext",
 ]
 

samples/python/agents/airbnb_planner_multiagent/pyproject.toml

@@ -15,7 +15,7 @@ dependencies = [
     "langgraph>=0.4.5",
     "mcp>=1.5.0",
     "a2a-sdk>=0.3.0",
-    "litellm",
+    "litellm<=1.82.6",
 ]
 
 [tool.uv.sources]

samples/python/agents/dice_agent_grpc/pyproject.toml

@@ -16,7 +16,7 @@ dependencies = [
     "grpcio-tools>=1.60",
     "grpcio_reflection>=1.7.0",
     "a2a-sdk>=0.3.0",
-    "litellm>=1.75.3",
+    "litellm>=1.75.3, <=1.82.6",
 ]
 
 [tool.hatch.metadata]

samples/python/hosts/a2a_multiagent_host/pyproject.toml

@@ -10,7 +10,7 @@ dependencies = [
     "google-adk>=1.7.0",
     "mcp>=1.5.0",
     "a2a-sdk>=0.3.0",
-    "litellm",
+    "litellm<=1.82.6",
     "traceability_ext",
 ]
 

samples/python/hosts/weather_and_airbnb_planner/pyproject.toml

@@ -15,6 +15,6 @@ dependencies = [
     "langgraph>=0.4.5",
     "mcp>=1.5.0",
     "a2a-sdk>=0.3.3",
-    "litellm"
+    "litellm<=1.82.6"
 ]