fix: tighten LiteLLM CVE-2026-40217 floor

[cursor]

Vulnerability details

• Vulnerability ID: CVE-2026-40217 / GHSA-wxxx-gvqv-xp7p
• Affected repo: potpie-ai/potpie
• Affected package: litellm
• Current vulnerable constraint: >=1.83.10,<1.84.0 allowed the vulnerable 1.83.10 floor
• Fixed version: >=1.83.11 (lock resolves to 1.83.14)
• Severity: High
• Source URL: https://osv.dev/vulnerability/GHSA-wxxx-gvqv-xp7p
• Linear: https://linear.app/potpie/issue/POT-1470/vanta-remediate-cve-2026-40217-in-litellm-for-potpie

Fix summary

• Tightened the root LiteLLM dependency floor from >=1.83.10 to >=1.83.11.
• Refreshed uv.lock metadata while preserving the resolved fixed LiteLLM version 1.83.14.
• Updated the adjacent CVE comment to match the corrected fixed floor.

Validation

• python3 -m uv lock --check passed.
• Runtime dependency assertion passed: installed litellm is 1.83.14 and >=1.83.11.
• python3 -m uv tree --package litellm --depth 1 resolved LiteLLM 1.83.14.
• Unit tests passed with local service URLs set: 1307 passed, 75 skipped (Postgres unavailable), 173 deselected.
• python3 -m uv run ruff check app/ tests/ currently fails on pre-existing unrelated lint issues in Python files not touched by this PR.
• python3 -m uv pip check --python .venv/bin/python reports the existing documented LiteLLM/OpenAI override (litellm requires openai==2.24.0, project resolves openai==2.38.0).