Improve LiteLLM deps #4093 (#4102)

requirements.txt

@@ -99,6 +99,12 @@ pytest-mock ~=3.15
 
 # OpenAPI validation support
 openapi-core[flask] ~= 0.23
+# openapi-spec-validator (pulled in by openapi-core) requires jsonschema>=4.24.0.
+# litellm 1.83.1–1.83.14 exact-pin jsonschema==4.23.0, which is below that floor —
+# the two can never coexist. Without this pin, pip walks back through ~14 litellm
+# patch releases before finding 1.83.0 (jsonschema>=4.23.0,<5.0.0, accepts 4.24.x).
+# Pinning >=4.24.0 here lets the resolver reject incompatible litellm versions immediately.
+jsonschema>=4.24.0,<5.0.0
 
 loguru
 
@@ -120,7 +126,7 @@ greenlet >= 3.0.3
 # Default SOCKETIO_MODE=threading is recommended for better compatibility
 gevent
 
-referencing  # Don't pin — jsonschema-path (required by openapi-core>=0.18) caps referencing<0.37.0, so pinning 0.37.0 forces openapi-core back to 0.17.2. Revisit once jsonschema-path>=0.3.5 relaxes the cap.
+referencing==0.37.0  # jsonschema-path>=0.4.x allows <0.38.0; 0.37.0 is current latest
 
 # For conditions
 panzi-json-logic
@@ -131,7 +137,7 @@ price-parser
 
 # Lightweight MIME type detection (saves ~14MB memory vs python-magic/libmagic)
 # Used for detecting correct favicon type and content-type detection
-puremagic
+puremagic<2.0  # 2.x requires Python >=3.12; unpin once 3.10/3.11 support is dropped
 
 # Scheduler - Windows seemed to miss a lot of default timezone info (even "UTC" !)
 tzdata
@@ -141,7 +147,7 @@ tzdata
 pluggy ~= 1.6
 
 # LLM intent-based change evaluation (multi-provider via litellm)
-litellm>=1.40.0
+litellm>=1.40.0,<1.83.1  # 1.83.1–1.83.14 exact-pin jsonschema==4.23.0, conflicting with openapi-spec-validator's >=4.24.0 floor; re-evaluate when litellm fixes this
 # BM25 relevance trimming for large snapshots (pure Python, no ML)
 rank-bm25>=0.2.2