Bump litellm from 1.100.1 to 1.104.0 in /packages/graphrag-llm

[dependabot]

Bumps litellm from 1.100.1 to 1.104.0.

Release notes

Sourced from litellm's releases.

v1.104.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.104.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.104.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.104.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• build(deps): re-suppress GHSA-h7x2-h6g9-p789 in osv-scan, mlflow still has no fixed release by @​devin-ai-integration[bot] in BerriAI/litellm#41036
• feat(auth): add breached password detection to password policy by @​ojensen-berri in BerriAI/litellm#39321
• feat(auth): add self-service password change and plug plaintext password leaks by @​ojensen-berri in BerriAI/litellm#39562
• feat(auth): force password reset for breached or admin-set passwords by @​ojensen-berri in BerriAI/litellm#40107
• perf(proxy): serialize /model/info listing once with orjson by @​devin-ai-integration[bot] in BerriAI/litellm#41061
• fix(utils): stop wrapper_async submitting the sync success handler twice by @​devin-ai-integration[bot] in BerriAI/litellm#41058
• test(integration): native responses and messages cost cases by @​devin-ai-integration[bot] in BerriAI/litellm#42010
• fix(proxy): stop re-sending un-resendable spend batches from the Redis buffer by @​devin-ai-integration[bot] in BerriAI/litellm#41994
• fix(router): skip cooldown for background response cost poll 404s by @​devin-ai-integration[bot] in BerriAI/litellm#42046
• fix(router): stamp model_group when retrieving a batch, so batch tokens are attributable (internal copy of #38499) by @​devin-ai-integration[bot] in BerriAI/litellm#42062
• test(mcp): restore scoped execution and credential isolation regressions by @​joshua-berri in BerriAI/litellm#42050
• feat(proxy)!: refuse to start with an unset, empty, or publicly known master key by @​ryan-crabbe-berri in BerriAI/litellm#42019
• docs: stop advertising sk-1234 as the master key in shipped configs and examples by @​ryan-crabbe-berri in BerriAI/litellm#42011
• test(logging): add autorouter estimate keys to the GCS pub/sub spend-log golden by @​devin-ai-integration[bot] in BerriAI/litellm#42061
• fix(router): add NotFoundErrorRetries so a retry policy can pin 404 retries by @​devin-ai-integration[bot] in BerriAI/litellm#42045

... (truncated)

Commits

• 7964577 Merge pull request #44397 from BerriAI/litellm_fix_d03a47
• 5bb3b88 fix(proxy-extras): keep the post-migration sanity check from building the han...
• 5aa0cd0 chore(release): backport part of #43902 and #43983 to rc/1.104.0 (#44332)
• 31d6c60 chore(release): backport #44283 and part of #44229 to rc/1.104.0 (#44312)
• 656daa0 chore(release): backport #44277 to rc/1.104.0 and bump oauthlib (#44304)
• a1f27fc test: fix three order-dependent and timing-flaky tests (#44271) (#44280)
• 6e747b0 test(integration): opt the config pass-through spend-log case into auth (#44267)
• 2e5981c Merge pull request #44224 from BerriAI/litellm_rc_1_104_0_extras_post1
• 13d3ba8 chore: bump litellm-proxy-extras to 0.4.102.post1
• e012755 Merge pull request #44206 from BerriAI/litellm_rc_1_104_0_enforce_migration_c...
• Additional commits viewable in compare view

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.