CVE-2024-6119: Locked litellm version

[tojaroslaw]

Hi dspy team!

I was trying to upgrade the version of litellm we use because older versions are vulnerable to CVE-2024-6119. This is fixed in versions 1.56.2 and above. However, I could not upgrade litellm because the latest versions of dspy lock the version of litellm to a lower value. I noticed that in the latest, unreleased version of the requirements file on the master branch, the version was changed to 1.57.4 which would solve the problem when dspy 2.6.0 is released.

I was wondering if it would be possible to upgrade this in version 2.5 and release a version 2.5.44 that allows us to patch this vulnerability. If that's not do-able, I was wondering if the team had a rough timeline for when dspy 2.6.0 would be released? Even another pre-release might help us if gets the job done.

Thanks!