fix(deps): pin all dependencies to exact versions; bump litellm to 1.87.2

litellm 1.87.2 fixes the chatgpt/* (ChatGPT subscription) provider
returning empty Responses output (BerriAI/litellm#25429) and auto-injects
GitHub Copilot IDE-auth headers in the chat path (BerriAI/litellm#20113).

All direct dependencies are now pinned exactly as a supply-chain
precaution (cf. the litellm package-poisoning incident) — the README
already claimed litellm was pinned to a safe version, but pyproject
carried no constraint at all. Versions match what uv.lock already
resolved, so installed behavior is unchanged apart from litellm
1.85.0 -> 1.87.2.

Refs #94

Author: KylinMountain

pyproject.toml

@@ -25,19 +25,25 @@ classifiers = [
     "Topic :: Scientific/Engineering :: Artificial Intelligence",
 ]
 keywords = ["ai", "rag", "retrieval", "knowledge-base", "llm", "pageindex", "agents", "document"]
+# All dependencies are pinned exactly (supply-chain caution — e.g. the
+# litellm package-poisoning incident). Bump deliberately after vetting
+# each release.
+# litellm 1.87.2 fixes the chatgpt/* (ChatGPT subscription) provider
+# returning empty Responses output (BerriAI/litellm#25429) and
+# auto-injects GitHub Copilot IDE-auth headers.
 dependencies = [
     "pageindex==0.3.0.dev1",
-    "markitdown[docx,pptx,xlsx,xls]>=0.1.5",
-    "trafilatura>=2.0",
-    "click>=8.0",
-    "watchdog>=3.0",
-    "litellm",
-    "openai-agents",
-    "pyyaml",
-    "python-dotenv",
-    "json-repair",
-    "prompt_toolkit>=3.0",
-    "rich>=13.0",
+    "markitdown[docx,pptx,xlsx,xls]==0.1.5",
+    "trafilatura==2.0.0",
+    "click==8.4.0",
+    "watchdog==6.0.0",
+    "litellm==1.87.2",
+    "openai-agents==0.17.3",
+    "pyyaml==6.0.3",
+    "python-dotenv==1.2.2",
+    "json-repair==0.59.10",
+    "prompt_toolkit==3.0.52",
+    "rich==15.0.0",
 ]
 
 [project.urls]
@@ -52,7 +58,7 @@ openkb = "openkb.cli:cli"
 testpaths = ["tests"]
 
 [project.optional-dependencies]
-dev = ["pytest", "pytest-asyncio"]
+dev = ["pytest==9.0.3", "pytest-asyncio==1.3.0"]
 
 [tool.hatch.version]
 source = "vcs"