fix(deps): bump ws override to 8.21.0 and add dependabot.yml

.github/dependabot.yml

@@ -0,0 +1,67 @@
+version: 2
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "pip"
+    directory: "/cookbook/litellm-ollama-docker-image"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "pip"
+    directory: "/cookbook/livekit_agent_sdk"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "pip"
+    directory: "/cookbook/anthropic_agent_sdk"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "npm"
+    directory: "/tests/pass_through_tests"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "npm"
+    directory: "/tests/proxy_admin_ui_tests/ui_unit_tests"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "npm"
+    directory: "/ui/litellm-dashboard"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "cargo"
+    directory: "/litellm-rust"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/fork-patches.txt

@@ -23,3 +23,5 @@ docker/Dockerfile.non_root            | FROM ghcr\.io/astral-sh/uv:0\.11\.7@sha2
 litellm-rust/crates/python-bridge/src/gil.rs        | py.detach(f)   | pyo3 0.29 removed Python::allow_threads (renamed Python::detach); RUSTSEC-2026-0176/0177 are only patched at pyo3 >=0.29.0, so we can't downgrade below the version that removed the old GIL API. REMOVAL CONDITION: remove when upstream litellm bumps pyo3 to >=0.29 and updates the bridge itself.
 litellm-rust/crates/python-bridge/src/lib.rs        | Python::attach | pyo3 0.29 removed Python::with_gil (renamed Python::attach); same RUSTSEC-2026-0176/0177 constraint as gil.rs above. REMOVAL CONDITION: remove when upstream litellm bumps pyo3 to >=0.29 and updates the bridge itself.
 litellm-rust/crates/ai-gateway/src/python/config.rs | Python::attach | pyo3 0.29 removed Python::with_gil (renamed Python::attach); same RUSTSEC-2026-0176/0177 constraint as gil.rs above. REMOVAL CONDITION: remove when upstream litellm bumps pyo3 to >=0.29 and updates the bridge itself.
+.github/dependabot.yml | package-ecosystem: "uv" | Fork-only dependabot config covering every ecosystem the fork's security sweep scans (uv, pip for cookbook, npm for all 4 lockfile dirs, cargo for litellm-rust); upstream has none. REMOVAL CONDITION: remove/merge if upstream ever ships its own dependabot.yml that a sync would otherwise clobber.
+tests/proxy_admin_ui_tests/ui_unit_tests/package.json | "ws": "8.21.0" | ws override bumped 8.20.1->8.21.0, closing GHSA-96hv-2xvq-fx4p (memory exhaustion DoS from tiny fragments). REMOVAL CONDITION: remove once upstream's own override (if any) is already >=8.21.0.

tests/proxy_admin_ui_tests/ui_unit_tests/package.json

@@ -31,7 +31,7 @@
         "@tootallnate/once": "3.0.1",
         "@isaacs/brace-expansion": "5.0.0",
         "@babel/traverse": "7.28.5",
-        "ws": "8.20.1",
+        "ws": "8.21.0",
         "brace-expansion": "5.0.6",
         "braces": "3.0.3",
         "js-yaml": "3.15.0",