[Infra] CI/CD Fixes - Nightly Release Feb 12

[yuneng-jiang]

Relevant issues

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Type

🚄 Infrastructure

Changes

This PR cherry-picks commits from https://github.com/BerriAI/litellm/tree/litellm_release_day_02_12_2026. Some commits from this branch should not be merged with main because they are workarounds, hence I am making a new branch to merge the CI/CD fixes into main.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Feb 13, 2026 1:57am

[greptile-apps]

Greptile Overview

Greptile Summary

Cherry-picks CI/CD and bug fixes from the litellm_release_day_02_12_2026 branch into main (v1.81.11). The changes span several areas:

• Bug fixes: CloudZero resource/id now correctly sends the CZRN instead of model name; _build_ui_spend_logs_response handles both dict and model objects; OpenAI user param validation errors no longer misclassified as context window errors; model_armor _process_response signature aligned with parent class
• Refactors: transform_request in responses transformation broken into smaller helper methods; aiohttp transport builds request kwargs dict to avoid passing None ssl param; content filter guardrail removes redundant @log_guardrail_information decorator (has its own detailed logging)
• MCP auth: Fallback DB lookup (cached) for key_object_permission when not pre-loaded in the auth flow
• Security deps: Pillow 11.0.0 → 12.1.1, cryptography 44.0.1 → 46.0.5 (CVE fixes)
• Test fixes: Updated model names, mock signatures, and test assertions to match updated interfaces

Confidence Score: 4/5

• This PR is safe to merge — it consists of targeted bug fixes, dependency security updates, and test alignment changes with low regression risk.
• The changes are well-scoped CI/CD fixes. The refactoring in transformation.py is purely structural with one minor behavioral change (user param truncation vs drop). The MCP auth DB fallback is cached. All test updates align with interface changes. Security dependency bumps address known CVEs.
• litellm/completion_extras/litellm_responses_transformation/transformation.py (behavioral change in user param handling), litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py (new DB fallback on request path)

Important Files Changed

Filename	Overview
litellm/completion_extras/litellm_responses_transformation/transformation.py	Refactors transform_request into smaller helper methods. Introduces silent truncation of user param > 64 chars (previously silently dropped). Behavioral change in how overlong user strings are handled.
litellm/integrations/cloudzero/transform.py	Bug fix: resource/id field now correctly uses resource_id (CZRN) instead of model name.
litellm/litellm_core_utils/exception_mapping_utils.py	Adds exclusions for OpenAI user param validation errors (string_above_max_length, Invalid 'user') so they are not misclassified as context window errors.
litellm/llms/custom_httpx/aiohttp_transport.py	Refactors aiohttp request call to build kwargs dict first, conditionally adding ssl only when non-None. Avoids passing None as ssl parameter.
litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py	Adds fallback DB lookup (with caching via user_api_key_cache) for key_object_permission when not pre-loaded. Uses inline imports from proxy_server.
litellm/proxy/spend_tracking/spend_management_endpoints.py	Fixes _build_ui_spend_logs_response to handle row as either dict or model object, preventing AttributeError when row is already a dict.
requirements.txt	Security updates: Pillow 11.0.0 → 12.1.1 (GHSA-cfh3-3jmp-rvhc), cryptography 44.0.1 → 46.0.5 (GHSA-r6ph-v2qm-q3c2). Moved to top of file with CVE annotations.

Sequence Diagram

sequenceDiagram
    participant Client
    participant TransformRequest as transform_request()
    participant MapParams as _map_optional_params
    participant BuildLitellm as _build_sanitized_litellm_params
    participant MergeRequest as _merge_responses_api_request
    participant ResponsesAPI as Responses API

    Client->>TransformRequest: model, messages, optional_params, litellm_params
    TransformRequest->>TransformRequest: convert_chat_completion_messages_to_responses_api()
    TransformRequest->>MapParams: optional_params, responses_api_request
    MapParams-->>TransformRequest: (mutated responses_api_request)
    TransformRequest->>BuildLitellm: litellm_params
    BuildLitellm-->>TransformRequest: sanitized_litellm_params
    TransformRequest->>TransformRequest: Build request_data dict
    TransformRequest->>MergeRequest: request_data, responses_api_request, instructions
    MergeRequest->>MergeRequest: Truncate user if > 64 chars
    MergeRequest-->>TransformRequest: (mutated request_data)
    TransformRequest-->>Client: request_data
    Client->>ResponsesAPI: request_data

Loading

_{Last reviewed commit: 3f8a1cf}

[greptile-apps]

_{19 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Behavioral change: previously, user values > 64 chars were silently dropped (not sent at all). Now they are silently truncated to 64 chars. This could cause different users with long IDs sharing the same 64-char prefix to become indistinguishable. Consider logging when truncation occurs so callers can detect and fix their user param.