[litellm-agent] Staging → litellm_internal_staging (5/9/2026)

[oss-pr-review-agent-shin]

Automated staging PR created by litellm-agent.

This branch collects PRs approved by the agent on 5/9/2026.

[oss-pr-review-agent-shin]

@greptile please review

[codecov]

Codecov Report

❌ Patch coverage is 78.33333% with 39 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
litellm/_redis.py	68.05%	23 Missing ⚠️
litellm/_redis_credential_provider.py	37.50%	10 Missing ⚠️
...ransformations/anthropic_claude3_transformation.py	86.66%	2 Missing ⚠️
litellm/proxy/common_utils/reset_budget_job.py	77.77%	2 Missing ⚠️
...y/management_endpoints/key_management_endpoints.py	95.65%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

[greptile-apps]

Greptile Summary

This staging PR aggregates several independently reviewed changes: Azure AD authentication for Redis, a new /team/key/bulk_update endpoint, fixes for Bedrock context_management filtering, tag budget cache invalidation after spend resets, health-check polling improvements, httpx header type coercions, and a ModelSelect empty-optgroup fix.

• Azure AD Redis auth (_redis.py, _redis_credential_provider.py): A new AzureADCredentialProvider and create_azure_ad_redis_connect_func let sync and async Redis clients authenticate via Azure AD, mirroring the existing GCP IAM path. The Azure SDK credential is reused across connections for transparent token refresh.
• /team/key/bulk_update (key_management_endpoints.py, types): New endpoint broadcasts one update payload to all selected keys in a team, with a KeyUpdateFields allowlist, batch limits, blocked/expired key filtering, and per-key failure collection.
• Bedrock context_management filter (anthropic_claude3_transformation.py): Strips unsupported edit types before InvokeModel and adds the compact-2026-01-12 beta header only when compact edits survive, fixing 400 errors from Claude Code requests.

Confidence Score: 5/5

Safe to merge — changes are well-scoped, each path has direct test coverage, and no auth or data-integrity regressions were found.

The new /team/key/bulk_update endpoint correctly gates access behind role checks and team-membership validation before per-key updates, the Azure AD Redis path mirrors the existing GCP IAM pattern, and the Bedrock context_management filter is additive with a safety-net allowlist as backstop.

No files require special attention beyond the minor style nits flagged in the inline comments.

Important Files Changed

Filename	Overview
litellm/_redis.py	Adds Azure AD Redis authentication alongside the existing GCP IAM path; sync path uses a closure-captured credential, async path wraps it in AzureADCredentialProvider for token refresh. Minor: AZURE_REDIS_SCOPE is duplicated from _redis_credential_provider.py.
litellm/_redis_credential_provider.py	Adds AzureADCredentialProvider mirroring the existing GCPIAMCredentialProvider; delegates to the Azure SDK's internal token cache for refresh. Clean implementation.
litellm/proxy/management_endpoints/key_management_endpoints.py	Adds /team/key/bulk_update endpoint; refactors _process_single_key_update to accept UpdateKeyRequest directly; includes team-scoped auth, batch limits, blocked/expired key filtering, and per-key failure handling.
litellm/types/proxy/management_endpoints/key_management_endpoints.py	Adds KeyUpdateFields (extra=forbid allowlist) and BulkUpdateTeamKeysRequest with validators for temp_budget pairing and selection exclusivity.
litellm/router.py	Registers a stripped alias (without responses/ prefix) in litellm.model_cost for both _create_deployment and add_deployment; str.replace is a global replace rather than a segment-aware strip.
litellm/proxy/common_utils/reset_budget_job.py	Adds user_api_key_cache invalidation after tag spend resets so stale cached spend does not keep tags budget-blocked across reset cycles. Opt-in via cache_key_fn.
litellm/proxy/health_check_utils/shared_health_check_manager.py	Replaces fixed 2-second sleep with a polling loop bounded by lock_ttl; adds early exit on orphaned lock detection and immediate fallback when Redis is unconfigured.
litellm/proxy/litellm_pre_call_utils.py	Fixes httpx header type error by serializing dict/list values as JSON and coercing numbers to str; adds provider resolution from router deployment when model name has no prefix.
litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py	Adds _filter_context_management_for_bedrock_invoke to strip unsupported edit types from context_management before Bedrock InvokeModel, fixing the 400 error from Claude Code clear_thinking edits.
ui/litellm-dashboard/src/components/ModelSelect/ModelSelect.tsx	Fixes empty optgroup rendering when includeSpecialOptions is falsy by spreading the conditional array instead of passing an object directly to the options array.
litellm/proxy/auth/route_checks.py	Adds TEAM_KEY_BULK_UPDATE to _PROXY_ADMIN_VIEW_ONLY_BLOCKED_ROUTES (using enum value) and _SELF_SERVICE_ALLOWED_ROUTES.

_{Reviews (6): Last reviewed commit: "Merge branch 'litellm_internal_staging' ..." | Re-trigger Greptile}

[greptile-apps]

The new route is added as a raw string literal "/team/key/bulk_update" here, while the _PROXY_ADMIN_VIEW_ONLY_BLOCKED_ROUTES frozenset just above uses KeyManagementRoutes.TEAM_KEY_BULK_UPDATE.value from the enum. If the enum value is ever changed, _SELF_SERVICE_ALLOWED_ROUTES would silently fall out of sync and the route would slip through the admin-view-only guard.

Suggested change

	"/key/service-account/generate",
	"/key/block",
	"/key/unblock",
	"/team/key/bulk_update",
	]
	)
	"/key/service-account/generate",
	"/key/block",
	"/key/unblock",
	KeyManagementRoutes.TEAM_KEY_BULK_UPDATE.value,
	]
	)

[oss-pr-review-agent-shin]

@greptile please review

[oss-pr-review-agent-shin]

@greptile please review

[oss-pr-review-agent-shin]

@greptile please review

[oss-pr-review-agent-shin]

@greptile please review

[oss-pr-review-agent-shin]

@greptile please review

[oss-pr-review-agent-shin]

@greptile please review

[oss-pr-review-agent-shin]

@greptile please review

[oss-pr-review-agent-shin]

@greptile please review

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
7 out of 8 committers have signed the CLA.

✅ Michael-RZ-Berri
✅ noahnistler
✅ Anai-Guo
✅ Bytechoreographer
✅ shivamrawat1
✅ krisxia0506
✅ Sameerlite
❌ oss-agent-shin
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Sameerlite]

@greptile please review