chore(release): backport six staged fixes into stable/1.84.x and cut 1.84.5

[mateo-berri]

Relevant issues

Backports six fixes that already merged on litellm_internal_staging but never reached the 1.84.x line. Each one is cherry-picked from the squashed commit that landed for its PR, so the set matches what the newer lines already carry. This closes that gap and cuts 1.84.5

Linear ticket

N/A

What is included

Cherry-picked in merge order:

• fix(azure): preserve AD token refresh in v1 OpenAI client path #28627 fix(azure): preserve AD token refresh in the v1 OpenAI client path
• fix(proxy): map stripped batch body.model to proxy alias for auth #29264 fix(proxy): map a stripped batch body.model back to the proxy alias so key access checks pass
• fix(proxy): resolve managed video model ids for auth #29545 fix(proxy): resolve managed video model ids through the router before auth, budget, and key checks
• fix(key_generate): allow team members to create keys on org-scoped teams #29310 fix(key_generate): let team members create keys on org-scoped teams (regression since v1.84.0-rc.1)
• fix(vertex): strip output_config.effort for Vertex Claude models that reject it (Haiku 4.5) #29585 fix(vertex): strip output_config.effort for Vertex Claude models that reject it, such as Haiku 4.5
• [internal copy of #29550] fix: passthrough endpoints duplicate logs #29598 fix(passthrough): stop duplicate cost callbacks for Anthropic streaming pass-through

The last two commits are the version bump (1.84.4 to 1.84.5) and the matching uv.lock refresh

#29598 needed a manual conflict resolution. pass_through_endpoints.py is stored with CRLF endings on the stable branches, so the verbatim cherry-pick will not apply, and the new tests sit next to an unrelated test class that this line does not carry. The resolved source change and the added tests are byte-identical to the upstream commit; only the surrounding file context differs, and the dedup guard the fix relies on (has_dispatched_final_stream_success) is present on this line

Pre-Submission checklist

• The cherry-picked PRs each carry their own tests
• My PR passes all unit tests on make test-unit
• Scope is limited to backporting already-merged fixes plus the release bump
• Greptile review requested

CI (LiteLLM team)

• Branch creation CI run
  Link:
• CI run for the last commit
  Link:
• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

These are backports of changes already merged, released, and validated on newer lines; each linked PR carries its own proof and review

Type

Bug Fix
Infrastructure

Changes

See the commit list above. No new code beyond the cherry-picks, the version bump, and the lockfile refresh

[greptile-apps]

Greptile Summary

This PR backports six targeted bug fixes from litellm_internal_staging to the stable/1.84.x line and cuts version 1.84.5. Each cherry-pick matches its upstream commit, conflict resolution on pass_through_endpoints.py (CRLF line endings) is explicitly documented, and every fix is accompanied by unit tests.

• Azure AD token provider (fix(azure): preserve AD token refresh in v1 OpenAI client path #28627): Passes azure_ad_token_provider (or azure_ad_token) as api_key on the v1 OpenAI client path so token refresh is preserved; wraps sync providers in asyncio.to_thread for the async client.
• Vertex Claude output_config.effort (fix(vertex): strip output_config.effort for Vertex Claude models that reject it (Haiku 4.5) #29585): Makes sanitize_vertex_anthropic_output_params model-aware, stripping effort only for models (e.g. Haiku 4.5) that don't advertise support, while forwarding it for Opus/Sonnet 4.6+. Delegates capability detection to AnthropicConfig._model_supports_effort_param, which reads from the model-cost map.
• Batch model auth mapping (fix(proxy): map stripped batch body.model to proxy alias for auth #29264), managed video auth routing (fix(proxy): resolve managed video model ids for auth #29545), team-org key creation (fix(key_generate): allow team members to create keys on org-scoped teams #29310), streaming pass-through dedup ([internal copy of #29550] fix: passthrough endpoints duplicate logs #29598): Remaining fixes address model ID resolution in batch and video auth paths, a regression in org-scoped team key generation, and duplicate cost callbacks for streaming Anthropic pass-through.

Confidence Score: 4/5

All six cherry-picks apply cleanly and are well-tested; the only rough edge is an unguarded router call in the batch rate-limiter that differs from the defensive pattern used elsewhere for the same operation.

The backported changes are narrow and well-scoped: AD token refresh, Vertex effort-param gating, batch model mapping, video model routing, team-org key creation, and streaming dedup. Tests cover positive, negative, and edge cases for each fix. The only rough edge is that batch_rate_limiter.py calls resolve_model_name_from_model_id without error handling, while the equivalent call in auth_utils.py wraps it in a try-except; an unexpected router error there would surface as an unhandled exception blocking the batch instead of falling back gracefully.

litellm/proxy/hooks/batch_rate_limiter.py — missing error guard around resolve_model_name_from_model_id call.

Important Files Changed

Filename	Overview
litellm/llms/azure/common_utils.py	Adds azure_ad_token_provider / azure_ad_token as fallback api_key for the v1 OpenAI client path, with async wrapping via asyncio.to_thread; also enriches the client-cache key with hashed credentials so distinct AD configs get separate clients.
litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/output_params_utils.py	Makes sanitize_vertex_anthropic_output_params model-aware: strips output_config.effort for models that don't accept it (e.g. Haiku 4.5) while forwarding it for Opus/Sonnet 4.6+, using the model-cost table via AnthropicConfig._model_supports_effort_param.
litellm/proxy/auth/auth_utils.py	Threads llm_router through the managed-resource-ID resolution chain so decoded video_id / character_id model IDs are resolved to their proxy model names before auth and budget checks.
litellm/proxy/auth/user_api_key_auth.py	Passes llm_router to all _get_model_from_request_context call sites so managed video model IDs are resolved before every auth, budget, and access check in the critical request path.
litellm/proxy/hooks/batch_rate_limiter.py	Resolves batch body.model provider IDs to proxy model names via llm_router.resolve_model_name_from_model_id before the can_key_call_model check, but unlike the parallel fix in auth_utils.py, this call has no error guard.
litellm/proxy/management_endpoints/key_management_endpoints.py	Adds _org_inherited_from_team bypass: when the key's organization_id matches the team's DB-sourced organization_id, the explicit org-membership check is skipped, fixing the v1.84.0-rc.1 regression without relaxing the check for unrelated orgs.
litellm/proxy/pass_through_endpoints/pass_through_endpoints.py	Sets logging_obj.stream = True and mirrors it to model_call_details["stream"] on both the explicit-stream path and the SSE-response fallback path, enabling the dedup guard for streaming pass-through requests.
litellm/proxy/pass_through_endpoints/llm_provider_handlers/anthropic_passthrough_logging_handler.py	Guards complete_streaming_response population on model_call_details["stream"] is True, preventing unredacted responses from leaking to logging callbacks on non-streaming pass-through calls.

_{Reviews (1): Last reviewed commit: "chore: update uv.lock for 1.84.5" | Re-trigger Greptile}

[greptile-apps]

The parallel fix in auth_utils.py wraps the same resolve_model_name_from_model_id call in a try-except and falls back to the raw model_id on failure. Here the call is unguarded, so an unexpected exception from the router lookup (e.g. an empty model_list race) would surface as an unhandled error and block the entire batch rather than gracefully falling through to the original model string.

Suggested change

	model_to_check = model
	if llm_router is not None:
	proxy_model_name = llm_router.resolve_model_name_from_model_id(model)
	if proxy_model_name is not None:
	model_to_check = proxy_model_name
	model_to_check = model
	if llm_router is not None:
	try:
	proxy_model_name = llm_router.resolve_model_name_from_model_id(model)
	if proxy_model_name is not None:
	model_to_check = proxy_model_name
	except Exception as e:
	verbose_proxy_logger.debug(
	"Unable to resolve model_id=%s in batch rate limiter: %s",
	model,
	str(e),
	)

[shivamrawat1]

maunally qa'd for startup.