build(deps): update ddtrace to the 4.x line

[yuneng-berri]

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Screenshots / Proof of Fix

Captured at edc38ea. Fresh venv with the new pin, running the proxy exactly the way the Docker image entrypoint does (ddtrace-run with USE_DDTRACE=true), then a real OpenAI completion through it

uv venv /tmp/ddt-qa --python 3.12
uv pip install --python /tmp/ddt-qa/bin/python "ddtrace==4.11.0" "litellm[proxy] @ file://$PWD"
USE_DDTRACE=true DD_TRACE_OPENAI_ENABLED=False LITELLM_MASTER_KEY=sk-1234 \
  /tmp/ddt-qa/bin/ddtrace-run /tmp/ddt-qa/bin/litellm --model gpt-5.4-mini --port 41231

$ curl -s http://localhost:41231/health/liveliness
"I'm alive!"

$ curl -s http://localhost:41231/v1/chat/completions \
    -H "Authorization: Bearer sk-1234" -H "Content-Type: application/json" \
    -d '{"model": "gpt-5.4-mini", "messages": [{"role": "user", "content": "Reply with exactly: ddtrace bump verified"}]}'
# {"id": "chatcmpl-E24GuTYv8CDCewCuKPjMPBgmsaJOL", "model": "gpt-5.4-mini",
#  "content": "ddtrace bump verified", "usage": {"total_tokens": 21}}

$ curl -s -D - -o /dev/null http://localhost:41231/v1/chat/completions \
    -H "Authorization: Bearer sk-1234" -H "Content-Type: application/json" \
    -d '{"model": "gpt-5.4-mini", "messages": [{"role": "user", "content": "hi"}]}' | grep -i "x-litellm-call-id\|HTTP/"
# HTTP/1.1 200 OK
# x-litellm-call-id: ebbc4169-6857-4390-94d1-12568a513c36

The proxy log shows the tracer actively producing spans during these requests (failed to send, dropping 1 traces to intake at http://localhost:8126 appears because no local Datadog agent is running, which confirms instrumentation is live), and there are no ddtrace errors in the log. The tag helper path was also exercised directly against 4.11.0: set_active_span_tag("litellm.call_id", ...) returns True and a span.get_tag readback returns the value

Type

🚄 Infrastructure

Changes

ddtrace 4.x supports Python 3.9 through 3.14, which covers litellm's full supported range (3.10 to 3.14), so the python-version split introduced in #33438 is no longer needed. This collapses the proxy-runtime constraint to a single ddtrace>=4.8.2,<5.0 (locking at 4.11.0 for every interpreter, the same version Python 3.14 installs already resolve to today) and aligns the hardcoded pin in docker/build_from_pip

Two code-level notes from the 2.x to 4.x jump. Span.set_tag_str no longer exists upstream; set_active_span_tag in dd_tracing.py already falls back to Span.set_tag through its hasattr guard, and the fallback was verified with a tag readback. The type-only Tracer import moved to ddtrace.trace because the ddtrace.tracer module was removed upstream; this sits under TYPE_CHECKING so it has no runtime effect. ddtrace.patch_all as called by _init_dd_tracer still works on 4.x; upstream deprecates it in favor of import ddtrace.auto, which can be a follow-up

Lock fallout: legacy-cgi and xmltodict drop out of uv.lock. Both were transitive dependencies of ddtrace 2.x only and nothing in the repo imports them directly

One note for deployments that enable USE_DDTRACE: ddtrace 3.0 removed some long-deprecated upstream configuration env vars (for example DD_TRACE_SAMPLE_RATE, replaced by DD_TRACE_SAMPLING_RULES), so environments still setting those should move to the current names

No new tests are added because litellm behavior does not change here; the existing tests/test_litellm/litellm_core_utils/test_dd_tracing.py suite covers the wrapper (169 tests across the two mapped files pass locally) and the runtime proof above exercises the real integration end to end

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[greptile-apps]

Greptile Summary

This PR upgrades ddtrace from the 2.x line to 4.x, collapsing the two Python-version-conditional constraints into a single ddtrace>=4.8.2,<5.0 range. The Dockerfile pin moves from 2.19.0 to 4.11.0, and a TYPE_CHECKING-only import path is corrected for the removed ddtrace.tracer module.

• Constraint simplification: The two version-gated entries (ddtrace>=2.19.0,<3.0; python_version < '3.14' and ddtrace>=4.0.0,<5.0; python_version >= '3.14') are replaced with a single ddtrace>=4.8.2,<5.0 that covers all of litellm's supported Python range (3.10–3.14).
• Code compatibility: The TYPE_CHECKING import now points to ddtrace.trace (the correct 4.x location); the set_tag_str → set_tag fallback in set_active_span_tag already handles the removed 4.x API without any new code.
• Note for operators: Environments that still set DD_TRACE_SAMPLE_RATE (removed in ddtrace 3.0) will need to migrate to DD_TRACE_SAMPLING_RULES before upgrading.

Confidence Score: 5/5

Safe to merge — the change is a straightforward dependency version bump with no litellm behaviour changes and a well-documented runtime proof.

All three changed files are narrow in scope: a Dockerfile pin update, a TYPE_CHECKING-only import path fix, and a pyproject.toml constraint simplification. The runtime compatibility is verified by the author with a real end-to-end trace, and the existing API-compatibility shim (set_tag_str → set_tag fallback) already handles the one removed 4.x method. No production logic paths are altered.

No files require special attention.

Important Files Changed

Filename	Overview
docker/build_from_pip/Dockerfile.build_from_pip	Pin updated from ddtrace==2.19.0 to ddtrace==4.11.0, aligning with the pyproject.toml constraint change.
litellm/litellm_core_utils/dd_tracing.py	TYPE_CHECKING import path for Tracer updated from removed ddtrace.tracer to ddtrace.trace; no runtime effect, and the set_tag_str→set_tag fallback already handles the 4.x API change.
pyproject.toml	Two Python-version-gated ddtrace constraints collapsed into a single ddtrace>=4.8.2,<5.0 range now that 4.x supports Python 3.9–3.14.

_{Reviews (1): Last reviewed commit: "build(deps): update ddtrace to the 4.x l..." | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_/ddtrace-security-regression-360bd8 (edc38ea) with litellm_internal_staging (923c325)¹}

Footnotes

1. No successful run was found on litellm_internal_staging (edc38ea) during the generation of this report, so 923c325 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩