build(rust): raise pyo3 to 0.29 so the native bridge compiles on Python 3.14

[yuneng-berri]

Relevant issues

Part of #26343 (Python 3.14 support); addresses the pyo3 build failure reported in #33116

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Screenshots / Proof of Fix

This is a build-compatibility change, so the proof is the native module refusing to compile on Python 3.14 before and building plus running after, with a live Mistral OCR round-trip exercising the migrated GIL calls end to end (no mocks; a bad key returns 401 from the real API)

Before (pyo3 0.23.5, at 04a5ebb94d) building the native module for Python 3.14 aborts in pyo3-ffi's build script:

$ uvx maturin@1.9.4 build -i python3.14
error: failed to run custom build command for `pyo3-ffi v0.23.5`
  error: the configured Python interpreter version (3.14) is newer than PyO3's maximum supported version (3.13)

After (pyo3 0.29.0, at 9011b24c9f) wheels build for both cp313 and cp314:

$ uvx maturin@1.9.4 build -i python3.13 -i python3.14 --out wheels
📦 Built wheel for CPython 3.13 to wheels/litellm-1.94.0-cp313-cp313-macosx_11_0_arm64.whl
📦 Built wheel for CPython 3.14 to wheels/litellm-1.94.0-cp314-cp314-macosx_11_0_arm64.whl

The compiled bridge exercised directly on Python 3.14, calling the live Mistral OCR API with a bad key so a 401 comes back only after the request is marshaled, the GIL is released via detach, the tokio runtime runs, and the GIL is reacquired via attach:

# python 3.14.6
gil_stats before: {'releases': 0}
sync ocr: RuntimeError [401] OCR request failed with status 401: {"detail":"Unauthorized"}
gil_stats after sync: {'releases': 1}
async aocr: RuntimeError [401] OCR request failed with status 401: {"detail":"Unauthorized"}
RESULT: PASS (sync=401 async=401 releases_delta=1)

The same probe on Python 3.13 returns byte-for-byte the same result as the 0.23.5 baseline, so with_gil -> attach and allow_threads -> detach are behavior-neutral on GIL-enabled builds

The workspace checks that CI runs pass on both interpreters at 9011b24c9f with the lockfile locked:

$ cargo fmt --check && cargo clippy --workspace --all-targets --locked -- -D warnings && cargo test --workspace --locked
test result: ok. 35 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out
test result: ok. 38 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out

Type

🐛 Bug Fix
🚄 Infrastructure

Changes

pyo3 and pyo3-async-runtimes move from 0.23 to 0.29, the first line that supports Python 3.14 (support landed in 0.26) and the current newest release. pyo3 0.23.5 hard-caps the interpreter at 3.13, so any 3.14 install that falls back to the sdist fails in pyo3-ffi's build script before anything links

Three call sites use APIs that were renamed across that range and are migrated in lockstep: Python::with_gil becomes Python::attach (the async OCR result marshaling and the python-config router loader) and Python::allow_threads becomes Python::detach (the single GIL-release chokepoint). On a GIL-enabled interpreter these are pure renames with identical semantics, so behavior on Python 3.10 through 3.13 is unchanged, and the lockfile churn is confined to the pyo3 crates

No new tests are added: this is a dependency bump with no unit-testable surface, the Python glue is untouched, and parity is proven by the existing workspace suite passing identically on 3.13 and 3.14 plus the end-to-end native probe above

This change only makes the source build succeed on 3.14; publishing cp314 wheels and widening the CI matrix are deliberately separate follow-ups, so a 3.14 install still builds from the sdist and needs a Rust toolchain until those land, which is a visible actionable error rather than a silent failure

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[greptile-apps]

Greptile Summary

This PR bumps pyo3 and pyo3-async-runtimes from 0.23 to 0.29, which is the minimum version that removes the hard Python 3.13 cap in pyo3-ffi's build script, allowing the native bridge to compile on Python 3.14. Three call sites are migrated in lockstep to the renamed APIs introduced in pyo3 0.24 (Python::with_gil → Python::attach, Python::allow_threads → Python::detach).

• Dependency bump: pyo3 0.23.5 → 0.29.0 and pyo3-async-runtimes 0.23.0 → 0.29.0 in Cargo.toml; lockfile drops now-unused transitive crates (indoc, memoffset, unindent, futures-executor).
• API renames: Three sites updated — Python::with_gil → Python::attach in config.rs and lib.rs, py.allow_threads → py.detach in gil.rs — all pure renames with identical semantics on GIL-enabled builds (3.10–3.13 behavior is unchanged).

Confidence Score: 5/5

The change is a targeted dependency version bump with mechanical API renames; no logic paths, data handling, or Python glue are altered.

Every changed line is either a version string in a manifest, a lockfile entry, or a one-for-one rename of a pyo3 API that carries identical runtime semantics. The PR description provides build logs and a live 3.14 end-to-end probe, and the existing workspace test suite passes identically on both interpreters.

No files require special attention; all changes are in the Rust native bridge and its build manifests, with no Python glue or proxy logic touched.

Important Files Changed

Filename	Overview
litellm-rust/Cargo.toml	Bumps pyo3 from 0.23.5 to 0.29.0 and pyo3-async-runtimes from 0.23.0 to 0.29.0 to lift the Python 3.13 hard cap
litellm-rust/Cargo.lock	Lockfile updated to reflect pyo3 0.29.0 tree; removes now-unneeded transitive deps (autocfg, futures, futures-executor, indoc, memoffset, unindent) and bumps target-lexicon to 0.13.5
litellm-rust/crates/python-bridge/src/gil.rs	Migrates py.allow_threads → py.detach (pure rename in pyo3 0.24+, identical semantics); updates the doc-comment to match
litellm-rust/crates/python-bridge/src/lib.rs	Migrates Python::with_gil → Python::attach in the aocr result-marshaling site (pure rename, correct usage inside future_into_py async block)
litellm-rust/crates/ai-gateway/src/python/config.rs	Migrates Python::with_gil → Python::attach in the boot-time router config loader; no behavioral change

_{Reviews (1): Last reviewed commit: "Merge remote-tracking branch 'origin/lit..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_/python-3-14-compat-8363c1 (155dd6e) with litellm_internal_staging (04a5ebb)¹}

Footnotes

1. No successful run was found on litellm_internal_staging (966ff65) during the generation of this report, so 04a5ebb was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩