chore(release): backport #35835, #35844 to stable/1.94.x and cut 1.94.2

[yuneng-berri]

Relevant issues

Backports two merged litellm_internal_staging PRs onto stable/1.94.x and cuts 1.94.2

#35835 routes the dashboard's MCP session-token store through the shared browser storage helper, so the store no longer keeps a refresh token and no longer writes its payload as readable text. #35844 refreshes the grpc and golang.org/x modules used by the Terraform provider

The line's tip, 1.94.1, is already published on DockerHub and GHCR and has both a release/v1.94.1 branch and a v1.94.1 tag, so this PR bumps to 1.94.2 rather than riding the existing version

It also carries routine maintenance refreshes of four third-party dependencies in the lock, picked as the smallest in-range move for each

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Greptile declined this one at 451 files, over its 100 file limit. 442 of those are the generated dashboard bundle described below, so the hand-reviewable surface is nine files

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

Type

🧹 Refactoring
🚄 Infrastructure

Changes

What is included, in merge order:

• refactor(ui): route MCP session tokens through the shared storage helper #35835 refactor(ui): route MCP session tokens through the shared storage helper
• chore(deps): bump grpc and golang.org/x modules in the terraform provider #35844 chore(deps): bump grpc and golang.org/x modules in the terraform provider
• chore(deps): bump aiohttp to 3.14.3
• chore(deps): bump gitpython to 3.1.58
• chore(deps): bump h2 to 4.4.1
• chore(deps): bump cryptography to 50.0.0
• chore: update Next.js build artifacts, the dashboard bundle rebuilt on this line
• bump: version 1.94.1 -> 1.94.2 and the matching uv.lock refresh

Adaptation notes

#35835 is adapted; #35844 is verbatim

Staging renamed CreateMCPServer.tsx after this line was cut, so on stable/1.94.x the same component is still create_mcp_server.tsx. Cherry-pick resolved the rename automatically and the hunk landed at the new path. The added and removed lines are byte-identical to the staging commit across all five files, so the only divergence is the path

Dependency refreshes

Each dep moved to the smallest version that satisfies the line's existing range, rather than matching staging. Three are lock-only and their regeneration moved nothing but the target: aiohttp 3.14.1 to 3.14.3, gitpython 3.1.54 to 3.1.58, and h2 4.3.0 to 4.4.1, which also carries hpack 4.1.0 to 4.2.0 because h2 4.4.1 raises its own hpack floor

cryptography 48.0.1 to 50.0.0 is the one that needed a manifest change. The proxy extra moves to >=49.0.0,<51.0, matching staging's published range, and a [tool.uv] override pins the resolution at 50.x. The override is required because every released mlflow, through 3.15.1, carries a precautionary cryptography upper bound that it ratchets each release (<47 on 3.11, <49 on 3.13, <50 on 3.15), which otherwise caps this workspace below the target. mlflow's whole cryptography surface is mlflow/utils/crypto.py, and its KEK derivation, DEK wrap and unwrap, AES-GCM round trip and authenticated-failure paths were all exercised against 50.0.0 before this landed. mlflow is not installed in the published image. The regenerated lock moves cryptography and nothing else

UI bundle

#35835 changes production dashboard source, and the proxy serves the prebuilt bundle from litellm/proxy/_experimental/out/, so the bundle was rebuilt on this line with node v20.20.2 and the artifacts are committed. Without it the released image would keep serving the previous bundle. That commit contains nothing but _experimental/out/ paths

Known noise on this line

None on the targeted set. The pre-pick baseline was 6 spec files, 195 tests, zero failures, and tsc reports 552 pre-existing errors in unrelated files on both the untouched tip and this branch, an identical error set

Verification

The targeted dashboard specs go from 195 passing at the tip to 197 passing here, the two added being the ones #35835 introduces. Reverting only mcpTokenStore.ts to its pre-pick contents makes exactly those two fail and the other three pass, so they are real guards and the pick delivers its change on this line. tsc delta is zero (552 pre-existing errors in unrelated files, an identical error set on both trees), prettier is clean on all five changed files, and eslint reports zero errors, one warning fewer than the tip

The dependency-facing Python suites (aiohttp transport and handler, http handler, OOM fixes, MCP outbound credentials, JWT handling, MCP JWT signer, proxy lifecycle) run 392 passed, zero failed against the new versions. A proxy booted from this branch on the locked dependencies answered /health/liveliness and served a real Anthropic claude-sonnet-4-6 completion (34 tokens), and it serves the rebuilt dashboard bundle rather than the previous one

The full mirrored suite was run six times to separate signal from noise, because it is order-dependent under xdist on this line. Failure counts were 111 and 110 on the untouched tip, and 125, 118 and 107 on this branch; every failure that appeared on the branch but not the tip passed in isolation, and none reproduced across all three branch runs. Holding the code at the tip and installing only the new dependency versions produced 109, the lowest of any run, which isolates the bumps as not responsible

An adversarial multi-agent review of the picks returned SURVIVED on all four claims (symbol resolution, each pick delivering its change, no existing consumer broken, and the pinned dependency versions). Its one refuting finding, that routing the store through the shared helper could silently fail to persist a token containing malformed unicode, did not reproduce: setToken calls JSON.stringify before the value reaches the helper, and well-formed JSON.stringify escapes lone surrogates to ASCII, so the value round-trips intact

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[greptile-apps]

Too many files changed for review (451 files, 100 file limit).

Bypass the limit by tagging @greptile-apps to review.