chore(release): backport proxy request-handling fixes and refresh runtime deps for 1.93.2

[yuneng-berri]

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

Type

🐛 Bug Fix

Changes

Patch release 1.93.2 on top of v1.93.1. Every code commit is a cherry-pick -x of a commit already merged to litellm_internal_staging, so nothing here is new work written against the stable line.

Backported	Staging commit	Notes
chore(proxy): clean up request parameter validation and provider destination handling (#34189)	065faf6e69	adapted, see below
fix(proxy)!: apply request-parameter checks consistently across body, path and form inputs (#36011)	c898d341c0	adapted, see below
fix(deps): raise aiohttp floor to 3.14.2 to clear pooled-connection timeouts	ffd6ac52c5	source + tests picked, lock re-derived
chore(deps): upgrade cryptography to 50.0.0 (#35803)	49eb19c39f	source picked, lock re-derived

Five PRs considered for this patch — #30585, #30867, #31905, #32093 and #32405 — are already on this line by direct ancestry. stable/1.93.x diverged from staging on 2026-07-11, after all five had merged, so they shipped in v1.93.0. Only #34189 and #36011 postdated the branch point.

#36011 is a merge commit carrying six underlying commits, so it is picked as cherry-pick -x -m 1. #32405's PR was single-commit and its discrete commit was already present.

Dependencies

Package	1.93.1	1.93.2	Staging
aiohttp	3.14.1	3.14.3	3.14.3
cryptography	48.0.1	50.0.0	50.0.0
mlflow (trio)	3.14.0	3.15.0	3.15.0
gitpython	3.1.54	3.1.58	3.1.58
h2	4.3.0	4.4.1	4.4.1
hpack	4.1.0	4.2.0	4.2.0

Lock deltas were re-derived on this line rather than taking the source commits' lock hunks. Accounting is complete and closed: 406 packages before and after, none added, none removed, exactly nine changed — the six above plus litellm itself for the version bump. The resulting lock carries the same advisory set as staging itself.

aiohttp moves both the runtime floor and the uv constraint to >=3.14.2, matching staging, because 3.14.0/3.14.1 re-arm the socket read timer on a keep-alive connection after it has returned to the idle pool — the stray timer marks a pooled connection timed out without closing it, so the next request to reuse it fails instantly on an unrelated request's error. One pool is shared across providers, so it surfaced as simultaneous sub-millisecond "Connection timed out" failures across Vertex AI, Bedrock, Anthropic and OpenAI-compatible deployments.

cryptography needs both halves of the staging change: the proxy extra's published range widens to >=49.0.0,<51.0 so pip install "litellm[proxy,mlflow]" stays resolvable downstream, while a [tool.uv] override-dependencies entry — a workspace setting that never reaches published metadata — holds our own lock and images at 50.0.0. mlflow moves to 3.15.0 deliberately rather than as incidental drift: 3.14.0 declares cryptography<49 while 3.15.0 declares <50, so holding it would have placed the lock two majors past mlflow's declared cap instead of one.

gitpython, h2 and hpack are lock-only and transitive. hpack is forced by h2 4.4.1's own metadata (4.3.0 required hpack>=4.1, 4.4.1 requires >=4.2), not incidental drift.

Adaptation notes

#34189 — the recursive_detector.py allowlist hunk also carried _redact_scanned_content, which does not exist on this line. Kept _iter_fallback_targets, dropped the other.

#36011 — three adaptations in the conflict resolution:

• The conflict region carried a LITELLM_PASS_THROUGH_ENDPOINT_MARKER import that is pre-existing staging context, not something the pick adds (both upstream diffs render it without a leading +). This line has no pass-through marker machinery, so taking it verbatim is a hard ImportError on every proxy auth path. Dropped.
• litellm_pre_call_utils.py needed Final added to its typing import, since the pick annotates allowed_hosts: Final.
• _health_endpoints.py takes Mapping from typing rather than staging's collections.abc form, because this line already imports Iterable from typing and the verbatim line would produce a duplicate binding. Final is included in that same import — the pick adds a module-level _CONFIG_CONNECTION_FIELDS: Final[frozenset[str]], and since module-level annotations evaluate eagerly on Python ≤ 3.13, omitting it would fail at import and take the whole proxy down on four of the five supported interpreters.

All touched files are clean under ruff format --check, and ruff check --select F821 over litellm/ reports no undefined names.

Verification

Both picks were exercised behaviourally against the pre-patch tree, not just by test count:

• Metadata supplied in bracket notation (metadata[api_base]) carrying a restricted parameter was accepted before this patch and is rejected after, matching its JSON-body equivalent. A clean-metadata control is unaffected on both.
• #34189's fallback-destination helpers are absent before and present and functional after. A differential over 13 fallback shapes shows the patched validation is a strict superset of the previous behaviour, with no model-access coverage lost. Ordinary names — gpt-4, openai/gpt-4, bedrock/anthropic.claude-3-5-sonnet, azure/my-deployment, multi-slash fireworks_ai/accounts/fireworks/models/llama-v3 — are unaffected.

Regression checks against v1.93.1:

• Broad matched pair over tests/test_litellm/proxy/ and llms/huggingface/, 12,700+ tests: seven patched-only failures, all seven reproducing identically on both trees in isolation — xdist ordering artifacts, pre-existing. Note that python-dotenv walks up from a worktree, so both trees must see the same .env or the comparison is invalid.
• Picked test set: 370 passed on both Python 3.13 and 3.14, with three health tests erroring at setup on both trees because the Prisma client is not generated locally.
• Removed symbols iter_router_fallback_model_names, ROUTER_FALLBACK_FIELDS and HuggingFaceEmbeddingConfig.get_api_base have no remaining references in litellm/, enterprise/ or tests/.
• The two aiohttp guard tests fail on the previous pins and pass on these.

One behaviour change worth calling out for reviewers: a model identifier of the form oobabooga/http://host supplied together with an explicit api_base now routes to the model URL rather than to api_base, because the previous predicate tested for https and was False for plain http://. Other shapes are unchanged or strictly improved — the previous code produced schemeless URLs for names that merely contained the substring https. The same predicate change applies in the HuggingFace embedding handler. This is an SDK path; the destination guard itself is proxy-only, and every call site lives under litellm/proxy/.

[greptile-apps]

Greptile Summary

This patch release backports proxy request-validation and destination-handling improvements while refreshing selected runtime dependencies and the lockfile

• Extends validation across nested form metadata, fallback targets, path models, and health-check connection parameters
• Corrects URL-model handling in the Hugging Face and Oobabooga adapters
• Raises aiohttp and cryptography constraints and re-resolves related transitive packages
• Adds regression coverage for the changed proxy and provider behavior

Confidence Score: 4/5

The PR appears safe to merge after addressing the two non-blocking inline comments that violate repository policy

The request-handling and dependency changes have no accepted blocking defect; the only retained issue is the addition of prohibited source-code comments

Files Needing Attention: litellm/proxy/health_endpoints/_health_endpoints.py

Important Files Changed

Filename	Overview
litellm/proxy/auth/auth_utils.py	Adds shared traversal and validation for nested metadata and fallback destinations without an accepted functional defect
litellm/proxy/auth/user_api_key_auth.py	Reuses the shared fallback traversal for key-level model authorization
litellm/proxy/litellm_pre_call_utils.py	Centralizes URL-valued destination validation for request identifiers
litellm/proxy/health_endpoints/_health_endpoints.py	Prevents configured credentials from carrying into caller-overridden connections, but adds two comments prohibited by repository policy
litellm/proxy/common_request_processing.py	Validates URL-valued path models before selecting the effective request model
litellm/llms/huggingface/embedding/handler.py	Restricts direct model URL detection to actual HTTP and HTTPS prefixes
litellm/llms/oobabooga/chat/oobabooga.py	Applies exact URL-prefix detection to chat and embedding destinations
pyproject.toml	Publishes version 1.93.2 and updates aiohttp and cryptography dependency constraints
uv.lock	Re-resolves the selected direct and transitive dependency versions for the patch release

_{Reviews (1): Last reviewed commit: "bump: version 1.93.1 → 1.93.2" | Re-trigger Greptile}

[greptile-apps]

New inline suppression comments

The private imports on this line and line 59 add new inline suppression comments despite the repository policy prohibiting new source-code comments; remove both comments or avoid the private imports that require them

Context Used: CLAUDE.md (source)

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!