chore(release): backport proxy request-handling maintenance and refresh runtime deps for 1.95.1

[yuneng-berri]

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests — carried in with the cherry-picks; see Verification for what was run
• My PR passes all unit tests on make test-unit — the two CI proxy scopes were run locally and are green; the full suite was not run, leaving that for CI
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

Type

🧹 Refactoring
🚄 Infrastructure

Changes

Patch release 1.95.1 on top of v1.95.0. Every code commit is a cherry-pick -x of a commit already merged to litellm_internal_staging, so nothing here is new work written against the stable line.

Backported	Staging commit	Notes
fix(proxy)!: apply request-parameter checks consistently across body, path and form inputs (#36011)	c898d341c0	adapted — import plumbing only, see below
refactor(ui): route MCP session tokens through the shared storage helper (#35835)	e4fd790f1c	applies verbatim, at this line's file path
chore(deps): bump grpc and golang.org/x modules in the terraform provider (#35844)	2e255191ab	applies verbatim

Six further commits were considered for this line and are already on it by direct ancestry — stable/1.95.x was cut from staging on 2026-07-29, after all six had merged, so they needed no pick: #30585, #30867, #31905, #32093, #32405, #34189.

Adaptation notes

#35835 and #35844 are verbatim. #35835's only divergence is a path: staging renamed create_mcp_server.tsx to CreateMCPServer.tsx after this line was cut, so the component is still at the old name here. The cherry-pick detected the rename and landed the hunk at this line's path; the added and removed lines are byte-identical to the staging commit across all five files.

#36011 diverges only in import plumbing. Every other added and removed line is byte-identical to staging. Two files needed it:

• _health_endpoints.py — staging imports Iterable/Mapping from collections.abc and Final from typing. This line still takes Iterable from typing and has neither Final nor Mapping. Rather than add a second import line and bind Iterable twice, Final and Mapping join the existing typing import, matching how the file already sources its generics.
• litellm_pre_call_utils.py — the commit's new reject_url_valued_destination annotates a local with Final, which this line's typing import also lacked.

This is load-bearing rather than cosmetic: the commit adds a module-level _CONFIG_CONNECTION_FIELDS: Final[frozenset[str]], and module-level annotations are evaluated at import, so a missing Final would be an import-time failure at proxy startup rather than a lint nit.

One context line differs for the same reason: staging had migrated auth_model_info to a Final annotation, so the commit carries the annotated form as context where this line has the plain assignment. This line's form is kept.

Known behavior change

#36011 is marked a breaking change upstream and it is worth stating plainly what changes on this line.

/health/test_connection merges differently. Previously the proxy config was the base and request parameters layered on top, so a request could name a configured model and override one field while still inheriting the configured connection details. Now, if the request carries any of the request-parameter list, the configured connection fields are not carried into it.

There is a rough edge here, carried in unchanged from the upstream commit: the trigger is the full request-parameter list, but the fields dropped are the narrower connection set. So a request that includes a non-connection field such as input_cost_per_token or output_cost_per_token also loses the configured api_base/api_key, leaving the probe with no endpoint and reporting a failed connection for a model that is actually fine. general_settings.allow_client_side_credentials restores the previous merge. This reproduces identically on litellm_internal_staging and main, so it is not introduced by this backport — flagging it so the release notes and any follow-up land in the right place.

The endpoint's docstring still describes the old merge and is now inaccurate; it is unchanged here to keep this line byte-faithful to staging.

Two other behavior changes are the intended effect of the commit: a URL-valued model supplied via the URL path or query is now rejected the same way a URL-valued model in the JSON body already was, and bracket-notation form fields such as metadata[...] are now inspected the same way the equivalent JSON object already was. Every bracket payload that is now rejected was already rejected in its JSON form on 1.95.0.

Dependency refreshes

Routine maintenance of the image lockfile. Each entry moved to the smallest version that satisfies this line's ranges.

Package	1.95.0	1.95.1	Kind
aiohttp	3.14.1	3.14.3	lock-only
gitpython	3.1.55	3.1.58	lock-only
h2	4.3.0	4.4.1	lock-only, carries hpack 4.1.0 → 4.2.0
cryptography	48.0.1	50.0.0	manifest + [tool.uv] override
msal	1.36.0	1.37.0	lock-only

Each lock-only bump's regeneration moved nothing but its target. hpack is forced rather than drift: h2 4.4.1 declares hpack<5,>=4.2.

cryptography is the one needing a manifest change. The proxy extra moves to >=49.0.0,<51.0, matching staging's published range, and a [tool.uv] override pins the resolution at 50.x. The override is load-bearing and was verified by removing it and re-locking: without it the resolution falls to 49.0.0 and additionally drags mlflow and msal along with it.

That override raises cryptography for every package in the workspace, including ones that declare a lower cap, so the caps it silences were checked rather than assumed:

• mlflow 3.14.0 caps below 50. It is a dev/test dependency and is not installed in the published image. Its entire cryptography surface is mlflow/utils/crypto.py; KEK derivation, DEK wrap/unwrap, the AES-GCM authenticated round trip, and the wrong-AAD, wrong-key and tampered-ciphertext rejection paths were all exercised against 50.0.0 and pass.
• msal 1.36.0 declares cryptography<49,>=2.5 and is a production dependency here, reached through azure-identity in both the proxy and extra_proxy extras. Rather than ship a pairing msal itself does not support, msal moves to 1.37.0, which declares cryptography<51. Nothing pins msal, and the bump moved only msal.

The published aiohttp floor is also raised from >=3.10 to >=3.14.2, matching staging. The lock already resolved 3.14.3; this makes the range a source install honours the same one, and it moved no package.

pypdf is deliberately left where it is: a newer release exists but litellm_internal_staging still resolves 6.14.2, and this line should not run ahead of staging.

UI bundle

#35835 changes production .tsx, so the dashboard bundle is rebuilt on this line with node v20.20.2 and committed. That is the bulk of the file count; the hand-reviewable surface is 18 files.

The rebuild was verified by reproducing it independently: a clean rebuild from this branch's source produced 974 files matching the committed tree byte for byte, with no file present on one side only, the sole difference being the nondeterministic Next.js build-ID directory name.

Verification

Run on stable/1.95.x with a mirrored baseline worktree at v1.95.0 for comparison.

• The two CI proxy scopes are green on this branch: the proxy-endpoints scope (23 directories, including health_endpoints, image_endpoints and utils) at 6308 passed / 0 failed, and the proxy-auth scope at 2278 passed / 0 failed.
• Cherry-pick tests, plus a revert check. #36011's own tests are 366 passed. Reverting its five source files and rerunning drops that to 12 failed / 354 passed, spanning all three of its claims, which confirms the tests bind to this line's behavior rather than passing incidentally. #35835's store tests are 5 passed, 2 failed on the same revert check.
• Two code paths the commit wires up have no test of their own and were exercised directly rather than assumed: the model check reached from common_processing_pre_call_logic, and the health-check merge as reached from the route (its new tests call the helper directly, never the route). Both behave as intended.
• Import integrity. All five modified modules import cleanly; tests/documentation_tests/test_circular_imports.py passes and from litellm import * is clean. The commit adds two new import edges out of _health_endpoints; neither introduces a cycle.
• #35844 was built, not just diffed: go mod verify, go build ./..., go vet, go test ./..., gofmt -l and go mod tidy -diff are all clean under both Go 1.25.0 (the version CI resolves from go-version-file) and 1.26.5. Note that test-terraform-provider.yml's pull_request trigger does not match a base of stable/1.95.x, so those checks will run from the push trigger rather than as a PR gate.
• Format. ruff format --check --exclude '/enterprise/' under litellm/ reports the same single pre-existing offender on this branch and on the untouched baseline (proxy/management_endpoints/credential_migration.py); every file this PR touches is clean.
• uv lock --check passes, so the lock is not stale against the manifest.

A whole-tree tests/test_litellm/proxy run — a scope CI does not use — is order-dependent under xdist on both this branch and the untouched baseline: two identical runs of the same tree differ by 7 tests, and this branch reports fewer failures than the baseline. Every such failure passes in isolation on both trees. One recurring case traces to tests/test_litellm/proxy/hooks/test_proxy_hooks_init.py removing litellm.proxy.utils from sys.modules without restoring it, which is pre-existing and affects both trees equally.

[greptile-apps]

Too many files changed for review (468 files, 100 file limit).

Bypass the limit by tagging @greptile-apps to review.