chore(release): backport proxy request-handling maintenance and refresh runtime deps for 1.96.1

[yuneng-berri]

TLDR

Problem this solves:

• 1.96.x lacks a request-handling change every older stable line carries
• Upgrading from a patched 1.95.1 to 1.96.0 would silently lose it
• Two pypdf lockfile exceptions on this line expire 2026-08-12

How it solves it:

• Cherry-picks fix(proxy)!: apply request-parameter checks consistently across body, path and form inputs #36011 onto stable/1.96.x, adapting only import plumbing
• Bumps pypdf to 6.15.0 and drops the exceptions it clears
• Cuts 1.96.1, the first release on this line carrying both

Relevant issues

Patch release 1.96.1 on top of v1.96.0. The code commit is a cherry-pick -x of a commit already merged to litellm_internal_staging, so nothing here is new work written against the stable line

#36011 reached litellm_internal_staging on 2026-08-05 and has been applied to every stable line from 1.88.x through 1.95.x. The 1.96.0 release branched before it arrived, so 1.96.x is the only line missing it. That ordering is the reason this PR exists: once 1.95.1 ships, a deployment upgrading to 1.96.0 would move from a line that has this change to one that does not, which is the opposite of what a version bump should mean

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests, carried in with the cherry-pick; see Verification
• My PR passes all CI/CD checks (e.g., lint, format, unit tests), leaving the full suite for CI
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

Type

🧹 Refactoring
🚄 Infrastructure

Changes

Backported	Staging commit	Notes
fix(proxy)!: apply request-parameter checks consistently across body, path and form inputs (#36011)	c898d341c0	adapted, import plumbing only

Adaptation notes

#36011 diverges from staging in exactly two lines, both the same cause. Every other added and removed line is byte-identical to the staging commit, verified by diffing the two patches line by line rather than by reading the range-diff

The commit annotates with Final, which neither _health_endpoints.py nor litellm_pre_call_utils.py imported on this line. Final joins each file's existing typing import rather than arriving on a second import line, matching how both files already source their generics. Unlike the 1.95.x backport, no Mapping or Iterable adaptation was needed; this line already imports those from collections.abc

The _health_endpoints.py half is load-bearing rather than cosmetic. That file gains a module-level _CONFIG_CONNECTION_FIELDS: Final[frozenset[str]], and module-level annotations are evaluated at import, so a missing Final would be an import-time failure at proxy startup rather than a lint finding. The litellm_pre_call_utils.py half annotates a function-local, which Python does not evaluate, so there the same omission would surface only as a lint failure

One conflict resolved, in litellm_pre_call_utils.py. The commit extracts the per-field logic into reject_url_valued_destination, which computes allowed_hosts itself, leaving the local in _reject_url_valued_destinations dead. Both sides delete that local; they differ only because this line's copy of the pre-image lacked the Final annotation staging had already added. The post-image is identical

Known behavior change

#36011 is marked a breaking change upstream, so it is worth stating plainly what changes here

/health/test_connection merges differently. Previously the proxy config was the base and request parameters layered on top, so a request could name a configured model, override one field, and still inherit the configured connection details. Now, if the request carries any of the request-parameter list, the configured connection fields are not carried into it

A rough edge rides along unchanged from the upstream commit: the trigger is the full request-parameter list, but the fields dropped are the narrower connection set. So a request including a non-connection field such as input_cost_per_token also loses the configured api_base and api_key, leaving the probe with no endpoint and reporting a failed connection for a model that is fine. general_settings.allow_client_side_credentials restores the previous merge. This reproduces identically on litellm_internal_staging, so it is not introduced by this backport; flagging it so any follow-up lands in the right place

The other two changes are the intended effect of the commit. A URL-valued model supplied through the URL path or query string is now handled the same way a URL-valued model in the JSON body already was, and bracket-notation form fields such as metadata[...] are now inspected the same way the equivalent JSON object already was. Every bracket payload now rejected was already rejected in its JSON form on 1.96.0

Dependency refreshes

Routine maintenance of the image lockfile, moving to the smallest version that satisfies this line's ranges

Package	1.96.0	1.96.1	Kind
pypdf	6.14.2	6.15.0	lock-only

The regeneration moved nothing but its target, checked by parsing both locks rather than reading the diff. pypdf>=6.12.0,<7.0 already admits 6.15.0, so no manifest change is needed. The lock's exclude-newer stamp also advances, which is inherent to re-resolving the relative P3D span and is what makes 6.15.0 reachable at all

osv-scanner.toml loses its two pypdf entries in the same change. Both were written to expire on 2026-08-12 and both say to drop them alongside this bump, so leaving them would leave a stale claim in the tree. The file now matches litellm_internal_staging byte for byte

The remaining diskcache entry stays. No fixed release exists upstream, and litellm_internal_staging resolves the same version, so this line is not behind staging on it

After this patch the line resolves every package at or below litellm_internal_staging, checked by parsing both locks: 426 packages identical, 7 behind, none ahead. So upgrading from 1.96.1 to a later release never walks a dependency backwards, and the resulting lock carries the same residual scanner findings as staging itself

Verification

Run on a worktree cut from stable/1.96.x, judged against a baseline captured on the untouched tip

• The four mapped test files go 345 passed to 373 passed, with zero new failures. The baseline was clean, so every one of the 28 added tests is signal rather than something argued against pre-existing noise
• A revert check confirms the tests bind to this line's behavior. Restoring the five source files to their pre-pick state while keeping the new tests drops the run to 12 failed / 361 passed, spanning all three of the commit's claims. Without it, green could mean the tests never exercised the new code
• The path-supplied model check has no test of its own and was exercised directly rather than assumed. It is reached from common_processing_pre_call_logic, which takes model as a parameter and is called with it from two call sites, behind the /engines/{model:path}/... and /openai/deployments/{model:path}/... routes. Driven directly, ordinary names such as gpt-4o and azure/my-deployment pass through, URL-valued ones return 400, and the provider_url_destination_allowed_hosts escape hatch both admits an allowlisted host and rejects it again once the allowlist is cleared, so the passing case is not vacuous
• Import integrity. All five modified modules import cleanly, and _CONFIG_CONNECTION_FIELDS evaluates to a 36-entry frozenset, which proves the module-level annotation resolves at runtime rather than merely satisfying the linter
• Format and lint. ruff format --check reports all five touched files already formatted, and ruff check is clean on them
• uv lock --check passes, so the lock is not stale against the manifest

The gauntlet and a live-proxy replay were deliberately skipped for this line. The same commit has landed cleanly on eight other lines, so the open question here was cherry-pick fidelity rather than behavioral correctness, and that is what the divergence audit, symbol closure, and the revert check address

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[greptile-apps]

Greptile Summary

This patch backports request-parameter safety handling to the 1.96 release line, updates the health-check credential merge, and cuts version 1.96.1

• Applies URL-destination checks consistently to body, path, and image-route model values
• Validates bracket-notation metadata using the shared form parser
• Prevents health-test destination overrides from inheriting configured credentials unless explicitly enabled
• Updates pypdf to 6.15.0 and removes the corresponding vulnerability exceptions

Confidence Score: 4/5

The PR appears safe to merge after removing the two newly added inline source comments

The request guards, health-check merge, and dependency refresh have no established blocking defect; the only accepted issue is a repository convention violation on two import lines

Files Needing Attention: litellm/proxy/health_endpoints/_health_endpoints.py

Important Files Changed

Filename	Overview
litellm/proxy/auth/auth_utils.py	Adds bracket-notation metadata to the centralized banned-parameter validation using the same parser as its downstream consumer
litellm/proxy/common_request_processing.py	Extends the existing URL-valued destination guard to path and query model inputs before effective model selection
litellm/proxy/health_endpoints/_health_endpoints.py	Removes configured connection details when a request supplies its own guarded parameters, with a non-blocking source-comment convention violation
litellm/proxy/image_endpoints/endpoints.py	Rejects URL-valued Azure image deployment path parameters before provider dispatch
litellm/proxy/litellm_pre_call_utils.py	Extracts the existing single-field URL destination validation without changing its parsing or allowlist semantics
uv.lock	Advances the project version and updates only pypdf from 6.14.2 to 6.15.0 within the existing dependency range
osv-scanner.toml	Removes the two pypdf vulnerability exceptions addressed by the lockfile upgrade

_{Reviews (1): Last reviewed commit: "chore: refresh uv.lock for 1.96.1" | Re-trigger Greptile}

[greptile-apps]

New inline import comments

The inline explanations added to this import and the corresponding import on line 49 violate the repository policy against adding source comments without an explicit request, creating maintenance text that should be removed.

Context Used: CLAUDE.md (source)

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!