feat(container): update image ghcr.io/berriai/litellm (v1.93.0 ➔ v1.94.0)

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/berriai/litellm (source)	minor	v1.93.0 → v1.94.0

---

Release Notes

BerriAI/litellm (ghcr.io/berriai/litellm)

v1.94.0

Compare Source

v1.94.0

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Brussels)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

📝 Walkthrough

Walkthrough

The LiteLLM Kubernetes proxy image is updated from v1.93.0 to v1.94.0 with a new SHA-256 digest. No other deployment settings change.

Changes

LiteLLM image update

Layer / File(s)	Summary
Update LiteLLM image reference kubernetes/apps/ai/litellm/instance/proxy.yaml	The proxy container image is pinned to LiteLLM v1.94.0 with a new SHA-256 digest.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• Tanguille/cluster#4146: Updates a pinned Kubernetes AI application container image digest.
• Tanguille/cluster#4234: Updates a pinned LiteLLM-related container image digest.

Suggested labels: type/patch

Suggested reviewers: tanguille

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the LiteLLM image upgrade and version bump, matching the pull request's main change.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/ghcr.io-berriai-litellm-1.x

---

_{Comment @coderabbitai help to get the list of available commands.}

[tanguille-cluster]

@@ spec.image @@
# litellm.home-operations.com/v1alpha1/LiteLLMProxy/ai/litellm
! ± value change
- ghcr.io/berriai/litellm:v1.93.0@sha256:a1745e629abfb17d434426ff48b115f54f4f4c4a0f5af241de569e93c63c411e
+ ghcr.io/berriai/litellm:v1.94.0@sha256:65d84a2282137b4dc73bbe184650a7c807177c533e4223b3bfbc87963fe3fabe

[github-actions]

AI Automated Review

Analysis engine: qwen-3.6-fast@http://litellm.ai.svc.cluster.local/v1 (openai)

Recommendation: Approve

This is a straightforward minor version bump of the LiteLLM proxy image from v1.93.0 to v1.94.0. The change is minimal, follows repository conventions for Renovate-managed container updates, and includes a verified SHA256 digest.

Release notes

• User-visible changes:
  • UI: Working "Test Connection" for complexity auto router; Virtual Keys and Teams tables rebuilt on shared DataTable; sidebar scrollbar updated; experimental dashboard pages flagged for deprecation.
  • Router: Random-pick multi-model complexity tiers; soft-floor adaptive mode for complexity router; new Router(plugins=[...]) routing-plugin pipeline.
  • Proxy/Auth: Fix preventing unrecognized model namespaces from slipping through provider wildcard keys; tracking unauthenticated pass-through requests in spend logs; forwarding AWS credential kwargs into litellm_params for WIF auth.
  • MCP: Interactive SSO sign-in for DCR OAuth delegate; client-held refresh envelope; surface rejected delegate-auth tokens as connect-time 401.
  • Guardrails/Logging: Sanitize scan results before logging; walk custom tool call output items; redact async complete streaming responses for custom callbacks.
  • Security: Bumped Pillow to 12.3.0 resolving OSV-scan CVEs.
• Breaking changes: None identified in v1.94.0 release notes.
• Security fixes: Pillow dependency bump (CVE resolution); API key hashing in spend logs; response ID decryption fixes.

Standards Compliance

• The PR follows the established pattern for Renovate container updates (feat(container): update image ...).
• Image reference includes both tag and SHA256 digest, consistent with security best practices and previous bumps in this repo.
• No unrelated changes are present; the diff is focused on a single field update.

Tool Harness Findings

No tool harness findings were reported.

Unknowns or Needs Verification

• The image digest sha256:65d84a2282137b4dc73bbe184650a7c807177c533e4223b3bfbc87963fe3fabe was not independently verified against the registry in this review run, but it was generated by Renovate which typically fetches digests directly from ghcr.io. If manual verification is required, run cosign verify --key https://raw.githubusercontent.com/BerriAI/litellm/v1.94.0/cosign.pub ghcr.io/berriai/litellm:v1.94.0 as documented in the upstream release notes.